Class swarmauri_keyprovider_gcpkms.GcpKmsKeyProvider.GcpKmsKeyProvider

swarmauri_keyprovider_gcpkms.GcpKmsKeyProvider.GcpKmsKeyProvider

GcpKmsKeyProvider(
    *,
    project_id,
    location_id,
    key_ring_id,
    http_timeout_s=8,
    user_agent="GcpKmsKeyProvider/1.0",
)

Bases: KeyProviderBase

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

def __init__(
    self,
    *,
    project_id: str,
    location_id: str,
    key_ring_id: str,
    http_timeout_s: int = 8,
    user_agent: str = "GcpKmsKeyProvider/1.0",
) -> None:
    super().__init__()
    self._project = project_id
    self._location = location_id
    self._ring = key_ring_id
    self._timeout = http_timeout_s
    self._ua = user_agent

    creds, _ = google.auth.default(scopes=[SCOPE])
    self._creds = creds
    self._ga_req = GARequest()

type class-attribute instance-attribute

type = 'GcpKmsKeyProvider'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

def supports(self) -> Mapping[str, Iterable[str]]:
    return {
        "class": ("kms", "asym", "sym"),
        "algs": ("AES", "RSA", "EC"),
        "features": (
            "create",
            "encrypt",
            "decrypt",
            "sign",
            "verify",
            "wrap",
            "unwrap",
            "jwks",
        ),
    }

create_key async

create_key(spec)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def create_key(self, spec: KeySpec) -> KeyRef:
    purpose = "ENCRYPT_DECRYPT"
    token = self._token()
    url = (
        f"{API_ROOT}/projects/{self._project}/locations/{self._location}/"
        f"keyRings/{self._ring}/cryptoKeys?cryptoKeyId={spec.name}"
    )
    body = {"purpose": purpose}
    r = requests.post(
        url, headers=self._hdr(token), json=body, timeout=self._timeout
    )
    if r.status_code not in (200, 201):
        raise RuntimeError(f"create_key failed: {r.status_code} {r.text}")
    return _GcpKeyRef(
        kid=spec.name,
        version=1,
        type="OPAQUE",
        uses=(KeyUse.encrypt, KeyUse.decrypt),
        export_policy=ExportPolicy.public_only,
        public=None,
        material=None,
        tags={"kms": "gcp"},
        fingerprint=self._fingerprint(kid=spec.name),
    )

import_key async

import_key(spec, material, *, public=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def import_key(
    self, spec: KeySpec, material: bytes, *, public: Optional[bytes] = None
) -> KeyRef:
    raise NotImplementedError(
        "Use Cloud KMS ImportJobs to import external keys (not provided here)"
    )

rotate_key async

rotate_key(kid, *, spec_overrides=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def rotate_key(
    self, kid: str, *, spec_overrides: Optional[dict] = None
) -> KeyRef:
    raise NotImplementedError(
        "Configure rotation via Cloud KMS CryptoKey rotation config or create new versions"
    )

destroy_key async

destroy_key(kid, version=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def destroy_key(self, kid: str, version: Optional[int] = None) -> bool:
    if version is None:
        raise ValueError("GCP KMS requires a specific version to destroy")
    name = self._version_name(kid, version)
    token = self._token()
    url = f"{API_ROOT}/{name}:destroy"
    r = requests.post(url, headers=self._hdr(token), json={}, timeout=self._timeout)
    if r.status_code != 200:
        raise RuntimeError(f"destroy_key failed: {r.status_code} {r.text}")
    return True

get_key async

get_key(kid, version=None, *, include_secret=False)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def get_key(
    self, kid: str, version: Optional[int] = None, *, include_secret: bool = False
) -> KeyRef:
    vname, algo = self._effective_version_and_algo(kid, version)
    public_pem = self._maybe_fetch_public_pem(vname, algo)
    public_bytes = None
    tags: Dict[str, Any] = {"kms": "gcp", "algorithm": algo}
    if public_pem:
        jwk = _jwk_from_pem_public_key(public_pem)
        tags["kty"] = jwk.get("kty")
        public_bytes = json.dumps(
            jwk, separators=(",", ":"), sort_keys=True
        ).encode("utf-8")

    ver_num = int(vname.rsplit("/", 1)[-1])
    if _is_rsa_decrypt_purpose(algo):
        uses = (KeyUse.wrap, KeyUse.unwrap)
    elif _is_rsa_sign_purpose(algo) or _is_ec_sign_purpose(algo):
        uses = (KeyUse.sign, KeyUse.verify)
    else:
        uses = (KeyUse.encrypt, KeyUse.decrypt)

    return _GcpKeyRef(
        kid=kid,
        version=ver_num,
        type="OPAQUE",
        uses=uses,
        export_policy=ExportPolicy.public_only,
        public=public_bytes,
        material=None,
        tags=tags,
        fingerprint=self._fingerprint(public=public_bytes, kid=kid),
    )

list_versions async

list_versions(kid)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def list_versions(self, kid: str) -> Tuple[int, ...]:
    token = self._token()
    name = self._key_name(kid)
    url = f"{API_ROOT}/{name}/cryptoKeyVersions?pageSize=1000"
    r = requests.get(url, headers=self._hdr(token), timeout=self._timeout)
    if r.status_code != 200:
        raise RuntimeError(f"list_versions failed: {r.status_code} {r.text}")
    obj = r.json()
    vers = []
    for v in obj.get("cryptoKeyVersions", []):
        if v.get("state") == "ENABLED":
            vers.append(int(v["name"].split("/")[-1]))
    return tuple(sorted(vers))

get_public_jwk async

get_public_jwk(kid, version=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def get_public_jwk(self, kid: str, version: Optional[int] = None) -> dict:
    ref = await self.get_key(kid, version)
    if not ref.public:
        raise RuntimeError("no public key material available")
    return json.loads(ref.public.decode("utf-8"))

jwks async

jwks(*, prefix_kids=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def jwks(self, *, prefix_kids: Optional[str] = None) -> dict:
    token = self._token()
    list_url = f"{API_ROOT}/projects/{self._project}/locations/{self._location}/keyRings/{self._ring}/cryptoKeys?pageSize=1000"
    r = requests.get(list_url, headers=self._hdr(token), timeout=self._timeout)
    if r.status_code != 200:
        raise RuntimeError(f"jwks list keys failed: {r.status_code} {r.text}")
    keys_out = []
    for ck in r.json().get("cryptoKeys", []):
        kid = ck["name"].split("/")[-1]
        if prefix_kids and not kid.startswith(prefix_kids):
            continue
        v_url = f"{API_ROOT}/{ck['name']}/cryptoKeyVersions?pageSize=1000"
        rv = requests.get(v_url, headers=self._hdr(token), timeout=self._timeout)
        if rv.status_code != 200:
            continue
        for v in rv.json().get("cryptoKeyVersions", []):
            if v.get("state") != "ENABLED":
                continue
            algo = v.get("algorithm", "")
            if (
                _is_rsa_sign_purpose(algo)
                or _is_ec_sign_purpose(algo)
                or _is_rsa_decrypt_purpose(algo)
            ):
                vname = v["name"]
                pem = self._maybe_fetch_public_pem(vname, algo)
                if not pem:
                    continue
                jwk = _jwk_from_pem_public_key(pem)
                jwk["kid"] = f"{kid}.{int(vname.split('/')[-1])}"
                if _is_rsa_sign_purpose(algo):
                    jwk["alg"] = (
                        JWAAlg.PS256.value
                        if "PKCS1_PSS" in algo or "PSS" in algo
                        else JWAAlg.RS256.value
                    )
                elif _is_ec_sign_purpose(algo):
                    jwk["alg"] = (
                        JWAAlg.ES256.value if "P256" in algo else JWAAlg.ES384.value
                    )
                elif _is_rsa_decrypt_purpose(algo):
                    jwk["alg"] = JWAAlg.RSA_OAEP_256.value
                keys_out.append(jwk)
    return {"keys": keys_out}

encrypt async

encrypt(kid, plaintext, *, aad=None, version=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def encrypt(
    self,
    kid: str,
    plaintext: bytes,
    *,
    aad: Optional[bytes] = None,
    version: Optional[int] = None,
) -> bytes:
    name = self._key_name(kid)
    token = self._token()
    url = f"{API_ROOT}/{name}:encrypt"
    body: Dict[str, Any] = {"plaintext": _b64e(plaintext)}
    if aad:
        body["additionalAuthenticatedData"] = _b64e(aad)
    r = requests.post(
        url, headers=self._hdr(token), json=body, timeout=self._timeout
    )
    if r.status_code != 200:
        raise RuntimeError(f"encrypt failed: {r.status_code} {r.text}")
    return _b64d(r.json()["ciphertext"])

decrypt async

decrypt(kid, ciphertext, *, aad=None, version=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def decrypt(
    self,
    kid: str,
    ciphertext: bytes,
    *,
    aad: Optional[bytes] = None,
    version: Optional[int] = None,
) -> bytes:
    name = self._key_name(kid)
    token = self._token()
    url = f"{API_ROOT}/{name}:decrypt"
    body: Dict[str, Any] = {"ciphertext": _b64e(ciphertext)}
    if aad:
        body["additionalAuthenticatedData"] = _b64e(aad)
    r = requests.post(
        url, headers=self._hdr(token), json=body, timeout=self._timeout
    )
    if r.status_code != 200:
        raise RuntimeError(f"decrypt failed: {r.status_code} {r.text}")
    return _b64d(r.json()["plaintext"])

wrap_key async

wrap_key(kid, dek, *, version=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def wrap_key(
    self, kid: str, dek: bytes, *, version: Optional[int] = None
) -> bytes:
    vname, algo = self._effective_version_and_algo(kid, version)
    if not _is_rsa_decrypt_purpose(algo):
        raise ValueError(f"wrap_key requires RSA_DECRYPT_* algorithm, got {algo}")
    pem = self._maybe_fetch_public_pem(vname, algo)
    if not pem:
        raise RuntimeError("No public key available for wrap_key")
    pub = load_pem_public_key(pem)
    if not isinstance(pub, rsa.RSAPublicKey):
        raise ValueError("wrap_key requires RSA public key")
    oaep_hash = _hash_from_algo(algo)
    ct = pub.encrypt(
        dek,
        padding.OAEP(
            mgf=padding.MGF1(algorithm=oaep_hash),
            algorithm=oaep_hash,
            label=None,
        ),
    )
    return ct

unwrap_key async

unwrap_key(kid, wrapped, *, version=None)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def unwrap_key(
    self, kid: str, wrapped: bytes, *, version: Optional[int] = None
) -> bytes:
    vname, algo = self._effective_version_and_algo(kid, version)
    if not _is_rsa_decrypt_purpose(algo):
        raise ValueError(f"unwrap_key requires RSA_DECRYPT_* algorithm, got {algo}")
    token = self._token()
    url = f"{API_ROOT}/{vname}:asymmetricDecrypt"
    body = {"ciphertext": _b64e(wrapped)}
    r = requests.post(
        url, headers=self._hdr(token), json=body, timeout=self._timeout
    )
    if r.status_code != 200:
        raise RuntimeError(f"unwrap_key failed: {r.status_code} {r.text}")
    return _b64d(r.json()["plaintext"])

sign async

sign(kid, message, *, version=None, prehashed=False)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def sign(
    self,
    kid: str,
    message: bytes,
    *,
    version: Optional[int] = None,
    prehashed: bool = False,
) -> bytes:
    vname, algo = self._effective_version_and_algo(kid, version)
    if not (_is_rsa_sign_purpose(algo) or _is_ec_sign_purpose(algo)):
        raise ValueError(
            f"sign requires RSA_SIGN_* or EC_SIGN_* algorithm, got {algo}"
        )

    h = _hash_from_algo(algo)
    if prehashed:
        digest_bytes = message
    else:
        digest = hashes.Hash(h)
        digest.update(message)
        digest_bytes = digest.finalize()

    token = self._token()
    url = f"{API_ROOT}/{vname}:asymmetricSign"
    body = {"digest": {f"sha{h.digest_size * 8}": _b64e(digest_bytes)}}
    r = requests.post(
        url, headers=self._hdr(token), json=body, timeout=self._timeout
    )
    if r.status_code != 200:
        raise RuntimeError(f"sign failed: {r.status_code} {r.text}")
    return _b64d(r.json()["signature"])

verify async

verify(
    kid,
    message,
    signature,
    *,
    version=None,
    prehashed=False,
)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def verify(
    self,
    kid: str,
    message: bytes,
    signature: bytes,
    *,
    version: Optional[int] = None,
    prehashed: bool = False,
) -> bool:
    vname, algo = self._effective_version_and_algo(kid, version)
    pem = self._maybe_fetch_public_pem(vname, algo)
    if not pem:
        raise RuntimeError("No public key available for verify")
    pub = load_pem_public_key(pem)

    h = _hash_from_algo(algo)
    if prehashed:
        digest_bytes = message
    else:
        digest_calc = hashes.Hash(h)
        digest_calc.update(message)
        digest_bytes = digest_calc.finalize()

    try:
        if isinstance(pub, rsa.RSAPublicKey):
            if "PKCS1" in algo and "PSS" not in algo:
                pub.verify(
                    signature,
                    digest_bytes,
                    padding.PKCS1v15(),
                    Prehashed(h),
                )
            else:
                pub.verify(
                    signature,
                    digest_bytes,
                    padding.PSS(
                        mgf=padding.MGF1(h),
                        salt_length=padding.PSS.MAX_LENGTH,
                    ),
                    Prehashed(h),
                )
            return True
        if isinstance(pub, ec.EllipticCurvePublicKey):
            pub.verify(signature, digest_bytes, ec.ECDSA(Prehashed(h)))
            return True
    except Exception:
        return False
    return False

random_bytes async

random_bytes(n)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def random_bytes(self, n: int) -> bytes:
    return secrets.token_bytes(n)

hkdf async

hkdf(ikm, *, salt, info, length)

Source code in swarmauri_keyprovider_gcpkms/GcpKmsKeyProvider.py

async def hkdf(self, ikm: bytes, *, salt: bytes, info: bytes, length: int) -> bytes:
    return HKDF(
        algorithm=hashes.SHA256(), length=length, salt=salt, info=info
    ).derive(ikm)

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger

get_key_by_ref async

get_key_by_ref(key_ref, *, include_secret=False)

Resolve simple URI-style key references into :class:KeyRef objects.

Subclasses must implement provider-specific resolution logic.

Source code in swarmauri_base/keys/KeyProviderBase.py

async def get_key_by_ref(
    self,
    key_ref: str,
    *,
    include_secret: bool = False,
) -> KeyRef:
    """Resolve simple URI-style key references into :class:`KeyRef` objects.

    Subclasses must implement provider-specific resolution logic.
    """

    raise NotImplementedError("get_key_by_ref must be implemented by subclasses")