dominus-sdk-python 8.0.0__tar.gz → 9.0.0__tar.gz

{dominus_sdk_python-8.0.0 → dominus_sdk_python-9.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dominus-sdk-python
-Version: 8.0.0
+Version: 9.0.0
 Summary: Python SDK for the Dominus gateway-first platform
 Author-email: CareBridge Systems <dev@carebridge.io>
 License-Expression: LicenseRef-Proprietary

{dominus_sdk_python-8.0.0 → dominus_sdk_python-9.0.0}/dominus/__init__.py

@@ -82,7 +82,12 @@ from .namespaces.files import FilesNamespace
 from .namespaces.portal import PortalNamespace
 from .namespaces.admin import AdminNamespace
 from .namespaces.secure import SecureNamespace, SecureAccessContext
-from .namespaces.secrets import SecretsNamespace
+from .namespaces.secrets import (
+    SecretsNamespace,
+    SecretEnvironment,
+    SecretPresenceCell,
+    SecretPresenceGrid,
+)
 from .namespaces.redis import RedisNamespace
 from .namespaces.logs import LogsNamespace
 from .namespaces.courier import CourierNamespace
@@ -173,7 +178,7 @@ from .errors import (
     TimeoutError as DominusTimeoutError,
 )
 
-__version__ = "8.0.0"
+__version__ = "9.0.0"
 __all__ = [
     # Main SDK instance
     "dominus",
@@ -197,6 +202,9 @@ __all__ = [
     "SecureNamespace",
     "SecureAccessContext",
     "SecretsNamespace",
+    "SecretEnvironment",
+    "SecretPresenceCell",
+    "SecretPresenceGrid",
     "RedisNamespace",
     "LogsNamespace",
     "CourierNamespace",

{dominus_sdk_python-8.0.0 → dominus_sdk_python-9.0.0}/dominus/namespaces/__init__.py

@@ -1,5 +1,10 @@
 """Dominus SDK namespace exports."""
-from .secrets import SecretsNamespace
+from .secrets import (
+    SecretsNamespace,
+    SecretEnvironment,
+    SecretPresenceCell,
+    SecretPresenceGrid,
+)
 from .db import DbNamespace
 from .redis import RedisNamespace
 from .files import FilesNamespace
@@ -33,6 +38,9 @@ from .ai import (
 
 __all__ = [
     "SecretsNamespace",
+    "SecretEnvironment",
+    "SecretPresenceCell",
+    "SecretPresenceGrid",
     "DbNamespace",
     "RedisNamespace",
     "FilesNamespace",

{dominus_sdk_python-8.0.0 → dominus_sdk_python-9.0.0}/dominus/namespaces/secrets.py

@@ -3,12 +3,115 @@ Secrets Namespace - Warden secrets management.
 
 Provides CRUD operations for secrets stored in the Warden service.
 """
-from typing import Any, Dict, List, Optional, TYPE_CHECKING
+from typing import Any, Dict, List, Literal, Optional, TYPE_CHECKING, TypedDict
 
 if TYPE_CHECKING:
     from ..start import Dominus
 
 
+SecretEnvironment = Literal["development", "staging", "production"]
+_SECRET_ENVIRONMENTS = ("development", "staging", "production")
+
+
+class SecretPresenceCell(TypedDict):
+    present: bool
+    preview: Optional[str]
+
+
+class SecretPresenceGrid(TypedDict):
+    secrets: Dict[str, Dict[SecretEnvironment, SecretPresenceCell]]
+    keys: List[str]
+    count: int
+    environment_counts: Dict[SecretEnvironment, int]
+
+
+def _invalid_presence_response() -> None:
+    raise ValueError("Invalid secret presence response")
+
+
+def _safe_preview(value: str) -> str:
+    if value == "":
+        return ""
+    if len(value) <= 8:
+        return "<redacted>"
+    return f"{value[:4]}...{value[-4:]}"
+
+
+def _is_canonical_preview(value: str) -> bool:
+    return value in ("", "<redacted>") or (len(value) == 11 and value[4:7] == "...")
+
+
+def _normalize_presence_grid(value: Any) -> SecretPresenceGrid:
+    if not isinstance(value, dict) or not isinstance(value.get("secrets"), dict):
+        _invalid_presence_response()
+    keys = value.get("keys")
+    count = value.get("count")
+    if not isinstance(keys, list) or not all(isinstance(key, str) for key in keys):
+        _invalid_presence_response()
+    if type(count) is not int or count < 0:
+        _invalid_presence_response()
+
+    unique_sorted = sorted(set(keys))
+    if keys != unique_sorted or sorted(value["secrets"].keys()) != keys or count != len(keys):
+        _invalid_presence_response()
+
+    canonical_mode = "environment_counts" in value
+    counts: Dict[SecretEnvironment, int] = {
+        "development": 0,
+        "staging": 0,
+        "production": 0,
+    }
+    secrets: Dict[str, Dict[SecretEnvironment, SecretPresenceCell]] = {}
+
+    for key in keys:
+        raw_row = value["secrets"][key]
+        if not isinstance(raw_row, dict) or not set(raw_row).issubset(_SECRET_ENVIRONMENTS):
+            _invalid_presence_response()
+        row: Dict[SecretEnvironment, SecretPresenceCell] = {}
+        for environment in _SECRET_ENVIRONMENTS:
+            has_cell = environment in raw_row
+            raw_cell = raw_row.get(environment)
+            if canonical_mode:
+                if not has_cell or not isinstance(raw_cell, dict) or set(raw_cell) != {"present", "preview"}:
+                    _invalid_presence_response()
+                if type(raw_cell["present"]) is not bool:
+                    _invalid_presence_response()
+                if raw_cell["present"]:
+                    if not isinstance(raw_cell["preview"], str) or not _is_canonical_preview(raw_cell["preview"]):
+                        _invalid_presence_response()
+                elif raw_cell["preview"] is not None:
+                    _invalid_presence_response()
+                cell: SecretPresenceCell = {
+                    "present": raw_cell["present"],
+                    "preview": raw_cell["preview"],
+                }
+            elif not has_cell or raw_cell is None:
+                cell = {"present": False, "preview": None}
+            elif isinstance(raw_cell, str):
+                cell = {"present": True, "preview": _safe_preview(raw_cell)}
+            else:
+                _invalid_presence_response()
+            row[environment] = cell
+            if cell["present"]:
+                counts[environment] += 1
+        secrets[key] = row
+
+    if canonical_mode:
+        response_counts = value["environment_counts"]
+        if not isinstance(response_counts, dict) or set(response_counts) != set(_SECRET_ENVIRONMENTS):
+            _invalid_presence_response()
+        if any(type(response_counts[environment]) is not int or response_counts[environment] != counts[environment]
+               for environment in _SECRET_ENVIRONMENTS):
+            _invalid_presence_response()
+
+    return {
+        "secrets": secrets,
+        "keys": list(keys),
+        "count": len(keys),
+        "environment_counts": counts,
+    }
+
+
 class SecretsNamespace:
     """
     Secrets management namespace.
@@ -193,9 +296,11 @@ class SecretsNamespace:
 
     async def list_secrets_all_environments(
         self, infisical_project_id: str
-    ) -> Dict[str, Any]:
+    ) -> SecretPresenceGrid:
         """Warden grid: secrets across environments for an Infisical project id."""
-        return await self._client._request(
+        if not infisical_project_id.strip():
+            raise ValueError("Infisical project id is required")
+        response = await self._client._request(
             endpoint="/api/warden/secrets",
             body={
                 "action": "list-all-environments",
@@ -203,3 +308,4 @@ class SecretsNamespace:
             },
             use_gateway=True,
         )
+        return _normalize_presence_grid(response)

{dominus_sdk_python-8.0.0 → dominus_sdk_python-9.0.0}/dominus_sdk_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dominus-sdk-python
-Version: 8.0.0
+Version: 9.0.0
 Summary: Python SDK for the Dominus gateway-first platform
 Author-email: CareBridge Systems <dev@carebridge.io>
 License-Expression: LicenseRef-Proprietary

{dominus_sdk_python-8.0.0 → dominus_sdk_python-9.0.0}/dominus_sdk_python.egg-info/SOURCES.txt

@@ -64,6 +64,7 @@ tests/test_public_exports.py
 tests/test_publisher_namespace.py
 tests/test_recipes_namespace.py
 tests/test_recipes_stash_routing.py
+tests/test_secrets_presence_contract.py
 tests/test_stash_artifact_facade.py
 tests/test_stash_tables_namespace.py
 tests/test_transport_compat.py

{dominus_sdk_python-8.0.0 → dominus_sdk_python-9.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dominus-sdk-python"
-version = "8.0.0"
+version = "9.0.0"
 description = "Python SDK for the Dominus gateway-first platform"
 readme = "README.md"
 license = "LicenseRef-Proprietary"

{dominus_sdk_python-8.0.0 → dominus_sdk_python-9.0.0}/tests/test_namespace_barrel_exports.py

@@ -39,3 +39,24 @@ def test_stash_tables_namespace_is_exported_from_both_barrels():
 
 def test_package_includes_declared_pep561_marker():
     assert Path(dominus.__file__).with_name("py.typed").is_file()
+
+
+def test_secret_presence_types_are_identical_across_both_public_barrels():
+    from dominus import SecretEnvironment, SecretPresenceCell, SecretPresenceGrid
+    from dominus.namespaces import (
+        SecretEnvironment as NamespaceEnvironment,
+        SecretPresenceCell as NamespaceCell,
+        SecretPresenceGrid as NamespaceGrid,
+    )
+    from dominus.namespaces.secrets import (
+        SecretEnvironment as DefinedEnvironment,
+        SecretPresenceCell as DefinedCell,
+        SecretPresenceGrid as DefinedGrid,
+    )
+
+    assert SecretEnvironment is NamespaceEnvironment is DefinedEnvironment
+    assert SecretPresenceCell is NamespaceCell is DefinedCell
+    assert SecretPresenceGrid is NamespaceGrid is DefinedGrid
+    for name in ("SecretEnvironment", "SecretPresenceCell", "SecretPresenceGrid"):
+        assert name in dominus.__all__
+        assert name in dominus.namespaces.__all__

dominus_sdk_python-9.0.0/tests/test_secrets_presence_contract.py

@@ -0,0 +1,143 @@
+import json
+from typing import Literal, get_args, get_type_hints
+
+import pytest
+
+from dominus.namespaces.secrets import SecretsNamespace
+
+
+RAW_SENTINEL = "SENTINEL-DO-NOT-LEAK"
+LEGACY = {
+    "secrets": {
+        "EMPTY": {"development": "", "staging": None, "production": None},
+        "LONG": {"development": RAW_SENTINEL, "staging": None, "production": "tiny"},
+        "STAGE": {"development": None, "staging": "12345678", "production": None},
+    },
+    "keys": ["EMPTY", "LONG", "STAGE"],
+    "count": 3,
+}
+OMITTED = {
+    "secrets": {
+        "EMPTY": {"development": ""},
+        "LONG": {"development": RAW_SENTINEL, "production": "tiny"},
+        "STAGE": {"staging": "12345678"},
+    },
+    "keys": ["EMPTY", "LONG", "STAGE"],
+    "count": 3,
+}
+EXPECTED = {
+    "secrets": {
+        "EMPTY": {
+            "development": {"present": True, "preview": ""},
+            "staging": {"present": False, "preview": None},
+            "production": {"present": False, "preview": None},
+        },
+        "LONG": {
+            "development": {"present": True, "preview": "SENT...LEAK"},
+            "staging": {"present": False, "preview": None},
+            "production": {"present": True, "preview": "<redacted>"},
+        },
+        "STAGE": {
+            "development": {"present": False, "preview": None},
+            "staging": {"present": True, "preview": "<redacted>"},
+            "production": {"present": False, "preview": None},
+        },
+    },
+    "keys": ["EMPTY", "LONG", "STAGE"],
+    "count": 3,
+    "environment_counts": {"development": 2, "staging": 1, "production": 1},
+}
+
+
+class Client:
+    def __init__(self, response=None, error=None):
+        self.response = response
+        self.error = error
+        self.calls = []
+
+    async def _request(self, **kwargs):
+        self.calls.append(kwargs)
+        if self.error is not None:
+            raise self.error
+        return self.response
+
+
+@pytest.mark.asyncio
+async def test_physical_id_wire_and_legacy_safe_rollback_normalization():
+    for response in (LEGACY, EXPECTED, LEGACY):
+        client = Client(response)
+        result = await SecretsNamespace(client).list_secrets_all_environments("physical-123")
+        assert client.calls == [{
+            "endpoint": "/api/warden/secrets",
+            "body": {"action": "list-all-environments", "infisical_project_id": "physical-123"},
+            "use_gateway": True,
+        }]
+        assert result == EXPECTED
+        assert RAW_SENTINEL not in json.dumps(result)
+
+
+@pytest.mark.asyncio
+async def test_omitted_legacy_properties_equal_explicit_nulls():
+    assert await SecretsNamespace(Client(OMITTED)).list_secrets_all_environments("physical-123") == EXPECTED
+
+
+@pytest.mark.asyncio
+async def test_blank_physical_id_is_rejected_locally():
+    client = Client(LEGACY)
+    with pytest.raises(ValueError, match="Infisical project id is required"):
+        await SecretsNamespace(client).list_secrets_all_environments("   ")
+    assert client.calls == []
+
+
+@pytest.mark.asyncio
+async def test_upstream_failure_propagates_unchanged():
+    failure = RuntimeError("upstream unavailable")
+    with pytest.raises(RuntimeError) as caught:
+        await SecretsNamespace(Client(error=failure)).list_secrets_all_environments("physical-123")
+    assert caught.value is failure
+
+
+@pytest.mark.asyncio
+async def test_malformed_responses_fail_without_raw_cell_in_error_or_logs(caplog):
+    malformed = [
+        {"secrets": {"BAD": {"development": value, "staging": None, "production": None}}, "keys": ["BAD"], "count": 1}
+        for value in (1, True, [], {})
+    ] + [
+        {**EXPECTED, "secrets": {"BAD": {"development": {"present": False, "preview": "bad"}, "staging": {"present": False, "preview": None}, "production": {"present": False, "preview": None}}}, "keys": ["BAD"], "count": 1, "environment_counts": {"development": 0, "staging": 0, "production": 0}},
+        {**EXPECTED, "secrets": {"BAD": {"development": {"present": True, "preview": None}, "staging": {"present": False, "preview": None}, "production": {"present": False, "preview": None}}}, "keys": ["BAD"], "count": 1, "environment_counts": {"development": 1, "staging": 0, "production": 0}},
+        {"secrets": {"BAD": {"development": RAW_SENTINEL, "staging": None, "production": None, "preview": "unknown"}}, "keys": ["BAD"], "count": 1},
+        {**LEGACY, "keys": ["LONG", "EMPTY", "STAGE"]},
+        {**LEGACY, "keys": ["EMPTY", "EMPTY", "STAGE"]},
+        {**LEGACY, "count": 2},
+        {**EXPECTED, "environment_counts": {"development": 99, "staging": 1, "production": 1}},
+        {"secrets": LEGACY["secrets"], "keys": LEGACY["keys"]},
+        {"success": False, "error": RAW_SENTINEL},
+    ]
+    for response in malformed:
+        with pytest.raises(ValueError) as caught:
+            await SecretsNamespace(Client(response)).list_secrets_all_environments("physical-123")
+        assert RAW_SENTINEL not in str(caught.value)
+    assert RAW_SENTINEL not in caplog.text
+
+
+def test_public_types_and_return_annotation_are_exact():
+    from dominus import SecretEnvironment, SecretPresenceCell, SecretPresenceGrid
+    from dominus.namespaces import (
+        SecretEnvironment as NamespaceEnvironment,
+        SecretPresenceCell as NamespaceCell,
+        SecretPresenceGrid as NamespaceGrid,
+    )
+    from dominus.namespaces.secrets import (
+        SecretEnvironment as DefinedEnvironment,
+        SecretPresenceCell as DefinedCell,
+        SecretPresenceGrid as DefinedGrid,
+    )
+
+    assert SecretEnvironment is NamespaceEnvironment is DefinedEnvironment
+    assert SecretPresenceCell is NamespaceCell is DefinedCell
+    assert SecretPresenceGrid is NamespaceGrid is DefinedGrid
+    assert get_args(SecretEnvironment) == ("development", "staging", "production")
+    assert SecretEnvironment == Literal["development", "staging", "production"]
+    assert SecretPresenceCell.__required_keys__ == frozenset({"present", "preview"})
+    assert SecretPresenceGrid.__required_keys__ == frozenset({"secrets", "keys", "count", "environment_counts"})
+    assert get_type_hints(SecretsNamespace.list_secrets_all_environments)["return"] is SecretPresenceGrid