@voxgig/sdkgen 4.8.2 → 4.9.0

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/doppler.py

@@ -0,0 +1,62 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/doppler.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The doppler plugin: Doppler, one bulk download per config. Needs
+# HTTPS. A port of typescript/plugins/doppler.ts.
+from ..addr import checkaddr
+from ..sekreto import SekretoError, envkey
+from ..providers import Provider, providerplugin
+from .httpjson import fetchjson, urlpart
+
+
+class DopplerProvider(Provider):
+    """Doppler.
+
+    The whole config is downloaded once - Doppler's own bulk endpoint -
+    and answered from memory, like a remote .env: `api.token` is the
+    `API_TOKEN` entry. A service token is config-scoped, so project and
+    config are only needed with broader tokens.
+    """
+
+    def __init__(self, options=None):
+        self.opts = options or {}
+        self.values = None
+
+    def load(self):
+        if self.values is not None:
+            return self.values
+
+        addr = (self.opts.get('addr') or 'https://api.doppler.com').rstrip('/')
+        checkaddr(addr)
+
+        url = addr + '/v3/configs/config/secrets/download?format=json'
+        if self.opts.get('project'):
+            url += '&project=' + urlpart(self.opts['project'])
+        if self.opts.get('config'):
+            url += '&config=' + urlpart(self.opts['config'])
+
+        status, body = fetchjson(
+            'GET', url, {'authorization': 'Bearer ' + (self.opts.get('token') or '')}
+        )
+
+        if 200 != status or not isinstance(body, dict):
+            raise SekretoError('sekreto: doppler error: ' + str(status))
+
+        self.values = {}
+        for key, value in body.items():
+            if value is not None:
+                self.values[key] = str(value)
+
+        return self.values
+
+    def lookup(self, name):
+        return self.load().get(envkey(name))
+
+    def describe(self):
+        if self.opts.get('project'):
+            return 'doppler:' + self.opts['project'] + '/' + (self.opts.get('config') or '')
+        return 'doppler'
+
+
+# The plugin: the `doppler` provider kind, as a voxgig/plugin definition.
+doppler = providerplugin('doppler', DopplerProvider)

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/gcpsecrets.py

@@ -0,0 +1,101 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/gcpsecrets.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The gcpsecrets plugin: GCP Secret Manager. Needs HTTPS. A port of
+# typescript/plugins/gcpsecrets.ts.
+import base64
+import os
+import time
+
+from ..addr import checkaddr
+from ..sekreto import SekretoError, flatname
+from ..providers import Provider, providerplugin
+from .httpjson import fetchjson, tonumber
+
+
+class GcpsecretsProvider(Provider):
+    """GCP Secret Manager.
+
+    `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+    Manager ids have no hierarchy and reject dots), latest version. The
+    token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+    GCE/GKE metadata server - so on Google's own platform no credential
+    configuration is needed at all.
+
+    The metadata call itself is plain http to a link-local host by
+    platform design; no credential rides on it, so `checkaddr` guards the
+    Secret Manager address instead.
+    """
+
+    def __init__(self, options=None):
+        self.opts = options or {}
+
+        # A configured token is kept forever; a metadata-server token carries
+        # expires_in and is renewed shortly before it runs out.
+        self.livetoken = None
+        self.renewat = float('inf')
+
+    def metadataaddr(self):
+        if self.opts.get('metadataaddr'):
+            return self.opts['metadataaddr']
+        host = os.environ.get('GCE_METADATA_HOST')
+        return 'http://' + host if host else 'http://metadata.google.internal'
+
+    def login(self):
+        configured = self.opts.get('token') or os.environ.get('GOOGLE_OAUTH_ACCESS_TOKEN')
+        if configured:
+            return configured
+
+        url = (self.metadataaddr().rstrip('/')
+               + '/computeMetadata/v1/instance/service-accounts/default/token')
+
+        status, body = fetchjson('GET', url, {'Metadata-Flavor': 'Google'})
+
+        got = (body or {}).get('access_token')
+        if 200 != status or not got:
+            raise SekretoError('sekreto: gcp: no token and metadata server did not answer')
+
+        expires = tonumber((body or {}).get('expires_in'))
+        self.renewat = time.time() + max(expires - 60, 1) if 0 < expires else float('inf')
+
+        return str(got)
+
+    def lookup(self, name):
+        project = self.opts.get('project') or ''
+        if '' == project:
+            raise SekretoError('sekreto: gcp: no project')
+
+        addr = self.opts.get('addr') or 'https://secretmanager.googleapis.com'
+        checkaddr(addr)
+
+        if self.livetoken is None or time.time() >= self.renewat:
+            self.livetoken = self.login()
+
+        url = (addr.rstrip('/') + '/v1/projects/' + project + '/secrets/'
+               + flatname(name, '_') + '/versions/latest:access')
+
+        status, body = fetchjson('GET', url, {'authorization': 'Bearer ' + self.livetoken})
+
+        if 404 == status:
+            return None
+
+        if 200 != status:
+            raise SekretoError('sekreto: gcp error: ' + str(status) + ': ' + url)
+
+        data = ((body or {}).get('payload') or {}).get('data')
+        if not isinstance(data, str):
+            return None
+
+        # See the aws provider: validate=True, and an undecodable payload
+        # is an error rather than a miss.
+        try:
+            return base64.b64decode(data, validate=True).decode('utf8')
+        except Exception:
+            raise SekretoError('sekreto: gcp: undecodable secret')
+
+    def describe(self):
+        return 'gcpsecrets:' + (self.opts.get('project') or '')
+
+
+# The plugin: the `gcpsecrets` provider kind, as a voxgig/plugin definition.
+gcpsecrets = providerplugin('gcpsecrets', GcpsecretsProvider)

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/hashicorp.py

@@ -0,0 +1,151 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/hashicorp.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The hashicorp plugin: HashiCorp Vault, and OpenBao. Needs HTTPS, and
+# the filesystem for a kubernetes service-account JWT. A port of
+# typescript/plugins/hashicorp.ts.
+import time
+
+from ..addr import checkaddr
+from ..sekreto import SekretoError, vaultref, writejson
+from ..providers import Provider, providerplugin
+from .httpjson import fetchjson, tonumber
+
+
+class HashicorpProvider(Provider):
+    """HashiCorp Vault.
+
+    KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
+    and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+    `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means
+    "not here" - a miss - so a vault can sit in a chain with fallbacks.
+
+    A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+    logins as well as reads.
+
+    Instead of being handed a token, the provider can log in: Kubernetes
+    auth (the pod's service-account JWT, from its conventional path) or
+    AppRole. A failed login is an error, never a miss - it means this
+    store could not answer at all.
+    """
+
+    def __init__(self, addr, token, mount=None, kv=None, vaultnamespace=None, auth=None):
+        self.addr = addr
+        self.mount = mount or 'secret'
+        self.kv = kv or 2
+        self.vaultnamespace = vaultnamespace
+        self.auth = auth
+
+        # A version typo like kv: 3 must not quietly behave as v2 and turn
+        # its 404s into misses; there is nothing safe to assume it meant.
+        if 1 != self.kv and 2 != self.kv:
+            raise SekretoError(
+                'sekreto: hashicorp: unsupported kv version: ' + str(self.kv)
+            )
+
+        # The working token: a configured token is kept forever, a logged-in
+        # token is renewed shortly before its lease runs out - a long-running
+        # process must not keep presenting a token the vault already expired.
+        self.livetoken = None if '' == token else token
+        self.renewat = float('inf')
+
+    def baseheaders(self):
+        headers = {}
+        if self.vaultnamespace:
+            headers['X-Vault-Namespace'] = self.vaultnamespace
+        return headers
+
+    def login(self):
+        auth = self.auth
+        if not auth:
+            raise SekretoError('sekreto: hashicorp: no token and no auth method')
+
+        method = auth.get('method')
+        mount = auth.get('mount') or method
+        url = self.addr.rstrip('/') + '/v1/auth/' + str(mount) + '/login'
+
+        if 'kubernetes' == method:
+            jwt = auth.get('jwt')
+            if jwt is None:
+                file = (
+                    auth.get('jwtfile')
+                    or '/var/run/secrets/kubernetes.io/serviceaccount/token'
+                )
+                try:
+                    with open(file, 'r', encoding='utf8') as handle:
+                        jwt = handle.read().strip()
+                except OSError:
+                    raise SekretoError('sekreto: hashicorp: cannot read jwt file ' + file)
+            body = {'role': auth.get('role') or '', 'jwt': jwt}
+        elif 'approle' == method:
+            body = {
+                'role_id': auth.get('roleid') or '',
+                'secret_id': auth.get('secretid') or '',
+            }
+        else:
+            raise SekretoError(
+                'sekreto: hashicorp: unknown auth method: ' + str(method)
+            )
+
+        status, resbody = fetchjson(
+            'POST', url, self.baseheaders(), writejson(body)
+        )
+
+        got = ((resbody or {}).get('auth') or {}).get('client_token')
+        if 200 != status or not got:
+            raise SekretoError(
+                'sekreto: hashicorp login failed: ' + str(status) + ': ' + url
+            )
+
+        lease = tonumber(((resbody or {}).get('auth') or {}).get('lease_duration'))
+        self.renewat = time.time() + max(lease - 60, 1) if 0 < lease else float('inf')
+
+        return str(got)
+
+    def lookup(self, name):
+        checkaddr(self.addr)
+
+        if self.livetoken is None or time.time() >= self.renewat:
+            self.livetoken = self.login()
+
+        ref = vaultref(name)
+        base = self.addr.rstrip('/') + '/v1/' + self.mount
+        url = base + '/' + ref['path'] if 1 == self.kv else base + '/data/' + ref['path']
+
+        headers = self.baseheaders()
+        headers['X-Vault-Token'] = self.livetoken
+
+        status, body = fetchjson('GET', url, headers)
+
+        if 404 == status:
+            return None
+
+        if 200 != status:
+            raise SekretoError('sekreto: hashicorp error: ' + str(status) + ': ' + url)
+
+        if 1 == self.kv:
+            data = (body or {}).get('data')
+        else:
+            data = ((body or {}).get('data') or {}).get('data')
+
+        value = data.get(ref['field']) if isinstance(data, dict) else None
+
+        return None if value is None else str(value)
+
+    def describe(self):
+        return 'hashicorp:' + self.addr + '/' + self.mount
+
+
+def _make(spec):
+    return HashicorpProvider(
+        spec.get('addr') or '',
+        spec.get('token') or '',
+        spec.get('mount'),
+        spec.get('kv'),
+        spec.get('vaultnamespace'),
+        spec.get('auth'),
+    )
+
+
+# The plugin: the `hashicorp` provider kind, as a voxgig/plugin definition.
+hashicorp = providerplugin('hashicorp', _make)

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/httpjson.py

@@ -0,0 +1,115 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/httpjson.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The HTTP half of every plugin that speaks to a store over the wire, in
+# one place and OUTSIDE the core: a chain of built-ins never imports this
+# module. One JSON round-trip, bounded in time and in size, refusing
+# redirects and ignoring proxies; and the small helpers every store client
+# needs. A port of typescript/plugins/httpjson.ts.
+
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+
+from ..sekreto import SekretoError
+
+
+# How long any single vault round-trip may take before it is treated as
+# unreachable, in seconds. Ports carry the same bound.
+_HTTP_TIMEOUT = 10
+
+# How much of a response body will be read before the store is treated as
+# having answered incoherently. Ports carry the same bound.
+#
+# Far above anything real - the largest legitimate payload this library
+# fetches is Doppler's whole-config download, measured in kilobytes. A bound
+# is needed because the TIMEOUT is not one: ten seconds on a loopback or
+# datacentre link is gigabytes, and the body is accumulated in memory before
+# it is parsed. This runs on an application's startup path, so the failure is
+# the application never starting.
+_HTTP_MAXBODY = 8 * 1024 * 1024
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    """A redirect handler that refuses to follow: a vault API never
+    legitimately redirects, and following one would resend the vault token
+    to the redirect's host."""
+
+    def redirect_request(self, *args, **kwargs):
+        return None
+
+
+# A secrets client dials the address it was configured with and nowhere
+# else. urllib installs a ProxyHandler from the environment by default, and
+# its proxy resolution does NOT exempt loopback - so with http_proxy set,
+# `X-Vault-Token` for a local dev vault went, in the clear, to whatever that
+# variable named. checkaddr permits plaintext to loopback precisely because
+# nothing leaves the machine; an environment variable it cannot see must not
+# be able to make that false. An empty ProxyHandler turns the whole
+# mechanism off.
+_opener = urllib.request.build_opener(_NoRedirect, urllib.request.ProxyHandler({}))
+
+
+def fetchjson(method, url, headers, body=None):
+    """One JSON round-trip, returning (status, parsed-json-or-None).
+
+    A 404 is a normal answer here, not an exception: callers decide on
+    status. Network failure is always an error - an unreachable store is a
+    store that could not answer.
+    """
+    data = None if body is None else body.encode('utf8')
+    request = urllib.request.Request(url, data=data, headers=headers, method=method)
+
+    try:
+        # No redirects (a followed one carries X-Vault-Token to the target,
+        # which checkaddr cannot see) and a bounded wait (an accepted-but-
+        # silent endpoint must not hang the caller forever). A 3xx surfaces
+        # as an HTTPError below and is treated as a store error.
+        with _opener.open(request, timeout=_HTTP_TIMEOUT) as response:
+            status = response.status
+            raw = response.read(_HTTP_MAXBODY + 1)
+    except urllib.error.HTTPError as err:
+        status = err.code
+        raw = err.read(_HTTP_MAXBODY + 1)
+    except urllib.error.URLError as err:
+        raise SekretoError(
+            'sekreto: cannot reach ' + url.split('?')[0] + ': ' + str(err.reason)
+        )
+
+    # One byte over the bound is enough to know it was exceeded. An endless
+    # body is a store that could not answer, so this raises rather than
+    # returning a miss - the latter would fall through to a weaker store on
+    # an attacker's cue.
+    if _HTTP_MAXBODY < len(raw):
+        raise SekretoError('sekreto: oversized response from ' + url.split('?')[0])
+
+    text = raw.decode('utf8', 'replace')
+
+    try:
+        return status, json.loads(text)
+    except ValueError:
+        # A success status promised JSON; a body that does not parse means
+        # the store could not answer coherently, and treating it as a miss
+        # would fall through to a weaker store. Error statuses may carry
+        # any body - they are decided on status alone.
+        if 200 == status:
+            raise SekretoError('sekreto: malformed response from ' + url.split('?')[0])
+        return status, None
+
+
+def urlpart(text):
+    """One URL component, escaped the way encodeURIComponent does it -
+    the addresses built here must match the canonical port's byte for
+    byte."""
+    return urllib.parse.quote(str(text), safe="-_.!~*'()")
+
+
+def tonumber(value):
+    """The canonical port's Number() as expiry fields need it: a number
+    or numeric string converts (expires_in may arrive as a string);
+    anything else becomes 0, which means "never renew"."""
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return 0

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/infisical.py

@@ -0,0 +1,90 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/infisical.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The infisical plugin: Infisical. Needs HTTPS. A port of
+# typescript/plugins/infisical.ts.
+import time
+
+from ..addr import checkaddr
+from ..sekreto import SekretoError, envkey, writejson
+from ..providers import Provider, providerplugin
+from .httpjson import fetchjson, tonumber, urlpart
+
+
+class InfisicalProvider(Provider):
+    """Infisical.
+
+    `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+    convention is environment-style keys) at a secret path in one
+    environment of a project. Auth is a token, or a universal-auth
+    (machine identity) login with clientid/clientsecret.
+    """
+
+    def __init__(self, options=None):
+        self.opts = options or {}
+
+        # A configured token is kept forever; a universal-auth token carries
+        # expiresIn and is renewed shortly before it runs out.
+        self.livetoken = None
+        self.renewat = float('inf')
+
+    def login(self, addr):
+        if self.opts.get('token'):
+            return self.opts['token']
+
+        if not self.opts.get('clientid') or not self.opts.get('clientsecret'):
+            raise SekretoError('sekreto: infisical: no token and no client credentials')
+
+        status, body = fetchjson(
+            'POST',
+            addr + '/api/v1/auth/universal-auth/login',
+            {'content-type': 'application/json'},
+            writejson(
+                {'clientId': self.opts['clientid'], 'clientSecret': self.opts['clientsecret']}
+            ),
+        )
+
+        got = (body or {}).get('accessToken')
+        if 200 != status or not got:
+            raise SekretoError('sekreto: infisical login failed: ' + str(status))
+
+        expires = tonumber((body or {}).get('expiresIn'))
+        self.renewat = time.time() + max(expires - 60, 1) if 0 < expires else float('inf')
+
+        return str(got)
+
+    def lookup(self, name):
+        addr = (self.opts.get('addr') or 'https://app.infisical.com').rstrip('/')
+        checkaddr(addr)
+
+        project = self.opts.get('project') or ''
+        environment = self.opts.get('environment') or ''
+        if '' == project or '' == environment:
+            raise SekretoError('sekreto: infisical: no project/environment')
+
+        if self.livetoken is None or time.time() >= self.renewat:
+            self.livetoken = self.login(addr)
+
+        url = (addr + '/api/v3/secrets/raw/' + envkey(name)
+               + '?workspaceId=' + urlpart(project)
+               + '&environment=' + urlpart(environment)
+               + '&secretPath=' + urlpart(self.opts.get('path') or '/'))
+
+        status, body = fetchjson('GET', url, {'authorization': 'Bearer ' + self.livetoken})
+
+        if 404 == status:
+            return None
+
+        if 200 != status:
+            raise SekretoError('sekreto: infisical error: ' + str(status))
+
+        value = ((body or {}).get('secret') or {}).get('secretValue')
+        return None if value is None else str(value)
+
+    def describe(self):
+        return ('infisical:' + (self.opts.get('project') or '')
+                + '/' + (self.opts.get('environment') or ''))
+
+
+# The plugin: the `infisical` provider kind, as a voxgig/plugin definition.
+infisical = providerplugin('infisical', InfisicalProvider)

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/onepassword.py

@@ -0,0 +1,101 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/onepassword.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The onepassword plugin: 1Password, through a Connect server. Needs
+# HTTPS. A port of typescript/plugins/onepassword.ts.
+from ..addr import checkaddr
+from ..sekreto import SekretoError, checkname
+from ..providers import Provider, providerplugin
+from .httpjson import fetchjson, urlpart
+
+
+class OnepasswordProvider(Provider):
+    """1Password, through a Connect server.
+
+    The item titled `api.token` (titles keep their dots), in the named
+    vault. The value is the field with purpose PASSWORD, or the field
+    labelled `value`. A vault that cannot be found is an error - config
+    names it, so its absence is a broken store, not a missing secret.
+    """
+
+    def __init__(self, options=None):
+        self.opts = options or {}
+        self.vaultid = None
+
+    def authheaders(self):
+        return {'authorization': 'Bearer ' + (self.opts.get('token') or '')}
+
+    def resolvevault(self, addr):
+        want = self.opts.get('vault') or ''
+        if '' == want:
+            raise SekretoError('sekreto: onepassword: no vault')
+
+        status, body = fetchjson('GET', addr + '/v1/vaults', self.authheaders())
+
+        if 200 != status or not isinstance(body, list):
+            raise SekretoError(
+                'sekreto: onepassword error: ' + str(status) + ': listing vaults'
+            )
+
+        for entry in body:
+            if isinstance(entry, dict) and (want == entry.get('id') or want == entry.get('name')):
+                return str(entry.get('id'))
+
+        raise SekretoError('sekreto: onepassword: no vault named ' + want)
+
+    def lookup(self, name):
+        checkname(name)
+
+        addr = (self.opts.get('addr') or '').rstrip('/')
+        if '' == addr:
+            raise SekretoError('sekreto: onepassword: no addr')
+        checkaddr(addr)
+
+        if self.vaultid is None:
+            self.vaultid = self.resolvevault(addr)
+
+        filterpart = urlpart('title eq "' + name + '"')
+        status, found = fetchjson(
+            'GET',
+            addr + '/v1/vaults/' + self.vaultid + '/items?filter=' + filterpart,
+            self.authheaders(),
+        )
+
+        if 200 != status or not isinstance(found, list):
+            raise SekretoError(
+                'sekreto: onepassword error: ' + str(status) + ': finding ' + name
+            )
+
+        if 0 == len(found):
+            return None
+
+        status, item = fetchjson(
+            'GET',
+            addr + '/v1/vaults/' + self.vaultid + '/items/' + str(found[0].get('id')),
+            self.authheaders(),
+        )
+
+        if 200 != status:
+            raise SekretoError(
+                'sekreto: onepassword error: ' + str(status) + ': reading ' + name
+            )
+
+        fields = (item or {}).get('fields') or []
+
+        for field in fields:
+            if isinstance(field, dict) and 'PASSWORD' == field.get('purpose'):
+                value = field.get('value')
+                return None if value is None else str(value)
+        for field in fields:
+            if isinstance(field, dict) and 'value' == field.get('label'):
+                value = field.get('value')
+                return None if value is None else str(value)
+
+        return None
+
+    def describe(self):
+        return 'onepassword:' + (self.opts.get('vault') or '')
+
+
+# The plugin: the `onepassword` provider kind, as a voxgig/plugin definition.
+onepassword = providerplugin('onepassword', OnepasswordProvider)