lorebase-platform 0.2.3__tar.gz → 0.3.0__tar.gz

{lorebase_platform-0.2.3 → lorebase_platform-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lorebase-platform
-Version: 0.2.3
+Version: 0.3.0
 Summary: Lorebase platform: settings, secrets, logging and telemetry
 Requires-Python: >=3.12
 Requires-Dist: opentelemetry-api>=1.25

{lorebase_platform-0.2.3 → lorebase_platform-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lorebase-platform"
-version = "0.2.3"
+version = "0.3.0"
 description = "Lorebase platform: settings, secrets, logging and telemetry"
 requires-python = ">=3.12"
 dependencies = ["pydantic>=2.7", "pydantic-settings>=2.3", "pyyaml>=6.0", "opentelemetry-api>=1.25", "opentelemetry-sdk>=1.25", "opentelemetry-exporter-otlp-proto-grpc>=1.25"]

lorebase_platform-0.3.0/src/lorebase_platform/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"

{lorebase_platform-0.2.3 → lorebase_platform-0.3.0}/src/lorebase_platform/secrets.py

@@ -6,6 +6,9 @@ A secret setting holds either a literal value or a reference resolved at load ti
 - `secret://file/PATH`: content of the file at `PATH` (trailing newline removed). Use a double
   slash for an absolute path, for example `secret://file//run/secrets/db_password`.
 
+Other providers (a vault, a cloud secret manager) are added with `register_secret_provider`
+before the settings are loaded; `env` and `file` cannot be replaced.
+
 Resolved values are typed `SecretStr` and are registered so that the logging redaction filter
 can mask them wherever they appear.
 """
@@ -22,8 +25,13 @@ from typing import Annotated, Any
 from pydantic import BeforeValidator, SecretStr
 
 REFERENCE_PREFIX = "secret://"
+_PROVIDER_NAME = re.compile(r"^[a-z0-9_-]+$")
 _REFERENCE = re.compile(r"^secret://(?P<provider>[a-z0-9_-]+)/(?P<target>.+)$")
 
+SecretProvider = Callable[[str], str]
+"""Resolves the target of a reference (the part after `secret://<name>/`) to its value; raises
+`SecretResolutionError`, with a message holding no secret value, when it cannot."""
+
 
 class SecretResolutionError(ValueError):
     """A secret reference cannot be resolved. The message never contains a secret value."""
@@ -44,12 +52,31 @@ def _from_file(path: str) -> str:
     return content.removesuffix("\n").removesuffix("\r")
 
 
-_PROVIDERS: dict[str, Callable[[str], str]] = {"env": _from_env, "file": _from_file}
+_PROVIDERS: dict[str, SecretProvider] = {"env": _from_env, "file": _from_file}
+_BUILT_IN = frozenset(_PROVIDERS)
 
 _known_values: set[str] = set()
 _lock = threading.Lock()
 
 
+def register_secret_provider(name: str, provider: SecretProvider, *, replace: bool = False) -> None:
+    """Resolve `secret://<name>/TARGET` references with `provider`.
+
+    `name` takes lowercase letters, digits, `_` and `-`. The built-in `env` and `file` cannot
+    be replaced; registering a name twice raises `ValueError` unless `replace` is true.
+    """
+    if not _PROVIDER_NAME.match(name):
+        raise ValueError(f"invalid secret provider name {name!r}; use [a-z0-9_-]+")
+    if not callable(provider):
+        raise TypeError("a secret provider must be callable")
+    if name in _BUILT_IN:
+        raise ValueError(f"the built-in secret provider {name!r} cannot be replaced")
+    with _lock:
+        if name in _PROVIDERS and not replace:
+            raise ValueError(f"secret provider {name!r} is already registered")
+        _PROVIDERS[name] = provider
+
+
 def register_secret_value(value: str) -> None:
     """Remember a secret value so log redaction can mask it."""
     if value:

{lorebase_platform-0.2.3 → lorebase_platform-0.3.0}/tests/test_secrets.py

@@ -5,9 +5,11 @@ from pathlib import Path
 import pytest
 from pydantic import SecretStr
 
+from lorebase_platform import secrets
 from lorebase_platform.secrets import (
     SecretResolutionError,
     SecretValue,
+    register_secret_provider,
     registered_secret_values,
     resolve_secret,
 )
@@ -101,3 +103,44 @@ def test_errors_never_contain_secret_values(monkeypatch: pytest.MonkeyPatch) ->
     with pytest.raises(ConfigError) as caught:
         load_settings()
     assert "super-secret-literal" not in str(caught.value)
+
+
+@pytest.fixture
+def providers(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Providers registered by a test are forgotten afterwards."""
+    monkeypatch.setattr(secrets, "_PROVIDERS", dict(secrets._PROVIDERS))
+
+
+@pytest.mark.usefixtures("providers")
+def test_a_registered_provider_resolves_its_references() -> None:
+    vault = {"db/password": "vault-s3cr3t"}
+
+    def lookup(target: str) -> str:
+        if target not in vault:
+            raise SecretResolutionError(f"no secret at {target!r}")
+        return vault[target]
+
+    register_secret_provider("vault", lookup)
+    assert resolve_secret("secret://vault/db/password") == "vault-s3cr3t"
+    assert "vault-s3cr3t" in registered_secret_values()
+    with pytest.raises(SecretResolutionError, match="no secret at 'missing'"):
+        resolve_secret("secret://vault/missing")
+
+
+@pytest.mark.usefixtures("providers")
+def test_providers_are_not_replaced_silently() -> None:
+    register_secret_provider("vault", lambda target: "first")
+    with pytest.raises(ValueError, match="already registered"):
+        register_secret_provider("vault", lambda target: "second")
+    register_secret_provider("vault", lambda target: "second", replace=True)
+    assert resolve_secret("secret://vault/x") == "second"
+    for built_in in ("env", "file"):
+        with pytest.raises(ValueError, match="cannot be replaced"):
+            register_secret_provider(built_in, lambda target: "x", replace=True)
+
+
+@pytest.mark.usefixtures("providers")
+@pytest.mark.parametrize("name", ["", "Vault", "my vault", "a/b", "vault:"])
+def test_provider_names_must_be_usable_in_references(name: str) -> None:
+    with pytest.raises(ValueError, match="invalid secret provider name"):
+        register_secret_provider(name, lambda target: "x")

lorebase_platform-0.2.3/src/lorebase_platform/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.3"