bloc.core.auth#

Microsoft Entra ID authentication utilities for Bloc.

Uses Python MSAL with a server-side OAuth2 authorization-code flow. Tokens are stored in an in-memory dictionary; sessions are managed via Starlette’s SessionMiddleware (see auth_server.py).

No Microsoft Graph data access is required — scopes are minimal (User.Read for basic profile, which also enables refresh-token issuance).

Attributes#

`TOKEN_STORE`
`SCOPES`
`AUTH_VARS`

Functions#

`auth_enabled`()	Return True when all five required Azure AD environment variables are set.
`msal_app`()	Return a fresh MSAL confidential client application.
`purge_expired_sessions`()	Remove sessions whose access token has already expired.
`refresh_access_token`(refresh_token)	Use the stored refresh token to silently obtain a new access token.

Module Contents#

bloc.core.auth.TOKEN_STORE: dict[str, Any]#

bloc.core.auth.SCOPES: list[str] = ['User.Read']#

bloc.core.auth.AUTH_VARS = ('CLOUD_TENANT_ID', 'CLOUD_CLIENT_ID', 'CLOUD_CLIENT_SECRET', 'CLOUD_REDIRECT_URI',...#

bloc.core.auth.auth_enabled()#: Return True when all five required Azure AD environment variables are set.

bloc.core.auth.msal_app()#

Return a fresh MSAL confidential client application.

A new instance per request is acceptable; MSAL caches tokens internally only when a token cache is explicitly provided.

bloc.core.auth.purge_expired_sessions()#

Remove sessions whose access token has already expired.

Returns the number of sessions removed.

bloc.core.auth.refresh_access_token(refresh_token)#

Use the stored refresh token to silently obtain a new access token.

Returns the raw MSAL result dict on success, or None on failure. The caller is responsible for updating TOKEN_STORE with the new values.