infisicalsdk 0.2.0__tar.gz → 1.0.2__tar.gz

{infisicalsdk-0.2.0 → infisicalsdk-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: infisicalsdk
-Version: 0.2.0
+Version: 1.0.2
 Summary: Infisical API Client
 Home-page: https://github.com/Infisical/python-sdk-official
 Author: Infisical
@@ -9,11 +9,18 @@ Keywords: Infisical,Infisical API,Infisical SDK
 Description-Content-Type: text/markdown
 Requires-Dist: urllib3<2.1.0,>=1.25.3
 Requires-Dist: python-dateutil
-Requires-Dist: pydantic<2,>=1.10.5
 Requires-Dist: aenum
 Requires-Dist: requests~=2.32
 Requires-Dist: boto3~=1.35
 Requires-Dist: botocore~=1.35
+Dynamic: author
+Dynamic: author-email
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: requires-dist
+Dynamic: summary
 
     Infisical SDK client for Python. To view documentation, please visit https://github.com/Infisical/python-sdk-official
     

infisicalsdk-1.0.2/README.md

@@ -0,0 +1,204 @@
+# Infisical Python SDK
+
+The Infisical SDK provides a convenient way to interact with the Infisical API. 
+
+### Migrating to version 1.0.0 or above
+
+We have recently rolled out our first stable version of the SDK, version `1.0.0` and above.
+
+The 1.0.0 version comes with a few key changes that may change how you're using the SDK.
+1. **Removal of `rest`**: The SDK no longer exposes the entire Infisical API. This was nessecary as we have moved away from using an OpenAPI generator approach. We aim to add support for more API resources in the near future. If you have any specific requests, please [open an issue](https://github.com/Infisical/python-sdk-official/issues).
+
+2. **New response types**: The 1.0.0 release uses return types that differ from the older versions. The new return types such as `BaseSecret`, are all exported from the Infisical SDK.
+
+3. **Property renaming**: Some properties on the responses have been slightly renamed. An example of this would be that the `secret_key` property on the `get_secret_by_name()` method, that has been renamed to `secretKey`.
+
+With this in mind, you're ready to upgrade your SDK version to `1.0.0` or above. 
+
+You can refer to our [legacy documentation](https://github.com/Infisical/python-sdk-official/tree/9b0403938ee5ae599d42c5f1fdf9158671a15606?tab=readme-ov-file#infisical-python-sdk) if need be.
+
+## Requirements
+
+Python 3.7+
+
+## Installation
+
+```bash
+pip install infisicalsdk
+```
+
+## Getting Started
+
+```python
+from infisical_sdk import InfisicalSDKClient
+
+# Initialize the client
+client = InfisicalSDKClient(host="https://app.infisical.com")
+
+# Authenticate (example using Universal Auth)
+client.auth.universal_auth.login(client_id="your_client_id", client_secret="your_client_secret")
+
+# Use the SDK to interact with Infisical
+secrets = client.secrets.list_secrets(project_id="your_project_id", environment_slug="dev", secret_path="/")
+```
+
+## Core Methods
+
+The SDK methods are organized into the following high-level categories:
+
+1. `auth`: Handles authentication methods.
+2. `secrets`: Manages CRUD operations for secrets.
+
+### `auth`
+
+The `Auth` component provides methods for authentication:
+
+#### Universal Auth
+
+```python
+response = client.auth.universal_auth.login(client_id="your_client_id", client_secret="your_client_secret")
+```
+
+#### AWS Auth
+
+```python
+response = client.auth.aws_auth.login(identity_id="your_identity_id")
+```
+
+### `secrets`
+
+This sub-class handles operations related to secrets:
+
+#### List Secrets
+
+```python
+secrets = client.secrets.list_secrets(
+    project_id="your_project_id",
+    environment_slug="dev",
+    secret_path="/",
+    expand_secret_references=True,
+    recursive=False,
+    include_imports=True,
+    tag_filters=[]
+)
+```
+
+**Parameters:**
+- `project_id` (str): The ID of your project.
+- `environment_slug` (str): The environment in which to list secrets (e.g., "dev").
+- `secret_path` (str): The path to the secrets.
+- `expand_secret_references` (bool): Whether to expand secret references.
+- `recursive` (bool): Whether to list secrets recursively.
+- `include_imports` (bool): Whether to include imported secrets.
+- `tag_filters` (List[str]): Tags to filter secrets.
+
+**Returns:**
+- `ListSecretsResponse`: The response containing the list of secrets.
+
+#### Create Secret
+
+```python
+new_secret = client.secrets.create_secret_by_name(
+    secret_name="NEW_SECRET",
+    project_id="your_project_id",
+    secret_path="/",
+    environment_slug="dev",
+    secret_value="secret_value",
+    secret_comment="Optional comment",
+    skip_multiline_encoding=False,
+    secret_reminder_repeat_days=30,  # Optional
+    secret_reminder_note="Remember to update this secret"  # Optional
+)
+```
+
+**Parameters:**
+- `secret_name` (str): The name of the secret.
+- `project_id` (str): The ID of your project.
+- `secret_path` (str): The path to the secret.
+- `environment_slug` (str): The environment in which to create the secret.
+- `secret_value` (str): The value of the secret.
+- `secret_comment` (str, optional): A comment associated with the secret.
+- `skip_multiline_encoding` (bool, optional): Whether to skip encoding for multiline secrets.
+- `secret_reminder_repeat_days` (Union[float, int], optional): Number of days after which to repeat secret reminders.
+- `secret_reminder_note` (str, optional): A note for the secret reminder.
+
+**Returns:**
+- `BaseSecret`: The response after creating the secret.
+
+#### Update Secret
+
+```python
+updated_secret = client.secrets.update_secret_by_name(
+    current_secret_name="EXISTING_SECRET",
+    project_id="your_project_id",
+    secret_path="/",
+    environment_slug="dev",
+    secret_value="new_secret_value",
+    secret_comment="Updated comment",  # Optional
+    skip_multiline_encoding=False,
+    secret_reminder_repeat_days=30,  # Optional
+    secret_reminder_note="Updated reminder note",  # Optional
+    new_secret_name="NEW_NAME"  # Optional
+)
+```
+
+**Parameters:**
+- `current_secret_name` (str): The current name of the secret.
+- `project_id` (str): The ID of your project.
+- `secret_path` (str): The path to the secret.
+- `environment_slug` (str): The environment in which to update the secret.
+- `secret_value` (str, optional): The new value of the secret.
+- `secret_comment` (str, optional): An updated comment associated with the secret.
+- `skip_multiline_encoding` (bool, optional): Whether to skip encoding for multiline secrets.
+- `secret_reminder_repeat_days` (Union[float, int], optional): Updated number of days after which to repeat secret reminders.
+- `secret_reminder_note` (str, optional): An updated note for the secret reminder.
+- `new_secret_name` (str, optional): A new name for the secret.
+
+**Returns:**
+- `BaseSecret`: The response after updating the secret.
+
+#### Get Secret by Name
+
+```python
+secret = client.secrets.get_secret_by_name(
+    secret_name="EXISTING_SECRET",
+    project_id="your_project_id",
+    environment_slug="dev",
+    secret_path="/",
+    expand_secret_references=True,
+    include_imports=True,
+    version=None  # Optional
+)
+```
+
+**Parameters:**
+- `secret_name` (str): The name of the secret.
+- `project_id` (str): The ID of your project.
+- `environment_slug` (str): The environment in which to retrieve the secret.
+- `secret_path` (str): The path to the secret.
+- `expand_secret_references` (bool): Whether to expand secret references.
+- `include_imports` (bool): Whether to include imported secrets.
+- `version` (str, optional): The version of the secret to retrieve. Fetches the latest by default.
+
+**Returns:**
+- `BaseSecret`: The response containing the secret.
+
+#### Delete Secret by Name
+
+```python
+deleted_secret = client.secrets.delete_secret_by_name(
+    secret_name="EXISTING_SECRET",
+    project_id="your_project_id",
+    environment_slug="dev",
+    secret_path="/"
+)
+```
+
+**Parameters:**
+- `secret_name` (str): The name of the secret to delete.
+- `project_id` (str): The ID of your project.
+- `environment_slug` (str): The environment in which to delete the secret.
+- `secret_path` (str): The path to the secret.
+
+**Returns:**
+- `BaseSecret`: The response after deleting the secret.

infisicalsdk-1.0.2/infisical_sdk/__init__.py

@@ -0,0 +1,3 @@
+from .client import InfisicalSDKClient # noqa
+from .infisical_requests import InfisicalError # noqa
+from .api_types import SingleSecretResponse, ListSecretsResponse, BaseSecret # noqa

infisicalsdk-1.0.2/infisical_sdk/api_types.py

@@ -0,0 +1,123 @@
+from dataclasses import dataclass, field
+from typing import Optional, List, Any, Dict
+from enum import Enum
+import json
+
+
+class ApprovalStatus(str, Enum):
+    """Enum for approval status"""
+    OPEN = "open"
+    APPROVED = "approved"
+    REJECTED = "rejected"
+
+
+class BaseModel:
+    """Base class for all models"""
+    def to_dict(self) -> Dict:
+        """Convert model to dictionary"""
+        result = {}
+        for key, value in self.__dict__.items():
+            if value is not None:  # Skip None values
+                if isinstance(value, BaseModel):
+                    result[key] = value.to_dict()
+                elif isinstance(value, list):
+                    result[key] = [
+                        item.to_dict() if isinstance(item, BaseModel) else item
+                        for item in value
+                    ]
+                elif isinstance(value, Enum):
+                    result[key] = value.value
+                else:
+                    result[key] = value
+        return result
+
+    @classmethod
+    def from_dict(cls, data: Dict) -> 'BaseModel':
+        """Create model from dictionary"""
+        return cls(**data)
+
+    def to_json(self) -> str:
+        """Convert model to JSON string"""
+        return json.dumps(self.to_dict())
+
+    @classmethod
+    def from_json(cls, json_str: str) -> 'BaseModel':
+        """Create model from JSON string"""
+        data = json.loads(json_str)
+        return cls.from_dict(data)
+
+
+@dataclass(frozen=True)
+class SecretTag(BaseModel):
+    """Model for secret tags"""
+    id: str
+    slug: str
+    name: str
+    color: Optional[str] = None
+
+
+@dataclass
+class BaseSecret(BaseModel):
+    """Infisical Secret"""
+    id: str
+    _id: str
+    workspace: str
+    environment: str
+    version: int
+    type: str
+    secretKey: str
+    secretValue: str
+    secretComment: str
+    createdAt: str
+    updatedAt: str
+    secretReminderNote: Optional[str] = None
+    secretReminderRepeatDays: Optional[int] = None
+    skipMultilineEncoding: Optional[bool] = False
+    metadata: Optional[Any] = None
+    secretPath: Optional[str] = None
+    tags: List[SecretTag] = field(default_factory=list)
+
+
+@dataclass
+class Import(BaseModel):
+    """Model for imports section"""
+    secretPath: str
+    environment: str
+    folderId: Optional[str] = None
+    secrets: List[BaseSecret] = field(default_factory=list)
+
+
+@dataclass
+class ListSecretsResponse(BaseModel):
+    """Complete response model for secrets API"""
+    secrets: List[BaseSecret]
+    imports: List[Import] = field(default_factory=list)
+
+    @classmethod
+    def from_dict(cls, data: Dict) -> 'ListSecretsResponse':
+        """Create model from dictionary with camelCase keys, handling nested objects"""
+        return cls(
+            secrets=[BaseSecret.from_dict(secret) for secret in data['secrets']],
+            imports=[Import.from_dict(imp) for imp in data.get('imports', [])]
+        )
+
+
+@dataclass
+class SingleSecretResponse(BaseModel):
+    """Response model for get secret API"""
+    secret: BaseSecret
+
+    @classmethod
+    def from_dict(cls, data: Dict) -> 'ListSecretsResponse':
+        return cls(
+            secret=BaseSecret.from_dict(data['secret']),
+        )
+
+
+@dataclass
+class MachineIdentityLoginResponse(BaseModel):
+    """Response model for machine identity login API"""
+    accessToken: str
+    expiresIn: int
+    accessTokenMaxTTL: int
+    tokenType: str

infisicalsdk-1.0.2/infisical_sdk/client.py

@@ -0,0 +1,345 @@
+import base64
+import json
+from typing import List, Union
+import os
+import datetime
+from typing import Dict, Any
+
+import requests
+import boto3
+from botocore.auth import SigV4Auth
+from botocore.awsrequest import AWSRequest
+from botocore.exceptions import NoCredentialsError
+
+from .infisical_requests import InfisicalRequests
+from .api_types import ListSecretsResponse, MachineIdentityLoginResponse
+from .api_types import SingleSecretResponse, BaseSecret
+
+
+class InfisicalSDKClient:
+    def __init__(self, host: str, token: str = None):
+        self.host = host
+        self.access_token = token
+
+        self.api = InfisicalRequests(host=host, token=token)
+
+        self.auth = Auth(self)
+        self.secrets = V3RawSecrets(self)
+
+    def set_token(self, token: str):
+        """
+        Set the access token for future requests.
+        """
+        self.api.set_token(token)
+        self.access_token = token
+
+    def get_token(self):
+        """
+        Set the access token for future requests.
+        """
+        return self.access_token
+
+
+class UniversalAuth:
+    def __init__(self, client: InfisicalSDKClient):
+        self.client = client
+
+    def login(self, client_id: str, client_secret: str) -> MachineIdentityLoginResponse:
+        """
+        Login with Universal Auth.
+
+        Args:
+            client_id (str): Your Machine Identity Client ID.
+            client_secret (str): Your Machine Identity Client Secret.
+
+        Returns:
+            Dict: A dictionary containing the access token and related information.
+        """
+
+        requestBody = {
+            "clientId": client_id,
+            "clientSecret": client_secret
+        }
+
+        result = self.client.api.post(
+          path="/api/v1/auth/universal-auth/login",
+          json=requestBody,
+          model=MachineIdentityLoginResponse
+        )
+
+        self.client.set_token(result.data.accessToken)
+
+        return result.data
+
+
+class AWSAuth:
+    def __init__(self, client: InfisicalSDKClient) -> None:
+        self.client = client
+
+    def login(self, identity_id: str) -> MachineIdentityLoginResponse:
+        """
+        Login with AWS Authentication.
+
+        Args:
+            identity_id (str): Your Machine Identity ID that has AWS Auth configured.
+
+        Returns:
+            Dict: A dictionary containing the access token and related information.
+        """
+
+        identity_id = identity_id or os.getenv("INFISICAL_AWS_IAM_AUTH_IDENTITY_ID")
+        if not identity_id:
+            raise ValueError(
+              "Identity ID must be provided or set in the environment variable" +
+              "INFISICAL_AWS_IAM_AUTH_IDENTITY_ID."
+            )
+
+        aws_region = self.get_aws_region()
+        session = boto3.Session(region_name=aws_region)
+
+        credentials = self._get_aws_credentials(session)
+
+        iam_request_url = f"https://sts.{aws_region}.amazonaws.com/"
+        iam_request_body = "Action=GetCallerIdentity&Version=2011-06-15"
+
+        request_headers = self._prepare_aws_request(
+          iam_request_url,
+          iam_request_body,
+          credentials,
+          aws_region
+        )
+
+        requestBody = {
+          "identityId": identity_id,
+          "iamRequestBody": base64.b64encode(iam_request_body.encode()).decode(),
+          "iamRequestHeaders": base64.b64encode(json.dumps(request_headers).encode()).decode(),
+          "iamHttpRequestMethod": "POST"
+        }
+
+        result = self.client.api.post(
+          path="/api/v1/auth/aws-auth/login",
+          json=requestBody,
+          model=MachineIdentityLoginResponse
+        )
+
+        self.client.set_token(result.data.accessToken)
+
+        return result.data
+
+    def _get_aws_credentials(self, session: boto3.Session) -> Any:
+        try:
+            credentials = session.get_credentials()
+            if credentials is None:
+                raise NoCredentialsError("AWS credentials not found.")
+            return credentials.get_frozen_credentials()
+        except NoCredentialsError as e:
+            raise RuntimeError(f"AWS IAM Auth Login failed: {str(e)}")
+
+    def _prepare_aws_request(
+      self,
+      url: str,
+      body: str,
+      credentials: Any,
+      region: str) -> Dict[str, str]:
+
+        current_time = datetime.datetime.now(datetime.timezone.utc)
+        amz_date = current_time.strftime('%Y%m%dT%H%M%SZ')
+
+        request = AWSRequest(method="POST", url=url, data=body)
+        request.headers["X-Amz-Date"] = amz_date
+        request.headers["Host"] = f"sts.{region}.amazonaws.com"
+        request.headers["Content-Type"] = "application/x-www-form-urlencoded; charset=utf-8"
+        request.headers["Content-Length"] = str(len(body))
+
+        signer = SigV4Auth(credentials, "sts", region)
+        signer.add_auth(request)
+
+        return {k: v for k, v in request.headers.items() if k.lower() != "content-length"}
+
+    @staticmethod
+    def get_aws_region() -> str:
+        region = os.getenv("AWS_REGION")  # Typically found in lambda runtime environment
+        if region:
+            return region
+
+        try:
+            return AWSAuth._get_aws_ec2_identity_document_region()
+        except Exception as e:
+            raise Exception("Failed to retrieve AWS region") from e
+
+    @staticmethod
+    def _get_aws_ec2_identity_document_region(timeout: int = 5000) -> str:
+        session = requests.Session()
+        token_response = session.put(
+            "http://169.254.169.254/latest/api/token",
+            headers={"X-aws-ec2-metadata-token-ttl-seconds": "21600"},
+            timeout=timeout / 1000
+        )
+        token_response.raise_for_status()
+        metadata_token = token_response.text
+
+        identity_response = session.get(
+            "http://169.254.169.254/latest/dynamic/instance-identity/document",
+            headers={"X-aws-ec2-metadata-token": metadata_token, "Accept": "application/json"},
+            timeout=timeout / 1000
+        )
+
+        identity_response.raise_for_status()
+        return identity_response.json().get("region")
+
+
+class Auth:
+    def __init__(self, client):
+        self.client = client
+        self.aws_auth = AWSAuth(client)
+        self.universal_auth = UniversalAuth(client)
+
+
+class V3RawSecrets:
+    def __init__(self, client: InfisicalSDKClient) -> None:
+        self.client = client
+
+    def list_secrets(
+            self,
+            project_id: str,
+            environment_slug: str,
+            secret_path: str,
+            expand_secret_references: bool = True,
+            recursive: bool = False,
+            include_imports: bool = True,
+            tag_filters: List[str] = []) -> ListSecretsResponse:
+
+        params = {
+            "workspaceId": project_id,
+            "environment": environment_slug,
+            "secretPath": secret_path,
+            "expandSecretReferences": str(expand_secret_references).lower(),
+            "recursive": str(recursive).lower(),
+            "include_imports": str(include_imports).lower(),
+        }
+
+        if tag_filters:
+            params["tag_slugs"] = ",".join(tag_filters)
+
+        result = self.client.api.get(
+            path="/api/v3/secrets/raw",
+            params=params,
+            model=ListSecretsResponse
+        )
+
+        return result.data
+
+    def get_secret_by_name(
+            self,
+            secret_name: str,
+            project_id: str,
+            environment_slug: str,
+            secret_path: str,
+            expand_secret_references: bool = True,
+            include_imports: bool = True,
+            version: str = None) -> BaseSecret:
+
+        params = {
+          "workspaceId": project_id,
+          "environment": environment_slug,
+          "secretPath": secret_path,
+          "expandSecretReferences": str(expand_secret_references).lower(),
+          "include_imports": str(include_imports).lower(),
+          "version": version
+        }
+
+        result = self.client.api.get(
+            path=f"/api/v3/secrets/raw/{secret_name}",
+            params=params,
+            model=SingleSecretResponse
+        )
+
+        return result.data.secret
+
+    def create_secret_by_name(
+            self,
+            secret_name: str,
+            project_id: str,
+            secret_path: str,
+            environment_slug: str,
+            secret_value: str = None,
+            secret_comment: str = None,
+            skip_multiline_encoding: bool = False,
+            secret_reminder_repeat_days: Union[float, int] = None,
+            secret_reminder_note: str = None) -> BaseSecret:
+
+        requestBody = {
+          "workspaceId": project_id,
+          "environment": environment_slug,
+          "secretPath": secret_path,
+          "secretValue": secret_value,
+          "secretComment": secret_comment,
+          "tagIds": None,
+          "skipMultilineEncoding": skip_multiline_encoding,
+          "type": "shared",
+          "secretReminderRepeatDays": secret_reminder_repeat_days,
+          "secretReminderNote": secret_reminder_note
+        }
+        result = self.client.api.post(
+            path=f"/api/v3/secrets/raw/{secret_name}",
+            json=requestBody,
+            model=SingleSecretResponse
+        )
+
+        return result.data.secret
+
+    def update_secret_by_name(
+            self,
+            current_secret_name: str,
+            project_id: str,
+            secret_path: str,
+            environment_slug: str,
+            secret_value: str = None,
+            secret_comment: str = None,
+            skip_multiline_encoding: bool = False,
+            secret_reminder_repeat_days: Union[float, int] = None,
+            secret_reminder_note: str = None,
+            new_secret_name: str = None) -> BaseSecret:
+
+        requestBody = {
+          "workspaceId": project_id,
+          "environment": environment_slug,
+          "secretPath": secret_path,
+          "secretValue": secret_value,
+          "secretComment": secret_comment,
+          "new_secret_name": new_secret_name,
+          "tagIds": None,
+          "skipMultilineEncoding": skip_multiline_encoding,
+          "type": "shared",
+          "secretReminderRepeatDays": secret_reminder_repeat_days,
+          "secretReminderNote": secret_reminder_note
+        }
+
+        result = self.client.api.patch(
+            path=f"/api/v3/secrets/raw/{current_secret_name}",
+            json=requestBody,
+            model=SingleSecretResponse
+        )
+        return result.data.secret
+
+    def delete_secret_by_name(
+            self,
+            secret_name: str,
+            project_id: str,
+            secret_path: str,
+            environment_slug: str) -> BaseSecret:
+
+        requestBody = {
+          "workspaceId": project_id,
+          "environment": environment_slug,
+          "secretPath": secret_path,
+          "type": "shared",
+        }
+
+        result = self.client.api.delete(
+            path=f"/api/v3/secrets/raw/{secret_name}",
+            json=requestBody,
+            model=SingleSecretResponse
+        )
+
+        return result.data.secret