@voxgig/sdkgen 4.8.2 → 4.9.0

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/secretspec.py

@@ -0,0 +1,119 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/secretspec.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The secretspec plugin: SecretSpec, through its CLI. Needs a child
+# process. A port of typescript/plugins/secretspec.ts.
+import subprocess
+
+from ..sekreto import SekretoError, envkey
+from ..providers import Provider, providerplugin
+
+
+class SecretspecProvider(Provider):
+    """SecretSpec (https://secretspec.dev).
+
+    SecretSpec is a declaration - a `secretspec.toml` naming the secrets a
+    project needs - plus a chain of its own backends to satisfy them from.
+    That makes it the same shape as sekreto one level down, and the reason
+    to support it is the same reason sekreto exists: a project that has
+    already declared its secrets there should not have to declare them
+    again here.
+
+    Read through its CLI, as boru is, because that is the interface it
+    offers a program in another language: `secretspec get API_TOKEN`
+    prints the value on stdout and nothing else. A sekreto name maps to a
+    SecretSpec key exactly as it maps to an environment variable -
+    `api.token` is `API_TOKEN` - which is the convention SecretSpec's own
+    examples use.
+
+    `backend` selects one of SecretSpec's backends (`--provider`, e.g.
+    `keyring` or `dotenv://.env`) and is called `backend` here only
+    because `provider` already means something else in this library.
+
+    A reason is required, not optional: SecretSpec records every read in
+    an audit log and refuses to read at all without one. sekreto sends
+    `sekreto` unless told otherwise, so the audit trail says which tool
+    asked.
+    """
+
+    def __init__(self, command=None, file=None, profile=None,
+                 backend=None, reason=None, prefix=None):
+        self.command = command or 'secretspec'
+        self.file = file
+        self.profile = profile
+        self.backend = backend
+        self.reason = reason
+        self.prefix = prefix
+
+    def lookup(self, name):
+        key = envkey(name, self.prefix)
+
+        args = [self.command]
+        if self.file:
+            args += ['--file', self.file]
+        args += ['get', key]
+        if self.backend:
+            args += ['--provider', self.backend]
+        if self.profile:
+            args += ['--profile', self.profile]
+        args += ['--reason', self.reason or 'sekreto']
+
+        try:
+            run = subprocess.run(
+                args,
+                capture_output=True,
+                text=True,
+                # See the boru provider: an inherited stdin lets a CLI that
+                # prompts block forever.
+                stdin=subprocess.DEVNULL,
+            )
+        except OSError as err:
+            raise SekretoError('sekreto: cannot run ' + self.command + ': ' + str(err))
+
+        if 0 == run.returncode:
+            # The value and one newline, and nothing else.
+            return run.stdout[:-1] if run.stdout.endswith('\n') else run.stdout
+
+        why = (run.stderr or '').strip()
+
+        if secretspecmiss(why, key):
+            return None
+
+        raise SekretoError(
+            'sekreto: secretspec error: ' + (why or 'exit ' + str(run.returncode))
+        )
+
+    def describe(self):
+        return 'secretspec' + (':' + self.backend if self.backend else '')
+
+
+def secretspecmiss(why, key):
+    """Does this SecretSpec failure mean "no such secret" rather than "I
+    could not answer"?
+
+    SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
+    not declare and one declared with no value, and both are misses: this
+    store does not hold it, so the chain carries on.
+
+    MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+    `Provider backend 'keyring' not found`, which is a store that could
+    not answer at all - and reading that as a miss is the worst failure
+    this library has, because the chain then falls through to a weaker
+    store without saying so. The key is required to appear, so the two
+    cannot be confused."""
+    return ("Secret '" + key + "' not found") in why
+
+
+def _make(spec):
+    return SecretspecProvider(
+        spec.get('command'),
+        spec.get('file'),
+        spec.get('profile'),
+        spec.get('backend'),
+        spec.get('reason'),
+        spec.get('prefix'),
+    )
+
+
+# The plugin: the `secretspec` provider kind, as a voxgig/plugin definition.
+secretspec = providerplugin('secretspec', _make)

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/plugins/sigv4.py

@@ -0,0 +1,125 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/plugins/sigv4.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# AWS Signature Version 4, hand-rolled.
+#
+# The AWS providers need exactly one thing from the AWS SDK - request
+# signing - and taking the SDK for it would break the no-dependency rule
+# that keeps ten ports honest. SigV4 is a stable, published algorithm
+# built from HMAC-SHA256, which the standard library already has.
+#
+# `sigv4` is pure: the caller passes the timestamp, so the same input
+# yields the same signature everywhere. That is what lets the shared spec
+# carry known-answer cases that all ten ports must reproduce bit-for-bit,
+# and lets the integration mock recompute the signature server-side.
+#
+# A port of typescript/plugins/sigv4.ts, which is canonical. It lives with
+# the aws plugin because it is the one place the library needs
+# HMAC-SHA256, and a built-in must not.
+
+import hashlib
+import hmac as hmaclib
+import re
+import urllib.parse
+
+
+def _sha256hex(text):
+    return hashlib.sha256(text.encode('utf8')).hexdigest()
+
+
+def _hmac(key, text):
+    return hmaclib.new(key, text.encode('utf8'), hashlib.sha256).digest()
+
+
+def _uriescape(text):
+    """RFC 3986 escaping, which is stricter than encodeURIComponent: AWS
+    wants `!`, `'`, `(`, `)` and `*` escaped too. Only the unreserved
+    characters survive, and the hex is uppercase."""
+    return urllib.parse.quote(text, safe='-_.~')
+
+
+def _canonicalquery(query):
+    """The canonical query string: each pair RFC 3986-escaped, sorted by
+    escaped key then escaped value."""
+    if '' == query:
+        return ''
+
+    pairs = []
+    for pair in query.split('&'):
+        eq = pair.find('=')
+        key = pair if -1 == eq else pair[:eq]
+        value = '' if -1 == eq else pair[eq + 1:]
+        pairs.append((
+            _uriescape(urllib.parse.unquote(key)),
+            _uriescape(urllib.parse.unquote(value)),
+        ))
+
+    pairs.sort()
+
+    return '&'.join(key + '=' + value for key, value in pairs)
+
+
+def sigv4(input):
+    """Sign one request. Returns the headers to attach: authorization,
+    x-amz-date, and x-amz-security-token when a session token was given."""
+    url = urllib.parse.urlsplit(input['url'])
+
+    datetime = input['datetime']
+    date = datetime[:8]
+    body = input.get('body') or ''
+    session = input.get('session')
+
+    # Every header that will be signed: the caller's extras, plus host and
+    # x-amz-date (and the session token when present), lower-cased and
+    # trimmed the way the canonical form requires.
+    # Canonical header values are trimmed AND internally collapsed -
+    # AWS folds sequential whitespace to one space before signing, so a
+    # header like "a  b" must sign as "a b" or the service refuses it.
+    headers = {}
+    for key, value in (input.get('headers') or {}).items():
+        headers[key.lower()] = re.sub(r'\s+', ' ', str(value).strip())
+    headers['host'] = url.netloc
+    headers['x-amz-date'] = datetime
+    if session:
+        headers['x-amz-security-token'] = session
+
+    names = sorted(headers.keys())
+    canonicalheaders = ''.join(name + ':' + headers[name] + '\n' for name in names)
+    signedheaders = ';'.join(names)
+
+    canonicalrequest = '\n'.join([
+        input['method'].upper(),
+        url.path or '/',
+        _canonicalquery(url.query),
+        canonicalheaders,
+        signedheaders,
+        _sha256hex(body),
+    ])
+
+    scope = date + '/' + input['region'] + '/' + input['service'] + '/aws4_request'
+
+    stringtosign = '\n'.join([
+        'AWS4-HMAC-SHA256',
+        datetime,
+        scope,
+        _sha256hex(canonicalrequest),
+    ])
+
+    kdate = _hmac(('AWS4' + input['secret']).encode('utf8'), date)
+    kregion = _hmac(kdate, input['region'])
+    kservice = _hmac(kregion, input['service'])
+    ksigning = _hmac(kservice, 'aws4_request')
+    signature = hmaclib.new(
+        ksigning, stringtosign.encode('utf8'), hashlib.sha256
+    ).hexdigest()
+
+    out = {
+        'authorization': 'AWS4-HMAC-SHA256 Credential=' + input['keyid'] + '/' + scope
+        + ', SignedHeaders=' + signedheaders + ', Signature=' + signature,
+        'x-amz-date': datetime,
+    }
+
+    if session:
+        out['x-amz-security-token'] = session
+
+    return out

package/project/.sdk/tm/py/pkg/feature/secrets/voxgig_sekreto/providers.py

@@ -0,0 +1,211 @@
+# VENDORED: @voxgig/sekreto 0.2.0 (python/voxgig_sekreto/providers.py)
+# Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# What a provider is, how a provider kind becomes a voxgig/plugin
+# definition - and the four BUILT-IN kinds.
+#
+# A provider answers one question: "do you have this secret?" It returns
+# the value, or None to mean "ask the next one". Nothing else about a
+# provider is visible to the caller - which is the point: an app reads
+# `api.token` and never learns whether it came from the environment, a
+# .env file, HashiCorp Vault or a boru vault.
+#
+# Two failure shapes, and they are never interchangeable. A store that
+# does not hold the secret is a MISS (None) - the chain carries on. A
+# store that could not answer - bad credentials, unreachable host,
+# missing configuration - is an ERROR: falling through there would
+# quietly reach for a weaker store.
+#
+# THIS MODULE IMPORTS NO urllib, NO hashlib AND NO subprocess. What makes
+# a kind built in is that it needs nothing of the platform beyond reading
+# a local file; every kind that opens a socket, signs a request or spawns
+# a process is a plugin under plugins/, its own module, imported only by
+# a program that names it (docs/design/plugin-providers.md).
+#
+# A port of typescript/src/provider/support.ts and
+# typescript/src/provider/builtin.ts, which are canonical.
+
+import os
+
+from ..voxgig_plugin import PluginError
+
+from .sekreto import SekretoError, envkey, parsedotenv
+
+
+class Provider:
+    """A source of secrets. `lookup` returns the value or None."""
+
+    def lookup(self, name):
+        raise NotImplementedError
+
+    def describe(self):
+        raise NotImplementedError
+
+
+class EnvProvider(Provider):
+    """Environment variables: `api.token` from `API_TOKEN`."""
+
+    def __init__(self, prefix=None, source=None):
+        self.prefix = prefix
+        self.source = source if source is not None else os.environ
+
+    def lookup(self, name):
+        value = self.source.get(envkey(name, self.prefix))
+        return None if value is None else str(value)
+
+    def describe(self):
+        return 'env' + (':' + self.prefix if self.prefix else '')
+
+
+class DotenvProvider(Provider):
+    """A `.env` file, read once, keyed exactly like the environment."""
+
+    def __init__(self, file, prefix=None):
+        self.file = file
+        self.prefix = prefix
+        self.values = None
+
+    def load(self):
+        if self.values is None:
+            try:
+                with open(self.file, 'r', encoding='utf8') as handle:
+                    self.values = parsedotenv(handle.read())
+            except (FileNotFoundError, NotADirectoryError):
+                # An absent file - or an absent directory - means "no
+                # secrets here", exactly like FileProvider. Anything else
+                # (permission denied, an unreadable mount) is a store that
+                # could not answer, and swallowing it would fall through to
+                # a weaker store.
+                self.values = {}
+            except OSError as err:
+                raise SekretoError(
+                    'sekreto: dotenv provider cannot read ' + self.file + ': ' + str(err)
+                )
+        return self.values
+
+    def lookup(self, name):
+        return self.load().get(envkey(name, self.prefix))
+
+    def describe(self):
+        return 'dotenv:' + self.file
+
+
+class MemoryProvider(Provider):
+    """Literal values, keyed like environment variables. The spec uses this
+    to test chain behaviour without touching the outside world."""
+
+    def __init__(self, values, prefix=None):
+        self.values = values or {}
+        self.prefix = prefix
+
+    def lookup(self, name):
+        return self.values.get(envkey(name, self.prefix))
+
+    def describe(self):
+        return 'memory' + (':' + self.prefix if self.prefix else '')
+
+
+class FileProvider(Provider):
+    """A directory of one-secret-per-file entries, keyed like the
+    environment: `api.token` reads `<dir>/API_TOKEN`.
+
+    This is the shape of a mounted Kubernetes Secret, a Docker or Swarm
+    secret, and a systemd credentials directory, so those all work with no
+    further configuration. One trailing newline is stripped - tools that
+    write these files disagree about it, and a newline is never part of a
+    secret on purpose.
+    """
+
+    def __init__(self, dir, prefix=None):
+        self.dir = dir
+        self.prefix = prefix
+
+    def lookup(self, name):
+        file = os.path.join(self.dir, envkey(name, self.prefix))
+
+        try:
+            with open(file, 'r', encoding='utf8') as handle:
+                text = handle.read()
+        except (FileNotFoundError, NotADirectoryError):
+            # An absent file - or an absent directory - means "no secrets
+            # here", exactly like a missing .env. Anything else (permission
+            # denied, an unreadable mount) is a store that could not answer.
+            return None
+        except OSError as err:
+            raise SekretoError(
+                'sekreto: file provider cannot read ' + file + ': ' + str(err)
+            )
+
+        if text.endswith('\r\n'):
+            return text[:-2]
+        if text.endswith('\n'):
+            return text[:-1]
+        return text
+
+    def describe(self):
+        return 'file:' + self.dir
+
+
+# --- providers as voxgig/plugin definitions -------------------------------
+
+# The export key under which a provider definition publishes the provider
+# it built. `Sekreto` reads `<ref>/provider` off the host.
+PROVIDER_EXPORT = 'provider'
+
+# The voxgig/plugin error code a SekretoError travels under when it is
+# raised inside a definition's `define`.
+#
+# plugin wraps a code-less error raised by a callback as
+# `plugin_define_failed`, and keeps an error that already carries a code.
+# A provider that refuses its own configuration - `kv: 3`, a missing
+# project - raises a SekretoError, and that message is pinned by the spec
+# byte for byte, so it must come back out of the host exactly as it went
+# in. `providerplugin` gives it this code on the way in; `Sekreto` turns
+# it back into a SekretoError on the way out.
+ERROR_CODE = 'sekreto_error'
+
+
+def providerplugin(kind, make):
+    """A provider kind, as a voxgig/plugin definition.
+
+    This is the whole bridge between the two libraries. The definition's
+    `name` is the `kind` a spec names; its `define` reads the spec as
+    `inst.options`, builds the provider with `make`, and exports it.
+    Nothing runs at `activate`: a provider opens nothing until its first
+    lookup, so there is nothing to capture - a provider that does hold a
+    resource acquires it there and lets the instance scope unwind it.
+
+    Every built-in and every plugin is made this way, so a custom
+    provider kind is one call:
+
+        providerplugin('mystore', lambda spec: MyStore(spec.get('addr')))
+    """
+    def define(inst):
+        try:
+            provider = make(inst.options)
+        except SekretoError as err:
+            raise PluginError(ERROR_CODE, str(err), {'ref': inst.ref, 'cause': str(err)})
+        inst.export(PROVIDER_EXPORT, provider)
+
+    return {'name': kind, 'define': define}
+
+
+# The four built-in provider kinds - the same four in every port. What
+# makes a kind built in is that it needs nothing of the platform beyond
+# reading a local file: no socket, no TLS, no crypto, no child process.
+BUILTINS = [
+    providerplugin('env', lambda spec: EnvProvider(spec.get('prefix'))),
+    providerplugin('memory', lambda spec: MemoryProvider(spec.get('values') or {}, spec.get('prefix'))),
+    providerplugin('dotenv', lambda spec: DotenvProvider(spec.get('file') or '.env', spec.get('prefix'))),
+    providerplugin('file', lambda spec: FileProvider(spec.get('dir') or '', spec.get('prefix'))),
+]
+
+# Every kind this library ships, built in or as a plugin, so that an
+# unknown kind can be told from a plugin that was not loaded.
+KINDS = {
+    'builtin': ['env', 'memory', 'dotenv', 'file'],
+    'plugin': [
+        'hashicorp', 'boru', 'awssecrets', 'awsparams', 'gcpsecrets',
+        'azuresecrets', 'onepassword', 'doppler', 'infisical', 'secretspec',
+    ],
+}