reach_commons 0.18.38__tar.gz → 0.18.39__tar.gz

{reach_commons-0.18.38 → reach_commons-0.18.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: reach_commons
-Version: 0.18.38
+Version: 0.18.39
 Summary: Reach Commons is a versatile utility library designed to streamline and enhance development workflows within the Reach ecosystem.
 License: MIT
 Author: Engineering

{reach_commons-0.18.38 → reach_commons-0.18.39}/pyproject.toml

@@ -1,7 +1,7 @@
 # isort .; black .; poetry build; poetry publish
 [tool.poetry]
 name = "reach_commons"
-version = "0.18.38"
+version = "0.18.39"
 description = "Reach Commons is a versatile utility library designed to streamline and enhance development workflows within the Reach ecosystem."
 authors = ["Engineering <engineering@getreach.ai>"]
 license = "MIT"

reach_commons-0.18.39/reach_commons/reach_aws/__init__.py

@@ -0,0 +1,3 @@
+from reach_commons.reach_aws.db_config import get_secret
+
+__all__ = ["get_secret"]

reach_commons-0.18.39/reach_commons/reach_aws/db_config.py

@@ -0,0 +1,87 @@
+import base64
+import json
+import os
+from typing import Any, Dict
+
+import boto3
+from botocore.exceptions import ClientError
+
+ENV = os.environ.get("ENV", "Staging")
+
+
+def _get_secret_json(secret_arn: str, region_name: str = "us-east-1") -> Dict[str, Any]:
+    """Fetch and parse a JSON secret from AWS Secrets Manager."""
+    session = boto3.Session(region_name=region_name)
+    client = session.client("secretsmanager")
+
+    try:
+        response = client.get_secret_value(SecretId=secret_arn)
+    except ClientError as exc:
+        raise RuntimeError(
+            f"Failed to fetch secret from AWS Secrets Manager: secret_arn={secret_arn}"
+        ) from exc
+
+    secret_string = _extract_secret_string(response, secret_arn)
+    try:
+        return json.loads(secret_string)
+    except json.JSONDecodeError as exc:
+        raise ValueError(
+            f"Secret value is not valid JSON: secret_arn={secret_arn}"
+        ) from exc
+
+
+def _extract_secret_string(response: Dict[str, Any], secret_arn: str) -> str:
+    if response.get("SecretBinary"):
+        decoded = base64.b64decode(response["SecretBinary"])
+        return decoded.decode("utf-8")
+    secret_string = response.get("SecretString")
+    if not secret_string:
+        raise ValueError(
+            f"Secret did not contain SecretString or SecretBinary: secret_arn={secret_arn}"
+        )
+    return secret_string
+
+
+def get_secret(
+    secret_arn: str,
+    region_name: str = "us-east-1",
+    host=os.getenv("db_host_proxy"),
+    db_name=os.getenv("db_name"),
+) -> Dict[str, Any]:
+    """
+    Load DB credentials from AWS Secrets Manager and host from SSM Parameter Store.
+
+    Example:
+        # from reach_commons.reach_aws import get_secret
+        # config = get_secret(
+        # os.environ[ "RDS_SECRET_ARN"],
+        #)
+    """
+
+    if not secret_arn:
+        raise ValueError(f"RDS secret ARN is not configured")
+    if not host:
+        raise ValueError(f"RDS host is not configured")
+
+    secrets_data = _get_secret_json(secret_arn, region_name)
+
+    if not isinstance(secrets_data, dict):
+        raise ValueError(
+            f"Secret payload must be a JSON object: secret_arn={secret_arn}"
+        )
+
+    secrets_data["host"] = host
+    secrets_data["dbname"] = db_name
+
+    missing = [
+        key
+        for key in ("host", "username", "password", "dbname")
+        if key not in secrets_data
+    ]
+    if missing:
+        raise ValueError(
+            "Secret is missing required fields: "
+            f"missing={missing}, secret_arn={secret_arn}"
+        )
+
+    return secrets_data