scalio-tenant

Tenant connection shared by the Scalio apps (scalio-docs ADR 0036). The app makes its own certificate; the private key never leaves the instance. The customer's admin runs a setup script that creates the app registration «Scalio Lesen» (read) or «Scalio Schreiben» (write) in their own tenant with only the public certificate, and pastes the printed connection code back into the app.

import scalio_tenant as st

cert = st.new_certificate("Scalio Lesen (rosetta.kunde.ch)")      # store cert_pem, encrypt key_pem
text = st.script(st.read_profile(), cert, "rosetta.kunde.ch")    # show to the admin (Azure Cloud Shell)
conn = st.parse_code(pasted, st.read_profile(), cert)            # tenant, client_id, object_id, key_id
info = st.check(conn["tenant"], conn["client_id"], cert, st.read_profile())  # organization, missing roles
token = st.get_token(conn["tenant"], conn["client_id"], cert)
if cert.due():                                                   # 30 days before expiry
    r = st.renew(conn["tenant"], conn["client_id"], conn["object_id"], conn["key_id"], cert, name)
    # store r["cert"] and r["key_id"] at once

• permissions.READ_ROLES: the Graph application permissions of «Scalio Lesen». write_profile(roles) takes the roles of the booked modules (the app knows them).
• read_profile(exchange_teams=True) (0.3.0): also Exchange.ManageAsApp and the Entra role Global Reader, for the Exchange and Teams admin APIs (tokens for st.EXCHANGE and st.TEAMS). check reports what is missing.
• GDAP (0.3.0): msp_profile(read_profile(...)) makes one multi-tenant registration «Scalio MSP» in the MSP's partner tenant; gdap_customers(partner, client_id, cert) lists the customers with an active GDAP relationship; consent_script(profile, client_id, customer) is run by the MSP's admin once per customer (GDAP roles Application Administrator and Privileged Role Administrator) and grants the permissions there. Tokens for a customer: get_token(customer_tenant, msp_client_id, msp_cert).
• The app stores the certificate and the encrypted key itself; this package keeps nothing.
• Renewal uses Graph addKey/removeKey with a proof signed by a key on the registration: no extra permission and no admin.

Tests run offline (pip install -e ".[dev]", pytest, ruff check .); Microsoft is faked with httpx.MockTransport.