trigerr 0.2.0__tar.gz → 0.3.0__tar.gz

{trigerr-0.2.0 → trigerr-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trigerr
-Version: 0.2.0
+Version: 0.3.0
 Summary: Python tools for quantitative trading research and analysis.
 Author: Anurag Singh Kushwah
 License-Expression: MIT
@@ -21,6 +21,7 @@ Requires-Dist: redis<6,>=5.0.8
 Requires-Dist: pymongo>=4.0
 Requires-Dist: numba>=0.57
 Requires-Dist: tqdm>=4.0
+Requires-Dist: cryptography>=42
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == "dev"
 Requires-Dist: pytest>=7.0; extra == "dev"

{trigerr-0.2.0 → trigerr-0.3.0}/pyproject.toml

@@ -32,6 +32,7 @@ dependencies = [
     "pymongo>=4.0",
     "numba>=0.57",
     "tqdm>=4.0",
+    "cryptography>=42",
 ]
 
 [project.optional-dependencies]

trigerr-0.3.0/tests/test_crypto_utils.py

@@ -0,0 +1,68 @@
+import pytest
+from cryptography.fernet import Fernet, InvalidToken
+
+from trigerr import crypto_utils as cu
+
+
+@pytest.fixture
+def fernet():
+    return cu.load_key(Fernet.generate_key().decode())
+
+
+def test_value_round_trip_string(fernet):
+    token = cu.encrypt_value("hunter2", fernet)
+    assert token != "hunter2"
+    assert cu.decrypt_value(token, fernet) == "hunter2"
+
+
+def test_value_round_trip_int(fernet):
+    token = cu.encrypt_value(1234, fernet)
+    assert cu.decrypt_value(token, fernet) == 1234
+
+
+def test_value_round_trip_none(fernet):
+    token = cu.encrypt_value(None, fernet)
+    assert cu.decrypt_value(token, fernet) is None
+
+
+def test_input_round_trip(fernet):
+    input_list = [
+        {"key_name": "api_key", "key_value": "abc"},
+        {"key_name": "client_id", "key_value": 42},
+    ]
+    encrypted = cu.encrypt_input(input_list, fernet)
+    assert {d["key_name"] for d in encrypted} == {"api_key", "client_id"}
+    for d in encrypted:
+        assert d["key_value"] not in ("abc", 42)
+
+    decrypted = cu.decrypt_input(encrypted, fernet)
+    assert decrypted == {"api_key": "abc", "client_id": 42}
+
+
+def test_is_encrypted():
+    assert cu.is_encrypted({"cred_enc": "fernet-v1"}) is True
+    assert cu.is_encrypted({"cred_enc": "something-else"}) is False
+    assert cu.is_encrypted({}) is False
+
+
+def test_multi_key_rotation_decrypts_old_token():
+    old_key = Fernet.generate_key().decode()
+    new_key = Fernet.generate_key().decode()
+
+    old_fernet = cu.load_key(old_key)
+    token = cu.encrypt_value("secret", old_fernet)
+
+    rotated_fernet = cu.load_key(f"{new_key},{old_key}")
+    assert cu.decrypt_value(token, rotated_fernet) == "secret"
+
+    # new encryptions use the first (newest) key
+    new_token = cu.encrypt_value("secret2", rotated_fernet)
+    new_only_fernet = cu.load_key(new_key)
+    assert cu.decrypt_value(new_token, new_only_fernet) == "secret2"
+
+
+def test_tamper_detection(fernet):
+    token = cu.encrypt_value("secret", fernet)
+    tampered = token[:-1] + ("A" if token[-1] != "A" else "B")
+    with pytest.raises(InvalidToken):
+        cu.decrypt_value(tampered, fernet)

{trigerr-0.2.0 → trigerr-0.3.0}/tests/test_live_orders_correlation.py

@@ -98,3 +98,32 @@ def test_place_live_order_still_sends_auth_headers():
     finally:
         import trigerr
         trigerr.config["api_key"] = None
+
+
+def test_validate_credential_success():
+    with patch("trigerr.orders.live.requests.post") as mock_post:
+        mock_post.return_value = _mock_response({"status": "SUCCESS", "message": "ok"})
+        status, message = live.validate_credential(credential_id="cred-1")
+
+    assert status == "success"
+    assert message == "ok"
+    sent_body = mock_post.call_args.kwargs["json"]
+    assert sent_body == {"credential_id": "cred-1"}
+
+
+def test_validate_credential_error():
+    with patch("trigerr.orders.live.requests.post") as mock_post:
+        mock_post.return_value = _mock_response({"status": "ERROR", "message": "bad credential"})
+        status, message = live.validate_credential(credential_id="cred-1")
+
+    assert status == "error"
+    assert message == "bad credential"
+
+
+def test_validate_credential_never_sends_credential_values():
+    with patch("trigerr.orders.live.requests.post") as mock_post:
+        mock_post.return_value = _mock_response({"status": "SUCCESS"})
+        live.validate_credential(credential_id="cred-1")
+
+    sent_body = mock_post.call_args.kwargs["json"]
+    assert set(sent_body.keys()) == {"credential_id"}

{trigerr-0.2.0 → trigerr-0.3.0}/trigerr/__init__.py

@@ -1,6 +1,6 @@
 from .config import config
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 
 
 def set_api_key(key):

trigerr-0.3.0/trigerr/crypto_utils.py

@@ -0,0 +1,55 @@
+"""Shared envelope encryption for broker credential values (`broker_credentials.input[].key_value`).
+
+Used by trigerr-oms (encrypt-on-write / decrypt-on-read at its Mongo resolver
+choke point) and trigerr-broker-automation (decrypt before use in its daily
+token-refresh cron, re-encrypt before persisting). Both hold the same master
+key material (env var `BROKER_CRED_MASTER_KEYS`, comma-separated for
+rotation); this module never reads the environment itself — each repo's own
+config module reads the env var and passes the string into load_key().
+
+Usage:
+    from trigerr.crypto_utils import load_key, encrypt_input, decrypt_input, is_encrypted, ENC_MARKER
+
+    fernet = load_key(os.environ["BROKER_CRED_MASTER_KEYS"])
+    encrypted_input = encrypt_input(doc["input"], fernet)
+    # doc["cred_enc"] = ENC_MARKER, doc["input"] = encrypted_input
+
+    if is_encrypted(doc):
+        credentials = decrypt_input(doc["input"], fernet)
+"""
+import json
+
+from cryptography.fernet import Fernet, MultiFernet
+
+ENC_MARKER = "fernet-v1"
+
+
+def load_key(keys_str):
+    """Comma-separated Fernet keys -> MultiFernet. First key encrypts; all
+    keys are tried on decrypt, so rotation is prepend-new-key/soak/drop-old
+    with no flag day."""
+    keys = [k.strip() for k in keys_str.split(",") if k.strip()]
+    return MultiFernet([Fernet(k) for k in keys])
+
+
+def encrypt_value(value, fernet):
+    return fernet.encrypt(json.dumps(value).encode()).decode()
+
+
+def decrypt_value(token, fernet):
+    return json.loads(fernet.decrypt(token.encode()).decode())
+
+
+def encrypt_input(input_list, fernet):
+    """[{key_name, key_value}, ...] -> same shape, key_value replaced by ciphertext."""
+    return [{"key_name": d["key_name"], "key_value": encrypt_value(d["key_value"], fernet)}
+            for d in input_list]
+
+
+def decrypt_input(input_list, fernet):
+    """[{key_name, key_value}, ...] (ciphertext) -> flat {key_name: plain_value} dict."""
+    return {d["key_name"]: decrypt_value(d["key_value"], fernet) for d in input_list}
+
+
+def is_encrypted(doc):
+    return doc.get("cred_enc") == ENC_MARKER

{trigerr-0.2.0 → trigerr-0.3.0}/trigerr/orders/live.py

@@ -289,3 +289,20 @@ def poll_order_status(credential_id, order_id, exchange, max_wait_seconds=1800,
     except Exception as e:
         print(f"Exception in Poll Order Status Function: {e}")
         return "failed", order_response
+
+
+def validate_credential(credential_id):
+    """Ask OMS to check a broker credential is live (real broker call on its
+    side) without ever handling the plaintext credential values here.
+    Returns (status, message) — status is "success" or "error"."""
+    try:
+        print(f"Validating broker credential: {credential_id}")
+        response = requests.post(url=urljoin(orders_url, "validate_broker_credentials"),
+                                 json={"credential_id": str(credential_id)},
+                                 headers=get_auth_headers()).json()
+        if response.get("status") == "SUCCESS":
+            return "success", response.get("message")
+        return "error", response.get("message")
+    except Exception as e:
+        print(f"Exception in Validate Credential Function: {e}")
+        return "error", str(e)

{trigerr-0.2.0 → trigerr-0.3.0}/trigerr.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trigerr
-Version: 0.2.0
+Version: 0.3.0
 Summary: Python tools for quantitative trading research and analysis.
 Author: Anurag Singh Kushwah
 License-Expression: MIT
@@ -21,6 +21,7 @@ Requires-Dist: redis<6,>=5.0.8
 Requires-Dist: pymongo>=4.0
 Requires-Dist: numba>=0.57
 Requires-Dist: tqdm>=4.0
+Requires-Dist: cryptography>=42
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == "dev"
 Requires-Dist: pytest>=7.0; extra == "dev"

{trigerr-0.2.0 → trigerr-0.3.0}/trigerr.egg-info/SOURCES.txt

@@ -1,11 +1,13 @@
 LICENSE
 README.md
 pyproject.toml
+tests/test_crypto_utils.py
 tests/test_live_orders_correlation.py
 tests/test_logging_utils.py
 tests/test_package.py
 trigerr/__init__.py
 trigerr/config.py
+trigerr/crypto_utils.py
 trigerr/custom_indicators.py
 trigerr/logging_utils.py
 trigerr/utils.py

{trigerr-0.2.0 → trigerr-0.3.0}/trigerr.egg-info/requires.txt

@@ -5,6 +5,7 @@ redis<6,>=5.0.8
 pymongo>=4.0
 numba>=0.57
 tqdm>=4.0
+cryptography>=42
 
 [dev]
 build>=1.2