certifyclouds 1.2.0__py3-none-any.whl

cc_scanner/scanner.py

@@ -0,0 +1,558 @@
+"""Core Azure Key Vault scanning logic.
+
+Extracted from the CertifyClouds backend discovery service. This module contains
+the pure scanning logic with all database, caching, and settings dependencies removed.
+It authenticates via Azure CLI or DefaultAzureCredential and enumerates subscriptions,
+Key Vaults, and their secrets/certificates/keys.
+"""
+from __future__ import annotations
+
+import concurrent.futures
+import logging
+import os
+from datetime import datetime, timezone
+from typing import Any, Callable
+
+from tenacity import retry, retry_if_exception_type, stop_after_attempt, wait_exponential
+
+from .thumbprint import normalize_thumbprint
+
+try:
+    from azure.core.exceptions import AzureError  # type: ignore
+    from azure.identity import AzureCliCredential, DefaultAzureCredential  # type: ignore
+    from azure.keyvault.certificates import CertificateClient  # type: ignore
+    from azure.keyvault.keys import KeyClient  # type: ignore
+    from azure.keyvault.secrets import SecretClient  # type: ignore
+    from azure.mgmt.keyvault import KeyVaultManagementClient  # type: ignore
+    from azure.mgmt.resource import SubscriptionClient  # type: ignore
+
+    AZURE_SDK_AVAILABLE = True
+except ImportError:
+    DefaultAzureCredential = None  # type: ignore
+    AzureCliCredential = None  # type: ignore
+    SubscriptionClient = None  # type: ignore
+    KeyVaultManagementClient = None  # type: ignore
+    SecretClient = None  # type: ignore
+    CertificateClient = None  # type: ignore
+    KeyClient = None  # type: ignore
+    AzureError = Exception  # type: ignore
+
+    AZURE_SDK_AVAILABLE = False
+
+logger = logging.getLogger(__name__)
+
+
+def _utc_now() -> datetime:
+    """Return current UTC time (timezone-aware, Python 3.9 compatible)."""
+    return datetime.now(timezone.utc)
+
+
+def _get_azure_credential(auth_method: str = "cli") -> Any:
+    """Get the appropriate Azure credential.
+
+    Args:
+        auth_method: "cli" for AzureCliCredential, "default" for DefaultAzureCredential
+    """
+    if auth_method == "cli" and AzureCliCredential is not None:
+        logger.debug("Using AzureCliCredential")
+        return AzureCliCredential()
+    else:
+        logger.debug("Using DefaultAzureCredential")
+        return DefaultAzureCredential(exclude_interactive_browser_credential=True)
+
+
+def _azure_retry_decorator(
+    max_retries: int = 1,
+    retry_wait_min: int = 1,
+    retry_wait_max: int = 2,
+) -> Callable[[Callable], Callable]:
+    """Retry decorator for Azure API calls on transient failures."""
+    total_attempts = 1 + max_retries
+    retryable_exceptions = (AzureError, TimeoutError, ConnectionError, OSError)
+
+    return retry(
+        retry=retry_if_exception_type(retryable_exceptions),
+        stop=stop_after_attempt(total_attempts),
+        wait=wait_exponential(multiplier=1, min=retry_wait_min, max=retry_wait_max),
+        before_sleep=lambda retry_state: logger.warning(
+            "Azure API call failed, retrying... (attempt %s/%s)",
+            retry_state.attempt_number,
+            total_attempts,
+        ),
+        reraise=True,
+    )
+
+
+def _log_azure_object_details(obj: Any, label: str, max_depth: int = 2) -> None:
+    """Log details about an Azure SDK object for debugging.
+
+    Only runs when AZURE_SDK_DEBUG=true environment variable is set.
+    """
+    if os.getenv("AZURE_SDK_DEBUG", "").lower() not in ("1", "true", "yes"):
+        return
+
+    if not obj:
+        logger.debug("[AZURE-SDK] %s: None", label)
+        return
+
+    attrs = {}
+    for attr_name in dir(obj):
+        if attr_name.startswith("_"):
+            continue
+        try:
+            value = getattr(obj, attr_name)
+            if callable(value):
+                continue
+
+            type_name = type(value).__name__
+            module = type(value).__module__ if hasattr(type(value), "__module__") else ""
+
+            if value is None:
+                formatted_value = "None"
+            elif isinstance(value, bytes):
+                formatted_value = f"bytes[{len(value)}] = {value.hex()[:32]}..."
+            elif isinstance(value, (list, tuple)):
+                formatted_value = f"{type_name}[{len(value)}] = {value[:3]}..." if len(value) > 3 else str(value)
+            elif isinstance(value, dict):
+                formatted_value = f"dict[{len(value)}] = {dict(list(value.items())[:3])}..." if len(value) > 3 else str(value)
+            elif isinstance(value, datetime):
+                formatted_value = value.isoformat()
+            elif hasattr(value, "value"):
+                formatted_value = f"{type_name}.{value.name if hasattr(value, 'name') else ''} = {value.value}"
+            elif max_depth > 0 and "azure" in str(module).lower():
+                formatted_value = f"<{type_name}> (nested Azure object)"
+            else:
+                formatted_value = str(value)[:100] if len(str(value)) > 100 else str(value)
+
+            attrs[attr_name] = {"type": f"{module}.{type_name}" if module and module != "builtins" else type_name, "value": formatted_value}
+        except Exception as e:
+            attrs[attr_name] = {"type": "error", "value": f"Error accessing: {str(e)[:50]}"}
+
+    logger.debug("[AZURE-SDK] %s (%s): attributes=%s", label, type(obj).__name__, list(attrs.keys()))
+    for attr_name, info in sorted(attrs.items()):
+        logger.debug("[AZURE-SDK]   .%s [%s] = %s", attr_name, info["type"], info["value"])
+
+
+def scan(
+    auth_method: str = "cli",
+    subscription_filter: list[str] | None = None,
+    vault_filter: list[str] | None = None,
+    max_workers: int = 5,
+    timeout: int = 300,
+    progress_callback: Callable[[str], None] | None = None,
+) -> dict[str, Any]:
+    """Scan Azure Key Vaults across subscriptions.
+
+    Args:
+        auth_method: "cli" for Azure CLI, "default" for DefaultAzureCredential
+        subscription_filter: List of subscription IDs to scan (None = all)
+        vault_filter: List of vault names to scan (None = all)
+        max_workers: Number of parallel scan workers
+        timeout: Total scan timeout in seconds
+        progress_callback: Optional callback for progress updates
+
+    Returns:
+        Dict with scan results: subscriptions, vaults, secrets, certificates, keys, errors
+    """
+    if not AZURE_SDK_AVAILABLE:
+        logger.error("Azure SDK not installed")
+        return {
+            "scannedAt": _utc_now().isoformat(),
+            "subscriptions": [],
+            "totalVaults": 0,
+            "totalSecrets": 0,
+            "totalCertificates": 0,
+            "totalKeys": 0,
+            "vaultsWithErrors": 0,
+            "error": "Azure SDK not installed. Run: pip install --force-reinstall cc-scanner",
+        }
+
+    try:
+        credential = _get_azure_credential(auth_method)
+        sub_client = SubscriptionClient(credential)
+
+        results: dict[str, Any] = {
+            "scannedAt": _utc_now().isoformat(),
+            "subscriptions": [],
+            "totalVaults": 0,
+            "totalSecrets": 0,
+            "totalCertificates": 0,
+            "totalKeys": 0,
+            "vaultsWithErrors": 0,
+            "errors": [],
+        }
+
+        # Build subscription filter set from CLI args
+        allowed_set = set(subscription_filter) if subscription_filter else None
+
+        # Discover subscriptions
+        if progress_callback:
+            progress_callback("Discovering subscriptions...")
+        discovered = list(sub_client.subscriptions.list())
+
+        if allowed_set:
+            subs_to_scan = [s for s in discovered if s.subscription_id in allowed_set]
+            if not subs_to_scan:
+                logger.warning("No discovered subscriptions matched filter; scanning none")
+        else:
+            subs_to_scan = discovered
+
+        logger.info("Found %s subscription(s) to scan", len(subs_to_scan))
+
+        # Normalize vault filter names for comparison (lowercase)
+        vault_filter_set = None
+        if vault_filter:
+            vault_filter_set = {name.lower() for name in vault_filter}
+            logger.info("Vault filter active: scanning only %s specific vault(s)", len(vault_filter_set))
+
+        retry_decorator = _azure_retry_decorator()
+
+        def scan_subscription(sub):
+            """Scan a single subscription for vaults and their contents."""
+            sub_id = sub.subscription_id
+            sub_name = getattr(sub, "display_name", sub_id)
+            logger.debug("Scanning subscription %s (%s)", sub_name, sub_id)
+
+            if progress_callback:
+                progress_callback(f"Scanning {sub_name}...")
+
+            sub_entry = {"id": sub_id, "name": sub_name, "vaults": []}
+
+            try:
+                vault_client = KeyVaultManagementClient(credential, sub_id)
+            except Exception as exc:
+                logger.error("Failed to create KeyVaultManagementClient for %s: %s", sub_id, exc)
+                return sub_entry
+
+            @retry_decorator
+            def list_vaults_with_retry():
+                return list(vault_client.vaults.list())
+
+            try:
+                vaults = list_vaults_with_retry()
+            except Exception as exc:
+                logger.error("Failed to list vaults for subscription %s: %s", sub_id, exc)
+                return sub_entry
+
+            # Filter vaults by name if specified
+            if vault_filter_set:
+                vaults = [v for v in vaults if getattr(v, "name", "").lower() in vault_filter_set]
+
+            for vault in vaults:
+                vault_name = getattr(vault, "name", None)
+                vault_uri = f"https://{vault_name}.vault.azure.net/" if vault_name else None
+                logger.debug("Scanning Key Vault %s", vault_name)
+
+                # Extract resource group from ARM resource ID
+                vault_resource_group = None
+                vault_id = getattr(vault, "id", None)
+                if vault_id:
+                    try:
+                        id_lower = vault_id.lower()
+                        rg_start = id_lower.find("/resourcegroups/")
+                        if rg_start != -1:
+                            rg_start += len("/resourcegroups/")
+                            rg_end = vault_id.find("/", rg_start)
+                            if rg_end != -1:
+                                vault_resource_group = vault_id[rg_start:rg_end]
+                    except (AttributeError, IndexError):
+                        pass
+
+                vault_props = getattr(vault, "properties", None)
+                vault_entry = {
+                    "name": vault_name,
+                    "uri": vault_uri,
+                    "location": getattr(vault, "location", None),
+                    "resource_group": vault_resource_group,
+                    "secrets": [],
+                    "certificates": [],
+                    "keys": [],
+                    "error": None,
+                    "soft_delete_enabled": getattr(vault_props, "enable_soft_delete", None) if vault_props else None,
+                    "purge_protection_enabled": getattr(vault_props, "enable_purge_protection", None) if vault_props else None,
+                    "public_network_access": getattr(vault_props, "public_network_access", None) if vault_props else None,
+                    "rbac_enabled": getattr(vault_props, "enable_rbac_authorization", None) if vault_props else None,
+                    "sku": getattr(vault_props.sku, "name", None) if vault_props and hasattr(vault_props, "sku") and vault_props.sku else None,
+                }
+
+                try:
+                    # --- SECRETS ---
+                    secret_client = SecretClient(vault_url=vault_uri, credential=credential, verify_challenge_resource=False)
+
+                    @retry_decorator
+                    def list_secrets_with_retry(client=secret_client):
+                        return list(client.list_properties_of_secrets())
+
+                    try:
+                        secret_properties = list_secrets_with_retry()
+                        for prop in secret_properties:
+                            _log_azure_object_details(prop, f"SecretProperties {vault_name}/{prop.name}")
+
+                            # Filter out disk encryption keys
+                            content_type = getattr(prop, "content_type", "") or ""
+                            if "BEK" in content_type or "Wrapped BEK" in content_type:
+                                logger.debug("Skipping disk encryption key: %s", prop.name)
+                                continue
+
+                            # Extract version from ID URL
+                            version = getattr(prop, "version", None)
+                            if not version and hasattr(prop, "id") and prop.id:
+                                try:
+                                    parts = prop.id.rstrip("/").split("/")
+                                    if len(parts) >= 6:
+                                        version = parts[-1]
+                                except (AttributeError, IndexError):
+                                    version = None
+
+                            secret_details = {
+                                "item_type": "secret",
+                                "name": prop.name,
+                                "version": version,
+                                "enabled": getattr(prop, "enabled", None),
+                                "expiresOn": prop.expires_on.isoformat() if getattr(prop, "expires_on", None) else None,
+                                "createdOn": prop.created_on.isoformat() if getattr(prop, "created_on", None) else None,
+                                "updatedOn": prop.updated_on.isoformat() if getattr(prop, "updated_on", None) else None,
+                                "notBefore": prop.not_before.isoformat() if getattr(prop, "not_before", None) else None,
+                                "contentType": content_type,
+                                "tags": prop.tags or {},
+                                "managed": getattr(prop, "managed", None),
+                                "keyId": getattr(prop, "key_id", None),
+                                "recoverableDays": getattr(prop, "recoverable_days", None),
+                                "recoveryLevel": str(prop.recovery_level.value) if hasattr(prop, "recovery_level") and prop.recovery_level and hasattr(prop.recovery_level, "value") else None,
+                            }
+                            vault_entry["secrets"].append(secret_details)
+                    except AzureError as exc:
+                        cause = str(exc).lower()
+                        if "forbiddenbyfirewall" in cause or "client address is not authorized" in cause or "firewall" in cause:
+                            error_msg = "Firewall restriction"
+                            logger.warning("Access denied to secrets in %s: firewall restriction", vault_name)
+                        elif "forbidden" in cause or "access denied" in cause or "unauthorized" in cause:
+                            error_msg = "Access denied (check RBAC permissions)"
+                            logger.warning("Access denied to secrets in %s: RBAC restriction", vault_name)
+                        else:
+                            error_msg = f"Error: {str(exc)[:100]}"
+                            logger.error("Failed to list secrets from %s: %s", vault_name, exc)
+                        vault_entry["error"] = error_msg
+                        results["errors"].append(f"{vault_name}: {error_msg}")
+
+                    # --- CERTIFICATES ---
+                    certificate_names: set[str] = set()
+
+                    if CertificateClient is not None:
+                        try:
+                            cert_client = CertificateClient(vault_url=vault_uri, credential=credential, verify_challenge_resource=False)
+
+                            @retry_decorator
+                            def list_certificates_with_retry(client=cert_client):
+                                return list(client.list_properties_of_certificates())
+
+                            try:
+                                cert_properties = list_certificates_with_retry()
+                                for cert_prop in cert_properties:
+                                    try:
+                                        cert = cert_client.get_certificate(cert_prop.name)
+
+                                        _log_azure_object_details(cert, f"Certificate {vault_name}/{cert_prop.name}")
+                                        _log_azure_object_details(cert.properties if cert else None, f"Certificate.properties {vault_name}/{cert_prop.name}")
+                                        _log_azure_object_details(cert.policy if cert else None, f"Certificate.policy {vault_name}/{cert_prop.name}")
+
+                                        cert_version = getattr(cert.properties, "version", None)
+                                        if not cert_version and hasattr(cert, "id") and cert.id:
+                                            try:
+                                                parts = cert.id.rstrip("/").split("/")
+                                                if len(parts) >= 6:
+                                                    cert_version = parts[-1]
+                                            except (AttributeError, IndexError):
+                                                cert_version = None
+
+                                        cert_details: dict[str, Any] = {
+                                            "item_type": "certificate",
+                                            "name": cert.name,
+                                            "version": cert_version,
+                                            "enabled": cert.properties.enabled,
+                                            "expiresOn": cert.properties.expires_on.isoformat() if cert.properties.expires_on else None,
+                                            "createdOn": cert.properties.created_on.isoformat() if cert.properties.created_on else None,
+                                            "updatedOn": cert.properties.updated_on.isoformat() if cert.properties.updated_on else None,
+                                            "notBefore": cert.properties.not_before.isoformat() if cert.properties.not_before else None,
+                                            "tags": cert.properties.tags or {},
+                                            "recoverableDays": getattr(cert.properties, "recoverable_days", None),
+                                            "recoveryLevel": str(cert.properties.recovery_level.value) if hasattr(cert.properties, "recovery_level") and cert.properties.recovery_level and hasattr(cert.properties.recovery_level, "value") else None,
+                                        }
+
+                                        if cert.policy:
+                                            cert_details["cert_subject"] = cert.policy.subject if cert.policy.subject else None
+                                            cert_details["cert_issuer"] = cert.policy.issuer_name if cert.policy.issuer_name else None
+
+                                            if cert.policy.key_type:
+                                                key_type = cert.policy.key_type
+                                                cert_details["cert_key_type"] = str(key_type.value) if hasattr(key_type, "value") else str(key_type)
+                                            else:
+                                                cert_details["cert_key_type"] = None
+
+                                            cert_details["cert_key_size"] = cert.policy.key_size if cert.policy.key_size else None
+
+                                            if cert.policy.content_type:
+                                                ct = cert.policy.content_type
+                                                cert_details["contentType"] = str(ct.value) if hasattr(ct, "value") else str(ct)
+
+                                            cert_details["validityInMonths"] = cert.policy.validity_in_months if hasattr(cert.policy, "validity_in_months") else None
+                                            cert_details["exportable"] = cert.policy.exportable if hasattr(cert.policy, "exportable") else None
+
+                                            if hasattr(cert.policy, "san_dns_names") and cert.policy.san_dns_names:
+                                                cert_details["cert_san"] = cert.policy.san_dns_names
+                                            else:
+                                                cert_details["cert_san"] = []
+
+                                            if hasattr(cert.policy, "key_usage") and cert.policy.key_usage:
+                                                cert_details["keyUsage"] = [
+                                                    str(ku.value) if hasattr(ku, "value") else str(ku) for ku in cert.policy.key_usage
+                                                ]
+
+                                            if hasattr(cert.policy, "enhanced_key_usage") and cert.policy.enhanced_key_usage:
+                                                cert_details["enhancedKeyUsage"] = cert.policy.enhanced_key_usage
+
+                                        # Normalized thumbprint
+                                        if cert.properties.x509_thumbprint:
+                                            cert_details["cert_thumbprint"] = normalize_thumbprint(cert.properties.x509_thumbprint)
+                                        else:
+                                            cert_details["cert_thumbprint"] = None
+
+                                        # Self-signed detection
+                                        if cert.policy and cert.policy.issuer_name and cert.policy.subject:
+                                            cert_details["cert_is_self_signed"] = cert.policy.issuer_name.lower() == "self"
+                                        else:
+                                            cert_details["cert_is_self_signed"] = None
+
+                                        vault_entry["certificates"].append(cert_details)
+                                        certificate_names.add(cert.name.lower())
+                                    except Exception as cert_exc:
+                                        logger.debug("Failed to get certificate details for %s: %s", cert_prop.name, cert_exc)
+                                        fallback_version = getattr(cert_prop, "version", None)
+                                        if not fallback_version and hasattr(cert_prop, "id") and cert_prop.id:
+                                            try:
+                                                parts = cert_prop.id.rstrip("/").split("/")
+                                                if len(parts) >= 6:
+                                                    fallback_version = parts[-1]
+                                            except (AttributeError, IndexError):
+                                                fallback_version = None
+                                        vault_entry["certificates"].append({
+                                            "item_type": "certificate",
+                                            "name": cert_prop.name,
+                                            "version": fallback_version,
+                                            "enabled": cert_prop.enabled,
+                                            "expiresOn": cert_prop.expires_on.isoformat() if cert_prop.expires_on else None,
+                                            "tags": cert_prop.tags or {},
+                                        })
+                                        certificate_names.add(cert_prop.name.lower())
+                            except AzureError as exc:
+                                logger.debug("Failed to list certificates from %s: %s", vault_name, exc)
+                        except Exception as exc:
+                            logger.debug("Failed to create CertificateClient for %s: %s", vault_name, exc)
+
+                    # --- KEYS ---
+                    if KeyClient is not None:
+                        try:
+                            key_client = KeyClient(vault_url=vault_uri, credential=credential, verify_challenge_resource=False)
+
+                            @retry_decorator
+                            def list_keys_with_retry(client=key_client):
+                                return list(client.list_properties_of_keys())
+
+                            try:
+                                key_properties = list_keys_with_retry()
+                                for key_prop in key_properties:
+                                    _log_azure_object_details(key_prop, f"KeyProperties {vault_name}/{key_prop.name}")
+
+                                    key_version = getattr(key_prop, "version", None)
+                                    if not key_version and hasattr(key_prop, "id") and key_prop.id:
+                                        try:
+                                            parts = key_prop.id.rstrip("/").split("/")
+                                            if len(parts) >= 6:
+                                                key_version = parts[-1]
+                                        except (AttributeError, IndexError):
+                                            key_version = None
+
+                                    key_details: dict[str, Any] = {
+                                        "item_type": "key",
+                                        "name": key_prop.name,
+                                        "version": key_version,
+                                        "enabled": key_prop.enabled,
+                                        "expiresOn": key_prop.expires_on.isoformat() if key_prop.expires_on else None,
+                                        "createdOn": key_prop.created_on.isoformat() if getattr(key_prop, "created_on", None) else None,
+                                        "updatedOn": key_prop.updated_on.isoformat() if getattr(key_prop, "updated_on", None) else None,
+                                        "notBefore": key_prop.not_before.isoformat() if getattr(key_prop, "not_before", None) else None,
+                                        "tags": key_prop.tags or {},
+                                        "managed": getattr(key_prop, "managed", None),
+                                        "recoverableDays": getattr(key_prop, "recoverable_days", None),
+                                        "recoveryLevel": str(key_prop.recovery_level.value) if hasattr(key_prop, "recovery_level") and key_prop.recovery_level and hasattr(key_prop.recovery_level, "value") else None,
+                                        "exportable": getattr(key_prop, "exportable", None),
+                                        "hsmPlatform": getattr(key_prop, "hsm_platform", None),
+                                    }
+
+                                    if hasattr(key_prop, "key_type") and key_prop.key_type:
+                                        kt = key_prop.key_type
+                                        key_details["key_type"] = str(kt.value) if hasattr(kt, "value") else str(kt)
+                                    else:
+                                        key_details["key_type"] = None
+
+                                    vault_entry["keys"].append(key_details)
+                            except AzureError as exc:
+                                logger.debug("Failed to list keys from %s: %s", vault_name, exc)
+                        except Exception as exc:
+                            logger.debug("Failed to create KeyClient for %s: %s", vault_name, exc)
+
+                    # Filter out certificate-backed secrets (Azure creates a backing secret for each cert)
+                    if certificate_names:
+                        original_count = len(vault_entry["secrets"])
+                        vault_entry["secrets"] = [
+                            s for s in vault_entry["secrets"] if s["name"].lower() not in certificate_names
+                        ]
+                        filtered_count = original_count - len(vault_entry["secrets"])
+                        if filtered_count > 0:
+                            logger.debug("Filtered %s certificate-backed secrets from %s", filtered_count, vault_name)
+
+                except Exception as exc:
+                    error_msg = f"Failed to connect: {str(exc)[:100]}"
+                    logger.error("Failed to create SecretClient for %s: %s", vault_name, exc)
+                    vault_entry["error"] = error_msg
+                    results["errors"].append(f"{vault_name}: {error_msg}")
+
+                sub_entry["vaults"].append(vault_entry)
+
+            return sub_entry
+
+        # Execute subscription scans in parallel
+        worker_count = min(max_workers, len(subs_to_scan)) if subs_to_scan else 1
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=worker_count) as executor:
+            future_to_sub = {executor.submit(scan_subscription, sub): sub for sub in subs_to_scan}
+
+            for future in concurrent.futures.as_completed(future_to_sub, timeout=timeout):
+                try:
+                    sub_entry = future.result()
+                    results["subscriptions"].append(sub_entry)
+                    results["totalVaults"] += len(sub_entry["vaults"])
+                    for vault in sub_entry["vaults"]:
+                        results["totalSecrets"] += len(vault.get("secrets", []))
+                        results["totalCertificates"] += len(vault.get("certificates", []))
+                        results["totalKeys"] += len(vault.get("keys", []))
+                        if vault.get("error"):
+                            results["vaultsWithErrors"] += 1
+                except Exception as exc:
+                    sub = future_to_sub[future]
+                    logger.error("Scan failed for subscription %s: %s", getattr(sub, "display_name", sub.subscription_id), exc)
+
+        return results
+
+    except Exception as exc:
+        logger.error("Error during scan: %s", exc, exc_info=True)
+        return {
+            "scannedAt": _utc_now().isoformat(),
+            "subscriptions": [],
+            "totalVaults": 0,
+            "totalSecrets": 0,
+            "totalCertificates": 0,
+            "totalKeys": 0,
+            "vaultsWithErrors": 0,
+            "error": str(exc),
+        }