o
    £ý¸i'	  ã                   @  sZ   d Z ddlmZ ddlZddlmZ ddlmZ ddlm	Z	 ddl
mZ G dd	„ d	ƒZdS )
z)Control-plane secret storage abstraction.é    )ÚannotationsN)Úselect)Úget_control_plane_session)ÚPlaceholderAESCipher)ÚTenantSecretc                   @  s<   e Zd ZdZdddd„Zdd	œddd„Zdd	œddd„ZdS )ÚSecretsManagerz?Encrypt and retrieve per-tenant secrets from the control plane.NÚkeyú
str | NoneÚreturnÚNonec                 C  s   |pt  dd¡}t|ƒ| _d S )NÚPLATFORM_SECRETS_KEYzdevelopment-only-key)ÚosÚgetenvr   Úcipher)Úselfr   Ú
master_key© r   ú#platform/secrets/secrets_manager.pyÚ__init__   s   zSecretsManager.__init__)Úapp_idÚ	tenant_idÚstrÚsecret_nameÚsecret_valuer   r   c          	      C  s®   | j  |¡}tƒ D}ttƒ tj|ktj|ktj|k¡ 	d¡}| 
|¡ ¡ }|d u r8t||||d}| |¡ n||_| ¡  | |¡ |W  d   ƒ S 1 sPw   Y  d S )Né   )r   r   r   Úsecret_value_encrypted)r   Úencryptr   r   r   Úwherer   r   r   ÚlimitÚexecuteÚscalar_one_or_noneÚaddr   ÚcommitÚrefresh)	r   r   r   r   r   Úencrypted_valueÚsessionÚstmtÚrecordr   r   r   Ú
put_secret   s0   ýù	ü
$ézSecretsManager.put_secretc                C  sŠ   t ƒ 8}ttƒ tj|ktj|ktj|k¡ d¡}| |¡ 	¡ }|d u r-	 W d   ƒ d S | j
 |j¡W  d   ƒ S 1 s>w   Y  d S )Nr   )r   r   r   r   r   r   r   r   r   r    r   Údecryptr   )r   r   r   r   r%   r&   r'   r   r   r   Ú
get_secret0   s   ýù	ô$ózSecretsManager.get_secret)N)r   r	   r
   r   )
r   r   r   r   r   r   r   r	   r
   r   )r   r   r   r   r   r	   r
   r	   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r(   r*   r   r   r   r   r      s
    r   )r.   Ú
__future__r   r   Ú
sqlalchemyr   Úconfig.control_planer   Úplatform.secrets.encryptionr   Úplatform.tenants.modelsr   r   r   r   r   r   Ú<module>   s    