cnos-hashicorp 1.12.0__tar.gz

cnos_hashicorp-1.12.0/.gitignore

@@ -0,0 +1,33 @@
+.coop/logs/
+.coop/tmp/
+node_modules/
+dist/
+coverage/
+.artifacts/
+.turbo/
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+*.log
+.env
+.env.local
+.env.*.local
+!.env.example
+pnpm-debug.log*
+
+# Claude Code worktrees and session scratch
+.claude/
+.tmp/
+
+# Python bytecode
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.pytest_cache/
+
+# Java build output
+target/
+*.class
+*.jar

cnos_hashicorp-1.12.0/PKG-INFO

@@ -0,0 +1,7 @@
+Metadata-Version: 2.4
+Name: cnos-hashicorp
+Version: 1.12.0
+Summary: CNOS HashiCorp Vault vault provider
+Requires-Python: >=3.8
+Requires-Dist: cnos>=1.12.0
+Requires-Dist: hvac>=1.2.0

cnos_hashicorp-1.12.0/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "cnos-hashicorp"
+version = "1.12.0"
+description = "CNOS HashiCorp Vault vault provider"
+requires-python = ">=3.8"
+dependencies = [
+    "cnos>=1.12.0",
+    "hvac>=1.2.0",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/cnos_hashicorp"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

cnos_hashicorp-1.12.0/src/cnos_hashicorp/__init__.py

@@ -0,0 +1,4 @@
+"""CNOS HashiCorp Vault provider."""
+from cnos_hashicorp.provider import HashiCorpVaultProvider, factory
+
+__all__ = ["HashiCorpVaultProvider", "factory"]

cnos_hashicorp-1.12.0/src/cnos_hashicorp/provider.py

@@ -0,0 +1,235 @@
+"""HashiCorp Vault CNOS vault provider — mirrors Go's hashicorpvault.go."""
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional, Tuple
+
+from cnos.errors import CnosError
+from cnos.types import (
+    SecretVaultProvider,
+    SecretVaultProviderFactory,
+    VaultAuthConfig,
+    VaultDefinition,
+)
+
+PROVIDER_NAME = "hashicorp-vault"
+
+
+def _string_config(config: Optional[Dict[str, Any]], key: str) -> str:
+    if not config:
+        return ""
+    val = config.get(key, "")
+    return str(val).strip() if val else ""
+
+
+def _first_string_config(config: Optional[Dict[str, Any]], *keys: str) -> str:
+    for key in keys:
+        val = _string_config(config, key)
+        if val:
+            return val
+    return ""
+
+
+def _read_version(value: Any) -> int:
+    if isinstance(value, int) and value in (1, 2):
+        return value
+    if isinstance(value, str):
+        stripped = value.strip()
+        if stripped in ("1", "kv-v1"):
+            return 1
+        if stripped in ("2", "kv-v2"):
+            return 2
+    return 0
+
+
+def _unique_sorted(refs: List[str]) -> List[str]:
+    return sorted(set(refs))
+
+
+def _join_path(*segments: str) -> str:
+    parts = []
+    for seg in segments:
+        trimmed = seg.strip("/")
+        if trimmed:
+            parts.append(trimmed)
+    return "/".join(parts)
+
+
+class _ParsedRef:
+    def __init__(self, path: str, field: str, explicit_field: bool) -> None:
+        self.path = path
+        self.field = field
+        self.explicit_field = explicit_field
+
+
+def _parse_vault_ref(ref: str) -> _ParsedRef:
+    index = ref.rfind("#")
+    if index == -1:
+        return _ParsedRef(path=ref, field="value", explicit_field=False)
+    field = ref[index + 1:] or "value"
+    return _ParsedRef(path=ref[:index], field=field, explicit_field=True)
+
+
+def _read_kv_data(data: Dict[str, Any], version: int) -> Optional[Dict[str, Any]]:
+    if version != 2:
+        return data
+    nested = data.get("data")
+    if isinstance(nested, dict):
+        return nested
+    return None
+
+
+def _decode_vault_value(
+    data: Optional[Dict[str, Any]], field: str, explicit_field: bool
+) -> Optional[str]:
+    if data is None:
+        return None
+    val = data.get(field)
+    if val is not None:
+        s = _primitive_string(val)
+        if s is not None:
+            return s
+    if explicit_field:
+        return None
+    # Try to find a single primitive field
+    primitives = []
+    for v in data.values():
+        s = _primitive_string(v)
+        if s is not None:
+            primitives.append(s)
+    if len(primitives) == 1:
+        return primitives[0]
+    return None
+
+
+def _primitive_string(value: Any) -> Optional[str]:
+    if isinstance(value, str):
+        return value
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, int):
+        return str(value)
+    if isinstance(value, float):
+        return str(value)
+    return None
+
+
+class HashiCorpVaultProvider(SecretVaultProvider):
+    """HashiCorp Vault KV provider. Supports injecting a mock client for tests."""
+
+    def __init__(
+        self,
+        vault_id: str,
+        definition: VaultDefinition,
+        client: Any = None,
+    ) -> None:
+        self._vault_id = vault_id
+        self._definition = definition
+        self._config = self._read_config(definition)
+        self._client = client
+        self._token: str = ""
+        self._authenticated = False
+
+    @staticmethod
+    def _read_config(definition: VaultDefinition) -> Dict[str, Any]:
+        config = definition.auth.config or {}
+        version = _read_version(config.get("version"))
+        if version == 0:
+            version = 2
+        mount = _string_config(config, "mount") or "secret"
+        return {
+            "address": _first_string_config(config, "address", "endpoint", "url"),
+            "mount": mount,
+            "namespace": _string_config(config, "namespace"),
+            "version": version,
+            "path": _string_config(config, "path"),
+        }
+
+    def authenticate(self, auth: VaultAuthConfig) -> None:
+        if auth.method != "token" or not auth.token:
+            raise CnosError(
+                f'vault "{self._vault_id}" uses {PROVIDER_NAME} and requires token authentication'
+            )
+        self._token = auth.token
+        self._authenticated = True
+        if self._client is None:
+            self._client = self._build_client()
+
+    def _build_client(self) -> Any:
+        try:
+            import hvac  # type: ignore[import]
+        except ImportError as exc:
+            raise CnosError(
+                "cnos-hashicorp: hvac is required. Install with: pip install hvac"
+            ) from exc
+        kwargs: Dict[str, Any] = {}
+        if self._config["address"]:
+            kwargs["url"] = self._config["address"]
+        client = hvac.Client(**kwargs)
+        client.token = self._token
+        return client
+
+    def batch_get(self, refs: List[str]) -> Dict[str, Any]:
+        result: Dict[str, Any] = {}
+        for ref in _unique_sorted(refs):
+            val = self._get_one(ref)
+            if val is not None:
+                result[ref] = val
+        return result
+
+    def get(self, ref: str) -> Optional[Any]:
+        return self._get_one(ref)
+
+    def _get_one(self, ref: str) -> Optional[str]:
+        external = self._external_ref(ref)
+        parsed = _parse_vault_ref(external)
+        read_path = self._read_path(parsed.path)
+        data, status = self._client_read(read_path)
+        if status == 404 or data is None:
+            return None
+        kv_data = _read_kv_data(data, self._config["version"])
+        return _decode_vault_value(kv_data, parsed.field, parsed.explicit_field)
+
+    def _client_read(self, path: str) -> Tuple[Optional[Dict[str, Any]], int]:
+        """Returns (data, status_code). 404 on not-found."""
+        try:
+            data, status = self._client.read(
+                path,
+                self._token,
+                self._config["namespace"],
+            )
+            return data, status
+        except Exception as exc:
+            if self._is_not_found(exc):
+                return None, 404
+            raise CnosError(f"cnos-hashicorp: read {path!r} failed: {exc}") from exc
+
+    def _read_path(self, path: str) -> str:
+        if self._config["version"] == 2:
+            return _join_path(self._config["mount"], "data", self._config["path"], path)
+        return _join_path(self._config["mount"], self._config["path"], path)
+
+    def _external_ref(self, ref: str) -> str:
+        mapping = self._definition.mapping or {}
+        for external, logical in mapping.items():
+            if logical == ref:
+                return external
+        return ref
+
+    @staticmethod
+    def _is_not_found(exc: Exception) -> bool:
+        cls_name = type(exc).__name__
+        if "InvalidPath" in cls_name or "NotFound" in cls_name:
+            return True
+        status = getattr(exc, "status_code", None)
+        return status == 404
+
+
+def factory(client: Any = None) -> SecretVaultProviderFactory:
+    """Return a SecretVaultProviderFactory for HashiCorp Vault.
+
+    Pass client= to inject a mock for tests.
+    """
+    def create(vault_id: str, definition: VaultDefinition) -> HashiCorpVaultProvider:
+        return HashiCorpVaultProvider(vault_id, definition, client=client)
+
+    return SecretVaultProviderFactory(provider=PROVIDER_NAME, create=create)

cnos_hashicorp-1.12.0/tests/test_provider.py

@@ -0,0 +1,214 @@
+"""Tests for the HashiCorp Vault provider."""
+from __future__ import annotations
+
+from typing import Any, Dict, Optional, Tuple
+
+import pytest
+
+from cnos.types import VaultAuthConfig, VaultAuthDefinition, VaultDefinition
+from cnos_hashicorp.provider import (
+    HashiCorpVaultProvider,
+    PROVIDER_NAME,
+    _parse_vault_ref,
+    _decode_vault_value,
+    _join_path,
+)
+
+
+# ---------------------------------------------------------------------------
+# Mock client — matches the interface expected by provider._client_read
+# ---------------------------------------------------------------------------
+
+class MockHvacClient:
+    def __init__(self, kv_data: dict, not_found: set = None, version: int = 2):
+        self._kv_data = kv_data  # path -> dict of fields
+        self._not_found = not_found or set()
+        self._version = version
+        self.token = ""
+
+    def read(self, path: str, token: str, namespace: str) -> Tuple[Optional[Dict], int]:
+        for key in self._not_found:
+            if key in path:
+                return None, 404
+        for key, val in self._kv_data.items():
+            if key in path:
+                if self._version == 2:
+                    return {"data": val}, 200
+                return val, 200
+        return None, 404
+
+
+def _make_provider(
+    kv_data: dict,
+    not_found: set = None,
+    mapping: dict = None,
+    version: int = 2,
+    kv_path: str = "",
+) -> HashiCorpVaultProvider:
+    config: Dict[str, Any] = {"version": version}
+    if kv_path:
+        config["path"] = kv_path
+    definition = VaultDefinition(
+        provider=PROVIDER_NAME,
+        auth=VaultAuthDefinition(method="token", config=config),
+        mapping=mapping or {},
+    )
+    client = MockHvacClient(kv_data, not_found, version)
+    p = HashiCorpVaultProvider("test-vault", definition, client=client)
+    p._token = "test-token"
+    p._authenticated = True
+    return p
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+class TestAuthenticate:
+    def test_token_accepted(self):
+        p = _make_provider({})
+        p._authenticated = False
+        p.authenticate(VaultAuthConfig(method="token", token="mytoken"))
+        assert p._authenticated
+
+    def test_wrong_method_raises(self):
+        p = _make_provider({})
+        p._authenticated = False
+        with pytest.raises(Exception, match="token authentication"):
+            p.authenticate(VaultAuthConfig(method="iam"))
+
+    def test_empty_token_raises(self):
+        p = _make_provider({})
+        p._authenticated = False
+        with pytest.raises(Exception, match="token authentication"):
+            p.authenticate(VaultAuthConfig(method="token", token=""))
+
+
+class TestParseVaultRef:
+    def test_no_field_defaults_to_value(self):
+        parsed = _parse_vault_ref("my/secret")
+        assert parsed.path == "my/secret"
+        assert parsed.field == "value"
+        assert parsed.explicit_field is False
+
+    def test_explicit_field(self):
+        parsed = _parse_vault_ref("my/secret#password")
+        assert parsed.path == "my/secret"
+        assert parsed.field == "password"
+        assert parsed.explicit_field is True
+
+    def test_empty_field_defaults_to_value(self):
+        parsed = _parse_vault_ref("my/secret#")
+        assert parsed.field == "value"
+
+    def test_uses_last_hash(self):
+        parsed = _parse_vault_ref("my#path/secret#field")
+        assert parsed.field == "field"
+        assert parsed.path == "my#path/secret"
+
+
+class TestDecodeVaultValue:
+    def test_returns_named_field(self):
+        data = {"value": "secret", "other": "x"}
+        result = _decode_vault_value(data, "value", False)
+        assert result == "secret"
+
+    def test_explicit_field(self):
+        data = {"password": "hunter2"}
+        result = _decode_vault_value(data, "password", True)
+        assert result == "hunter2"
+
+    def test_single_primitive_fallback(self):
+        data = {"token": "abc123"}
+        result = _decode_vault_value(data, "value", False)
+        assert result == "abc123"
+
+    def test_multiple_fields_no_explicit_returns_none(self):
+        data = {"a": "1", "b": "2"}
+        result = _decode_vault_value(data, "value", False)
+        assert result is None
+
+    def test_none_data(self):
+        result = _decode_vault_value(None, "value", False)
+        assert result is None
+
+
+class TestBatchGet:
+    def test_returns_secret(self):
+        p = _make_provider({"my-secret": {"value": "secret123"}})
+        result = p.batch_get(["my-secret"])
+        assert result == {"my-secret": "secret123"}
+
+    def test_not_found_excluded(self):
+        p = _make_provider({}, not_found={"missing"})
+        result = p.batch_get(["missing"])
+        assert "missing" not in result
+
+    def test_multiple_secrets(self):
+        p = _make_provider({"s1": {"value": "v1"}, "s2": {"value": "v2"}})
+        result = p.batch_get(["s1", "s2"])
+        assert result["s1"] == "v1"
+        assert result["s2"] == "v2"
+
+    def test_deduplicates(self):
+        p = _make_provider({"s1": {"value": "v1"}})
+        result = p.batch_get(["s1", "s1"])
+        assert result == {"s1": "v1"}
+
+
+class TestGet:
+    def test_existing(self):
+        p = _make_provider({"sec": {"value": "val"}})
+        assert p.get("sec") == "val"
+
+    def test_missing_returns_none(self):
+        p = _make_provider({}, not_found={"missing"})
+        assert p.get("missing") is None
+
+
+class TestKvVersion:
+    def test_v2_wraps_data(self):
+        p = _make_provider({"sec": {"value": "v2-secret"}}, version=2)
+        result = p.batch_get(["sec"])
+        assert result.get("sec") == "v2-secret"
+
+    def test_v1_no_wrapping(self):
+        p = _make_provider({"sec": {"value": "v1-secret"}}, version=1)
+        result = p.batch_get(["sec"])
+        assert result.get("sec") == "v1-secret"
+
+    def test_read_path_v2(self):
+        p = _make_provider({}, version=2)
+        path = p._read_path("my/secret")
+        assert "data" in path
+
+    def test_read_path_v1(self):
+        p = _make_provider({}, version=1)
+        path = p._read_path("my/secret")
+        assert "data" not in path
+
+
+class TestMapping:
+    def test_external_mapping(self):
+        p = _make_provider(
+            {"external-path": {"value": "mapped!"}},
+            mapping={"external-path": "logical-name"},
+        )
+        result = p.batch_get(["logical-name"])
+        assert result.get("logical-name") == "mapped!"
+
+
+class TestJoinPath:
+    def test_basic(self):
+        assert _join_path("a", "b", "c") == "a/b/c"
+
+    def test_strips_slashes(self):
+        assert _join_path("/a/", "/b/") == "a/b"
+
+    def test_empty_segments_skipped(self):
+        assert _join_path("a", "", "b") == "a/b"
+
+
+class TestProviderName:
+    def test_constant(self):
+        assert PROVIDER_NAME == "hashicorp-vault"