apache-airflow-providers-google 14.0.0__py3-none-any.whl → 19.1.0rc1__py3-none-any.whl

airflow/providers/google/cloud/triggers/pubsub.py

@@ -23,9 +23,10 @@ from collections.abc import AsyncIterator, Sequence
 from functools import cached_property
 from typing import Any
 
+from google.cloud.pubsub_v1.types import ReceivedMessage
+
 from airflow.providers.google.cloud.hooks.pubsub import PubSubAsyncHook
 from airflow.triggers.base import BaseTrigger, TriggerEvent
-from google.cloud.pubsub_v1.types import ReceivedMessage
 
 
 class PubsubPullTrigger(BaseTrigger):
@@ -84,27 +85,23 @@ class PubsubPullTrigger(BaseTrigger):
             },
         )
 
-    async def run(self) -> AsyncIterator[TriggerEvent]:  # type: ignore[override]
-        try:
-            while True:
-                if pulled_messages := await self.hook.pull(
-                    project_id=self.project_id,
-                    subscription=self.subscription,
-                    max_messages=self.max_messages,
-                    return_immediately=True,
-                ):
-                    if self.ack_messages:
-                        await self.message_acknowledgement(pulled_messages)
+    async def run(self) -> AsyncIterator[TriggerEvent]:
+        while True:
+            if pulled_messages := await self.hook.pull(
+                project_id=self.project_id,
+                subscription=self.subscription,
+                max_messages=self.max_messages,
+                return_immediately=True,
+            ):
+                if self.ack_messages:
+                    await self.message_acknowledgement(pulled_messages)
 
-                    messages_json = [ReceivedMessage.to_dict(m) for m in pulled_messages]
+                messages_json = [ReceivedMessage.to_dict(m) for m in pulled_messages]
 
-                    yield TriggerEvent({"status": "success", "message": messages_json})
-                    return
-                self.log.info("Sleeping for %s seconds.", self.poke_interval)
-                await asyncio.sleep(self.poke_interval)
-        except Exception as e:
-            yield TriggerEvent({"status": "error", "message": str(e)})
-            return
+                yield TriggerEvent({"status": "success", "message": messages_json})
+                return
+            self.log.info("Sleeping for %s seconds.", self.poke_interval)
+            await asyncio.sleep(self.poke_interval)
 
     async def message_acknowledgement(self, pulled_messages):
         await self.hook.acknowledge(

airflow/providers/google/cloud/triggers/vertex_ai.py

@@ -20,6 +20,14 @@ from collections.abc import AsyncIterator, Sequence
 from functools import cached_property
 from typing import TYPE_CHECKING, Any
 
+from google.cloud.aiplatform_v1 import (
+    BatchPredictionJob,
+    HyperparameterTuningJob,
+    JobState,
+    PipelineState,
+    types,
+)
+
 from airflow.exceptions import AirflowException
 from airflow.providers.google.cloud.hooks.vertex_ai.batch_prediction_job import BatchPredictionJobAsyncHook
 from airflow.providers.google.cloud.hooks.vertex_ai.custom_job import CustomJobAsyncHook
@@ -28,13 +36,6 @@ from airflow.providers.google.cloud.hooks.vertex_ai.hyperparameter_tuning_job im
 )
 from airflow.providers.google.cloud.hooks.vertex_ai.pipeline_job import PipelineJobAsyncHook
 from airflow.triggers.base import BaseTrigger, TriggerEvent
-from google.cloud.aiplatform_v1 import (
-    BatchPredictionJob,
-    HyperparameterTuningJob,
-    JobState,
-    PipelineState,
-    types,
-)
 
 if TYPE_CHECKING:
     from proto import Message

airflow/providers/google/cloud/utils/bigquery.py

@@ -27,16 +27,15 @@ def bq_cast(string_field: str, bq_type: str) -> None | int | float | bool | str:
     """
     if string_field is None:
         return None
-    elif bq_type == "INTEGER":
+    if bq_type == "INTEGER":
         return int(string_field)
-    elif bq_type in ("FLOAT", "TIMESTAMP"):
+    if bq_type in ("FLOAT", "TIMESTAMP"):
         return float(string_field)
-    elif bq_type == "BOOLEAN":
+    if bq_type == "BOOLEAN":
         if string_field not in ["true", "false"]:
             raise ValueError(f"{string_field} must have value 'true' or 'false'")
         return string_field == "true"
-    else:
-        return string_field
+    return string_field
 
 
 def convert_job_id(job_id: str | list[str], project_id: str, location: str | None) -> Any:
@@ -51,5 +50,4 @@ def convert_job_id(job_id: str | list[str], project_id: str, location: str | Non
     location = location or "US"
     if isinstance(job_id, list):
         return [f"{project_id}:{location}:{i}" for i in job_id]
-    else:
-        return f"{project_id}:{location}:{job_id}"
+    return f"{project_id}:{location}:{job_id}"

airflow/providers/google/cloud/utils/bigquery_get_data.py

@@ -23,9 +23,9 @@ from google.cloud.bigquery.table import Row, RowIterator
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
-    from logging import Logger
 
     from airflow.providers.google.cloud.hooks.bigquery import BigQueryHook
+    from airflow.sdk.types import Logger
 
 
 def bigquery_get_data(

airflow/providers/google/cloud/utils/credentials_provider.py

@@ -29,6 +29,10 @@ from urllib.parse import urlencode
 
 import google.auth
 import google.oauth2.service_account
+from google.auth import impersonated_credentials
+from google.auth.credentials import AnonymousCredentials, Credentials
+from google.auth.environment_vars import CREDENTIALS, LEGACY_PROJECT, PROJECT
+
 from airflow.exceptions import AirflowException
 from airflow.providers.google.cloud._internal_client.secret_manager_client import _SecretManagerClient
 from airflow.providers.google.cloud.utils.external_token_supplier import (
@@ -36,9 +40,6 @@ from airflow.providers.google.cloud.utils.external_token_supplier import (
 )
 from airflow.utils.log.logging_mixin import LoggingMixin
 from airflow.utils.process_utils import patch_environ
-from google.auth import impersonated_credentials  # type: ignore[attr-defined]
-from google.auth.credentials import AnonymousCredentials, Credentials
-from google.auth.environment_vars import CREDENTIALS, LEGACY_PROJECT, PROJECT
 
 log = logging.getLogger(__name__)
 

airflow/providers/google/cloud/utils/dataform.py

@@ -202,7 +202,7 @@ def make_initialization_workspace_flow(
 def define_default_location(region: str) -> DataformLocations:
     if "us" in region:
         return DataformLocations.US
-    elif "europe" in region:
+    if "europe" in region:
         return DataformLocations.EUROPE
 
     regions_mapping: Mapping[str, DataformLocations] = {}

airflow/providers/google/cloud/utils/external_token_supplier.py

@@ -22,7 +22,6 @@ from functools import wraps
 from typing import TYPE_CHECKING, Any
 
 import requests
-
 from google.auth.exceptions import RefreshError
 from google.auth.identity_pool import SubjectTokenSupplier
 

airflow/providers/google/cloud/utils/field_validator.py

@@ -134,8 +134,7 @@ Here are the guidelines that you should follow to make validation forward-compat
 from __future__ import annotations
 
 import re
-from collections.abc import Sequence
-from typing import Callable
+from collections.abc import Callable, Sequence
 
 from airflow.exceptions import AirflowException
 from airflow.utils.log.logging_mixin import LoggingMixin

airflow/providers/google/cloud/utils/validators.py

@@ -0,0 +1,43 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+import json
+from json import JSONDecodeError
+
+from wtforms.validators import ValidationError
+
+
+class ValidJson:
+    """
+    Validates data is valid JSON.
+
+    :param message:
+        Error message to raise in case of a validation error.
+    """
+
+    def __init__(self, message=None):
+        self.message = message
+
+    def __call__(self, form, field):
+        if field.data:
+            try:
+                json.loads(field.data)
+            except JSONDecodeError as ex:
+                message = self.message or f"JSON Validation Error: {ex}"
+                raise ValidationError(message=field.gettext(message.format(field.data)))

airflow/providers/google/common/auth_backend/google_openid.py

@@ -20,24 +20,36 @@
 from __future__ import annotations
 
 import logging
+from collections.abc import Callable
 from functools import wraps
-from typing import Callable, TypeVar, cast
+from typing import TypeVar, cast
 
-from flask import Response, current_app, request as flask_request  # type: ignore
-
-import google
 import google.auth.transport.requests
 import google.oauth2.id_token
-from airflow.configuration import conf
-from airflow.providers.google.common.utils.id_token_credentials import get_default_id_token_credentials
+
+try:
+    from flask import Response, current_app, request as flask_request
+except ImportError:
+    raise ImportError(
+        "Google requires FAB provider to be installed in order to use this auth backend. "
+        "Please install the FAB provider by running: "
+        "pip install apache-airflow-providers-google[fab]"
+    )
 from google.auth import exceptions
 from google.auth.transport.requests import AuthorizedSession
 from google.oauth2 import service_account
 
+from airflow.configuration import conf
+from airflow.exceptions import AirflowProviderDeprecationWarning
+from airflow.providers.google.common.deprecated import deprecated
+from airflow.providers.google.common.utils.id_token_credentials import get_default_id_token_credentials
+
 log = logging.getLogger(__name__)
 
 _GOOGLE_ISSUERS = ("accounts.google.com", "https://accounts.google.com")
-AUDIENCE = conf.get("api", "google_oauth2_audience")
+AUDIENCE = conf.get(
+    "api", "google_oauth2_audience", fallback="project-id-random-value.apps.googleusercontent.com"
+)
 
 
 def create_client_session():
@@ -52,6 +64,11 @@ def create_client_session():
     return AuthorizedSession(credentials=id_token_credentials)
 
 
+@deprecated(
+    planned_removal_release="apache-airflow-providers-google==15.0.0",
+    reason="Auth backends are not supported on Airflow 3, and this entire module will be removed",
+    category=AirflowProviderDeprecationWarning,
+)
 def init_app(_):
     """Initialize authentication."""
 
@@ -104,7 +121,7 @@ def _lookup_user(user_email: str):
 
 
 def _set_current_user(user):
-    current_app.appbuilder.sm.lm._update_request_context_with_user(user=user)  # type: ignore[attr-defined]
+    current_app.appbuilder.sm.lm._update_request_context_with_user(user=user)
 
 
 T = TypeVar("T", bound=Callable)
@@ -137,4 +154,4 @@ def requires_authentication(function: T):
 
         return function(*args, **kwargs)
 
-    return cast(T, decorated)
+    return cast("T", decorated)

airflow/providers/google/common/consts.py

@@ -16,9 +16,10 @@
 # under the License.
 from __future__ import annotations
 
-from airflow import version
 from google.api_core.gapic_v1.client_info import ClientInfo
 
+from airflow import version
+
 GOOGLE_DEFAULT_DEFERRABLE_METHOD_NAME = "execute_complete"
 
 CLIENT_INFO = ClientInfo(client_library_version="airflow_v" + version.version)

airflow/providers/google/common/deprecated.py

@@ -18,8 +18,9 @@ from __future__ import annotations
 
 import inspect
 import re
+from collections.abc import Callable
 from datetime import date, datetime
-from typing import Any, Callable
+from typing import Any
 
 from deprecated import deprecated as standard_deprecated
 from deprecated.classic import ClassicAdapter

airflow/providers/google/common/hooks/base_google.py

@@ -26,44 +26,39 @@ import json
 import logging
 import os
 import tempfile
-from collections.abc import Generator, Sequence
+from collections.abc import Callable, Generator, Sequence
 from contextlib import ExitStack, contextmanager
 from subprocess import check_output
-from typing import TYPE_CHECKING, Any, Callable, TypeVar, cast
+from typing import TYPE_CHECKING, Any, TypeVar, cast
 
+import google.auth
 import google_auth_httplib2
 import requests
 import tenacity
 from asgiref.sync import sync_to_async
 from gcloud.aio.auth.token import Token, TokenResponse
+from google.api_core.exceptions import Forbidden, ResourceExhausted, TooManyRequests
+from google.auth import _cloud_sdk, compute_engine
+from google.auth.environment_vars import CLOUD_SDK_CONFIG_DIR, CREDENTIALS
+from google.auth.exceptions import RefreshError
+from google.auth.transport import _http_client
 from googleapiclient import discovery
 from googleapiclient.errors import HttpError
 from googleapiclient.http import MediaIoBaseDownload, build_http, set_user_agent
 from requests import Session
 
-import google.auth
-import google.oauth2.service_account
 from airflow import version
-from airflow.exceptions import AirflowException, AirflowProviderDeprecationWarning
-from airflow.hooks.base import BaseHook
+from airflow.exceptions import AirflowException
+from airflow.providers.common.compat.sdk import BaseHook
 from airflow.providers.google.cloud.utils.credentials_provider import (
     _get_scopes,
     _get_target_principal_and_delegates,
     get_credentials_and_project_id,
 )
-from airflow.providers.google.common.consts import CLIENT_INFO
-from airflow.providers.google.common.deprecated import deprecated
 from airflow.utils.process_utils import patch_environ
-from google.api_core.exceptions import Forbidden, ResourceExhausted, TooManyRequests
-from google.auth import _cloud_sdk, compute_engine  # type: ignore[attr-defined]
-from google.auth.environment_vars import CLOUD_SDK_CONFIG_DIR, CREDENTIALS
-from google.auth.exceptions import RefreshError
-from google.auth.transport import _http_client
 
 if TYPE_CHECKING:
     from aiohttp import ClientSession
-
-    from google.api_core.gapic_v1.client_info import ClientInfo
     from google.auth.credentials import Credentials
 
 log = logging.getLogger(__name__)
@@ -154,13 +149,16 @@ class retry_if_temporary_refresh_credentials(tenacity.retry_if_exception):
 # This allows the 'project_id' argument to be of type str instead of str | None,
 # making it easier to type hint the function body without dealing with the None
 # case that can never happen at runtime.
-PROVIDE_PROJECT_ID: str = cast(str, None)
+PROVIDE_PROJECT_ID: str = cast("str", None)
 
 T = TypeVar("T", bound=Callable)
 RT = TypeVar("RT")
 
+# Sentinel value to distinguish "parameter not provided" from "parameter explicitly set to a value"
+_UNSET = object()
+
 
-def get_field(extras: dict, field_name: str):
+def get_field(extras: dict, field_name: str) -> str | None:
     """Get field from extra, first checking short name, then for backcompat we check for prefixed name."""
     if field_name.startswith("extra__"):
         raise ValueError(
@@ -168,9 +166,11 @@ def get_field(extras: dict, field_name: str):
             "when using this method."
         )
     if field_name in extras:
-        return extras[field_name] or None
+        value = extras[field_name]
+        return None if value == "" else value
     prefixed_name = f"extra__google_cloud_platform__{field_name}"
-    return extras.get(prefixed_name) or None
+    value = extras.get(prefixed_name)
+    return None if value == "" else value
 
 
 class GoogleBaseHook(BaseHook):
@@ -410,7 +410,22 @@ class GoogleBaseHook(BaseHook):
         custom UI elements to the hook page, which allow admins to specify
         service_account, key_path, etc. They get formatted as shown below.
         """
-        return hasattr(self, "extras") and get_field(self.extras, f) or default
+        # New behavior: If default is _UNSET, parameter was not provided
+        # Check connection extras first, return None if not found (caller handles default)
+        if default is _UNSET:
+            if hasattr(self, "extras"):
+                value = get_field(self.extras, f)
+                if value is not None:
+                    return value
+            return None
+
+        # Old behavior (for backward compatibility):
+        # Check connection extras, but properly handle False values
+        if hasattr(self, "extras"):
+            value = get_field(self.extras, f)
+            if value is not None:
+                return value
+        return default
 
     @property
     def project_id(self) -> str:
@@ -443,24 +458,6 @@ class GoogleBaseHook(BaseHook):
                 f"Please check the connection configuration."
             )
 
-    @property
-    @deprecated(
-        planned_removal_date="March 01, 2025",
-        use_instead="airflow.providers.google.common.consts.CLIENT_INFO",
-        category=AirflowProviderDeprecationWarning,
-    )
-    def client_info(self) -> ClientInfo:
-        """
-        Return client information used to generate a user-agent for API calls.
-
-        It allows for better errors tracking.
-
-        This object is only used by the google-cloud-* libraries that are built specifically for
-        the Google Cloud. It is not supported by The Google APIs Python Client that use Discovery
-        based APIs.
-        """
-        return CLIENT_INFO
-
     @property
     def scopes(self) -> Sequence[str]:
         """
@@ -500,7 +497,7 @@ class GoogleBaseHook(BaseHook):
                 "after": tenacity.after_log(log, logging.DEBUG),
             }
             default_kwargs.update(**kwargs)
-            return cast(T, tenacity.retry(*args, **default_kwargs)(func))
+            return cast("T", tenacity.retry(*args, **default_kwargs)(func))
 
         return decorator
 
@@ -518,7 +515,7 @@ class GoogleBaseHook(BaseHook):
                 "after": tenacity.after_log(log, logging.DEBUG),
             }
             default_kwargs.update(**kwargs)
-            return cast(T, tenacity.retry(*args, **default_kwargs)(func))
+            return cast("T", tenacity.retry(*args, **default_kwargs)(func))
 
         return decorator
 
@@ -570,7 +567,7 @@ class GoogleBaseHook(BaseHook):
             with self.provide_gcp_credential_file_as_context():
                 return func(self, *args, **kwargs)
 
-        return cast(T, wrapper)
+        return cast("T", wrapper)
 
     @contextmanager
     def provide_gcp_credential_file_as_context(self) -> Generator[str | None, None, None]:
@@ -719,7 +716,7 @@ class _CredentialsToken(Token):
         scopes: Sequence[str] | None = None,
     ) -> None:
         _scopes: list[str] | None = list(scopes) if scopes else None
-        super().__init__(session=cast(Session, session), scopes=_scopes)
+        super().__init__(session=cast("Session", session), scopes=_scopes)
         self.credentials = credentials
         self.project = project
 
@@ -744,7 +741,7 @@ class _CredentialsToken(Token):
     async def refresh(self, *, timeout: int) -> TokenResponse:
         await sync_to_async(self.credentials.refresh)(google.auth.transport.requests.Request())
 
-        self.access_token = cast(str, self.credentials.token)
+        self.access_token = cast("str", self.credentials.token)
         self.access_token_duration = 3600
         self.access_token_acquired_at = self._now()
         return TokenResponse(value=self.access_token, expires_in=self.access_token_duration)

airflow/providers/google/common/hooks/operation_helpers.py

@@ -0,0 +1,78 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""This module contains a helper class to work with `google.api_core.operation.Operation` object."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from google.api_core.exceptions import GoogleAPICallError
+
+from airflow.exceptions import AirflowException
+
+if TYPE_CHECKING:
+    from google.api_core.operation import Operation
+    from google.api_core.retry import Retry
+    from proto import Message
+
+
+class OperationHelper:
+    """Helper class to work with `operation.Operation` objects."""
+
+    @staticmethod
+    def wait_for_operation_result(
+        operation: Operation,
+        timeout: int | None = None,
+        polling: Retry | None = None,
+        retry: Retry | None = None,
+    ) -> Message:
+        """
+        Wait for long-lasting operation result to be retrieved.
+
+        For advance usage please check the docs on:
+        :class:`google.api_core.future.polling.PollingFuture`
+        :class:`google.api_core.retry.Retry`
+
+        :param operation: The initial operation to get result from.
+        :param timeout: How long (in seconds) to wait for the operation to complete.
+            If None, wait indefinitely. Overrides polling.timeout if both specified.
+        :param polling: How often and for how long to call polling RPC periodically.
+        :param retry: How to retry the operation polling if error occurs.
+        """
+        try:
+            return operation.result(timeout=timeout, polling=polling, retry=retry)
+        except GoogleAPICallError as ex:
+            raise AirflowException("Google API error on operation result call") from ex
+        except Exception:
+            error = operation.exception(timeout=timeout)
+            raise AirflowException(error)
+
+    def wait_for_operation(
+        self,
+        operation: Operation,
+        timeout: float | int | None = None,
+    ):
+        """
+        Legacy method name wrapper.
+
+        Intended to use with existing hooks/operators, until the proper deprecation and replacement provided.
+        """
+        if isinstance(timeout, float):
+            timeout = int(timeout)
+
+        return self.wait_for_operation_result(operation=operation, timeout=timeout)

airflow/providers/google/common/links/storage.py

@@ -18,18 +18,12 @@
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING
-
 from airflow.providers.google.cloud.links.base import BaseGoogleLink
 
 BASE_LINK = "https://console.cloud.google.com"
 GCS_STORAGE_LINK = BASE_LINK + "/storage/browser/{uri};tab=objects?project={project_id}"
 GCS_FILE_DETAILS_LINK = BASE_LINK + "/storage/browser/_details/{uri};tab=live_object?project={project_id}"
 
-if TYPE_CHECKING:
-    from airflow.models import BaseOperator
-    from airflow.utils.context import Context
-
 
 class StorageLink(BaseGoogleLink):
     """Helper class for constructing GCS Storage link."""
@@ -38,14 +32,6 @@ class StorageLink(BaseGoogleLink):
     key = "storage_conf"
     format_str = GCS_STORAGE_LINK
 
-    @staticmethod
-    def persist(context: Context, task_instance, uri: str, project_id: str | None):
-        task_instance.xcom_push(
-            context=context,
-            key=StorageLink.key,
-            value={"uri": uri, "project_id": project_id},
-        )
-
 
 class FileDetailsLink(BaseGoogleLink):
     """Helper class for constructing GCS file details link."""
@@ -53,11 +39,3 @@ class FileDetailsLink(BaseGoogleLink):
     name = "GCS File Details"
     key = "file_details"
     format_str = GCS_FILE_DETAILS_LINK
-
-    @staticmethod
-    def persist(context: Context, task_instance: BaseOperator, uri: str, project_id: str | None):
-        task_instance.xcom_push(
-            context=context,
-            key=FileDetailsLink.key,
-            value={"uri": uri, "project_id": project_id},
-        )

airflow/providers/google/common/utils/get_secret.py

@@ -0,0 +1,31 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from __future__ import annotations
+
+from google.cloud.exceptions import NotFound
+
+from airflow.providers.google.cloud.hooks.secret_manager import (
+    GoogleCloudSecretManagerHook,
+)
+
+
+def get_secret(secret_id: str) -> str:
+    hook = GoogleCloudSecretManagerHook()
+    if hook.secret_exists(secret_id=secret_id):
+        return hook.access_secret(secret_id=secret_id).payload.data.decode()
+    raise NotFound("The secret '%s' not found", secret_id)