secret_template_renderer 0.2.0__py3-none-any.whl

secret_template_renderer-0.2.0.dist-info/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 BenTriByte
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

secret_template_renderer-0.2.0.dist-info/METADATA

@@ -0,0 +1,145 @@
+Metadata-Version: 2.3
+Name: secret_template_renderer
+Version: 0.2.0
+Summary: A tool for templating .env files and more.
+Keywords: template,management,jinja2,secrets,dotenv,.env
+Author: Ben Trinh
+Author-email: huantrinh1802@gmail.com
+Requires-Python: >=3.12,<4.0
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Provides-Extra: crypto
+Requires-Dist: jinja2 (>=3.1.5,<4.0.0)
+Project-URL: Homepage, https://github.com/huantrinh1802/secret_template_renderer
+Project-URL: Issues, https://github.com/huantrinh1802/secret_template_renderer/issues
+Description-Content-Type: text/markdown
+
+# Secret Template Renderer
+
+This project is a Jinja template renderer that supports fetching secrets from various providers.
+
+## Features
+
+- Load built-in and user-defined plugins to extend the functionality
+- Register multiple secret providers
+- Render Jinja templates with secrets
+
+## Installation
+
+### Using pip
+
+1. Clone the repository
+2. Install the required dependencies
+
+   ```bash
+   pip install -r requirements.txt
+   ```
+
+### Using pipx
+
+```bash
+pipx install secret_template_renderer
+
+```
+
+## Usage
+
+### Template Utilities
+
+- `import_env`: import dotenv file
+- `get_secret`:  retrieve secret via secret providers
+- `shell`: execute shell command
+- `random`: generate a random string with the following parameters:
+  - length: int = 16,
+  - type: string | password = 'string',
+  - lower_case: bool = True,
+  - numbers: bool = True,
+  - has_special_chars: bool = False,
+  - must_has_special_chars: bool = False,
+  - exclude_characters: str = "",
+
+### Command Line Interface
+
+- `-d`, `--debug`: Enable debug mode
+
+#### Generate
+
+```bash
+str generate [-f <template_path>] [-o <output_path>] [-i <input_string>] [-p <password>]
+```
+
+- `-f`, `--file`: Path to the Jinja template file
+- `-o`, `--output`:   Path to the output file
+- `-i`, `--input`:   Input string to be rendered
+- `-p`, `--password`:   Password to be used for encryption
+
+#### Encryption
+
+```bash
+str encrypt|decrypt [-f <template_path>] [-o <output_path>] [-i <input_string>] [-p <password>]
+```
+
+- `-f`, `--file`: Path to the Jinja template file
+- `-o`, `--output`:   Path to the output file
+- `-i`, `--input`:   Input string to be rendered
+- `-p`, `--password`:   Password to be used for encryption
+
+#### Example
+
+```dotenv
+
+{{ import_env('.default.env') }} # Importing another dotenv file
+DATABASE_PWD={{ get_secret('bitwarden', 'database_system_a', 'login.password') }} # Use the bitwarden plugins to load Bitwarden
+NAME=app-{{ random(10) }} # Generate the randomised strings
+PWD={{ decrypt("SfB505whBisKznrdHKLvQ0hhaESDP0MqvWFsYNkI0to=", "password") }}
+UID={{ shell('echo $UID') }}
+
+```
+
+## Custom plugins
+
+To load custom plugins, place your plugin `.py` files in `~/.config/temv/plugins/[plugin_type]/[plugin_name]`. Currently, there are 2 plugins: `secrets` and `encryptions`.
+
+Each plugin must have a `register` function that takes a dictionary of secret providers as an argument.
+
+Secret example:
+
+```python
+import subprocess
+from collections.abc import Callable
+
+
+def get_custom_secret(item_name: str, path: str) -> str | None:
+    pass
+
+
+def register(secrets_providers: dict[str, Callable[[str, str], str | None]]):
+    """Register secret provider."""
+    secrets_providers["custom_provider"] = get_custom_secret
+```
+
+Encryption example:
+
+```python
+import subprocess
+from collections.abc import Callable
+
+
+def encrypt(value: str, password: str) -> str | None:
+    pass
+
+
+def decrypt(value: str, password: str) -> str | None:
+    pass
+
+
+def register(providers: dict[str, Callable[[str, str], str | None]]):
+    """Register encryption provider."""
+    providers["custom_provider"] = {"encrypt": encrypt, "decrypt": decrypt}
+```
+
+## License
+
+This project is licensed under the MIT License.
+

secret_template_renderer-0.2.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+src/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+src/app.py,sha256=8ILyVcaQgvj3v9mqt2Uyy8lK_tR0otlOuh2zhVy05uA,9633
+src/logger.py,sha256=-vPyiI2ZSxBqfv2Nz6a2aez0R9DgL8ZbtkrRUXJMTLU,10740
+src/plugins/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+src/plugins/encryptions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+src/plugins/encryptions/basic.py,sha256=ZwtdmC_etR-h15Wr9ZCQ6x4QMTVnnRCM5e0lqk7jFNg,3010
+src/plugins/secrets/1password.py,sha256=p400YHc1e_-loU2bV4lZHl-Wr6C50F4a8r40C3thVLs,483
+src/plugins/secrets/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+src/plugins/secrets/bitwarden.py,sha256=bZcVagLdbQxU_raZSsJIeYe-Xa3DzPLvCw433VWi8dM,844
+src/plugins/secrets/pass.py,sha256=yUttAIQxZBmjsiWASr1FVLYjx0YuW8IR8RxWa5NsyOY,433
+secret_template_renderer-0.2.0.dist-info/LICENSE,sha256=mrW2fUttjcRV5BJGl88QcJc3kBQmpD_tjmTj8Rc4GLU,1067
+secret_template_renderer-0.2.0.dist-info/METADATA,sha256=RTOX_ovUv1s4yRsiYX0m3UF-Xgu9VBWWIYPYwJtUnBQ,3853
+secret_template_renderer-0.2.0.dist-info/WHEEL,sha256=XbeZDeTWKc1w7CSIyre5aMDU_-PohRwTQceYnisIYYY,88
+secret_template_renderer-0.2.0.dist-info/entry_points.txt,sha256=_OacEHU8VmTPFNu7TVo8TzDeic3elneOLN7YsEwP3vk,36
+secret_template_renderer-0.2.0.dist-info/RECORD,,

secret_template_renderer-0.2.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.1.1
+Root-Is-Purelib: true
+Tag: py3-none-any

secret_template_renderer-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+str=src.app:main
+

src/app.py

@@ -0,0 +1,275 @@
+import argparse
+import importlib
+import importlib.machinery
+import importlib.util
+import logging
+import os
+import pathlib
+import secrets
+import string
+import subprocess
+import sys
+import types
+from collections.abc import Callable
+from functools import partial
+from typing import Any, Literal, TypedDict
+
+from jinja2 import Environment, FileSystemLoader
+
+from src.logger import Logging
+
+# Registry for secret providers
+providers: dict[str, dict[str, Any]] = {"secrets": {}, "encryptions": {}}
+logger = Logging(__name__)
+
+
+type plugins_type = Literal["secrets", "encryptions"]
+
+
+def load_plugins(type: plugins_type):
+    """Load built-in and user plugins."""
+    # Load built-in plugins
+    _load_plugins_from_dir(pathlib.Path(__file__).parent / "plugins" / type, type)
+    cwd_config_plugins = pathlib.Path.cwd() / ".temv" / "plugins" / type
+    if cwd_config_plugins.exists():
+        _load_plugins_from_dir(cwd_config_plugins, type)
+    # Load plugins from TEMV_PLUGIN_DIR
+    env_var_plugin_dir = os.getenv("TEMV_PLUGIN_DIR", None)
+    if env_var_plugin_dir is None:
+        env_var_plugin_dir = os.getenv("XDG_CONFIG_DIR")
+    if env_var_plugin_dir:
+        env_var_path = pathlib.Path(env_var_plugin_dir) / type
+        if env_var_plugin_dir != "" and env_var_path.exists():
+            _load_plugins_from_dir(env_var_path, "encryptions")
+    logger.debug(
+        "Loaded plugins",
+        data={
+            f"{type}_providers": list(providers[type].keys()),
+        },
+    )
+
+
+def _load_plugins_from_dir(directory: pathlib.Path, type: plugins_type = "secrets"):
+    """Helper to load plugins from a directory."""
+    for file in directory.glob("*.py"):
+        if file.name == "__init__.py":
+            continue  # Skip __init__.py
+        if type == "encryptions" and file.name == "basic.py":
+            pkg = importlib.util.find_spec("cryptography")
+            if pkg is None:
+                continue
+        spec: importlib.machinery.ModuleSpec | None = (
+            importlib.util.spec_from_file_location(file.stem, file)
+        )
+        if spec and spec.loader:
+            module: types.ModuleType = importlib.util.module_from_spec(spec)
+            spec.loader.exec_module(module)
+            if hasattr(module, "register"):
+                register_func: Callable[..., Any] | None = getattr(module, "register")
+                if callable(register_func):
+                    register_func(providers[type])
+
+
+def get_secret(source: str, key: str, path: str = "") -> str | None:
+    if source in providers["secrets"]:
+        return providers["secrets"][source](key, path)
+    else:
+        return None
+
+
+def import_env(source: str) -> str:
+    with open(source, "r") as env_file:
+        env = env_file.readlines()
+    return "\n".join(env).rstrip("\n")
+
+
+type StringType = Literal["string", "password"]
+
+
+def generate_random_string(
+    length: int = 16,
+    type: StringType = "string",
+    lower_case: bool = True,
+    numbers: bool = True,
+    has_special_chars: bool = False,
+    must_has_special_chars: bool = False,
+    exclude_characters: str = "",
+):
+    characters = ""
+    if not has_special_chars and must_has_special_chars:
+        raise ValueError(
+            "must_has_special_chars is True cannot use with has_special_chars is False"
+        )
+    if lower_case:
+        characters += string.ascii_lowercase
+    if numbers:
+        characters += string.digits
+    if type == "password" or has_special_chars:
+        characters += string.punctuation
+
+    # Remove excluded characters
+    characters = "".join(c for c in characters if c not in exclude_characters)
+
+    if not characters:
+        raise ValueError("No valid characters left to generate a string.")
+    output: str | None = None
+    while (
+        output is None
+        or (output and len(output) < length)
+        or (must_has_special_chars and all(c not in characters for c in output))
+    ):
+        try:
+            # Try using OpenSSL for better randomness
+            result = subprocess.run(
+                [
+                    "openssl",
+                    "rand",
+                    "-base64",
+                    str(length * 2),  # Generate more bytes to filter properly
+                ],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            random_bytes = result.stdout
+
+            # Filter to allowed characters
+            output = "".join(c for c in random_bytes if c in characters)[:length]
+        except (FileNotFoundError, subprocess.CalledProcessError):
+            logger.exception("openssl not found")
+            # Fallback to Python's secrets module
+            output = "".join(secrets.choice(characters) for _ in range(length))
+    return output
+
+
+def decrypt(
+    encrypted_value: str, module: str = "basic", password: str | None = None
+) -> str | None:
+    return providers["encryptions"][module]["decrypt"](encrypted_value, password)
+
+
+def encrypt(
+    value: str, module: str = "basic", password: str | None = None
+) -> str | None:
+    return providers["encryptions"][module]["encrypt"](value, password)
+
+
+def shell(command: str) -> str | None:
+    result = subprocess.run(
+        command,
+        shell=True,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return result.stdout.rstrip("\n")
+
+
+# Main rendering function
+def render_template(template_path: str, password: str | None):
+    env: Environment = Environment(loader=FileSystemLoader("."))
+    env.globals["get_secret"] = get_secret  # pyright: ignore [reportArgumentType]
+    env.globals["import_env"] = import_env  # pyright:ignore [reportArgumentType]
+    env.globals["random"] = generate_random_string  # pyright:ignore [reportArgumentType]
+    decrypt_func = partial(decrypt, password=password)
+    env.globals["decrypt"] = decrypt_func  # pyright:ignore [reportArgumentType]
+    encrypt_func = partial(encrypt, password=password)
+    env.globals["encrypt"] = encrypt_func  # pyright:ignore [reportArgumentType]
+    env.globals["shell"] = shell  # pyright:ignore [reportArgumentType]
+
+    template = env.from_string(template_path)
+    return template.render()
+
+
+def read_input(file_path: str):
+    """Reads input from a file."""
+    with open(file_path, "r", encoding="utf-8") as f:
+        return f.read()
+
+
+def read_stdin():
+    """Reads input from stdin if data is available."""
+    if not sys.stdin.isatty():  # Check if stdin is piped
+        return sys.stdin.read()
+    return None
+
+
+class Args(TypedDict):
+    subcommand: str
+    password: str | None
+    input: str | None
+    file: str | None
+    output: str | None
+    debug: bool
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Render Jinja template with secrets.")
+    _ = parser.add_argument("-d", "--debug", help="Debug mode", action="store_true")
+    subparsers = parser.add_subparsers(help="subcommand help", dest="subcommand")
+    generate_cmd = subparsers.add_parser("generate", help="Generate file from template")
+    _ = generate_cmd.add_argument(
+        "-f", "--file", required=True, help="Path to the Jinja template."
+    )
+    _ = generate_cmd.add_argument(
+        "-o", "--output", help="Path to the output file.", default=None
+    )
+    _ = generate_cmd.add_argument(
+        "-p", "--password", help="Password for decrypt", default=None
+    )
+    encrypt_cmd = subparsers.add_parser("encrypt", help="Encrypt input file or text")
+    _ = encrypt_cmd.add_argument("-p", "--password", help="Password", default=None)
+    _ = encrypt_cmd.add_argument("-i", "--input", help="Input")
+    _ = encrypt_cmd.add_argument("-f", "--file", help="File")
+    _ = encrypt_cmd.add_argument("-o", "--output", help="Directory")
+
+    decrypt_cmd = subparsers.add_parser("decrypt", help="Decrypt input file or text")
+    _ = decrypt_cmd.add_argument("-p", "--password", help="Pass", default=None)
+    _ = decrypt_cmd.add_argument("-i", "--input", help="Input")
+    _ = decrypt_cmd.add_argument("-f", "--file", help="File")
+    _ = decrypt_cmd.add_argument("-o", "--output", help="Directory")
+    args: Args = vars(parser.parse_args())  #pyright: ignore[reportAssignmentType]
+    input_content: str | None = None
+    if "input" in args and args['input'] is not None:
+        input_content = args['input']
+    elif args['file'] is not None:
+        try:
+            with open(args['file'], "r") as f:
+                input_content = "".join(f.readlines())
+        except Exception:
+            input_content = None
+    else:
+        input_content = read_stdin()
+    if args['debug']:
+        logger.logger.setLevel(logging.DEBUG)
+    content: str | None = None
+    match args.get('subcommand', None):
+        case "generate":
+            load_plugins("secrets")
+            load_plugins("encryptions")
+            if input_content:
+                content = render_template(input_content, args.get("password", None))
+        case "encrypt":
+            load_plugins("encryptions")
+            if input_content:
+                content = providers["encryptions"]["basic"]["encrypt"](
+                    input_content, args.get('password', None)
+                )
+        case "decrypt":
+            load_plugins("encryptions")
+            if input_content:
+                content = providers["encryptions"]["basic"]["decrypt"](
+                    input_content, args.get('password', None)
+                )
+        case _:
+            pass
+    if content:
+        if (output := args.get('output', None)):
+            with open(output, "w") as f:
+                _ = f.write(content)
+        else:
+            print(content)
+
+
+if __name__ == "__main__":
+    main()

src/logger.py

@@ -0,0 +1,251 @@
+import contextlib
+import inspect
+import json
+import logging
+import sys
+import traceback
+from contextvars import ContextVar
+from datetime import datetime, timezone
+from functools import wraps
+from typing import Any
+from uuid import uuid4
+
+correlation_id: ContextVar[str] = ContextVar("correlation_id")
+start_time: ContextVar[datetime] = ContextVar("start_time")
+extras: ContextVar[dict] = ContextVar("extras", default={})
+
+
+class Logging:
+    EXCEPTION_LEVEL = 60
+    name = None
+
+    def __init__(self, name=None):
+        if name:
+            self.name = name
+            self.logger = logging.getLogger(name)
+        else:
+            self.logger = logging.getLogger()
+        console_handler = logging.StreamHandler()
+        self.logger.addHandler(console_handler)
+        for h in self.logger.handlers:
+            h.setFormatter(logging.Formatter("%(message)s"))
+        self.logger.setLevel(logging.INFO)
+
+    def build_log(self, level, message, data, frame_level):
+        level_map = {
+            60: "EXCEPTION",
+            50: "CRITICAL",
+            40: "ERROR",
+            30: "WARNING",
+            20: "INFO",
+            10: "DEBUG",
+            0: "NOTSET",
+        }
+        aFrame = sys._getframe(frame_level)
+        info = inspect.getframeinfo(aFrame)
+        log = {
+            "level": level_map[level],
+        }
+        if message:
+            log["message"] = message
+        log["timestamp"] = datetime.now(timezone.utc).isoformat()
+        log["path"] = f"{info.filename}:{info.lineno}"
+        if id := correlation_id.get(None):
+            log["correlation_id"] = id
+        if start_time.get(None):
+            log["duration"] = str(datetime.now(timezone.utc) - start_time.get())
+        if self.name:
+            log["module"] = self.name
+        if extras_data := extras.get(None):
+            log.update(extras_data)
+        if data:
+            log.update(data)
+        if level > logging.WARNING:
+            log.update({"traceback": traceback.format_exc()})
+        return log
+
+    def _exception(self, message, data: dict[str, Any] | None | None = None):
+        self._log(self.EXCEPTION_LEVEL, message, data)
+
+    def _log(self, level, message, data: dict | None | None = None, frame_level=2):
+        self.logger.log(
+            level,
+            json.dumps(self.build_log(level, message, data, frame_level), default=str),
+        )
+
+    def info(self, message: str | None = None, data: dict[str, Any] | None = None):
+        self._log(logging.INFO, message, data, 3)
+
+    def warn(self, message: str | None = None, data: dict[str, Any] | None = None):
+        self._log(logging.WARNING, message, data, 3)
+
+    def warning(self, message: str | None = None, data: dict[str, Any] | None = None):
+        self._log(logging.WARNING, message, data, 3)
+
+    def debug(self, message: str | None = None, data: dict[str, Any] | None = None):
+        self._log(logging.DEBUG, message, data, 3)
+
+    def error(self, message: str | None = None, data: dict[str, Any] | None = None):
+        self._log(logging.ERROR, message, data, 3)
+
+    def exception(self, message: str | None = None, data: dict[str, Any] | None = None):
+        self._log(self.EXCEPTION_LEVEL, message, data, 3)
+
+    def add_extras(self, extras_data):
+        return extras.set({**extras.get({}), **extras_data})
+
+    def extract_args(self, func, args, kwargs):
+        args_name = inspect.signature(func).parameters.keys()
+        return {**dict(zip(args_name, args)), **kwargs}
+
+    def attach_logger(
+        self,
+        attach_correlation_id: bool = True,
+        attached_fields={},
+        log_endpoint: bool = False,
+    ):
+        """
+        This is a Python function that attaches a logger to a given function, with options to include a
+        correlation ID, additional fields, and endpoint information.
+
+        :param attach_correlation_id: A boolean parameter that determines whether or not to attach a
+        unique correlation ID to the log messages. If set to True, a new UUID will be generated and
+        attached to the log messages. If set to False, no correlation ID will be attached, defaults to
+        True
+        :type attach_correlation_id: bool (optional)
+        :param attached_fields: `attached_fields` is a dictionary that contains additional fields to be
+        logged along with the function call. The keys of the dictionary represent the names of the
+        fields to be logged, and the values represent the corresponding argument names of the function.
+        If the argument is not provided, the default value of the argument
+        :param is_lambda: A boolean parameter that indicates whether the function being decorated is a
+        Lambda function or not. If it is a Lambda function, the decorator will wrap the function with
+        additional functionality to handle Lambda-specific event and context parameters, defaults to
+        False
+        :type is_lambda: bool (optional)
+        :param log_endpoint: log_endpoint is a boolean parameter that determines whether to include
+        additional logging information related to the endpoint being called, such as the user agent,
+        operation name, IP address, and field names. If set to True, this information will be added to
+        the log record as extra data, defaults to False
+        :type log_endpoint: bool (optional)
+        :return: The function `attach_logger` is returning a decorator function
+        `decorator_attach_logger`.
+        """
+
+        def decorator_attach_logger(func):
+            @wraps(func)
+            def wrapper(*args, **kwargs):
+                args_dict = self.extract_args(func, args, kwargs)
+                local_extras = {}
+                id = None
+                if attach_correlation_id:
+                    id = correlation_id.set(str(uuid4()))
+                if len(attached_fields) > 0:
+                    local_extras.update(
+                        dict(
+                            {
+                                value: args_dict[field]
+                                if args_dict.get(field, None)
+                                else (
+                                    inspect.signature(func).parameters[field].default
+                                    if inspect.signature(func).parameters[field].default
+                                    != inspect._empty
+                                    else None
+                                )
+                                for field, value in attached_fields.items()
+                            }
+                        )
+                    )
+                if log_endpoint:
+                    info = args_dict.get("info", None)
+                    if info:
+                        local_extras.update(
+                            {
+                                "source": info.context["request"].headers.get(
+                                    "user-agent"
+                                ),
+                                "operation": info.operation.operation.name,
+                                # Will detect if the name exists x-forwarded-for and REMOTE_ADDR
+                                "ip_address": info.context["request"].headers.get(
+                                    "x-forwarded-for"
+                                )
+                                or info.context["request"].headers.get("REMOTE_ADDR")
+                                or "n/a",
+                                "field_names": info.field_name,
+                            }
+                        )
+                if len(local_extras) > 0:
+                    self.add_extras(local_extras)
+                result = func(*args, **kwargs)
+                if id and attach_correlation_id:
+                    correlation_id.reset(id)
+                return result
+
+            return wrapper
+
+        return decorator_attach_logger
+
+    @contextlib.contextmanager
+    def logger_context(
+        self, attach_correlation_id: bool = True, extras_data: dict[str, Any] | None = None
+    ):
+        """
+        This is a context manager function that attaches a logger context with an optional correlation
+        ID.
+
+        :param attach_correlation_id: A boolean parameter that determines whether or not to attach a
+        correlation ID to the logger context. If set to True, a new correlation ID will be generated and
+        attached to the logger context. If set to False, no correlation ID will be attached, defaults to
+        True
+        :type attach_correlation_id: bool (optional)
+        """
+        id = None
+        if attach_correlation_id:
+            id = correlation_id.set(str(uuid4()))
+        extras_token = None
+        if extras_data:
+            extras_token = self.add_extras(extras_data)
+        try:
+            yield
+        finally:
+            if id and attach_correlation_id:
+                correlation_id.reset(id)
+            if extras_token and extras_data:
+                extras.reset(extras_token)
+
+    def record_time(self, func):
+        """
+        This function records the execution time of a given function and returns a wrapper function that
+        can be used to call the original function with the added functionality of recording the
+        execution time.
+
+        :param func: `func` is a function that will be timed and recorded. It is the function that will
+        be passed as an argument to the `record_time` method
+        :param is_lambda: is a boolean parameter that indicates whether the function being decorated is
+        a lambda function or not. If it is a lambda function, the decorator will wrap it with a
+        lambda_wrapper function that takes in event and context parameters in addition to any other
+        arguments. If it is not a lambda function, the decorator will, defaults to False
+        :type is_lambda: bool (optional)
+        :return: The `record_time` function returns a wrapper function that records the execution time
+        of the input function. The returned wrapper function either takes in `event` and `context`
+        parameters (if `is_lambda` is True) or `*args` and `**kwargs` parameters (if `is_lambda` is
+        False) and returns the output of the input function.
+        """
+
+        @wraps(func)
+        def wrapper(*args, **kwargs):
+            time_token = start_time.set(datetime.now(timezone.utc))
+            cur_func = func(*args, **kwargs)
+            start_time.reset(time_token)
+            return cur_func
+
+        return wrapper
+
+    @contextlib.contextmanager
+    def record_time_context(self):
+        time_token = None
+        try:
+            time_token = start_time.set(datetime.now(timezone.utc))
+            yield
+        finally:
+            if time_token:
+                start_time.reset(time_token)

src/plugins/encryptions/basic.py

@@ -0,0 +1,85 @@
+import base64
+import hashlib
+import logging
+import os
+from getpass import getpass
+from typing import Callable
+
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+from cryptography.hazmat.primitives.padding import PKCS7
+
+logger = logging.getLogger(__name__)
+
+
+def derive_key(password: str, salt: bytes) -> bytes:
+    """Derives a 32-byte key from the password using PBKDF2."""
+    return hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000, dklen=32)
+
+
+def encrypt(plaintext: str, password: str | None) -> str:
+    """Encrypts plaintext using AES-256-CBC."""
+    if password is None:
+        password = os.getenv("TEMV_BASIC_PASSWORD")
+    if password is None:
+        password = getpass()
+    salt = os.urandom(16)  # Generate a random salt
+    key = derive_key(password, salt)
+    iv = os.urandom(16)  # AES block size is 16 bytes
+    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
+    encryptor = cipher.encryptor()
+
+    # Apply PKCS7 padding
+    padder = PKCS7(128).padder()
+    padded_data = padder.update(plaintext.encode()) + padder.finalize()
+
+    ciphertext = encryptor.update(padded_data) + encryptor.finalize()
+
+    # Encode IV + ciphertext in Base64
+    return base64.b64encode(salt + iv + ciphertext).decode()
+
+
+def decrypt(encrypted: str, password: str | None) -> str | None:
+    """Decrypts AES-256-CBC encrypted text."""
+    time = 0
+    if password is None:
+        password = os.getenv("TEMV_BASIC_PASSWORD", None)
+    if password is not None:
+        time = 2
+    plaintext = None
+    while time < 3 and plaintext is None:
+        if password is None:
+            password = getpass()
+        try:
+            encrypted_bytes = base64.b64decode(encrypted)
+            salt = encrypted_bytes[:16]  # First 16 bytes are the salt
+            key = derive_key(password, salt)
+            iv = encrypted_bytes[16:32]  # Next 16 bytes are the IV
+            ciphertext = encrypted_bytes[32:]
+
+            cipher = Cipher(
+                algorithms.AES(key), modes.CBC(iv), backend=default_backend()
+            )
+            decryptor = cipher.decryptor()
+
+            padded_plaintext = decryptor.update(ciphertext) + decryptor.finalize()
+
+            # Remove padding
+            unpadder = PKCS7(128).unpadder()
+            plaintext = unpadder.update(padded_plaintext) + unpadder.finalize()
+        except Exception:
+            if time < 2:
+                logger.warning("Cannot decrypt the secret. Try again!")
+            else:
+                logger.warning("Failed to decrypt the secret")
+            time = time + 1
+            plaintext = None
+            password = None
+    if time == 3 or plaintext is None:
+        return None
+    return plaintext.decode()
+
+
+def register(registry: dict[str, dict[str, Callable[[str, str | None], str | None]]]):
+    """Register the pass secret provider."""
+    registry["basic"] = {"encrypt": encrypt, "decrypt": decrypt}

src/plugins/secrets/1password.py

@@ -0,0 +1,14 @@
+import subprocess
+from collections.abc import Callable
+
+
+def get_1password_secret(item_name: str, *_) -> str | None:
+    result = subprocess.run(
+        ["op", "read", f"op://{item_name}"], capture_output=True, text=True
+    )
+    return result.stdout.strip() if result.returncode == 0 else ""
+
+
+def register(secrets_providers: dict[str, Callable[[str, str], str | None]]):
+    """Register the 1Password secret provider."""
+    secrets_providers["1password"] = get_1password_secret

src/plugins/secrets/bitwarden.py

@@ -0,0 +1,24 @@
+import subprocess
+from collections.abc import Callable
+
+
+def get_bitwarden_secret(item_name: str, path: str) -> str | None:
+    command = f'bw get item "{item_name}"'
+    if path and len(path) > 0:
+        type, value = path.split(".")
+        match type:
+            case "field":
+                command += (
+                    f" | jq -r '.fields[] | select(.name == \"{value}\") | .value'"
+                )
+            case "login":
+                command += f" | jq -r '.login.{value}"
+            case _:
+                return None
+    result = subprocess.run(command, capture_output=True, text=True, shell=True)
+    return result.stdout.strip()
+
+
+def register(secrets_providers: dict[str, Callable[[str, str], str | None]]):
+    """Register the Bitwarden secret provider."""
+    secrets_providers["bitwarden"] = get_bitwarden_secret

src/plugins/secrets/pass.py

@@ -0,0 +1,12 @@
+import subprocess
+from collections.abc import Callable
+
+
+def get_pass_secret(item_name: str, *_) -> str | None:
+    result = subprocess.run(["pass", item_name], capture_output=True, text=True)
+    return result.stdout.strip() if result.returncode == 0 else ""
+
+
+def register(secrets_providers: dict[str, Callable[[str, str], str | None]]):
+    """Register the pass secret provider."""
+    secrets_providers["pass"] = get_pass_secret