digitalkin 1.0.0.dev20__tar.gz → 1.0.0.dev22__tar.gz

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: digitalkin
-Version: 1.0.0.dev20
+Version: 1.0.0.dev22
 Summary: SDK to build kin used in DigitalKin
 Author-email: "DigitalKin.ai" <contact@digitalkin.ai>
 License: Attribution-NonCommercial-ShareAlike 4.0 International
@@ -453,7 +453,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: ag-ui-protocol>=0.1.18
-Requires-Dist: agentic-mesh-protocol==1.0.0a0
+Requires-Dist: agentic-mesh-protocol==1.0.0a1
 Requires-Dist: anyio>=4.13.0
 Requires-Dist: grpcio-health-checking==1.81.0
 Requires-Dist: grpcio-reflection==1.81.0

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/pyproject.toml

@@ -28,7 +28,7 @@
 
     dependencies = [
         "ag-ui-protocol>=0.1.18",
-        "agentic-mesh-protocol==1.0.0a0",
+        "agentic-mesh-protocol==1.0.0a1",
         "anyio>=4.13.0",
         "grpcio-health-checking==1.81.0",
         "grpcio-reflection==1.81.0",
@@ -37,7 +37,7 @@
         "pydantic-settings>=2.14.1",
         "redis[hiredis]>=7.4.0,<9",
     ]
-    version = "1.0.0.dev20"
+    version = "1.0.0.dev22"
 
     [project.optional-dependencies]
         performance = [ "uvloop>=0.21" ]

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/__version__.py

@@ -5,4 +5,4 @@ from importlib.metadata import PackageNotFoundError, version
 try:
     __version__ = version("digitalkin")
 except PackageNotFoundError:
-    __version__ = "1.0.0.dev20"
+    __version__ = "1.0.0.dev22"

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/community/agno/hitl.py

@@ -611,7 +611,7 @@ class AgnoHitlRunner:
         stream: Any,
         send: Callable[[BaseAgentRunEvent], Coroutine[Any, Any, None]],
         thread_id: str,
-        run_output_cls: type,
+        run_output_cls: type[RunOutput],
     ) -> PauseInfo | None:
         """Drain an Agno stream, forward events, persist on pause.
 

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/core/task_manager/module_runner.py

@@ -13,6 +13,7 @@ from redis.exceptions import RedisError
 from digitalkin.core.exceptions import BackpressureTimeoutError
 from digitalkin.core.profiling.step_timer import StepTimer
 from digitalkin.core.profiling.task_profiler import TaskProfiler
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError
 from digitalkin.grpc_servers.interceptors.request_ids import RequestContext
 from digitalkin.logger import logger
 from digitalkin.models.grpc_servers.stream_error_codes import StreamErrorCode
@@ -226,6 +227,9 @@ class ModuleRunner:
                 StreamErrorCode.REDIS_UNAVAILABLE.value,
                 f"redis unavailable: {type(exc).__name__}: {exc}",
             )
+        except PermissionDeniedError as exc:
+            logger.warning("ModuleRunner: setup access denied: %s", exc, extra=log_extra)
+            await on_fatal(StreamErrorCode.SETUP_ACCESS_DENIED.value, str(exc))
         except Exception as exc:
             logger.exception("ModuleRunner: module job failed", extra=log_extra)
             await on_fatal(

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/grpc_servers/exceptions.py

@@ -19,6 +19,10 @@ class SecurityError(ServerError):
     """Error related to security configuration."""
 
 
+class PermissionDeniedError(ServerError):
+    """Remote service rejected the call with gRPC PERMISSION_DENIED."""
+
+
 class ServerStateError(ServerError):
     """Error related to server state (e.g., already started, not started)."""
 

digitalkin-1.0.0.dev22/src/digitalkin/grpc_servers/interceptors/permission.py

@@ -0,0 +1,103 @@
+"""Client-side permission middleware for gRPC service-data access.
+
+A single cross-cutting interceptor: any unary call a backend rejects with
+``PERMISSION_DENIED`` surfaces as :class:`PermissionDeniedError`, so callers
+never handle permission per service. Attached on every channel, it covers all
+data services and module-to-module calls uniformly.
+
+The interceptor *returns* a terminal denied call rather than raising: raising a
+non-``AioRpcError`` from an aio interceptor leaks into the intercepted call's
+``__del__`` (grpc only swallows ``AioRpcError``/``CancelledError`` there), so we
+mirror grpc's own ``UnaryUnaryCallResponse`` pattern and raise from ``__await__``.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+import grpc
+import grpc.aio
+
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError
+from digitalkin.logger import logger
+
+if TYPE_CHECKING:
+    from collections.abc import Awaitable, Callable
+
+
+class _DeniedUnaryUnaryCall(grpc.aio.UnaryUnaryCall):
+    """A finished unary call that raises ``PermissionDeniedError`` when awaited."""
+
+    def __init__(self, method: str, details: str) -> None:
+        self._message = f"[{method}] {details or 'permission denied'}"
+        self._details = details
+
+    def cancel(self) -> bool:  # noqa: PLR6301
+        return False
+
+    def cancelled(self) -> bool:  # noqa: PLR6301
+        return False
+
+    def done(self) -> bool:  # noqa: PLR6301
+        return True
+
+    def add_done_callback(self, unused_callback: Any) -> None:
+        """No-op: the call is already finished.
+
+        Args:
+            unused_callback: Ignored; present to satisfy the call interface.
+        """
+
+    def time_remaining(self) -> float | None:  # noqa: PLR6301
+        return None
+
+    async def initial_metadata(self) -> grpc.aio.Metadata:  # noqa: PLR6301
+        return grpc.aio.Metadata()
+
+    async def trailing_metadata(self) -> grpc.aio.Metadata:  # noqa: PLR6301
+        return grpc.aio.Metadata()
+
+    async def code(self) -> grpc.StatusCode:  # noqa: PLR6301
+        return grpc.StatusCode.PERMISSION_DENIED
+
+    async def details(self) -> str:
+        return self._details
+
+    async def debug_error_string(self) -> None:  # noqa: PLR6301
+        return None
+
+    async def wait_for_connection(self) -> None:
+        """No-op: the call already resolved to a permission denial."""
+
+    def __await__(self) -> Any:
+        raise PermissionDeniedError(self._message)
+        yield  # unreachable; marks this method a generator so it is awaitable
+
+
+class PermissionClientInterceptor(grpc.aio.UnaryUnaryClientInterceptor):
+    """Map a ``PERMISSION_DENIED`` unary reply to ``PermissionDeniedError``."""
+
+    async def intercept_unary_unary(  # noqa: PLR6301
+        self,
+        continuation: Callable[[grpc.aio.ClientCallDetails, Any], Awaitable[Any]],
+        client_call_details: grpc.aio.ClientCallDetails,
+        request: Any,
+    ) -> Any:
+        """Return a denied call on PERMISSION_DENIED, else pass the real call through.
+
+        Args:
+            continuation: Downstream call continuation.
+            client_call_details: Original call details.
+            request: Request message.
+
+        Returns:
+            The downstream call, or a terminal call raising PermissionDeniedError on await.
+        """
+        call = await continuation(client_call_details, request)
+        if await call.code() == grpc.StatusCode.PERMISSION_DENIED:
+            method = client_call_details.method
+            method_name = method.decode() if isinstance(method, bytes) else method
+            details = await call.details()
+            logger.warning("permission denied on %s: %s", method_name, details or "")
+            return _DeniedUnaryUnaryCall(method_name, details)
+        return call

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/grpc_servers/module_servicer.py

@@ -14,12 +14,13 @@ from agentic_mesh_protocol.module.v1 import (
     lifecycle_pb2,
     module_service_pb2_grpc,
 )
+from agentic_mesh_protocol.user_profile.v1 import user_profile_pb2
 from google.protobuf import json_format, struct_pb2
 
 from digitalkin.core.job_manager.base_job_manager import BaseJobManager
 from digitalkin.core.job_manager.single_job_manager import SingleJobManager
 from digitalkin.core.task_manager.redis.redis_signal import SharedRedisListener
-from digitalkin.grpc_servers.exceptions import ServicerError
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError, ServicerError
 from digitalkin.logger import logger
 from digitalkin.models.module.module import ModuleCodeModel
 from digitalkin.models.module.setup_types import SetupModel
@@ -31,6 +32,7 @@ from digitalkin.services.registry import GrpcRegistry, RegistryStrategy
 from digitalkin.services.setup.default_setup import DefaultSetup
 from digitalkin.services.setup.grpc_setup import GrpcSetup
 from digitalkin.services.setup.setup_strategy import SetupStrategy, SetupVersionData
+from digitalkin.services.user_profile import DefaultUserProfile, GrpcUserProfile, UserProfileStrategy
 from digitalkin.utils.arg_parser import ArgParser
 from digitalkin.utils.development_mode_action import DevelopmentModeMappingAction
 
@@ -40,6 +42,7 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
 
     args: Namespace
     setup: SetupStrategy
+    user_profile: UserProfileStrategy
     job_manager: BaseJobManager
     _registry_cache: RegistryStrategy | None
     _tool_cache_by_setup: dict[str, tuple[Any, float]]
@@ -82,6 +85,16 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
 
         logger.debug("ModuleServicer initialized with SingleJobManager")
         self.setup = GrpcSetup() if self.args.services_mode == ServicesMode.REMOTE else DefaultSetup()
+        # Access-control client gating the setup cache. Always built, always called (fail-closed).
+        if self.args.services_mode == ServicesMode.REMOTE:
+            up_cfg = self.module_class.services_config_params.get("user_profile") or {}
+            up_client_config = up_cfg.get("client_config")
+            if not up_client_config:
+                msg = "user_profile client_config is required for setup access control"
+                raise RuntimeError(msg)
+            self.user_profile = GrpcUserProfile("", "", "", up_client_config)
+        else:
+            self.user_profile = DefaultUserProfile("", "", "")
         self._setup_cache: dict[str, tuple[float, SetupVersionData]] = {}
         self._setup_inflight: dict[str, asyncio.Future[SetupVersionData]] = {}
 
@@ -97,6 +110,11 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
                 await self.setup.close_channel()
             except Exception:
                 logger.exception("Error closing GrpcSetup channel")
+        if isinstance(self.user_profile, GrpcUserProfile):
+            try:
+                await self.user_profile.close_channel()
+            except Exception:
+                logger.exception("Error closing GrpcUserProfile channel")
         # M8: close the Redis connection pools (were leaked on every server stop).
         logger.info("[VALIDATE M8] closing module servicer Redis pools")  # TODO(validate): remove after prod validation
         await self._redis_client.close()
@@ -245,6 +263,19 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
             del self._setup_cache[oldest_key]
         self._setup_cache[setup_id] = (time.monotonic(), version_data)
 
+    async def _check_setup_access(self, setup_id: str) -> None:
+        """Block if the caller may not access the setup (RESOURCE_TYPE_SETUP).
+
+        Args:
+            setup_id: The setup identifier being resolved.
+
+        Raises:
+            PermissionDeniedError: If access to the setup is denied.
+        """
+        if not await self.user_profile.check_resource_access(user_profile_pb2.RESOURCE_TYPE_SETUP, setup_id):
+            msg = f"access denied to setup {setup_id}"
+            raise PermissionDeniedError(msg)
+
     async def resolve_setup(self, setup_id: str, mission_id: str) -> SetupVersionData:
         """Return setup version data from cache or remote service.
 
@@ -257,7 +288,9 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
 
         Raises:
             LookupError: No setup data found for setup_id.
+            PermissionDeniedError: If the caller may not access this setup.
         """
+        await self._check_setup_access(setup_id)
         # Fast path: cache hit within TTL
         if (cached := self._setup_cache.get(setup_id)) is not None:
             if time.monotonic() - cached[0] < get_module_servicer_settings().setup_cache_ttl:
@@ -326,6 +359,12 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
             extra={"mission_id": request.mission_id},
         )
         setup_version = request.setup_version
+        if not await self.user_profile.check_resource_access(
+            user_profile_pb2.RESOURCE_TYPE_SETUP, setup_version.setup_id
+        ):
+            context.set_code(grpc.StatusCode.PERMISSION_DENIED)
+            context.set_details(f"access denied to setup {setup_version.setup_id}")
+            return lifecycle_pb2.ConfigSetupModuleResponse(success=False)
         # Invalidate cached setup so concurrent/subsequent starts refetch the reconfigured version
         self._setup_cache.pop(setup_version.setup_id, None)
         config_setup_data = self.module_class.create_config_setup_model(json_format.MessageToDict(request.content))

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/grpc_servers/utils/grpc_client_wrapper.py

@@ -16,6 +16,7 @@ import grpc.aio
 
 from digitalkin.core.resilience.bulkhead import Bulkhead
 from digitalkin.grpc_servers.exceptions import CircuitOpenError, ServerError
+from digitalkin.grpc_servers.interceptors.permission import PermissionClientInterceptor
 from digitalkin.grpc_servers.interceptors.request_ids import RequestIdClientInterceptor
 from digitalkin.grpc_servers.utils.circuit_breaker import CircuitBreaker
 from digitalkin.logger import logger
@@ -103,7 +104,7 @@ class GrpcClientWrapper:
 
         credentials = self._build_channel_credentials(config)
         grpc_compression = config.compression.to_grpc()
-        interceptors = [RequestIdClientInterceptor()]
+        interceptors = [RequestIdClientInterceptor(), PermissionClientInterceptor()]
         if credentials is not None:
             channel = grpc.aio.secure_channel(
                 config.address,

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/grpc_servers/utils/grpc_error_handler.py

@@ -4,7 +4,7 @@ from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 from typing import Any
 
-from digitalkin.grpc_servers.exceptions import ServerError
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError, ServerError
 from digitalkin.logger import logger
 
 
@@ -28,6 +28,7 @@ class GrpcErrorHandlerMixin:
             Context for the operation.
 
         Raises:
+            PermissionDeniedError: Re-raised as-is so the authz status is never masked.
             ServerError: For gRPC-related errors.
             service_error_class: For service-specific errors if provided.
         """
@@ -36,6 +37,8 @@ class GrpcErrorHandlerMixin:
 
         try:
             yield
+        except PermissionDeniedError:
+            raise
         except service_error_class as e:
             # Re-raise service-specific errors as-is
             msg = f"{service_error_class.__name__} in {operation}: {e}"

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/models/grpc_servers/stream_error_codes.py

@@ -23,3 +23,4 @@ class StreamErrorCode(str, Enum):
     MODULE_RUNTIME_ERROR = "MODULE_RUNTIME_ERROR"
     INPUT_VALIDATION_ERROR = "INPUT_VALIDATION_ERROR"
     BACKPRESSURE_TIMEOUT = "BACKPRESSURE_TIMEOUT"
+    SETUP_ACCESS_DENIED = "SETUP_ACCESS_DENIED"

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/models/module/module_context.py

@@ -17,6 +17,7 @@ from digitalkin.services.cost.cost_strategy import CostStrategy
 from digitalkin.services.filesystem.filesystem_strategy import FilesystemStrategy
 from digitalkin.services.identity.identity_strategy import IdentityStrategy
 from digitalkin.services.registry.registry_strategy import RegistryStrategy
+from digitalkin.services.secret.secret_strategy import SecretStrategy
 from digitalkin.services.storage.storage_strategy import StorageStrategy
 from digitalkin.services.task_manager.task_manager_strategy import TaskManagerStrategy
 from digitalkin.services.user_profile.user_profile_strategy import UserProfileStrategy
@@ -95,6 +96,7 @@ class ModuleContext:
     filesystem: FilesystemStrategy
     identity: IdentityStrategy
     registry: RegistryStrategy
+    secret: SecretStrategy
     storage: StorageStrategy
     task_manager: TaskManagerStrategy | None
     user_profile: UserProfileStrategy
@@ -115,6 +117,7 @@ class ModuleContext:
         filesystem: FilesystemStrategy,
         identity: IdentityStrategy,
         registry: RegistryStrategy,
+        secret: SecretStrategy,
         storage: StorageStrategy,
         user_profile: UserProfileStrategy,
         session: dict[str, Any],
@@ -135,6 +138,7 @@ class ModuleContext:
             filesystem: FilesystemStrategy.
             identity: IdentityStrategy.
             registry: RegistryStrategy.
+            secret: SecretStrategy.
             storage: StorageStrategy.
             user_profile: UserProfileStrategy.
             task_manager: Optional, injected by SingleJobManager (RedisTaskManager).
@@ -153,6 +157,7 @@ class ModuleContext:
         self.filesystem = filesystem
         self.identity = identity
         self.registry = registry
+        self.secret = secret
         self.storage = storage
         self.task_manager = task_manager
         self.user_profile = user_profile
@@ -374,6 +379,7 @@ class ModuleContext:
             ("registry", self.registry),
             ("filesystem", self.filesystem),
             ("user_profile", self.user_profile),
+            ("secret", self.secret),
             ("identity", self.identity),
         )
         for name, service in owned:

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/modules/_base_module.py

@@ -7,6 +7,7 @@ from abc import ABC, abstractmethod
 from collections.abc import Callable, Coroutine
 from typing import Any, ClassVar, Generic
 
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError
 from digitalkin.grpc_servers.utils.utility_schema_extender import UtilitySchemaExtender
 from digitalkin.logger import logger
 from digitalkin.models.module.module import ModuleCodeModel, ModuleStatus
@@ -548,6 +549,10 @@ class BaseModule(  # Module SDK base class requires many public methods # noqa:
             self._status = ModuleStatus.CANCELLED
             logger.info("Module %s cancelled", self.name, extra=self.context.session.current_ids())
             raise
+        except PermissionDeniedError as e:
+            self._status = ModuleStatus.FAILED
+            logger.warning("Permission denied in module %s: %s", self.name, e, extra=self.context.session.current_ids())
+            await self._notify_permission_denied(self.context.callbacks.send_message, e)
         except Exception as e:
             self._status = ModuleStatus.FAILED
             logger.exception("Error inside module %s", self.name, extra=self.context.session.current_ids())
@@ -564,6 +569,28 @@ class BaseModule(  # Module SDK base class requires many public methods # noqa:
         else:
             self._status = ModuleStatus.STOPPING
 
+    async def _notify_permission_denied(
+        self,
+        callback: Callable[..., Coroutine[Any, Any, None]],
+        e: PermissionDeniedError,
+    ) -> None:
+        """Send a PermissionDenied notification to the user via the callback.
+
+        Args:
+            callback: The output callback installed on the module context.
+            e: The permission-denied error raised by a service call.
+        """
+        try:
+            await callback(
+                ModuleCodeModel(
+                    code="PermissionDenied",
+                    short_description="Permission denied",
+                    message=str(e),
+                )
+            )
+        except Exception:
+            logger.exception("Failed to send permission-denied callback", extra=self.context.session.current_ids())
+
     async def prepare(
         self,
         setup_data: SetupModelT,
@@ -623,6 +650,14 @@ class BaseModule(  # Module SDK base class requires many public methods # noqa:
         try:
             await self.prepare(setup_data, callback)
             timer.mark("prepare")
+        except PermissionDeniedError as e:
+            self._status = ModuleStatus.FAILED
+            logger.warning("Permission denied initializing module: %s", e, extra=self.context.session.current_ids())
+            await self._notify_permission_denied(callback, e)
+            if done_callback is not None:
+                await done_callback(None)
+            await self.stop()
+            return
         except Exception as e:
             self._status = ModuleStatus.FAILED
             short_description = "Error initializing module"

digitalkin-1.0.0.dev22/src/digitalkin/services/secret/__init__.py

@@ -0,0 +1,13 @@
+"""Secret service package."""
+
+from digitalkin.services.secret.default_secret import DefaultSecret
+from digitalkin.services.secret.exceptions import SecretServiceError
+from digitalkin.services.secret.grpc_secret import GrpcSecret
+from digitalkin.services.secret.secret_strategy import SecretStrategy
+
+__all__ = [
+    "DefaultSecret",
+    "GrpcSecret",
+    "SecretServiceError",
+    "SecretStrategy",
+]

digitalkin-1.0.0.dev22/src/digitalkin/services/secret/default_secret.py

@@ -0,0 +1,45 @@
+"""Default secret implementation."""
+
+from typing import Any
+
+from digitalkin.logger import logger
+from digitalkin.services.secret.secret_strategy import SecretStrategy
+
+
+class DefaultSecret(SecretStrategy):
+    """Default secret strategy with in-memory storage."""
+
+    def __init__(
+        self,
+        mission_id: str,
+        setup_id: str,
+        setup_version_id: str,
+    ) -> None:
+        """Initialize the strategy.
+
+        Args:
+            mission_id: The ID of the mission this strategy is associated with
+            setup_id: The ID of the setup
+            setup_version_id: The ID of the setup version
+        """
+        super().__init__(mission_id=mission_id, setup_id=setup_id, setup_version_id=setup_version_id)
+        self.db: dict[str, dict[str, Any]] = {}
+
+    async def get_secret(self) -> dict[str, Any] | None:
+        """Get the secret for this setup from in-memory storage.
+
+        Returns:
+            Secret values, or None if not found.
+        """
+        if self.setup_id not in self.db:
+            logger.warning("No secret found for setup_id: %s", self.setup_id)
+            return None
+        return self.db[self.setup_id]
+
+    def add_secret(self, secret_data: dict[str, Any]) -> None:
+        """Add a secret to the in-memory database (helper for testing).
+
+        Args:
+            secret_data: Dictionary containing secret values.
+        """
+        self.db[self.setup_id] = secret_data

digitalkin-1.0.0.dev22/src/digitalkin/services/secret/exceptions.py

@@ -0,0 +1,5 @@
+"""Exceptions for the secret service."""
+
+
+class SecretServiceError(Exception):
+    """Base exception for Secret service errors."""

digitalkin-1.0.0.dev22/src/digitalkin/services/secret/grpc_secret.py

@@ -0,0 +1,63 @@
+"""Digital Kin Secret Service gRPC Client (wraps UserProfileService.GetSetupSecret)."""
+
+from typing import Any
+
+from agentic_mesh_protocol.user_profile.v1 import (
+    user_profile_pb2,
+    user_profile_service_pb2_grpc,
+)
+
+from digitalkin.grpc_servers.utils.grpc_client_wrapper import GrpcClientWrapper
+from digitalkin.grpc_servers.utils.grpc_error_handler import GrpcErrorHandlerMixin
+from digitalkin.logger import logger
+from digitalkin.models.grpc_servers.models import ClientConfig
+from digitalkin.services.secret.exceptions import SecretServiceError
+from digitalkin.services.secret.secret_strategy import SecretStrategy
+from digitalkin.utils.proto_utils import ProtoUtils
+
+
+class GrpcSecret(SecretStrategy, GrpcClientWrapper, GrpcErrorHandlerMixin):
+    """gRPC client for setup secrets (backed by the UserProfileService)."""
+
+    service_name: str = "UserProfileService"
+
+    def __init__(
+        self,
+        mission_id: str,
+        setup_id: str,
+        setup_version_id: str,
+        client_config: ClientConfig,
+    ) -> None:
+        """Initialize the secret service.
+
+        Args:
+            mission_id: The ID of the mission this strategy is associated with
+            setup_id: The ID of the setup
+            setup_version_id: The ID of the setup version
+            client_config: Client configuration for gRPC connection
+        """
+        super().__init__(mission_id=mission_id, setup_id=setup_id, setup_version_id=setup_version_id)
+        self._init_channel(client_config)
+        self.stub = self._get_or_create_stub(user_profile_service_pb2_grpc.UserProfileServiceStub)
+        logger.debug("Channel client 'Secret' initialized successfully")
+
+    async def close(self) -> None:
+        """Release this instance's pooled gRPC channel ref."""
+        await self.close_channel()
+
+    async def get_secret(self) -> dict[str, Any] | None:
+        """Resolve the secret object attached to this setup.
+
+        Returns:
+            The secret values, or None if not found.
+
+        Raises:
+            SecretServiceError: If the gRPC operation fails.
+        """
+        async with self.handle_grpc_errors("GetSetupSecret", SecretServiceError):
+            request = user_profile_pb2.GetSetupSecretRequest(setup_id=self.setup_id, mission_id=self.mission_id)
+            response = await self.exec_grpc_query("GetSetupSecret", request)
+            if not response.success:
+                logger.warning("No secret found for setup_id: %s", self.setup_id)
+                return None
+            return ProtoUtils.proto_to_dict(response.secret, with_defaults=True)

digitalkin-1.0.0.dev22/src/digitalkin/services/secret/secret_strategy.py

@@ -0,0 +1,21 @@
+"""This module contains the abstract base class for Secret strategies."""
+
+from abc import ABC, abstractmethod
+from typing import Any
+
+from digitalkin.services.base_strategy import BaseStrategy
+
+
+class SecretStrategy(BaseStrategy, ABC):
+    """Abstract base class for Secret strategies."""
+
+    @abstractmethod
+    async def get_secret(self) -> dict[str, Any] | None:
+        """Resolve the secret object attached to this setup.
+
+        Returns:
+            The secret values (matching the module's secret_schema), or None if not found.
+
+        Raises:
+            SecretServiceError: If the service call fails.
+        """

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/services/services_config.py

@@ -10,6 +10,7 @@ from digitalkin.services.cost import CostStrategy, DefaultCost, GrpcCost
 from digitalkin.services.filesystem import DefaultFilesystem, FilesystemStrategy, GrpcFilesystem
 from digitalkin.services.identity import DefaultIdentity, IdentityStrategy
 from digitalkin.services.registry import DefaultRegistry, GrpcRegistry, RegistryStrategy
+from digitalkin.services.secret import DefaultSecret, GrpcSecret, SecretStrategy
 from digitalkin.services.services_models import ServicesStrategy
 from digitalkin.services.storage import DefaultStorage, GrpcStorage, StorageStrategy
 from digitalkin.services.user_profile import DefaultUserProfile, GrpcUserProfile, UserProfileStrategy
@@ -36,6 +37,7 @@ class ServicesConfig(BaseModel):
         "identity",
         "communication",
         "user_profile",
+        "secret",
     }
 
     def __init__(
@@ -67,6 +69,7 @@ class ServicesConfig(BaseModel):
             "identity": ServicesStrategy(local=DefaultIdentity, remote=DefaultIdentity),
             "communication": ServicesStrategy(local=DefaultCommunication, remote=GrpcCommunication),
             "user_profile": ServicesStrategy(local=DefaultUserProfile, remote=GrpcUserProfile),
+            "secret": ServicesStrategy(local=DefaultSecret, remote=GrpcSecret),
         }
 
         # Apply strategy overrides
@@ -162,6 +165,11 @@ class ServicesConfig(BaseModel):
         """The user_profile service strategy class for the current mode."""
         return self._strategies["user_profile"][self.mode.value]
 
+    @property
+    def secret(self) -> type[SecretStrategy]:
+        """The secret service strategy class for the current mode."""
+        return self._strategies["secret"][self.mode.value]
+
     def update_mode(self, mode: ServicesMode) -> None:
         """Update the strategy mode.
 

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev22}/src/digitalkin/services/services_models.py

@@ -11,6 +11,7 @@ from digitalkin.services.cost import CostStrategy
 from digitalkin.services.filesystem import FilesystemStrategy
 from digitalkin.services.identity import IdentityStrategy
 from digitalkin.services.registry import RegistryStrategy
+from digitalkin.services.secret import SecretStrategy
 from digitalkin.services.storage import StorageStrategy
 from digitalkin.services.task_manager.task_manager_strategy import TaskManagerStrategy
 from digitalkin.services.user_profile import UserProfileStrategy
@@ -23,6 +24,7 @@ T = TypeVar(
     | FilesystemStrategy
     | IdentityStrategy
     | RegistryStrategy
+    | SecretStrategy
     | StorageStrategy
     | UserProfileStrategy
     | TaskManagerStrategy,