multi-forge 0.2.0__py3-none-any.whl

forge/core/auth/secrets.py

@@ -0,0 +1,243 @@
+"""SecretsProvider protocol and implementations.
+
+This module provides a unified interface for accessing secrets (API keys,
+auth URLs) from multiple sources with explicit precedence.
+
+Usage:
+    from forge.core.auth import EnvSecretsProvider, ChainSecretsProvider
+
+    # Simple env-only access
+    secrets = EnvSecretsProvider()
+    api_key = secrets.require("ANTHROPIC_API_KEY")
+
+    # Chain with file-based credentials
+    from forge.core.auth.secrets import FileSecretsProvider
+    secrets = ChainSecretsProvider(
+        EnvSecretsProvider(),           # Env wins (user can override)
+        FileSecretsProvider(),          # File-based fallback
+    )
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from pathlib import Path
+from typing import Any
+
+from forge.config.schema import ForgeConfig
+from forge.core.auth.protocols import SecretsProvider
+from forge.core.llm.errors import NoApiKeyError
+
+logger = logging.getLogger(__name__)
+
+
+def _format_missing_credential_detail(
+    key: str,
+    *,
+    profile: str | None = None,
+    env_ignored: bool = False,
+) -> str | None:
+    """Best-effort actionable message for known credential env vars."""
+    try:
+        from forge.core.auth.capabilities import (
+            credential_for_env_var,
+            format_missing_credential_error,
+        )
+
+        credential = credential_for_env_var(key)
+        if credential is None:
+            return None
+        return format_missing_credential_error(
+            credential,
+            missing_vars=[key],
+            profile=profile,
+            env_ignored=env_ignored,
+        )
+    except Exception as e:
+        logger.debug("Could not format missing credential detail for %s: %s", key, e)
+        return None
+
+
+class EnvSecretsProvider:
+    """Reads secrets from os.environ.
+
+    Expects dotenv to already be loaded (by CLI main or config loader).
+    Does NOT call load_dotenv() itself to avoid import-time side effects.
+
+    Args:
+        ignore_env: When True, all lookups return the default value.
+            Used by ``auth_ignore_env`` to bypass shell env vars.
+            When None (default), reads from runtime config on each call
+            so config changes take effect without restarting.
+    """
+
+    def __init__(self, *, ignore_env: bool | None = None) -> None:
+        self._ignore_env = ignore_env
+
+    def _should_ignore(self) -> bool:
+        if self._ignore_env is not None:
+            return self._ignore_env
+        try:
+            from forge.runtime_config import get_runtime_config
+
+            return get_runtime_config().auth_ignore_env
+        except Exception as e:
+            logger.debug("Could not read auth_ignore_env; using environment credentials: %s", e)
+            return False
+
+    def get(self, key: str, default: Any = None) -> Any:
+        """Get secret from environment, returning default if not found or empty."""
+        if self._should_ignore():
+            return default
+        value = os.environ.get(key)
+        # Treat empty string as not-set (consistent with config schema defaults)
+        return value if value else default
+
+    def require(self, key: str) -> str:
+        """Get required secret from environment, raising if not found or empty."""
+        if self._should_ignore():
+            raise NoApiKeyError(
+                provider="env",
+                env_var=key,
+                detail=_format_missing_credential_detail(key, env_ignored=True),
+            )
+        value = os.environ.get(key)
+        if not value:
+            raise NoApiKeyError(
+                provider="env",
+                env_var=key,
+                detail=_format_missing_credential_detail(key),
+            )
+        return value
+
+
+class ConfigSecretsProvider:
+    """Reads secrets injected into ForgeConfig by the config loader.
+
+    The config loader maps certain env vars into ForgeConfig fields:
+    - OPENAI_AUTH_URL -> config.proxy.openai.auth_url
+    - GEMINI_AUTH_URL -> config.proxy.gemini.auth_url
+
+    This provider reads those config paths, allowing env vars to be the
+    primary source while config-injected values serve as fallbacks.
+
+    Args:
+        config: ForgeConfig instance (explicitly injected to avoid circular deps)
+    """
+
+    # Mapping of secret keys to config accessor lambdas
+    _KEY_MAPPING: dict[str, str] = {
+        "OPENAI_AUTH_URL": "proxy.openai.auth_url",
+        "GEMINI_AUTH_URL": "proxy.gemini.auth_url",
+    }
+
+    def __init__(self, config: ForgeConfig) -> None:
+        self._config = config
+
+    def get(self, key: str, default: Any = None) -> Any:
+        """Get secret from config-injected value, returning default if not found."""
+        if key not in self._KEY_MAPPING:
+            return default
+
+        # Navigate the config path
+        path = self._KEY_MAPPING[key]
+        value = self._get_nested_attr(path)
+
+        # Treat empty string as not-set
+        return value if value else default
+
+    def require(self, key: str) -> str:
+        """Get required secret from config, raising if not found or empty."""
+        value = self.get(key)
+        if not value:
+            raise NoApiKeyError(
+                provider="config",
+                env_var=key,
+                detail=_format_missing_credential_detail(key),
+            )
+        return value
+
+    def _get_nested_attr(self, path: str) -> Any:
+        """Navigate dotted path on config object."""
+        obj: Any = self._config
+        for part in path.split("."):
+            obj = getattr(obj, part, None)
+            if obj is None:
+                return None
+        return obj
+
+
+class FileSecretsProvider:
+    """Read secrets from ~/.forge/credentials.yaml for a named profile.
+
+    Reads from disk on each call (no caching) — CredentialManager's TTL
+    cache gates call frequency. This ensures freshly-saved credentials
+    (via ``forge auth login``) are picked up without restart.
+    """
+
+    def __init__(self, profile: str | None = None, *, path: Path | None = None) -> None:
+        from forge.core.auth.credentials_file import resolve_profile
+
+        self._profile = resolve_profile(profile)
+        self._path = path
+
+    def get(self, key: str, default: Any = None) -> Any:
+        """Get secret from credential file, returning default if not found or empty."""
+        from forge.core.auth.credentials_file import load_profile
+
+        secrets = load_profile(self._profile, path=self._path)
+        value = secrets.get(key)
+        return value if value else default
+
+    def require(self, key: str) -> str:
+        """Get required secret from credential file, raising if not found or empty."""
+        value = self.get(key)
+        if not value:
+            raise NoApiKeyError(
+                provider=f"file:{self._profile}",
+                env_var=key,
+                detail=_format_missing_credential_detail(key, profile=self._profile),
+            )
+        return value
+
+
+class ChainSecretsProvider:
+    """Chain of providers with explicit precedence.
+
+    Returns the first truthy (non-empty) value found across the provider chain.
+    Both None and empty string "" are treated as "not set".
+
+    Typical usage:
+        secrets = ChainSecretsProvider(
+            EnvSecretsProvider(),           # Env wins
+            ConfigSecretsProvider(config),  # Config fallback
+        )
+
+    Args:
+        *providers: SecretsProvider instances in priority order (first wins)
+    """
+
+    def __init__(self, *providers: SecretsProvider) -> None:
+        if not providers:
+            raise ValueError("ChainSecretsProvider requires at least one provider")
+        self._providers = providers
+
+    def get(self, key: str, default: Any = None) -> Any:
+        """Get secret from first provider that has a truthy value."""
+        for provider in self._providers:
+            value = provider.get(key)
+            if value:  # Truthy check: treats "" and None as not-set
+                return value
+        return default
+
+    def require(self, key: str) -> str:
+        """Get required secret, raising if no provider has a truthy value."""
+        value = self.get(key)
+        if not value:
+            raise NoApiKeyError(
+                provider="chain",
+                env_var=key,
+                detail=_format_missing_credential_detail(key),
+            )
+        return value

forge/core/auth/template_secrets.py

@@ -0,0 +1,112 @@
+"""Template-to-credential mapping and credential resolution.
+
+Maps proxy templates to required environment variable names and provides
+``resolve_env_or_credential()`` — the single lookup that checks os.environ
+first, then falls back to ``~/.forge/credentials.yaml``.
+
+Extracted from ``forge.sidecar.secrets`` so proxy orchestration, review
+engine, and sidecar can all share the same resolution logic.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+
+logger = logging.getLogger(__name__)
+
+TEMPLATE_SECRETS: dict[str, list[str]] = {
+    "litellm-openai": ["LITELLM_API_KEY", "LITELLM_BASE_URL"],
+    "litellm-gemini": ["LITELLM_API_KEY", "LITELLM_BASE_URL"],
+    "litellm-anthropic": ["LITELLM_API_KEY", "LITELLM_BASE_URL"],
+    "litellm-gemini-local": ["GEMINI_API_KEY"],
+    "litellm-gemini-test": ["GEMINI_API_KEY"],
+    "litellm-gemini-flash-local": ["GEMINI_API_KEY"],
+    "litellm-openai-local": ["OPENAI_API_KEY"],
+    "litellm-openai-codex-local": ["OPENAI_API_KEY"],
+    "litellm-anthropic-local": ["ANTHROPIC_API_KEY"],
+    "openrouter-anthropic": ["OPENROUTER_API_KEY"],
+    "openrouter-openai": ["OPENROUTER_API_KEY"],
+    "openrouter-gemini": ["OPENROUTER_API_KEY"],
+    "openrouter-openai-codex": ["OPENROUTER_API_KEY"],
+    "openrouter-gemini-flash": ["OPENROUTER_API_KEY"],
+    "openrouter-deepseek": ["OPENROUTER_API_KEY"],
+    "openrouter-kimi": ["OPENROUTER_API_KEY"],
+    "openrouter-glm": ["OPENROUTER_API_KEY"],
+    "openrouter-minimax": ["OPENROUTER_API_KEY"],
+    "openrouter-qwen": ["OPENROUTER_API_KEY"],
+}
+
+
+def _get_file_secrets() -> dict[str, str]:
+    """Load all secrets from the credential file for the active profile.
+
+    Returns empty dict on any error so callers never fail due to
+    credential file issues.
+    """
+    try:
+        from forge.core.auth.credentials_file import load_profile, resolve_profile
+
+        profile = resolve_profile()
+        return load_profile(profile)
+    except Exception as e:
+        logger.debug("Credential file load failed (non-critical): %s", e)
+        return {}
+
+
+def _auth_ignore_env() -> bool:
+    """Check if auth_ignore_env is active (lazy import to avoid cycles)."""
+    try:
+        from forge.runtime_config import get_runtime_config
+
+        return get_runtime_config().auth_ignore_env
+    except Exception as e:
+        logger.debug("Could not read auth_ignore_env; using environment credentials: %s", e)
+        return False
+
+
+def resolve_env_or_credential(var_name: str) -> str | None:
+    """Resolve a single value from environment, then credential file.
+
+    When ``auth_ignore_env`` is active, skips os.environ and reads from
+    the credential file only.
+
+    Returns the first truthy (non-empty) value found, or None.
+    """
+    if not _auth_ignore_env():
+        value = os.environ.get(var_name)
+        if value:
+            return value
+    return _get_file_secrets().get(var_name) or None
+
+
+def get_secrets_for_template(template: str) -> dict[str, str]:
+    """Get credentials required by a template.
+
+    Resolves each key from environment first, then falls back to the
+    credential file. When ``auth_ignore_env`` is active, skips environment.
+    Only includes values that resolve to non-empty strings.
+    """
+    required = TEMPLATE_SECRETS.get(template, [])
+    if not required:
+        return {}
+
+    ignore_env = _auth_ignore_env()
+    secrets: dict[str, str] = {}
+    file_secrets: dict[str, str] | None = None
+
+    for key in required:
+        if not ignore_env:
+            value = os.environ.get(key)
+            if value:
+                secrets[key] = value
+                continue
+
+        if file_secrets is None:
+            file_secrets = _get_file_secrets()
+        value = file_secrets.get(key)
+        if value:
+            logger.debug("Credential %s resolved from credential file", key)
+            secrets[key] = value
+
+    return secrets

forge/core/data/__init__.py

@@ -0,0 +1,5 @@
+"""Package marker for core data files.
+
+This package contains repo-owned data files (YAML, JSON, etc.)
+that are loaded at runtime via importlib.resources.
+"""