rPj}>ddlmZddlZddlmZmZddlmZddl m Z m Z ddl m Z ddlmZd d lmZd d lmZmZmZd d lmZe rddlmaddlmaddlmaddlm Z ndadadaddZ!ddZ"Gddee#e#dzfZ$GddeZ%ddgZ&y)) annotationsN)IteratorMapping)cached_property) TYPE_CHECKINGAny) FieldInfo) SettingsError) SecretVersion) InitState_parse_env_none_str_validate_by_name_enabled)EnvSettingsSourcedefault CredentialsSecretManagerServiceClient) BaseSettingsc ddlmaddlmat j 5t jdtddl m a dddy#1swYyxYw#t$r}td|d}~wwxYw)Nrrrignore)categoryrzjGCP Secret Manager dependencies are not installed, run `pip install pydantic-settings[gcp-secret-manager]`) google.authrgoogle_auth_defaultgoogle.auth.credentialsrwarningscatch_warningsfilterwarnings FutureWarninggoogle.cloud.secretmanagerr ImportError)es l/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/pydantic_settings/sources/providers/gcp.pyimport_gcp_secret_managerr(si >7  $ $ & N  # #H} E M N N N  x  s4 A"A A AAA A3" A..A3cF ddlm}t||S#t$rYywxYw)Nr)NotFoundF)google.api_core.exceptionsr* isinstancer%)excr*s r'_is_not_found_errorr.-s)7#x(( s   ceZdZUded<ded< d ddZeddZddZedd Z edd Z ddd Z ddd Z dd Z ddZddZddZy)GoogleSecretManagerMappingzdict[str, str | None]_loaded_secretsr_secret_clientNcJi|_||_||_||_||_yN)r1r2 _project_id_case_sensitive_env_parse_none_str)self secret_client project_idcase_sensitiveenv_parse_none_strs r'__init__z#GoogleSecretManagerMapping.__init__:s, "+%-#5 cL|jj|jSr4)r2common_project_pathr5r8s r'_gcp_project_pathz,GoogleSecretManagerMapping._gcp_project_pathGs""66t7G7GHHr>c t|dk(r|dS|j|d}tjd|d|d|dtd |S) Nrrz)Secret collision: Found multiple secrets z normalizing to 'z '. Using 'z' for case-insensitive lookup.r ) stacklevel)lensortr warn UserWarning)r8 lower_name candidateswinners r'_select_case_insensitive_secretz:GoogleSecretManagerMapping._select_case_insensitive_secretKsi z?a a=  B 7 |CTU_T`aX; =    r>ci}i}|jj|j}|D]v}|jj|jj dd}|||<|j rJ|j}||vrg||<||j|x|j s-|jD]\}}|j||||<|S)N)parentsecret) r2 list_secretsrBparse_secret_pathnamegetr6lowerappenditemsrM)r8mappingnormalized_groupssecretsrPrTrJrKs r'_secret_name_mapz+GoogleSecretManagerMapping._secret_name_mapZs"$24%%22$:P:P2Q ;F&&88EII(TVWD GDM''!ZZ\ %6646%j1!*-44T: ;##*;*A*A*C c& J&*&J&J:Wa&b # cr>cHt|jjSr4)listr\keysrAs r' _secret_namesz(GoogleSecretManagerMapping._secret_namesqsD))..011r>cP|jj|j||Sr4)r2secret_version_pathr5)r8keyversions r'_secret_version_pathz/GoogleSecretManagerMapping._secret_version_pathus#""66t7G7GgVVr>c |jj|j||jjj d}t||jS#t $rYywxYwN)rTzUTF-8) r2access_secret_versionrepayloaddatadecode Exceptionrr7)r8gcp_secret_namerdvalues r'_get_secret_valuez,GoogleSecretManagerMapping._get_secret_valuexso ''==..H>gdd66'?  #5$*B*BCC  sAA'' A32A3c& |jj|j|jjj d}t||jS#t $r!}t|r t||Yd}~yd}~wwxYwrg) r2rhrerirjrkrlr.KeyErrorrr7)r8rmrnr&s r'_get_secret_value_or_raisez5GoogleSecretManagerMapping._get_secret_value_or_raises ''==..?>gdd66'? #5$*B*BCC  "1%/Q6 sAA&& B/B  Bc||jvr|j|S|jr-|j||j|<|j|S|jj |}|)|jj |j }|r|j ||j|<n t||j|Sr4)r1r6rrr\rUrVrorq)r8rcrms r' __getitem__z&GoogleSecretManagerMapping.__getitem__s $&& &'', ,   (,(G(G(LD  %'', ,//33C8  ""3377 DO (,(>(>(OD  %3- ##C((r>c,t|jSr4)rFr`rAs r'__len__z"GoogleSecretManagerMapping.__len__s4%%&&r>c,t|jSr4)iterr`rAs r'__iter__z#GoogleSecretManagerMapping.__iter__sD&&''r>r4) r9rr:strr;boolr< str | NonereturnNoner}rz)rJrzrK list[str]r}rz)r}zdict[str, str])r}r)latest)rcrzrdrzr}rz)rmrzrdrzr}r|)rmrzr}r|)rcrzr}r|)r}int)r}z Iterator[str])__name__ __module__ __qualname____annotations__r=propertyrBrMrr\r`rerorrrtrvryr>r'r0r06s**..*. 61 6 6 6 ' 6  6II ,22WD D)&'(r>r0ceZdZUded<ded<ded<ded< d dfd Zdfd Zdd Zdd Zdfd Zdd Z xZ S)!GoogleSecretManagerSettingsSourceCredentials | None _credentials!SecretManagerServiceClient | Noner2r|r5_explicit_project_idc t tt t||_d|_||_||_| |_d|_ t |-|||d||| d|_ y)aSettings source that reads secrets from Google Cloud Secret Manager. Args: project_id: The GCP project to read secrets from. If not provided, it is resolved lazily (see below). project_id_field: The key, populated by a previous (higher priority) settings source, to use as the ``project_id`` when one is not passed explicitly. This must match the key used in ``current_state`` by the previous source (typically the field name or its preferred alias). For example, with ``some_field: str = Field(alias='GCP_PROJECT')``, previous env sources will expose the value under ``'GCP_PROJECT'``. Defaults to ``'project_id'``. The ``project_id`` is resolved lazily in :meth:`__call__` rather than at construction time so that it can be sourced from settings resolved by previous sources (only available via ``current_state`` once the source is called). Resolution order is: 1. the explicit ``project_id`` argument 2. the ``project_id_field`` value from previous settings sources 3. ``google.auth.default()`` NF)r; env_prefixenv_ignore_emptyr<env_parse_enums _init_stateT) rrrr(rr5rr2_project_id_field_env_vars_loadedsuperr=) r8 settings_cls credentialsr:rr<rr9r;project_id_fieldr __class__s r'r=z*GoogleSecretManagerSettingsSource.__init__sH & -1DH[Hc % ' %/!'+!1 %  )!"1+#  !%r>cztd|jDd}|rt|jtr|j ||D]\}}}|j r|}nZ|jjj|}|3|jjj|j}|ss|jj||}|t|jr|||fcS|||fcSd|dfSt |9||\} } } t|jr| | || fS| | | fS)aOverride get_field_value to get the secret value from GCP Secret Manager. Look for a SecretVersion metadata field to specify a particular SecretVersion. Args: field: The field to get the value for field_name: The declared name of the field Returns: A tuple of (value, key, value_is_complex), where `key` is the identifier used to populate the model (either the field name or an alias, depending on configuration). c3VK|]!}t|ts|j#ywr4)r,r rd).0ms r' zDGoogleSecretManagerSettingsSource.get_field_value..saQJqR_D`qyyas))NF)nextmetadatar,env_varsr0_extract_field_infor;r\rUrVrorconfigrget_field_value) r8field field_namesecret_version field_keyenv_namevalue_is_complexrmenv_valvalrc is_complexrs r'rz1GoogleSecretManagerSettingsSource.get_field_valuesDa%..acgh j8RS9=9Q9QRWYc9d D5 8%5&&2:O&*mm&D&D&H&H&RO&.+/--*H*H*L*LX^^M]*^""mm==o~^G*5T[[A#*J8H#HH& 3CCC# D*U* *$w6ujIS* %T[[ 1co J. .C##r>c|jy|j}|j}|7|jj |j }t |tr|}|jduxr|du}|du}|s|r%t\}}|r|}|rt |tr|}| td||_||_|jt|j|_yy)a:Resolve the credentials, project_id and Secret Manager client. ``project_id`` is resolved, in order of precedence, from: the explicit ``project_id`` argument, the ``project_id_field`` value from previous settings sources (``current_state``), and finally ``google.auth.default()``. Nzproject_id is required to be specified either as an argument, via a previous settings source, or from google.auth.default. See https://google-auth.readthedocs.io/en/master/reference/google.auth.html#google.auth.default)r) r5rr current_staterUrr,rzr2rAttributeErrorr)r8r:rstate_project_idneed_credentials need_project_credsr5s r'_resolve_gcp_projectz6GoogleSecretManagerSettingsSource._resolve_gcp_projects    ' .. ''   #1155d6L6LM *C0-  ..$6N;$;N!T) |"5"7 FK$  ; <(   n  (%    &"<IZIZ"[D  'r>c|jsiS|j|j |j t dt |j|j|j |jS)NzGoogleSecretManagerSettingsSource: could not determine GCP project_id or initialize the Secret Manager client. Pass project_id explicitly or ensure it is available via application default credentials or a previous settings source.)r:r;r<)rrr5r2r r0r;r<rAs r'_load_env_varsz0GoogleSecretManagerSettingsSource._load_env_varsHs}$$I !!#    #t':':'BJ *   ''..#66   r>cXd|_|j|_t|S)NT)rrrr__call__)r8rs r'rz*GoogleSecretManagerSettingsSource.__call__]s+!%++- w!!r>c|j |jn |j}|jjd|d|jdS)Nz (project_id=z, env_nested_delimiter=))r5rrrenv_nested_delimiter)r8r:s r'__repr__z*GoogleSecretManagerSettingsSource.__repr__dsR*.)9)9)ET%%4KdKd ~~&&'|J>AXY]YrYrXuuv w r>) NNNNNNTr:N)rztype[BaseSettings]rrr:r|rr|r<r|r bool | Noner9rr;rrrzrzInitState | Noner}r~)rr rrzr}ztuple[Any, str, bool]r}r~)r}zMapping[str, str | None])r}zdict[str, Any]r) rrrrr=rrrrr __classcell__)rs@r'rrs$$55$$ +/!%!%)-'+;?&* ,(,;%(;%(;% ;%  ;% ' ;%%;%9;%$;%;%&;% ;%z1$f*\X *" r>rr)r-rlr}r{)' __future__r _annotationsr collections.abcrr functoolsrtypingrrpydantic.fieldsr exceptionsr typesr utilsrrrenvrrrrrrr$rpydantic_settings.mainrr(r.rzr0r__all__rr>r'rs2-%%%'!MM":3E3K!%$m(cDj!9m(`D (9D N ()L Mr>