scalio-tenant

Tenant connection shared by the Scalio apps (scalio-docs ADR 0036). The app makes its own certificate; the private key never leaves the instance. The customer's admin runs a setup script that creates the app registration «Scalio Lesen» (read) or «Scalio Schreiben» (write) in their own tenant with only the public certificate, and pastes the printed connection code back into the app.

import scalio_tenant as st

cert = st.new_certificate("Scalio Lesen (rosetta.kunde.ch)")      # store cert_pem, encrypt key_pem
text = st.script(st.read_profile(), cert, "rosetta.kunde.ch")    # show to the admin (Azure Cloud Shell)
conn = st.parse_code(pasted, st.read_profile(), cert)            # tenant, client_id, object_id, key_id
info = st.check(conn["tenant"], conn["client_id"], cert, st.read_profile())  # organization, missing roles
token = st.get_token(conn["tenant"], conn["client_id"], cert)
if cert.due():                                                   # 30 days before expiry
    r = st.renew(conn["tenant"], conn["client_id"], conn["object_id"], conn["key_id"], cert, name)
    # store r["cert"] and r["key_id"] at once

• permissions.READ_ROLES: the Graph application permissions of «Scalio Lesen». write_profile(roles) takes the roles of the booked modules (the app knows them).
• The app stores the certificate and the encrypted key itself; this package keeps nothing.
• Renewal uses Graph addKey/removeKey with a proof signed by a key on the registration: no extra permission and no admin.

Tests run offline (pip install -e ".[dev]", pytest, ruff check .); Microsoft is faked with httpx.MockTransport.