o _j;@s ddlmZddlZddlmZmZddlmZddl m Z m Z ddl m Z ddlmZd d lmZd d lmZd d lmZe rYddlmaddlmaddlmaddlmZndadadadddZd ddZ Gdddee!e!dBfZ"GdddeZ#ddgZ$dS)!) annotationsN)IteratorMapping)cached_property) TYPE_CHECKINGAny) FieldInfo) SettingsError) SecretVersion) InitState)EnvSettingsSourcedefault CredentialsSecretManagerServiceClient) BaseSettingsreturnNonec Csz2ddlmaddlmattjdtdddl m a WdWdS1s+wYWdSt yC}zt d|d}~ww)Nrrrignore)categoryrzjGCP Secret Manager dependencies are not installed, run `pip install pydantic-settings[gcp-secret-manager]`) google.authrgoogle_auth_defaultgoogle.auth.credentialsrwarningscatch_warningsfilterwarnings FutureWarninggoogle.cloud.secretmanagerr ImportError)er%b/home/dinkstrade/pdmp/venv/lib/python3.10/site-packages/pydantic_settings/sources/providers/gcp.pyimport_gcp_secret_managers   &r'exc ExceptionboolcCs.z ddlm}t||WStyYdSw)Nr)NotFoundF)google.api_core.exceptionsr+ isinstancer#)r(r+r%r%r&_is_not_found_error-s    r.c@seZdZUded<ded<d.d d Zed/ddZd0ddZed1ddZ ed2ddZ d3d4ddZ d3d5d!d"Z d6d#d$Z d7d%d&Zd8d(d)Zd9d+d,Zd-S):GoogleSecretManagerMappingzdict[str, str | None]_loaded_secretsr_secret_client secret_client project_idstrcase_sensitiver*rrcCsi|_||_||_||_dSN)r0r1 _project_id_case_sensitive)selfr2r3r5r%r%r&__init__:s z#GoogleSecretManagerMapping.__init__cCs|j|jSr6)r1common_project_pathr7r9r%r%r&_gcp_project_path@z,GoogleSecretManagerMapping._gcp_project_path lower_name candidates list[str]cCsLt|dkr |dS||d}tjd|d|d|dtdd |S) Nrrz)Secret collision: Found multiple secrets z normalizing to 'z '. Using 'z' for case-insensitive lookup.r ) stacklevel)lensortrwarn UserWarning)r9r?r@winnerr%r%r&_select_case_insensitive_secretDs z:GoogleSecretManagerMapping._select_case_insensitive_secretdict[str, str]cCsi}i}|jj|jd}|D]'}|j|jdd}|||<|js5|}||vr.g||<|||q|jsJ| D] \}}| ||||<q=|S)N)parentsecret) r1 list_secretsr=parse_secret_pathnamegetr8lowerappenditemsrI)r9mappingnormalized_groupssecretsrLrPr?r@r%r%r&_secret_name_mapSs z+GoogleSecretManagerMapping._secret_name_mapcCst|jSr6)listrXkeysr<r%r%r& _secret_namesjr>z(GoogleSecretManagerMapping._secret_nameslatestkeyversioncCs|j|j||Sr6)r1secret_version_pathr7)r9r]r^r%r%r&_secret_version_pathnsz/GoogleSecretManagerMapping._secret_version_pathgcp_secret_name str | NonecCs8z|jj|||djjdWStyYdSwN)rPzUTF-8)r1access_secret_versionr`payloaddatadecoder))r9rar^r%r%r&_get_secret_valueqs   z,GoogleSecretManagerMapping._get_secret_valuec CsZz|jj||djjdWSty,}zt|r!t||WYd}~dSd}~wwrc) r1rdr`rerfrgr)r.KeyError)r9rar$r%r%r&_get_secret_value_or_raiseys  z5GoogleSecretManagerMapping._get_secret_value_or_raisecCs||jvr |j|S|jr|||j|<|j|S|j|}|dur,|j|}|r7|||j|<nt||j|Sr6)r0r8rjrXrQrRrhri)r9r]rar%r%r& __getitem__s     z&GoogleSecretManagerMapping.__getitem__intcC t|jSr6)rDr[r<r%r%r&__len__ z"GoogleSecretManagerMapping.__len__ Iterator[str]cCrmr6)iterr[r<r%r%r&__iter__roz#GoogleSecretManagerMapping.__iter__N)r2rr3r4r5r*rrrr4)r?r4r@rArr4)rrJ)rrA)r\)r]r4r^r4rr4)rar4r^r4rrb)rar4rrb)r]r4rrb)rrl)rrp)__name__ __module__ __qualname____annotations__r:propertyr=rIrrXr[r`rhrjrkrnrrr%r%r%r&r/6s"          r/cseZdZUded<ded<ded<ded<       d,d-fdd Zd.fd d! Zd/d"d#Zd0d%d&Zd1fd(d) Zd2d*d+Z Z S)3!GoogleSecretManagerSettingsSourceCredentials | None _credentials!SecretManagerServiceClient | Noner1rbr7_explicit_project_idNTr3 settings_clstype[BaseSettings] credentials env_prefixenv_parse_none_strenv_parse_enums bool | Noner2r5project_id_fieldr4 _init_stateInitState | Nonerrc sftdus tdus tdurt||_d|_||_||_| |_d|_ t j |||d||| dd|_ dS)aSettings source that reads secrets from Google Cloud Secret Manager. Args: project_id: The GCP project to read secrets from. If not provided, it is resolved lazily (see below). project_id_field: The key, populated by a previous (higher priority) settings source, to use as the ``project_id`` when one is not passed explicitly. This must match the key used in ``current_state`` by the previous source (typically the field name or its preferred alias). For example, with ``some_field: str = Field(alias='GCP_PROJECT')``, previous env sources will expose the value under ``'GCP_PROJECT'``. Defaults to ``'project_id'``. The ``project_id`` is resolved lazily in :meth:`__call__` rather than at construction time so that it can be sourced from settings resolved by previous sources (only available via ``current_state`` once the source is called). Resolution order is: 1. the explicit ``project_id`` argument 2. the ``project_id_field`` value from previous settings sources 3. ``google.auth.default()`` NF)r5renv_ignore_emptyrrrT) rrrr'r}r7r{r1_project_id_field_env_vars_loadedsuperr:) r9r~rr3rrrr2r5rr __class__r%r&r:s$$ z*GoogleSecretManagerSettingsSource.__init__fieldr field_nametuple[Any, str, bool]c stdd|jDd}|r`t|jtr`|||D]A\}}}|jr$|}n|jj|}|dur8|jj| }|rZ|j ||}|durZ|j j drS|||fS|||fSqd|dfSt ||\} } } |j j drz| durz| || fS| | | fS)aOverride get_field_value to get the secret value from GCP Secret Manager. Look for a SecretVersion metadata field to specify a particular SecretVersion. Args: field: The field to get the value for field_name: The declared name of the field Returns: A tuple of (value, key, value_is_complex), where `key` is the identifier used to populate the model (either the field name or an alias, depending on configuration). css |] }t|tr|jVqdSr6)r-r r^).0mr%r%r& szDGoogleSecretManagerSettingsSource.get_field_value..Npopulate_by_nameF)nextmetadatar-env_varsr/_extract_field_infor5rXrQrRrhr~ model_configrget_field_value) r9rrsecret_version field_keyenv_namevalue_is_complexraenv_valvalr] is_complexrr%r&rs(   z1GoogleSecretManagerSettingsSource.get_field_valuecCs|jdurdS|j}|j}|dur|j|j}t|tr|}|jduo'|du}|du}|s0|rBt \}}|r9|}|rBt|trB|}|durJt d||_||_|jdur^t |jd|_dSdS)a:Resolve the credentials, project_id and Secret Manager client. ``project_id`` is resolved, in order of precedence, from: the explicit ``project_id`` argument, the ``project_id_field`` value from previous settings sources (``current_state``), and finally ``google.auth.default()``. Nzproject_id is required to be specified either as an argument, via a previous settings source, or from google.auth.default. See https://google-auth.readthedocs.io/en/master/reference/google.auth.html#google.auth.default)r) r7r}r{ current_staterQrr-r4r1rAttributeErrorr)r9r3rstate_project_idneed_credentials need_project_credsr7r%r%r&_resolve_gcp_projects2    z6GoogleSecretManagerSettingsSource._resolve_gcp_projectMapping[str, str | None]cCsB|jsiS||jdus|jdurtdt|j|j|jdS)NzGoogleSecretManagerSettingsSource: could not determine GCP project_id or initialize the Secret Manager client. Pass project_id explicitly or ensure it is available via application default credentials or a previous settings source.)r3r5)rrr7r1r r/r5r<r%r%r&_load_env_vars=s z0GoogleSecretManagerSettingsSource._load_env_varsdict[str, Any]csd|_||_tS)NT)rrrr__call__r<rr%r&rMs  z*GoogleSecretManagerSettingsSource.__call__cCs2|jdur|jn|j}|jjd|d|jdS)Nz (project_id=z, env_nested_delimiter=))r7r}rrtenv_nested_delimiter)r9r3r%r%r&__repr__Tsz*GoogleSecretManagerSettingsSource.__repr__) NNNNNNTr3N)r~rrrzr3rbrrbrrbrrr2r|r5rrr4rrrr)rrrr4rrrr)rr)rrrs) rtrurvrwr:rrrrr __classcell__r%r%rr&rys( = 1 ,ryr)r(r)rr*)% __future__r _annotationsrcollections.abcrr functoolsrtypingrrpydantic.fieldsr exceptionsr typesr utilsr envrrrrrrr"rpydantic_settings.mainrr'r.r4r/ry__all__r%r%r%r&s0             g A