j<*ddlmZddlZddlmZmZddlmZddl m Z m Z ddl m Z ddlmZd d lmZd d lmZd d lmZe rddlmaddlmaddlmaddlmZndadadaddZddZ Gddee!e!dzfZ"GddeZ#ddgZ$dS)) annotationsN)IteratorMapping)cached_property) TYPE_CHECKINGAny) FieldInfo) SettingsError) SecretVersion) InitState)EnvSettingsSourcedefault CredentialsSecretManagerServiceClient) BaseSettingsreturnNonec ddlmaddlmat j5t jdtddl m a ddddS#1swxYwYdS#t$r}td|d}~wwxYw)Nrrrignore)categoryrzjGCP Secret Manager dependencies are not installed, run `pip install pydantic-settings[gcp-secret-manager]`) google.authrgoogle_auth_defaultgoogle.auth.credentialsrwarningscatch_warningsfilterwarnings FutureWarninggoogle.cloud.secretmanagerr ImportError)es UC:\Projects\DSCons\.venv\Lib\site-packages\pydantic_settings\sources\providers\gcp.pyimport_gcp_secret_managerr(s >>>>>>777777  $ & & N N  #H} E E E E M M M M M M N N N N N N N N N N N N N N N N N N  x   s:A"A AAAAA A<'A77A<exc ExceptionboolcR ddlm}t||S#t$rYdSwxYw)Nr)NotFoundF)google.api_core.exceptionsr- isinstancer%)r)r-s r'_is_not_found_errorr0-sK777777#x((( uus  &&ceZdZUded<ded<d#d Zed$d Zd%dZed&dZ ed'dZ d(d)dZ d(d*dZ d+dZ d,dZd-dZd.d!Zd"S)/GoogleSecretManagerMappingzdict[str, str | None]_loaded_secretsr_secret_client secret_client project_idstrcase_sensitiver+rrc>i|_||_||_||_dSN)r3r4 _project_id_case_sensitive)selfr5r6r8s r'__init__z#GoogleSecretManagerMapping.__init__:s(!+%-c@|j|jSr:)r4common_project_pathr;r=s r'_gcp_project_pathz,GoogleSecretManagerMapping._gcp_project_path@s"66t7GHHHr? lower_name candidates list[str]c t|dkr|dS||d}tjd|d|d|dtd |S) Nrrz)Secret collision: Found multiple secrets z normalizing to 'z '. Using 'z' for case-insensitive lookup.r ) stacklevel)lensortr warn UserWarning)r=rDrEwinners r'_select_case_insensitive_secretz:GoogleSecretManagerMapping._select_case_insensitive_secretDs z??a  a=  B  =  = =U_ = = = = =       r?dict[str, str]ci}i}|j|j}|D]y}|j|jdd}|||<|js8|}||vrg||<|||z|js3| D]\}}| ||||<|S)N)parentsecret) r4 list_secretsrCparse_secret_pathnamegetr<lowerappenditemsrO)r=mappingnormalized_groupssecretsrSrWrDrEs r'_secret_name_mapz+GoogleSecretManagerMapping._secret_name_mapSs"$24%22$:P2QQ ; ;F&88EEII(TVWWD GDM' ;!ZZ\\ %66646%j1!*-44T:::# c*;*A*A*C*C c c& J&*&J&J:Wa&b&b ##r?cNt|jSr:)listr_keysrBs r' _secret_namesz(GoogleSecretManagerMapping._secret_namesjsD)..00111r?latestkeyversioncD|j|j||Sr:)r4secret_version_pathr;)r=rerfs r'_secret_version_pathz/GoogleSecretManagerMapping._secret_version_pathns "66t7GgVVVr?gcp_secret_name str | Nonec |j|||jjdS#t $rYdSwxYwN)rWzUTF-8)r4access_secret_versionripayloaddatadecoder*)r=rjrfs r'_get_secret_valuez,GoogleSecretManagerMapping._get_secret_valueqsm &<<..HH=d66'?? +   44 sA A AAc |j||jjdS#t $r*}t|rt||Yd}~dSd}~wwxYwrm) r4rnrirorprqr*r0KeyError)r=rjr&s r'_get_secret_value_or_raisez5GoogleSecretManagerMapping._get_secret_value_or_raiseys &<<..??=d66'?? +   "1%% 7//Q644444 sA A BA<<Bc||jvr |j|S|jr*|||j|<|j|S|j|}|,|j|}|r|||j|<nt||j|Sr:)r3r<rur_rXrYrrrt)r=rerjs r' __getitem__z&GoogleSecretManagerMapping.__getitem__s $& & &', ,   -(,(G(G(L(LD  %', ,/33C88  ""377 DDO  (,(>(>(O(OD  % %3-- #C((r?intc*t|jSr:)rJrcrBs r'__len__z"GoogleSecretManagerMapping.__len__s4%&&&r? Iterator[str]c*t|jSr:)iterrcrBs r'__iter__z#GoogleSecretManagerMapping.__iter__sD&'''r?N)r5rr6r7r8r+rrrr7)rDr7rErFrr7)rrP)rrF)rd)rer7rfr7rr7)rjr7rfr7rrk)rjr7rrk)rer7rrk)rrx)rr{)__name__ __module__ __qualname____annotations__r>propertyrCrOrr_rcrirrrurwrzr~r?r'r2r26sA****........ IIIXI    _,222X2WWWWW))))&''''((((((r?r2ceZdZUded<ded<ded<ded< d&d'fd Zd(fd Zd)d Zd*d"Zd+fd$ Zd,d%Z xZ S)-!GoogleSecretManagerSettingsSourceCredentials | None _credentials!SecretManagerServiceClient | Noner4rkr;_explicit_project_idNTr6 settings_clstype[BaseSettings] credentials env_prefixenv_parse_none_strenv_parse_enums bool | Noner5r8project_id_fieldr7 _init_stateInitState | Nonerrc tttt||_d|_||_||_| |_d|_ t |||d||| d|_ dS)aSettings source that reads secrets from Google Cloud Secret Manager. Args: project_id: The GCP project to read secrets from. If not provided, it is resolved lazily (see below). project_id_field: The key, populated by a previous (higher priority) settings source, to use as the ``project_id`` when one is not passed explicitly. This must match the key used in ``current_state`` by the previous source (typically the field name or its preferred alias). For example, with ``some_field: str = Field(alias='GCP_PROJECT')``, previous env sources will expose the value under ``'GCP_PROJECT'``. Defaults to ``'project_id'``. The ``project_id`` is resolved lazily in :meth:`__call__` rather than at construction time so that it can be sourced from settings resolved by previous sources (only available via ``current_state`` once the source is called). Resolution order is: 1. the explicit ``project_id`` argument 2. the ``project_id_field`` value from previous settings sources 3. ``google.auth.default()`` NF)r8renv_ignore_emptyrrrT) rrrr(rr;rr4_project_id_field_env_vars_loadedsuperr>) r=rrr6rrrr5r8rr __class__s r'r>z*GoogleSecretManagerSettingsSource.__init__sH & -1DH[Hc % ' ' ' %/!'+!1 %  )!"1+#    !%r?fieldr field_nametuple[Any, str, bool]ctd|jDd}|rt|jtr|||D]\}}}|jr|}nR|jj|}|1|jj| }|rJ|j ||}|-|j j dr|||fcS|||fcSd|dfSt||\} } } |j j dr| | || fS| | | fS)aOverride get_field_value to get the secret value from GCP Secret Manager. Look for a SecretVersion metadata field to specify a particular SecretVersion. Args: field: The field to get the value for field_name: The declared name of the field Returns: A tuple of (value, key, value_is_complex), where `key` is the identifier used to populate the model (either the field name or an alias, depending on configuration). c3NK|] }t|t|jV!dSr:)r/r rf).0ms r' zDGoogleSecretManagerSettingsSource.get_field_value..s4aaQJqR_D`D`aqyaaaaaar?Npopulate_by_nameF)nextmetadatar/env_varsr2_extract_field_infor8r_rXrYrrr model_configrget_field_value) r=rrsecret_version field_keyenv_namevalue_is_complexrjenv_valvalre is_complexrs r'rz1GoogleSecretManagerSettingsSource.get_field_valuesaa%.aaacghh  +j8RSS +9=9Q9QRWYc9d9d D D5 8%5&_2:OO&*m&D&H&H&R&RO&.*.-*H*L*LX^^M]M]*^*^"D"m==o~^^G* ,9==>PQQI#*J8H#HHHH& 3CCCCCU* *$ww66ujIIS*   ) - -.@ A A /co J. .C##r?c|jdS|j}|j}|6|j|j}t |tr|}|jduo|du}|du}|s|r.t\}}|r|}|rt |tr|}|td||_||_|jt|j|_dSdS)a:Resolve the credentials, project_id and Secret Manager client. ``project_id`` is resolved, in order of precedence, from: the explicit ``project_id`` argument, the ``project_id_field`` value from previous settings sources (``current_state``), and finally ``google.auth.default()``. Nzproject_id is required to be specified either as an argument, via a previous settings source, or from google.auth.default. See https://google-auth.readthedocs.io/en/master/reference/google.auth.html#google.auth.default)r) r;rr current_staterXrr/r7r4rAttributeErrorr)r=r6rstate_project_idneed_credentials need_project_credsr;s r'_resolve_gcp_projectz6GoogleSecretManagerSettingsSource._resolve_gcp_projects'   ' F. '   #155d6LMM *C00 .-  .$6N;$;N!T)  )| )"5"7"7 FK %$  ) ; < < )(   n  (%   &"<IZ"["["[D    ' &r?Mapping[str, str | None]c|jsiS||j|jt dt |j|j|jS)NzGoogleSecretManagerSettingsSource: could not determine GCP project_id or initialize the Secret Manager client. Pass project_id explicitly or ensure it is available via application default credentials or a previous settings source.)r6r8)rrr;r4r r2r8rBs r'_load_env_varsz0GoogleSecretManagerSettingsSource._load_env_vars=sx$ I !!###   #t':'BJ *  D,rrrrr __classcell__)rs@r'rrs$$$$5555$$$$ +/!%!%)-'+;?&* ,(,;%;%;%;%;%;%;%z/$/$/$/$/$/$b*\*\*\*\X    """"""        r?rr)r)r*rr+)% __future__r _annotationsr collections.abcrr functoolsrtypingrrpydantic.fieldsr exceptionsr typesr utilsrenvrrrrrrr$rpydantic_settings.mainrr(r0r7r2r__all__rr?r'rs222222--------%%%%%%%%%%%%%%%%%%%%''''''!!!!!!"""""" ::::::333333EEEEEE3333333K!%$d(d(d(d(d(cDj!9d(d(d(N} } } } } (9} } } @ ()L Mr?