cnos-firebase 1.12.0__tar.gz

cnos_firebase-1.12.0/.gitignore

@@ -0,0 +1,33 @@
+.coop/logs/
+.coop/tmp/
+node_modules/
+dist/
+coverage/
+.artifacts/
+.turbo/
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+*.log
+.env
+.env.local
+.env.*.local
+!.env.example
+pnpm-debug.log*
+
+# Claude Code worktrees and session scratch
+.claude/
+.tmp/
+
+# Python bytecode
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.pytest_cache/
+
+# Java build output
+target/
+*.class
+*.jar

cnos_firebase-1.12.0/PKG-INFO

@@ -0,0 +1,7 @@
+Metadata-Version: 2.4
+Name: cnos-firebase
+Version: 1.12.0
+Summary: CNOS Firebase Secrets provider (thin wrapper over cnos-gcp)
+Requires-Python: >=3.8
+Requires-Dist: cnos-gcp>=1.12.0
+Requires-Dist: cnos>=1.12.0

cnos_firebase-1.12.0/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "cnos-firebase"
+version = "1.12.0"
+description = "CNOS Firebase Secrets provider (thin wrapper over cnos-gcp)"
+requires-python = ">=3.8"
+dependencies = [
+    "cnos>=1.12.0",
+    "cnos-gcp>=1.12.0",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/cnos_firebase"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

cnos_firebase-1.12.0/src/cnos_firebase/__init__.py

@@ -0,0 +1,4 @@
+"""CNOS Firebase Secrets provider."""
+from cnos_firebase.provider import FirebaseSecretsProvider, factory
+
+__all__ = ["FirebaseSecretsProvider", "factory"]

cnos_firebase-1.12.0/src/cnos_firebase/provider.py

@@ -0,0 +1,56 @@
+"""Firebase Secrets CNOS vault provider.
+
+This is a thin wrapper over GcpSecretManagerProvider. Firebase projects use
+the same GCP Secret Manager API; the only difference is the provider name
+reported to the CNOS runtime ("firebase-secrets" instead of "gcp-secret-manager").
+
+All authentication and secret-fetching logic is delegated entirely to
+GcpSecretManagerProvider.
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional
+
+from cnos.types import (
+    SecretVaultProvider,
+    SecretVaultProviderFactory,
+    VaultAuthConfig,
+    VaultDefinition,
+)
+from cnos_gcp.provider import GcpSecretManagerProvider
+
+PROVIDER_NAME = "firebase-secrets"
+
+
+class FirebaseSecretsProvider(SecretVaultProvider):
+    """Delegates entirely to GcpSecretManagerProvider; swaps the provider name."""
+
+    def __init__(
+        self,
+        vault_id: str,
+        definition: VaultDefinition,
+        client: Any = None,
+    ) -> None:
+        self._vault_id = vault_id
+        self._definition = definition
+        self._delegate = GcpSecretManagerProvider(vault_id, definition, client=client)
+
+    def authenticate(self, auth: VaultAuthConfig) -> None:
+        self._delegate.authenticate(auth)
+
+    def batch_get(self, refs: List[str]) -> Dict[str, Any]:
+        return self._delegate.batch_get(refs)
+
+    def get(self, ref: str) -> Optional[Any]:
+        return self._delegate.get(ref)
+
+
+def factory(client: Any = None) -> SecretVaultProviderFactory:
+    """Return a SecretVaultProviderFactory for Firebase Secrets.
+
+    Pass client= to inject a mock GCP Secret Manager client for tests.
+    """
+    def create(vault_id: str, definition: VaultDefinition) -> FirebaseSecretsProvider:
+        return FirebaseSecretsProvider(vault_id, definition, client=client)
+
+    return SecretVaultProviderFactory(provider=PROVIDER_NAME, create=create)

cnos_firebase-1.12.0/tests/test_provider.py

@@ -0,0 +1,135 @@
+"""Tests for the Firebase Secrets provider.
+
+FirebaseSecretsProvider is a thin wrapper over GcpSecretManagerProvider;
+all functional logic is tested in cnos-gcp. These tests verify:
+  - the provider name constant is "firebase-secrets"
+  - delegation to the GCP provider works end-to-end
+  - factory() returns a usable SecretVaultProviderFactory
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+import pytest
+
+from cnos.types import VaultAuthConfig, VaultAuthDefinition, VaultDefinition
+from cnos_firebase.provider import FirebaseSecretsProvider, PROVIDER_NAME, factory
+
+
+# ---------------------------------------------------------------------------
+# Mock GCP Secret Manager client (reused from cnos-gcp tests)
+# ---------------------------------------------------------------------------
+
+class _NotFoundError(Exception):
+    pass
+
+
+class MockGcpClient:
+    def __init__(self, secrets: Dict[str, str], project_id: str = "test-project") -> None:
+        self._secrets = secrets
+        self.project_id = project_id
+
+    def access_secret_version(self, name: str) -> str:
+        for key, val in self._secrets.items():
+            if key in name:
+                return val
+        raise _NotFoundError(f"not found: {name}")
+
+
+def _make_provider(
+    secrets: Dict[str, str] = None,
+    project_id: str = "test-project",
+    mapping: dict = None,
+) -> FirebaseSecretsProvider:
+    definition = VaultDefinition(
+        provider=PROVIDER_NAME,
+        auth=VaultAuthDefinition(method="iam", config={"projectId": project_id}),
+        mapping=mapping or {},
+    )
+    client = MockGcpClient(secrets or {}, project_id=project_id)
+    p = FirebaseSecretsProvider("test-vault", definition, client=client)
+    p._delegate._authenticated = True
+    return p
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+class TestProviderName:
+    def test_constant(self):
+        assert PROVIDER_NAME == "firebase-secrets"
+
+    def test_factory_provider_name(self):
+        f = factory()
+        assert f.provider == "firebase-secrets"
+
+
+class TestAuthenticate:
+    def test_iam_accepted(self):
+        p = _make_provider()
+        p._delegate._authenticated = False
+        p.authenticate(VaultAuthConfig(method="iam"))
+        assert p._delegate._authenticated
+
+    def test_environment_accepted(self):
+        p = _make_provider()
+        p._delegate._authenticated = False
+        p.authenticate(VaultAuthConfig(method="environment"))
+        assert p._delegate._authenticated
+
+    def test_wrong_method_raises(self):
+        p = _make_provider()
+        p._delegate._authenticated = False
+        with pytest.raises(Exception, match="iam authentication"):
+            p.authenticate(VaultAuthConfig(method="token", token="t"))
+
+
+class TestBatchGet:
+    def test_delegates_to_gcp(self):
+        p = _make_provider({"my-secret": "firebase-value"})
+        result = p.batch_get(["my-secret"])
+        assert result == {"my-secret": "firebase-value"}
+
+    def test_not_found_excluded(self):
+        p = _make_provider({})
+        result = p.batch_get(["missing"])
+        assert "missing" not in result
+
+    def test_multiple_secrets(self):
+        p = _make_provider({"s1": "v1", "s2": "v2"})
+        result = p.batch_get(["s1", "s2"])
+        assert result == {"s1": "v1", "s2": "v2"}
+
+
+class TestGet:
+    def test_existing_secret(self):
+        p = _make_provider({"sec": "val"})
+        assert p.get("sec") == "val"
+
+    def test_missing_returns_none(self):
+        p = _make_provider({})
+        assert p.get("missing") is None
+
+
+class TestMapping:
+    def test_external_mapping(self):
+        p = _make_provider(
+            {"firebase-project/external-name": "mapped-value"},
+            mapping={"firebase-project/external-name": "logical.key"},
+        )
+        result = p.batch_get(["logical.key"])
+        assert result.get("logical.key") == "mapped-value"
+
+
+class TestFactory:
+    def test_factory_creates_provider(self):
+        client = MockGcpClient({"key": "val"})
+        definition = VaultDefinition(
+            provider=PROVIDER_NAME,
+            auth=VaultAuthDefinition(method="iam", config={"projectId": "proj"}),
+        )
+        f = factory(client=client)
+        p = f.create("my-vault", definition)
+        assert isinstance(p, FirebaseSecretsProvider)
+        assert f.provider == PROVIDER_NAME