bt-cred-resolver 0.1.0__tar.gz

bt_cred_resolver-0.1.0/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: bt-cred-resolver
+Version: 0.1.0
+Summary: Utility classes for miscellaneous functions
+Author-email: Bert Tejeda <berttejeda@gmail.com>
+Requires-Python: >=3.9
+Requires-Dist: keyring>=24.0.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
+Requires-Dist: pytest-mock>=3.11.1; extra == "dev"

bt_cred_resolver-0.1.0/README.md

@@ -0,0 +1,61 @@
+# bt-utils
+
+Utility classes for credential resolution and OS password management.
+
+## Installation
+
+```bash
+pip install -e .
+```
+
+For development:
+
+```bash
+pip install -e ".[dev]"
+```
+
+## Usage
+
+```python
+from bt_cred_resolver import CredentialResolver, RequiredCredentialMissingError
+
+# Initialize with optional logger
+resolver = CredentialResolver(logger=logger)
+
+# Resolve a credential from the OS password manager
+token = resolver.resolve_credential(
+    'JIRA_PERSONAL_ACCESS_TOKEN',
+    keyring_name='JIRA_PERSONAL_ACCESS_TOKEN',
+    required=True
+)
+
+# Or use the dict-based interface
+jira_url = resolver.resolve(
+    'JIRA_URL',
+    sources={'keyring': 'JIRA_URL'},
+    required=True
+)
+```
+
+You can also use `PasswordManager` directly:
+
+```python
+from bt_cred_resolver import PasswordManager
+
+pm = PasswordManager()
+
+# Store a password
+pm.store_password('MyService', 'username', 'secret_password')
+
+# Retrieve a password
+password = pm.retrieve_password('MyService', 'username')
+
+# Delete a password
+pm.delete_password('MyService', 'username')
+```
+
+## Running Tests
+
+```bash
+pytest
+```

bt_cred_resolver-0.1.0/bt_cred_resolver/__init__.py

@@ -0,0 +1,60 @@
+"""
+bt_cred_resolver provides utility classes for credential resolution and OS password management.
+"""
+from .credential_resolver import (
+    CredentialResolver,
+    CredentialResolverError,
+    RequiredCredentialMissingError,
+)
+from .password_manager import (
+    PasswordManager,
+    PasswordManagerError,
+    PasswordNotFoundError,
+    InvalidInputError,
+    StorageError,
+    RetrievalError,
+    DeletionError,
+)
+
+__all__ = [
+    "CredentialResolver",
+    "CredentialResolverError",
+    "RequiredCredentialMissingError",
+    "PasswordManager",
+    "PasswordManagerError",
+    "PasswordNotFoundError",
+    "InvalidInputError",
+    "StorageError",
+    "RetrievalError",
+    "DeletionError",
+    "__version__",
+]
+
+try:
+    from importlib.metadata import version, PackageNotFoundError
+except ImportError:
+    # Python < 3.8
+    try:
+        from importlib_metadata import version, PackageNotFoundError
+    except ImportError:
+        PackageNotFoundError = Exception
+        def version(package_name):
+            raise PackageNotFoundError
+
+try:
+    __version__ = version("bt-utils")
+except (PackageNotFoundError, Exception):
+    # Package not installed, fall back to reading from pyproject.toml
+    import re
+    from pathlib import Path
+
+    pyproject_path = Path(__file__).parent.parent / "pyproject.toml"
+    if pyproject_path.exists():
+        content = pyproject_path.read_text(encoding="utf-8")
+        match = re.search(r'version\s*=\s*["\']([^"\']+)["\']', content)
+        if match:
+            __version__ = match.group(1)
+        else:
+            __version__ = "0.0.0"
+    else:
+        __version__ = "0.0.0"

bt_cred_resolver-0.1.0/bt_cred_resolver/credential_resolver.py

@@ -0,0 +1,260 @@
+#!/usr/bin/env python3
+"""
+Credential Resolver Class
+Provides a unified interface for resolving credentials from multiple sources:
+1. OS Password Manager (lowest priority)
+
+This follows the DRY principle by centralizing credential resolution logic
+that was previously duplicated across multiple scripts.
+
+Usage:
+    from bt_cred_resolver import CredentialResolver
+    
+    # Initialize with optional logger
+    resolver = CredentialResolver(logger=logger)
+    
+    # Resolve a credential with automatic fallback
+    jira_url = resolver.resolve(
+        name='JIRA_URL',
+        sources={
+            'keyring': 'JIRA_URL'
+        },
+        required=True
+    )
+    
+    # Or use the simplified method for common patterns
+    token = resolver.resolve_credential(
+        'JIRA_PERSONAL_ACCESS_TOKEN',
+        keyring_name='JIRA_PERSONAL_ACCESS_TOKEN',
+        required=True
+    )
+"""
+
+import os
+from typing import Optional, Any, Dict
+from .password_manager import (
+    PasswordManager,
+    PasswordManagerError,
+    PasswordNotFoundError,
+    RetrievalError
+)
+
+
+class CredentialResolverError(Exception):
+    """Base exception for credential resolver errors."""
+    pass
+
+
+class RequiredCredentialMissingError(CredentialResolverError):
+    """Raised when a required credential cannot be resolved."""
+    pass
+
+
+class CredentialResolver:
+    """
+    Resolves credentials from multiple sources with automatic fallback.
+    
+    Attributes:
+        logger: Optional logger instance for logging resolution attempts.
+        password_manager: PasswordManager instance for keyring access.
+        password_manager_available: Boolean indicating if password manager is available.
+    """
+    
+    def __init__(self, logger=None):
+        """
+        Initialize the CredentialResolver.
+        
+        Args:
+            logger: Optional logger instance for logging. If None, logging is disabled.
+        """
+        self.logger = logger
+        self.password_manager = None
+        self.password_manager_available = False
+        
+        # Try to initialize password manager
+        try:
+            self.password_manager = PasswordManager()
+            self.password_manager_available = True
+            if self.logger:
+                self.logger.info('Password manager initialized successfully')
+        except Exception as e:
+            if self.logger:
+                self.logger.warning(f'Could not initialize password manager: {e}')
+    
+    def _log_info(self, message: str):
+        """Log info message if logger is available."""
+        if self.logger:
+            self.logger.info(message)
+    
+    def _log_debug(self, message: str):
+        """Log debug message if logger is available."""
+        if self.logger:
+            self.logger.debug(message)
+    
+    def _log_warning(self, message: str):
+        """Log warning message if logger is available."""
+        if self.logger:
+            self.logger.warning(message)
+    
+    def _retrieve_from_keyring(self, keyring_name: str) -> Optional[str]:
+        """
+        Retrieve a credential from the OS password manager.
+        
+        Args:
+            keyring_name: The service/username identifier in the keyring.
+        
+        Returns:
+            The credential if found, None otherwise.
+        """
+        if not self.password_manager_available:
+            return None
+        
+        try:
+            credential = self.password_manager.retrieve_password(keyring_name, keyring_name)
+            self._log_info(f"Retrieved {keyring_name} from OS Password Manager")
+            return credential
+        except PasswordNotFoundError as e:
+            self._log_debug(f"{keyring_name} not found in password manager")
+            return None
+        except RetrievalError as e:
+            self._log_warning(f"Failed password manager retrieval for {keyring_name}: {e}")
+            return None
+        except Exception as e:
+            self._log_warning(f"Unexpected error retrieving {keyring_name} from password manager: {e}")
+            return None
+
+    def resolve_credential(
+        self,
+        name: str,
+        keyring_name: Optional[str] = None,
+        required: bool = False,
+        default: Optional[Any] = None
+    ) -> Optional[Any]:
+        """
+        Resolve a credential from OS password manager with automatic fallback.
+        
+        Resolution order:
+        1. OS Password Manager keyring (if keyring_name provided)
+        2. Default value (if provided)
+        
+        Args:
+            name: Human-readable name of the credential (for error messages).
+            keyring_name: Name of keyring entry to check.
+            required: If True, raises an error if credential cannot be resolved.
+            default: Default value if credential cannot be resolved.
+        
+        Returns:
+            The resolved credential value, or None if not found and not required.
+        
+        Raises:
+            RequiredCredentialMissingError: If required=True and credential cannot be resolved.
+        
+        Example:
+            >>> resolver = CredentialResolver(logger=logger)
+            >>> jira_url = resolver.resolve_credential(
+            ...     'JIRA_URL',
+            ...     keyring_name='JIRA_URL',
+            ...     required=True
+            ... )
+        """
+        # Try each source in priority order
+        sources_tried = []
+        
+
+        # 4. Password manager keyring
+        if keyring_name:
+            keyring_value = self._retrieve_from_keyring(keyring_name)
+            if keyring_value is not None:
+                return keyring_value
+            sources_tried.append(f'password manager ({keyring_name})')
+        
+        # 5. Default value
+        if default is not None:
+            self._log_debug(f"Using default value for {name}")
+            return default
+        
+        # If we get here, credential was not found
+        if required:
+            sources_str = ', '.join(sources_tried)
+            error_msg = (
+                f"Could not determine {name} from {sources_str}. "
+                f"Please provide it via CLI argument, configuration file, "
+                f"environment variable, or password manager."
+            )
+            self._log_warning(error_msg)
+            raise RequiredCredentialMissingError(error_msg)
+        
+        return None
+    
+    def resolve(
+        self,
+        name: str,
+        sources: Dict[str, Any],
+        required: bool = False,
+        default: Optional[Any] = None
+    ) -> Optional[Any]:
+        """
+        Resolve a credential using a dictionary of sources.
+        
+        This is an alternative interface that uses a sources dictionary
+        instead of individual keyword arguments.
+        
+        Args:
+            name: Human-readable name of the credential.
+            sources: Dictionary with keys: 'keyring'.
+            required: If True, raises an error if credential cannot be resolved.
+            default: Default value if credential cannot be resolved.
+        
+        Returns:
+            The resolved credential value.
+        
+        Example:
+            >>> resolver.resolve(
+            ...     'JIRA_URL',
+            ...     sources={
+            ...         'keyring': 'JIRA_URL'
+            ...     },
+            ...     required=True
+            ... )
+        """
+        return self.resolve_credential(
+            name=name,
+            keyring_name=sources.get('keyring'),
+            required=required,
+            default=default
+        )
+    
+    def batch_resolve(
+        self,
+        credentials: Dict[str, Dict[str, Any]]
+    ) -> Dict[str, Any]:
+        """
+        Resolve multiple credentials at once.
+        
+        Args:
+            credentials: Dictionary where keys are credential names and values
+                        are dictionaries of resolution parameters.
+        
+        Returns:
+            Dictionary of resolved credentials.
+        
+        Example:
+            >>> resolved = resolver.batch_resolve({
+            ...     'jira_url': {
+            ...         'keyring_name': 'JIRA_URL',
+            ...         'required': True
+            ...     },
+            ...     'jira_token': {
+            ...         'keyring_name': 'JIRA_PERSONAL_ACCESS_TOKEN',
+            ...         'required': True
+            ...     }
+            ... })
+            >>> print(resolved['jira_url'])
+        """
+        results = {}
+        for cred_name, params in credentials.items():
+            results[cred_name] = self.resolve_credential(
+                name=cred_name,
+                **params
+            )
+        return results

bt_cred_resolver-0.1.0/bt_cred_resolver/password_manager.py

@@ -0,0 +1,327 @@
+#!/usr/bin/env python3
+"""
+Password Manager Class
+Secure password storage and retrieval using the OS's native password manager.
+Supports macOS (Darwin), Linux, and Windows platforms.
+
+Usage:
+    from bt_cred_resolver import PasswordManager
+    
+    pm = PasswordManager()
+    
+    # Store a password
+    pm.store_password('MyService', 'username', 'secret_password')
+    
+    # Retrieve a password
+    password = pm.retrieve_password('MyService', 'username')
+    
+    # Delete a password
+    pm.delete_password('MyService', 'username')
+"""
+
+import platform
+import keyring
+from typing import Optional, Dict
+
+
+class PasswordManagerError(Exception):
+    """Base exception for password manager errors."""
+    pass
+
+
+class InvalidInputError(PasswordManagerError):
+    """Raised when invalid input is provided."""
+    pass
+
+
+class PasswordNotFoundError(PasswordManagerError):
+    """Raised when a password is not found in the keyring."""
+    pass
+
+
+class StorageError(PasswordManagerError):
+    """Raised when there's an error storing a password."""
+    pass
+
+
+class RetrievalError(PasswordManagerError):
+    """Raised when there's an error retrieving a password."""
+    pass
+
+
+class DeletionError(PasswordManagerError):
+    """Raised when there's an error deleting a password."""
+    pass
+
+
+class PasswordManager:
+    """
+    Manages passwords using the operating system's native password manager.
+    
+    Attributes:
+        platform_name (str): The detected operating system name.
+        backend_name (str): The keyring backend being used.
+        manager_name (str): The name of the password manager in use.
+    """
+    
+    def __init__(self):
+        """Initialize the PasswordManager with platform detection."""
+        self.platform_name = self._detect_platform()
+        self.backend_name = self._get_keyring_backend()
+        self.manager_name = self._get_manager_name()
+    
+    @staticmethod
+    def _detect_platform() -> str:
+        """
+        Detect the operating system.
+        
+        Returns:
+            str: The platform name (macOS, Linux, or Windows).
+        """
+        system = platform.system()
+        platform_map = {
+            'Darwin': 'macOS',
+            'Linux': 'Linux',
+            'Windows': 'Windows'
+        }
+        return platform_map.get(system, system)
+    
+    @staticmethod
+    def _get_keyring_backend() -> str:
+        """
+        Get the current keyring backend name.
+        
+        Returns:
+            str: The keyring backend class name.
+        """
+        try:
+            backend = keyring.get_keyring()
+            return backend.__class__.__name__
+        except Exception as e:
+            return f"Unknown ({str(e)})"
+    
+    def _get_manager_name(self) -> str:
+        """
+        Get the name of the password manager based on the platform.
+        
+        Returns:
+            str: The password manager name.
+        """
+        system = platform.system()
+        manager_map = {
+            'Darwin': 'macOS Keychain',
+            'Windows': 'Windows Credential Manager',
+            'Linux': 'Secret Service (GNOME Keyring/KWallet)'
+        }
+        return manager_map.get(system, 'System Keyring')
+    
+    def _validate_input(self, service: str, username: str, 
+                       password: Optional[str] = None) -> None:
+        """
+        Validate input parameters.
+        
+        Args:
+            service: The service name.
+            username: The username.
+            password: The password (optional, only for storage).
+            
+        Raises:
+            InvalidInputError: If any required parameter is invalid.
+        """
+        if not service or not isinstance(service, str) or not service.strip():
+            raise InvalidInputError("Service name must be a non-empty string")
+        
+        if not username or not isinstance(username, str) or not username.strip():
+            raise InvalidInputError("Username must be a non-empty string")
+        
+        if password is not None:
+            if not isinstance(password, str) or not password:
+                raise InvalidInputError("Password must be a non-empty string")
+    
+    def store_password(self, service: str, username: str, password: str) -> Dict[str, str]:
+        """
+        Store a password in the OS password manager.
+        
+        Args:
+            service: The service name (e.g., 'MySQLDatabase', 'GitHubAPI').
+            username: The username/account name.
+            password: The password to store.
+            
+        Returns:
+            dict: A dictionary with storage confirmation details.
+            
+        Raises:
+            InvalidInputError: If any parameter is invalid.
+            StorageError: If there's an error storing the password.
+            
+        Example:
+            >>> pm = PasswordManager()
+            >>> result = pm.store_password('MyApp', 'user123', 'secret_pass')
+            >>> print(result['status'])
+            'success'
+        """
+        # Validate input
+        self._validate_input(service, username, password)
+        
+        try:
+            # Store the password
+            keyring.set_password(service, username, password)
+            
+            return {
+                'status': 'success',
+                'service': service,
+                'username': username,
+                'platform': self.platform_name,
+                'manager': self.manager_name,
+                'message': f'Password stored successfully in {self.manager_name}'
+            }
+            
+        except Exception as e:
+            raise StorageError(
+                f"Failed to store password for {username}@{service}: {str(e)}"
+            )
+    
+    def retrieve_password(self, service: str, username: str) -> str:
+        """
+        Retrieve a password from the OS password manager.
+        
+        Args:
+            service: The service name.
+            username: The username/account name.
+            
+        Returns:
+            str: The retrieved password.
+            
+        Raises:
+            InvalidInputError: If any parameter is invalid.
+            PasswordNotFoundError: If the password is not found.
+            RetrievalError: If there's an error retrieving the password.
+            
+        Example:
+            >>> pm = PasswordManager()
+            >>> password = pm.retrieve_password('MyApp', 'user123')
+            >>> print(password)
+            'secret_pass'
+        """
+        # Validate input
+        self._validate_input(service, username)
+        
+        try:
+            # Retrieve the password
+            password = keyring.get_password(service, username)
+            
+            if password is None:
+                raise PasswordNotFoundError(
+                    f"No password found for {username}@{service}. "
+                    f"Use store_password() to store it first."
+                )
+            
+            return password
+            
+        except PasswordNotFoundError:
+            # Re-raise our custom exception
+            raise
+        except Exception as e:
+            raise RetrievalError(
+                f"Failed to retrieve password for {username}@{service}: {str(e)}"
+            )
+    
+    def delete_password(self, service: str, username: str) -> Dict[str, str]:
+        """
+        Delete a password from the OS password manager.
+        
+        Args:
+            service: The service name.
+            username: The username/account name.
+            
+        Returns:
+            dict: A dictionary with deletion confirmation details.
+            
+        Raises:
+            InvalidInputError: If any parameter is invalid.
+            PasswordNotFoundError: If the password is not found.
+            DeletionError: If there's an error deleting the password.
+            
+        Example:
+            >>> pm = PasswordManager()
+            >>> result = pm.delete_password('MyApp', 'user123')
+            >>> print(result['status'])
+            'success'
+        """
+        # Validate input
+        self._validate_input(service, username)
+        
+        try:
+            # Check if password exists first
+            password = keyring.get_password(service, username)
+            if password is None:
+                raise PasswordNotFoundError(
+                    f"No password found for {username}@{service}"
+                )
+            
+            # Delete the password
+            keyring.delete_password(service, username)
+            
+            return {
+                'status': 'success',
+                'service': service,
+                'username': username,
+                'platform': self.platform_name,
+                'manager': self.manager_name,
+                'message': f'Password deleted successfully from {self.manager_name}'
+            }
+            
+        except PasswordNotFoundError:
+            # Re-raise our custom exception
+            raise
+        except Exception as e:
+            raise DeletionError(
+                f"Failed to delete password for {username}@{service}: {str(e)}"
+            )
+    
+    def password_exists(self, service: str, username: str) -> bool:
+        """
+        Check if a password exists in the OS password manager.
+        
+        Args:
+            service: The service name.
+            username: The username/account name.
+            
+        Returns:
+            bool: True if the password exists, False otherwise.
+            
+        Raises:
+            InvalidInputError: If any parameter is invalid.
+            
+        Example:
+            >>> pm = PasswordManager()
+            >>> if pm.password_exists('MyApp', 'user123'):
+            ...     print("Password exists")
+        """
+        # Validate input
+        self._validate_input(service, username)
+        
+        try:
+            password = keyring.get_password(service, username)
+            return password is not None
+        except Exception:
+            return False
+    
+    def get_info(self) -> Dict[str, str]:
+        """
+        Get information about the password manager configuration.
+        
+        Returns:
+            dict: A dictionary with platform and backend information.
+            
+        Example:
+            >>> pm = PasswordManager()
+            >>> info = pm.get_info()
+            >>> print(info['platform'])
+            'macOS'
+        """
+        return {
+            'platform': self.platform_name,
+            'backend': self.backend_name,
+            'manager': self.manager_name
+        }

bt_cred_resolver-0.1.0/bt_cred_resolver.egg-info/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: bt-cred-resolver
+Version: 0.1.0
+Summary: Utility classes for miscellaneous functions
+Author-email: Bert Tejeda <berttejeda@gmail.com>
+Requires-Python: >=3.9
+Requires-Dist: keyring>=24.0.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
+Requires-Dist: pytest-mock>=3.11.1; extra == "dev"

bt_cred_resolver-0.1.0/bt_cred_resolver.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+setup.py
+bt_cred_resolver/__init__.py
+bt_cred_resolver/credential_resolver.py
+bt_cred_resolver/password_manager.py
+bt_cred_resolver.egg-info/PKG-INFO
+bt_cred_resolver.egg-info/SOURCES.txt
+bt_cred_resolver.egg-info/dependency_links.txt
+bt_cred_resolver.egg-info/requires.txt
+bt_cred_resolver.egg-info/top_level.txt
+tests/test_credential_resolver.py

bt_cred_resolver-0.1.0/bt_cred_resolver.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

bt_cred_resolver-0.1.0/bt_cred_resolver.egg-info/requires.txt

@@ -0,0 +1,6 @@
+keyring>=24.0.0
+
+[dev]
+pytest>=7.4.0
+pytest-cov>=4.1.0
+pytest-mock>=3.11.1

bt_cred_resolver-0.1.0/bt_cred_resolver.egg-info/top_level.txt

@@ -0,0 +1 @@
+bt_cred_resolver

bt_cred_resolver-0.1.0/pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "bt-cred-resolver"
+version = "0.1.0"
+description = "Utility classes for miscellaneous functions"
+requires-python = ">=3.9"
+authors = [{ name = "Bert Tejeda", email = "berttejeda@gmail.com" }]
+dependencies = [
+    "keyring>=24.0.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.4.0",
+    "pytest-cov>=4.1.0",
+    "pytest-mock>=3.11.1",
+]
+
+[tool.setuptools]
+packages = ["bt_cred_resolver"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = ["test_*.py"]
+python_classes = ["Test*"]
+python_functions = ["test_*"]
+addopts = [
+    "-v",
+    "--strict-markers",
+    "--tb=short",
+]
+markers = [
+    "unit: Unit tests",
+    "integration: Integration tests",
+]

bt_cred_resolver-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

bt_cred_resolver-0.1.0/setup.py

@@ -0,0 +1,9 @@
+"""Setup script for bt-utils package.
+
+This is a minimal setup.py that allows using traditional build commands.
+The actual package configuration is in pyproject.toml.
+"""
+from setuptools import setup
+
+# setuptools will automatically read from pyproject.toml
+setup()

bt_cred_resolver-0.1.0/tests/test_credential_resolver.py

@@ -0,0 +1,74 @@
+"""Tests for the CredentialResolver class."""
+import pytest
+from unittest.mock import MagicMock, patch
+
+from bt_cred_resolver import (
+    CredentialResolver,
+    RequiredCredentialMissingError,
+    PasswordManager,
+    PasswordNotFoundError,
+)
+
+
+@pytest.fixture
+def mock_logger():
+    """Create a mock logger."""
+    logger = MagicMock()
+    return logger
+
+
+@pytest.fixture
+def resolver(mock_logger):
+    """Create a CredentialResolver with mocked password manager."""
+    with patch.object(PasswordManager, '__init__', return_value=None):
+        r = CredentialResolver(logger=mock_logger)
+        r.password_manager = MagicMock(spec=PasswordManager)
+        r.password_manager_available = True
+        return r
+
+
+class TestCredentialResolver:
+    """Tests for CredentialResolver."""
+
+    def test_resolve_from_keyring(self, resolver):
+        resolver.password_manager.retrieve_password.return_value = "secret_value"
+        result = resolver.resolve_credential("MY_CRED", keyring_name="MY_CRED")
+        assert result == "secret_value"
+
+    def test_resolve_fallback_to_default(self, resolver):
+        resolver.password_manager.retrieve_password.side_effect = PasswordNotFoundError("nope")
+        result = resolver.resolve_credential(
+            "MY_CRED", keyring_name="MY_CRED", default="fallback"
+        )
+        assert result == "fallback"
+
+    def test_resolve_required_raises(self, resolver):
+        resolver.password_manager.retrieve_password.side_effect = PasswordNotFoundError("nope")
+        with pytest.raises(RequiredCredentialMissingError):
+            resolver.resolve_credential("MY_CRED", keyring_name="MY_CRED", required=True)
+
+    def test_resolve_returns_none_when_not_required(self, resolver):
+        resolver.password_manager.retrieve_password.side_effect = PasswordNotFoundError("nope")
+        result = resolver.resolve_credential("MY_CRED", keyring_name="MY_CRED")
+        assert result is None
+
+    def test_resolve_dict_interface(self, resolver):
+        resolver.password_manager.retrieve_password.return_value = "val"
+        result = resolver.resolve("MY_CRED", sources={"keyring": "MY_CRED"})
+        assert result == "val"
+
+    def test_batch_resolve(self, resolver):
+        resolver.password_manager.retrieve_password.return_value = "val"
+        results = resolver.batch_resolve({
+            "cred_a": {"keyring_name": "CRED_A"},
+            "cred_b": {"keyring_name": "CRED_B"},
+        })
+        assert results["cred_a"] == "val"
+        assert results["cred_b"] == "val"
+
+    def test_password_manager_unavailable(self, mock_logger):
+        with patch.object(PasswordManager, '__init__', side_effect=Exception("no backend")):
+            r = CredentialResolver(logger=mock_logger)
+        assert r.password_manager_available is False
+        result = r.resolve_credential("MY_CRED", keyring_name="MY_CRED")
+        assert result is None