qodalis-cli-server-plugin-users 1.0.0b6__py3-none-any.whl

qodalis_cli_users/services/password_hasher.py

@@ -0,0 +1,98 @@
+"""PBKDF2-HMAC-SHA256 password hashing.
+
+Encoded format (shared by the node, python and .NET servers)::
+
+    pbkdf2$100000$<saltB64>$<hashB64>
+
+16-byte random salt, 32-byte derived key, constant-time comparison.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import secrets
+
+ITERATIONS = 100_000
+SALT_BYTES = 16
+KEY_BYTES = 32
+PREFIX = "pbkdf2"
+
+
+def _derive(password: str, salt: bytes, iterations: int, key_len: int = KEY_BYTES) -> bytes:
+    # surrogatepass: a lone surrogate (never in a stored password) must fail
+    # verification normally instead of raising.
+    return hashlib.pbkdf2_hmac("sha256", password.encode("utf-8", "surrogatepass"), salt, iterations, key_len)
+
+
+def hash_password(password: str) -> tuple[str, str]:
+    """Hash ``password``; returns ``(encoded_hash, salt_b64)``."""
+    salt = secrets.token_bytes(SALT_BYTES)
+    key = _derive(password, salt, ITERATIONS)
+    salt_b64 = base64.b64encode(salt).decode("ascii")
+    encoded = f"{PREFIX}${ITERATIONS}${salt_b64}${base64.b64encode(key).decode('ascii')}"
+    return encoded, salt_b64
+
+
+def verify_password(password: str, encoded: str, legacy_salt: str = "") -> bool:
+    """Verify ``password`` against an encoded hash (constant-time).
+
+    Hashes written by earlier plugin versions (hex ``sha256(salt + password)``
+    with a separate salt) are still accepted so existing persisted stores keep
+    working; :func:`needs_rehash` reports them so callers can upgrade them.
+    """
+    if not encoded:
+        return False
+    parts = encoded.split("$")
+    if len(parts) == 4 and parts[0] == PREFIX:
+        try:
+            iterations = int(parts[1])
+            salt = base64.b64decode(parts[2])
+            expected = base64.b64decode(parts[3])
+        except (ValueError, TypeError):
+            return False
+        if iterations <= 0 or not expected:
+            return False
+        actual = _derive(password, salt, iterations, len(expected))
+        return hmac.compare_digest(actual, expected)
+    # Legacy SHA-256 format
+    legacy = hashlib.sha256((legacy_salt + password).encode("utf-8", "surrogatepass")).hexdigest()
+    return hmac.compare_digest(legacy.encode("ascii"), encoded.encode("utf-8", "replace"))
+
+
+def needs_rehash(encoded: str) -> bool:
+    parts = encoded.split("$")
+    return not (len(parts) == 4 and parts[0] == PREFIX and parts[1] == str(ITERATIONS))
+
+
+# ---------------------------------------------------------------------------
+# Async API — PBKDF2 runs off the event loop with a concurrency cap.
+# ---------------------------------------------------------------------------
+
+import asyncio  # noqa: E402
+from concurrent.futures import ThreadPoolExecutor  # noqa: E402
+
+#: At most this many PBKDF2 computations run at once.
+MAX_CONCURRENT_HASHES = 4
+_executor = ThreadPoolExecutor(max_workers=MAX_CONCURRENT_HASHES, thread_name_prefix="qcli-pbkdf2")
+_dummy_hash: str | None = None
+
+
+async def hash_password_async(password: str) -> tuple[str, str]:
+    return await asyncio.get_running_loop().run_in_executor(_executor, hash_password, password)
+
+
+async def verify_password_async(password: str, encoded: str, legacy_salt: str = "") -> bool:
+    return await asyncio.get_running_loop().run_in_executor(
+        _executor, verify_password, password, encoded, legacy_salt,
+    )
+
+
+async def dummy_verify_async(password: str) -> None:
+    """Run a full PBKDF2 verification against a throwaway hash so unknown
+    users take as long as known ones."""
+    global _dummy_hash
+    if _dummy_hash is None:
+        _dummy_hash = (await hash_password_async(secrets.token_hex(16)))[0]
+    await verify_password_async(password, _dummy_hash)

qodalis_cli_users/services/users_service.py

@@ -0,0 +1,330 @@
+"""User and group management — validation, privilege checks, protections,
+cascades and audit.
+
+Controllers check endpoint permissions; this service enforces the data and
+security rules shared by every caller.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ..errors import bad_request, conflict, not_found
+from ..models import Group, User
+from ..permissions import ADMIN_GROUP, USERS_GROUP
+from ..validation import (
+    DESCRIPTION_MAX,
+    NAME_MAX,
+    validate_data,
+    validate_email,
+    validate_name,
+    validate_permissions,
+    validate_text,
+)
+from .auth_service import AuthContext, AuthService
+
+BUILT_IN_GROUPS = (ADMIN_GROUP, USERS_GROUP)
+
+LAST_ADMIN = "cannot remove the last admin"
+HOME_DIR_MAX = 1024
+
+
+def _clean(value: str | None) -> str:
+    return (value or "").strip()
+
+
+def _actor(ctx: AuthContext | None) -> dict[str, Any]:
+    if ctx is None:
+        return {}
+    return {"actor": ctx.user.name, "actor_id": ctx.user.id}
+
+
+class UsersService:
+    def __init__(self, auth: AuthService) -> None:
+        self.auth = auth
+        self.users = auth.user_store
+        self.groups = auth.group_store
+        self.credentials = auth.credential_store
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    async def resolve_groups(self, names: list[str] | None) -> list[str]:
+        """Validate group names; return the stored (canonical) names,
+        de-duplicated case-insensitively."""
+        out: list[str] = []
+        for raw in names or []:
+            name = _clean(raw)
+            if not name:
+                continue
+            group = await self.groups.get_group(name) if len(name) <= NAME_MAX else None
+            if not group:
+                raise bad_request(f"unknown group: {name[:NAME_MAX]}")
+            if not any(g.lower() == group.name.lower() for g in out):
+                out.append(group.name)
+        return out
+
+    async def _ensure_unique(self, name: str | None, email: str | None, exclude_id: str | None) -> None:
+        """Names and emails share one namespace (case-insensitive)."""
+        for user in await self.users.get_users():
+            if user.id == exclude_id:
+                continue
+            taken = {user.name.lower(), user.email.lower()}
+            if name is not None and name.lower() in taken:
+                raise conflict(f"user already exists: {name}")
+            if email is not None and email.lower() in taken:
+                raise conflict(f"email already in use: {email}")
+
+    @staticmethod
+    def _is_built_in(group: Group) -> bool:
+        return group.built_in or group.name.lower() in BUILT_IN_GROUPS
+
+    # ------------------------------------------------------------------
+    # Users
+    # ------------------------------------------------------------------
+
+    async def list_users(self, query: str | None, skip: int, take: int | None) -> list[User]:
+        users = await self.users.get_users()
+        q = _clean(query).lower()
+        if q:
+            users = [u for u in users if q in u.name.lower() or q in u.email.lower()]
+        users = users[skip:]
+        if take is not None:
+            users = users[:take]
+        return users
+
+    async def create_user(
+        self,
+        ctx: AuthContext | None,
+        *,
+        name: str,
+        email: str,
+        groups: list[str] | None = None,
+        password: str | None = None,
+        disabled: bool | None = None,
+        home_dir: str | None = None,
+        data: dict[str, Any] | None = None,
+    ) -> User:
+        name = validate_name(_clean(name))
+        email = validate_email(_clean(email))
+        validate_text(home_dir, "homeDir", HOME_DIR_MAX)
+        validate_data(data)
+        if password is not None:
+            error = self.auth.validate_password_policy(password)
+            if error:
+                raise bad_request(error)
+        resolved = await self.resolve_groups(groups)
+        if resolved and ctx is not None:
+            await self.auth.ensure_can_grant_groups(ctx, resolved)
+        if not resolved:
+            resolved = await self.resolve_groups([USERS_GROUP])
+        await self._ensure_unique(name, email, None)
+        try:
+            user = await self.users.create_user(
+                name, email, resolved, data,
+                disabled=bool(disabled), home_dir=home_dir,
+            )
+        except ValueError as exc:
+            raise conflict(str(exc)) from exc
+        if password is not None:
+            await self.auth.set_password(user.id, password)
+        await self.auth.audit("user_created", user.name, user_id=user.id, **_actor(ctx))
+        return user
+
+    async def update_user(
+        self,
+        ctx: AuthContext | None,
+        target: User,
+        *,
+        name: str | None = None,
+        email: str | None = None,
+        groups: list[str] | None = None,
+        disabled: bool | None = None,
+        home_dir: str | None = None,
+        data: dict[str, Any] | None = None,
+    ) -> User:
+        if name is not None:
+            name = validate_name(_clean(name))
+            if name == target.name:
+                name = None
+        if email is not None:
+            email = validate_email(_clean(email))
+            if email == target.email:
+                email = None
+        validate_text(home_dir, "homeDir", HOME_DIR_MAX)
+        validate_data(data)
+
+        resolved_groups: list[str] | None = None
+        if groups is not None:
+            resolved_groups = await self.resolve_groups(groups)
+
+        if ctx is not None:
+            await self.auth.ensure_covers_user(ctx, target)
+            if resolved_groups is not None:
+                added = [g for g in resolved_groups if not self.auth.in_group(target, g)]
+                if added:
+                    await self.auth.ensure_can_grant_groups(ctx, added)
+
+        await self._ensure_unique(name, email, target.id)
+
+        removes_admin = resolved_groups is not None and not any(
+            g.lower() == ADMIN_GROUP for g in resolved_groups
+        )
+        if (removes_admin or disabled is True) and await self.auth.is_last_enabled_admin(target):
+            raise conflict(LAST_ADMIN)
+
+        was_disabled = bool(target.disabled)
+        try:
+            user = await self.users.update_user(
+                target.id,
+                name=name,
+                email=email,
+                groups=resolved_groups,
+                disabled=disabled,
+                home_dir=home_dir,
+                data=data,
+            )
+        except KeyError as exc:
+            raise not_found(f"user not found: {target.name}") from exc
+
+        actor = _actor(ctx)
+        await self.auth.audit("user_updated", user.name, user_id=user.id, **actor)
+        if disabled is not None and disabled != was_disabled:
+            if disabled:
+                await self.auth.audit("user_disabled", user.name, user_id=user.id, **actor)
+                await self.auth.revoke_user_sessions(user.id, "user_disabled", **actor)
+            else:
+                await self.auth.audit("user_enabled", user.name, user_id=user.id, **actor)
+        return user
+
+    async def delete_user(self, ctx: AuthContext | None, target: User) -> None:
+        if ctx is not None and ctx.is_self(target):
+            raise conflict("cannot delete yourself")
+        if ctx is not None:
+            await self.auth.ensure_covers_user(ctx, target)
+        if await self.auth.is_last_enabled_admin(target):
+            raise conflict(LAST_ADMIN)
+        await self.users.delete_user(target.id)
+        await self.credentials.delete_credentials(target.id)
+        self.auth.reset_failures(target.id)
+        actor = _actor(ctx)
+        await self.auth.revoke_user_sessions(target.id, "user_deleted", **actor)
+        await self.auth.audit("user_deleted", target.name, user_id=target.id, **actor)
+
+    async def change_password(
+        self, ctx: AuthContext, target: User, password: str, *, temporary: bool | None = None,
+    ) -> None:
+        """Set ``target``'s password.  By self: clears mustChangePassword and
+        revokes the caller's other sessions.  Admin reset: clears the
+        target's lockout, revokes all their sessions and sets
+        mustChangePassword unless ``temporary`` is ``False``."""
+        error = self.auth.validate_password_policy(password)
+        if error:
+            raise bad_request(error)
+        is_self = ctx.is_self(target)
+        if not is_self:
+            await self.auth.ensure_covers_user(ctx, target)
+        await self.auth.set_password(target.id, password)
+        actor = _actor(ctx)
+        if is_self:
+            if target.must_change_password:
+                await self.users.update_user(target.id, must_change_password=False)
+                ctx.user.must_change_password = False
+            await self.auth.audit("password_changed", target.name, user_id=target.id, **actor)
+            await self.auth.revoke_user_sessions(
+                target.id, "password_changed",
+                except_session_id=ctx.session.id if ctx.session else None, **actor,
+            )
+        else:
+            self.auth.reset_failures(target.id)
+            await self.users.update_user(target.id, must_change_password=temporary is not False)
+            await self.auth.audit("password_changed", target.name, user_id=target.id, **actor)
+            await self.auth.revoke_user_sessions(target.id, "password_changed", **actor)
+
+    # ------------------------------------------------------------------
+    # Groups
+    # ------------------------------------------------------------------
+
+    async def group_members(self, group: Group) -> list[User]:
+        return [u for u in await self.users.get_users() if self.auth.in_group(u, group.name)]
+
+    async def create_group(
+        self,
+        ctx: AuthContext | None,
+        *,
+        name: str,
+        description: str | None = None,
+        permissions: list[str] | None = None,
+    ) -> Group:
+        name = validate_name(_clean(name))
+        validate_text(description, "description", DESCRIPTION_MAX)
+        perms = validate_permissions(permissions) or []
+        if ctx is not None:
+            self.auth.ensure_can_grant_permissions(ctx, perms)
+        if await self.groups.get_group(name):
+            raise conflict(f"group already exists: {name}")
+        try:
+            group = await self.groups.create_group(name, description, perms)
+        except ValueError as exc:
+            raise conflict(str(exc)) from exc
+        await self.auth.audit("group_created", ctx.user.name if ctx else "", details=group.name, **_actor(ctx))
+        return group
+
+    async def update_group(
+        self,
+        ctx: AuthContext | None,
+        group: Group,
+        *,
+        description: str | None = None,
+        permissions: list[str] | None = None,
+    ) -> Group:
+        validate_text(description, "description", DESCRIPTION_MAX)
+        perms = validate_permissions(permissions)
+        if perms is not None and group.name.lower() == ADMIN_GROUP:
+            raise conflict("cannot change the permissions of the admin group")
+        if perms is not None and ctx is not None:
+            self.auth.ensure_can_grant_permissions(ctx, perms)
+        try:
+            updated = await self.groups.update_group(
+                group.name, description=description, permissions=perms,
+            )
+        except KeyError as exc:
+            raise not_found(f"group not found: {group.name}") from exc
+        await self.auth.audit("group_updated", ctx.user.name if ctx else "", details=updated.name, **_actor(ctx))
+        return updated
+
+    async def delete_group(self, ctx: AuthContext | None, group: Group) -> None:
+        if self._is_built_in(group):
+            raise conflict(f"cannot delete built-in group: {group.name}")
+        for user in await self.group_members(group):
+            await self.users.update_user(
+                user.id,
+                groups=[g for g in user.groups if g.lower() != group.name.lower()],
+            )
+        await self.groups.delete_group(group.name)
+        await self.auth.audit("group_deleted", ctx.user.name if ctx else "", details=group.name, **_actor(ctx))
+
+    async def add_member(self, ctx: AuthContext | None, group: Group, user: User) -> None:
+        if ctx is not None:
+            await self.auth.ensure_covers_user(ctx, user)
+            await self.auth.ensure_can_grant_groups(ctx, [group.name])
+        if self.auth.in_group(user, group.name):
+            return
+        await self.users.update_user(user.id, groups=[*user.groups, group.name])
+        await self.auth.audit("group_member_added", user.name, details=group.name,
+                              user_id=user.id, **_actor(ctx))
+
+    async def remove_member(self, ctx: AuthContext | None, group: Group, user: User) -> None:
+        if ctx is not None:
+            await self.auth.ensure_covers_user(ctx, user)
+        if not self.auth.in_group(user, group.name):
+            return
+        if group.name.lower() == ADMIN_GROUP and await self.auth.is_last_enabled_admin(user):
+            raise conflict(LAST_ADMIN)
+        await self.users.update_user(
+            user.id,
+            groups=[g for g in user.groups if g.lower() != group.name.lower()],
+        )
+        await self.auth.audit("group_member_removed", user.name, details=group.name,
+                              user_id=user.id, **_actor(ctx))

qodalis_cli_users/shell_access.py

@@ -0,0 +1,125 @@
+"""Remote shell access for the users plugin (Appendix C, ``users`` mode).
+
+Registered on the CLI server when the plugin is mounted.  An open shell is
+bound to the session that opened it: the server re-checks it periodically and
+on every session/user/group change, and closes it (4401 ``session ended``)
+after logout, expiry, revoke, disable/delete or loss of ``shell:execute``.
+Identities from an external auth adapter are re-validated by calling the
+adapter again with the shell's WebSocket request, so the adapter must be able
+to authenticate it from its headers/cookies.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Callable
+from urllib.parse import parse_qs
+
+from ._http import get_scope_auth
+from .permissions import has_permission
+from .services.auth_service import AuthContext, AuthService
+
+SHELL_PERMISSION = "shell:execute"
+#: ``shell_closed`` audit reason when ``shell:execute`` is lost.
+PERMISSION_REMOVED = "permission removed"
+
+
+@dataclass
+class UsersShellPrincipal:
+    """The caller owning a shell (duck-type of ``qodalis_cli.ShellPrincipal``)."""
+
+    user_id: str
+    user_name: str
+    session_id: str | None
+    context: AuthContext
+    #: The shell's WebSocket: adapter identities are re-validated by calling
+    #: the external auth adapter again with it.
+    connection: Any = None
+
+
+class UsersShellAccess:
+    """``ShellAccessProvider`` backed by the users plugin's sessions."""
+
+    def __init__(self, auth_service: AuthService) -> None:
+        self.auth = auth_service
+
+    async def resolve(self, websocket: Any) -> UsersShellPrincipal | None:
+        # Normally set by the server-protection middleware (ticket consumed);
+        # without it (protect_server=False) the shell still requires a ticket.
+        ctx = get_scope_auth(websocket.scope)
+        if not isinstance(ctx, AuthContext):
+            raw = websocket.scope.get("query_string", b"").decode("latin-1")
+            ticket = (parse_qs(raw).get("ticket") or [None])[0]
+            ctx = await self.auth.consume_ticket(ticket)
+        if ctx is None:
+            return None
+        return UsersShellPrincipal(
+            user_id=ctx.user.id,
+            user_name=ctx.user.name,
+            session_id=ctx.session.id if ctx.session else None,
+            context=ctx,
+            connection=websocket,
+        )
+
+    def can_open(self, principal: UsersShellPrincipal) -> bool:
+        ctx = principal.context
+        return not ctx.must_change_password and ctx.can(SHELL_PERMISSION)
+
+    async def is_active(self, principal: UsersShellPrincipal) -> bool | str:
+        """``True`` while valid; ``False`` (session ended) or
+        ``"permission removed"`` otherwise.  Never extends the session."""
+        ctx = principal.context
+        if ctx.external:
+            return await self._adapter_active(principal)
+        if principal.session_id is None:
+            return False
+        session = await self.auth.session_store.get_session_by_id(principal.session_id)
+        if session is None or session.user_id != principal.user_id or self.auth.is_expired(session):
+            return False
+        user = await self.auth.user_store.get_user(principal.user_id)
+        if user is None or user.id != principal.user_id or user.disabled or user.must_change_password:
+            return False
+        if not has_permission(await self.auth.user_permissions(user), SHELL_PERMISSION):
+            return PERMISSION_REMOVED
+        return True
+
+    async def _adapter_active(self, principal: UsersShellPrincipal) -> bool | str:
+        """Adapter identities have no stored session: ask the external auth
+        adapter again with the shell's WebSocket (its headers and cookies).
+        ``None`` or an exception ends the shell; a different user or one
+        without ``shell:execute`` too."""
+        if principal.connection is None or not self.auth.external_auth:
+            return False
+        try:
+            fresh = await self.auth.authenticate_external(principal.connection)
+        except Exception:
+            return False
+        if fresh.user.id != principal.user_id or fresh.must_change_password:
+            return False
+        if not fresh.can(SHELL_PERMISSION):
+            return PERMISSION_REMOVED
+        return True
+
+    async def touch(self, principal: UsersShellPrincipal) -> None:
+        """Count shell input as session activity (idle timeout)."""
+        if principal.context.external or principal.session_id is None:
+            return
+        session = await self.auth.session_store.get_session_by_id(principal.session_id)
+        if session is not None and session.token_hash:
+            await self.auth.session_store.update_last_activity(session.token_hash)
+
+    async def audit(self, event: str, principal: UsersShellPrincipal, metadata: dict[str, Any]) -> None:
+        await self.auth.audit(
+            event,
+            principal.user_name,
+            user_id=principal.user_id,
+            actor=principal.user_name,
+            actor_id=principal.user_id,
+            metadata=metadata,
+        )
+
+    def add_change_listener(self, listener: Callable[[], Any]) -> None:
+        self.auth.add_change_listener(listener)
+
+
+__all__ = ["SHELL_PERMISSION", "UsersShellAccess", "UsersShellPrincipal"]

qodalis_cli_users/stores/__init__.py

@@ -0,0 +1,27 @@
+"""Users plugin store implementations."""
+
+from .interfaces import (
+    IUserStore,
+    ISessionStore,
+    ICredentialStore,
+    IAuditStore,
+    IGroupStore,
+)
+from .in_memory_user_store import InMemoryUserStore
+from .in_memory_session_store import InMemorySessionStore
+from .in_memory_credential_store import InMemoryCredentialStore
+from .in_memory_audit_store import InMemoryAuditStore
+from .in_memory_group_store import InMemoryGroupStore
+
+__all__ = [
+    "IAuditStore",
+    "ICredentialStore",
+    "IGroupStore",
+    "ISessionStore",
+    "IUserStore",
+    "InMemoryAuditStore",
+    "InMemoryCredentialStore",
+    "InMemoryGroupStore",
+    "InMemorySessionStore",
+    "InMemoryUserStore",
+]

qodalis_cli_users/stores/in_memory_audit_store.py

@@ -0,0 +1,50 @@
+"""In-memory implementation of IAuditStore.
+
+Keeps the last 1000 entries, with failed logins capped separately (last 200)
+so a flood of failed attempts cannot evict other history.
+"""
+
+from __future__ import annotations
+
+import itertools
+from collections import deque
+
+from ..models import AuditEntry, AuditQueryOptions
+from .interfaces import IAuditStore
+
+MAX_ENTRIES = 1000
+MAX_FAILED_LOGIN_ENTRIES = 200
+FAILED_LOGIN_EVENT = "login_failed"
+
+
+class InMemoryAuditStore(IAuditStore):
+    def __init__(
+        self,
+        max_entries: int = MAX_ENTRIES,
+        max_failed_login_entries: int = MAX_FAILED_LOGIN_ENTRIES,
+    ) -> None:
+        self._seq = itertools.count()
+        self._entries: deque[tuple[int, AuditEntry]] = deque(maxlen=max_entries)
+        self._failed: deque[tuple[int, AuditEntry]] = deque(maxlen=max_failed_login_entries)
+
+    async def log(self, entry: AuditEntry) -> None:
+        target = self._failed if entry.event == FAILED_LOGIN_EVENT else self._entries
+        target.append((next(self._seq), entry))
+
+    async def get_entries(self, options: AuditQueryOptions | None = None) -> list[AuditEntry]:
+        merged = sorted([*self._entries, *self._failed], key=lambda x: x[0], reverse=True)
+        result = [e for _, e in merged]  # newest first
+        if options:
+            if options.event:
+                ev = options.event.lower()
+                result = [e for e in result if e.event.lower() == ev]
+            if options.username:
+                un = options.username.lower()
+                result = [e for e in result if e.username.lower() == un]
+            if options.limit is not None and options.limit > 0:
+                result = result[: options.limit]
+        return result
+
+    async def clear(self) -> None:
+        self._entries.clear()
+        self._failed.clear()

qodalis_cli_users/stores/in_memory_credential_store.py

@@ -0,0 +1,25 @@
+"""In-memory implementation of ICredentialStore."""
+
+from __future__ import annotations
+
+from ..models import Credentials, now_ms
+from .interfaces import ICredentialStore
+
+
+class InMemoryCredentialStore(ICredentialStore):
+    def __init__(self) -> None:
+        self._credentials: dict[str, Credentials] = {}
+
+    async def set_password(self, user_id: str, hash_: str, salt: str) -> None:
+        self._credentials[user_id] = Credentials(
+            user_id=user_id,
+            password_hash=hash_,
+            salt=salt,
+            last_changed=now_ms(),
+        )
+
+    async def get_credentials(self, user_id: str) -> Credentials | None:
+        return self._credentials.get(user_id)
+
+    async def delete_credentials(self, user_id: str) -> None:
+        self._credentials.pop(user_id, None)