Class swarmauri_keyprovider_vaulttransit.VaultTransitKeyProvider.VaultTransitKeyProvider

swarmauri_keyprovider_vaulttransit.VaultTransitKeyProvider.VaultTransitKeyProvider

VaultTransitKeyProvider(
    url,
    token,
    *,
    mount="transit",
    namespace=None,
    verify=True,
    prefer_vault_rng=True,
    client=None,
)

Bases: KeyProviderBase

Key provider backed by HashiCorp Vault's Transit engine.

Supports key creation, rotation, listing and JWKS export.

Initialize the key provider.

url (str): Base URL of the Vault server. token (str): Authentication token for Vault. mount (str): Path where the Transit engine is mounted. namespace (str or None): Optional Vault namespace. verify (bool or str): TLS verification settings. prefer_vault_rng (bool): Prefer Vault's RNG for random bytes. client (Any or None): Preconfigured hvac client to use.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

def __init__(
    self,
    url: str,
    token: str,
    *,
    mount: str = "transit",
    namespace: Optional[str] = None,
    verify: bool | str = True,
    prefer_vault_rng: bool = True,
    client: Any | None = None,
) -> None:
    """Initialize the key provider.

    url (str): Base URL of the Vault server.
    token (str): Authentication token for Vault.
    mount (str): Path where the Transit engine is mounted.
    namespace (str or None): Optional Vault namespace.
    verify (bool or str): TLS verification settings.
    prefer_vault_rng (bool): Prefer Vault's RNG for random bytes.
    client (Any or None): Preconfigured hvac client to use.
    """
    super().__init__()
    if hvac is None and client is None:  # pragma: no cover - runtime guard
        raise ImportError(
            "hvac is required for VaultTransitKeyProvider (pip install hvac)"
        )
    self._client = client or hvac.Client(
        url=url, token=token, namespace=namespace, verify=verify
    )  # type: ignore[attr-defined]
    if not self._client.is_authenticated():
        raise RuntimeError(
            "VaultTransitKeyProvider: failed to authenticate to Vault"
        )
    self._mount = mount
    self._transit = self._client.secrets.transit
    self._prefer_vault_rng = prefer_vault_rng

type class-attribute instance-attribute

type = 'VaultTransitKeyProvider'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Describe supported key types, algorithms and features.

RETURNS (Mapping[str, Iterable[str]]): Supported capabilities.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

def supports(self) -> Mapping[str, Iterable[str]]:
    """Describe supported key types, algorithms and features.

    RETURNS (Mapping[str, Iterable[str]]): Supported capabilities.
    """
    return {
        "class": ("sym", "asym"),
        "algs": (
            KeyAlg.AES256_GCM,
            KeyAlg.RSA_OAEP_SHA256,
            KeyAlg.RSA_PSS_SHA256,
            KeyAlg.ECDSA_P256_SHA256,
            KeyAlg.ED25519,
        ),
        "features": ("create", "rotate", "jwks", "non_exportable"),
    }

create_key async

create_key(spec)

Create a new key in Vault.

spec (KeySpec): Desired key specification. RETURNS (KeyRef): Reference to the created key.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def create_key(self, spec: KeySpec) -> KeyRef:
    """Create a new key in Vault.

    spec (KeySpec): Desired key specification.
    RETURNS (KeyRef): Reference to the created key.
    """
    vtype, purpose = self._vault_type_for_alg(spec.alg)
    name = (
        spec.label or f"k-{hashlib.sha256(os.urandom(16)).hexdigest()[:12]}"
    ).strip()
    self._transit.create_key(
        name=name,
        type=vtype,
        exportable=False,
        allow_plaintext_backup=False,
        mount_point=self._mount,
    )
    status = self._key_status(name)
    latest = int(status["latest_version"])
    public_pem = None
    if purpose in ("signing", "encryption") and spec.alg != KeyAlg.AES256_GCM:
        public_pem = self._export_public_pem(name, latest, purpose)
    return KeyRef(
        kid=name,
        version=latest,
        type="OPAQUE",
        uses=spec.uses,
        export_policy=ExportPolicy.NONE,
        public=public_pem,
        material=None,
        tags={
            "label": spec.label,
            "alg": spec.alg.value,
            "vault_mount": self._mount,
            "vault_type": vtype,
            "vault_purpose": purpose,
        },
        fingerprint=self._fingerprint(public=public_pem, kid=name),
    )

import_key async

import_key(spec, material, *, public=None)

Import a key into Vault.

This provider does not support importing existing key material.

spec (KeySpec): Specification of the key to import. material (bytes): Raw key material. public (bytes or None): Optional public portion of the key. RAISES (NotImplementedError): Always raised.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def import_key(
    self, spec: KeySpec, material: bytes, *, public: Optional[bytes] = None
) -> KeyRef:
    """Import a key into Vault.

    This provider does not support importing existing key material.

    spec (KeySpec): Specification of the key to import.
    material (bytes): Raw key material.
    public (bytes or None): Optional public portion of the key.
    RAISES (NotImplementedError): Always raised.
    """
    raise NotImplementedError(
        "VaultTransitKeyProvider.import_key is intentionally not supported"
    )

rotate_key async

rotate_key(kid, *, spec_overrides=None)

Rotate an existing key.

kid (str): Identifier of the key to rotate. spec_overrides (dict or None): Optional override values. RETURNS (KeyRef): Reference to the rotated key version.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def rotate_key(
    self, kid: str, *, spec_overrides: Optional[dict] = None
) -> KeyRef:
    """Rotate an existing key.

    kid (str): Identifier of the key to rotate.
    spec_overrides (dict or None): Optional override values.
    RETURNS (KeyRef): Reference to the rotated key version.
    """
    self._transit.rotate_key(name=kid, mount_point=self._mount)
    status = self._key_status(kid)
    latest = int(status["latest_version"])
    purpose = "signing"
    public_pem = None
    for p in ("signing", "encryption"):
        public_pem = self._export_public_pem(kid, latest, p)
        if public_pem:
            purpose = p
            break
    return KeyRef(
        kid=kid,
        version=latest,
        type="OPAQUE",
        uses=(),
        export_policy=ExportPolicy.NONE,
        public=public_pem,
        material=None,
        tags={
            "vault_mount": self._mount,
            "vault_purpose": purpose,
        },
        fingerprint=self._fingerprint(public=public_pem, kid=kid),
    )

destroy_key async

destroy_key(kid, version=None)

Destroy a key or specific key version.

kid (str): Key identifier. version (int or None): Specific version to destroy or all versions. RETURNS (bool): True when the operation succeeds.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def destroy_key(self, kid: str, version: Optional[int] = None) -> bool:
    """Destroy a key or specific key version.

    kid (str): Key identifier.
    version (int or None): Specific version to destroy or all versions.
    RETURNS (bool): ``True`` when the operation succeeds.
    """
    if version is None:
        self._transit.delete_key(name=kid, mount_point=self._mount)
        return True
    self._transit.destroy_key(
        name=kid, versions=[int(version)], mount_point=self._mount
    )
    return True

get_key async

get_key(kid, version=None, *, include_secret=False)

Retrieve a key reference from Vault.

kid (str): Key identifier. version (int or None): Desired version or latest. include_secret (bool): Unused, kept for interface parity. RETURNS (KeyRef): Reference describing the key.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def get_key(
    self, kid: str, version: Optional[int] = None, *, include_secret: bool = False
) -> KeyRef:
    """Retrieve a key reference from Vault.

    kid (str): Key identifier.
    version (int or None): Desired version or latest.
    include_secret (bool): Unused, kept for interface parity.
    RETURNS (KeyRef): Reference describing the key.
    """
    status = self._key_status(kid)
    latest = int(status["latest_version"])
    ver = int(version or latest)
    public_pem = None
    purpose_detected = None
    for p in ("signing", "encryption"):
        public_pem = self._export_public_pem(kid, ver, p)
        if public_pem:
            purpose_detected = p
            break
    return KeyRef(
        kid=kid,
        version=ver,
        type="OPAQUE",
        uses=(),
        export_policy=ExportPolicy.NONE,
        public=public_pem,
        material=None,
        tags={
            "vault_mount": self._mount,
            "vault_purpose": purpose_detected,
            "latest_version": latest,
        },
        fingerprint=self._fingerprint(public=public_pem, kid=kid),
    )

list_versions async

list_versions(kid)

List available versions for a key.

kid (str): Key identifier. RETURNS (Tuple[int, ...]): Sorted tuple of version numbers.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def list_versions(self, kid: str) -> Tuple[int, ...]:
    """List available versions for a key.

    kid (str): Key identifier.
    RETURNS (Tuple[int, ...]): Sorted tuple of version numbers.
    """
    status = self._key_status(kid)
    keys = status.get("keys") or {}
    return tuple(sorted(int(v) for v in keys.keys()))

get_public_jwk async

get_public_jwk(kid, version=None)

Export a public key in JWK format.

kid (str): Key identifier. version (int or None): Specific version or latest. RETURNS (dict): JSON Web Key representation.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def get_public_jwk(self, kid: str, version: Optional[int] = None) -> dict:
    """Export a public key in JWK format.

    kid (str): Key identifier.
    version (int or None): Specific version or latest.
    RETURNS (dict): JSON Web Key representation.
    """
    ref = await self.get_key(kid, version)
    if isinstance(ref.public, (bytes, bytearray)):
        jwk = _pem_to_jwk(bytes(ref.public))
        jwk["kid"] = f"{ref.kid}.{ref.version}"
        return jwk
    return {"kty": "oct", "alg": "A256GCM", "kid": f"{ref.kid}.{ref.version}"}

jwks async

jwks(*, prefix_kids=None)

Return a JWKS document with all available keys.

prefix_kids (str or None): Optional prefix filter for key IDs. RETURNS (dict): JWKS containing available public keys.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def jwks(self, *, prefix_kids: Optional[str] = None) -> dict:
    """Return a JWKS document with all available keys.

    prefix_kids (str or None): Optional prefix filter for key IDs.
    RETURNS (dict): JWKS containing available public keys.
    """
    out: List[dict] = []
    try:
        names = self._list_key_names()
    except Exception:  # pragma: no cover
        names = []
    for name in names:
        if prefix_kids and not str(name).startswith(prefix_kids):
            continue
        try:
            status = self._key_status(name)
            latest = int(status.get("latest_version", 1))
            jwk = await self.get_public_jwk(name, latest)
            out.append(jwk)
        except Exception:  # pragma: no cover
            continue
    return {"keys": out}

random_bytes async

random_bytes(n)

Generate cryptographically secure random bytes.

n (int): Number of bytes to generate. RETURNS (bytes): Random byte string.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def random_bytes(self, n: int) -> bytes:
    """Generate cryptographically secure random bytes.

    n (int): Number of bytes to generate.
    RETURNS (bytes): Random byte string.
    """
    if self._prefer_vault_rng:
        try:
            res = self._client.sys.generate_random_bytes(n_bytes=n)
            data = res.get("data") or {}
            b64 = data.get("random_bytes")
            if b64:
                return base64.b64decode(b64)
        except Exception:  # pragma: no cover
            pass
    return os.urandom(n)

hkdf async

hkdf(ikm, *, salt, info, length)

Derive key material using HKDF-SHA256.

ikm (bytes): Input keying material. salt (bytes): HKDF salt value. info (bytes): Contextual information. length (int): Length of derived key. RETURNS (bytes): Derived key bytes.

Source code in swarmauri_keyprovider_vaulttransit/VaultTransitKeyProvider.py

async def hkdf(self, ikm: bytes, *, salt: bytes, info: bytes, length: int) -> bytes:
    """Derive key material using HKDF-SHA256.

    ikm (bytes): Input keying material.
    salt (bytes): HKDF salt value.
    info (bytes): Contextual information.
    length (int): Length of derived key.
    RETURNS (bytes): Derived key bytes.
    """
    return HKDF(
        algorithm=hashes.SHA256(), length=length, salt=salt, info=info
    ).derive(ikm)

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger

get_key_by_ref async

get_key_by_ref(key_ref, *, include_secret=False)

Resolve simple URI-style key references into :class:KeyRef objects.

Subclasses must implement provider-specific resolution logic.

Source code in swarmauri_base/keys/KeyProviderBase.py

async def get_key_by_ref(
    self,
    key_ref: str,
    *,
    include_secret: bool = False,
) -> KeyRef:
    """Resolve simple URI-style key references into :class:`KeyRef` objects.

    Subclasses must implement provider-specific resolution logic.
    """

    raise NotImplementedError("get_key_by_ref must be implemented by subclasses")