Class swarmauri_keyprovider_file.FileKeyProvider.FileKeyProvider

swarmauri_keyprovider_file.FileKeyProvider.FileKeyProvider

FileKeyProvider(root_dir)

Bases: KeyProviderBase

File-backed key provider.

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

def __init__(self, root_dir: str | Path) -> None:
    super().__init__()
    self.root = Path(root_dir)
    _ensure_dir(self.root)
    _ensure_dir(self.root / "keys")
    object.__setattr__(self, "_lock", threading.RLock())

type class-attribute instance-attribute

type = 'FileKeyProvider'

root instance-attribute

root = Path(root_dir)

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

def supports(self) -> Mapping[str, Iterable[str]]:
    return {
        "class": ("sym", "asym"),
        "algs": (
            KeyAlg.AES256_GCM,
            KeyAlg.ED25519,
            KeyAlg.X25519,
            KeyAlg.RSA_OAEP_SHA256,
            KeyAlg.RSA_PSS_SHA256,
            KeyAlg.ECDSA_P256_SHA256,
        ),
        "features": (
            "create",
            "rotate",
            "import",
            "jwks",
            "hkdf",
            "random",
            "persist",
        ),
    }

create_key async

create_key(spec)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def create_key(self, spec: KeySpec) -> KeyRef:
    with self._lock:
        kid = _hash_hex(os.urandom(16))
        version = 1
        vdir = self._ver_dir(kid, version)
        _ensure_dir(vdir)

        public: Optional[bytes] = None
        material: Optional[bytes] = None

        if spec.klass == KeyClass.symmetric:
            if spec.alg != KeyAlg.AES256_GCM:
                raise ValueError(f"Unsupported symmetric alg: {spec.alg}")
            raw = secrets.token_bytes(32)
            if spec.export_policy != ExportPolicy.PUBLIC_ONLY:
                material = raw
                (vdir / "private.pem").write_text(
                    json.dumps({"kty": "oct", "k": _b64u(raw)})
                )
            (vdir / "public.jwk").write_text(
                json.dumps({"kty": "oct", "alg": "A256GCM"})
            )
        else:
            if spec.alg == KeyAlg.ED25519:
                sk = ed25519.Ed25519PrivateKey.generate()
            elif spec.alg == KeyAlg.X25519:
                sk = x25519.X25519PrivateKey.generate()
            elif spec.alg in (KeyAlg.RSA_OAEP_SHA256, KeyAlg.RSA_PSS_SHA256):
                bits = spec.size_bits or 3072
                sk = rsa.generate_private_key(public_exponent=65537, key_size=bits)
            elif spec.alg == KeyAlg.ECDSA_P256_SHA256:
                sk = ec.generate_private_key(ec.SECP256R1())
            else:
                raise ValueError(f"Unsupported asymmetric alg: {spec.alg}")

            public, material = _serialize_keypair(sk, spec)
            (vdir / "public.pem").write_bytes(public)
            if material is not None:
                (vdir / "private.pem").write_bytes(material)

        self._write_meta(
            kid,
            klass=spec.klass,
            alg=spec.alg,
            uses=spec.uses,
            export_policy=spec.export_policy,
            label=spec.label,
            tags=spec.tags,
        )

        return KeyRef(
            kid=kid,
            version=version,
            type="OPAQUE",
            uses=spec.uses,
            export_policy=spec.export_policy,
            public=public,
            material=material,
            tags={"label": spec.label, "alg": spec.alg.value, **(spec.tags or {})},
            fingerprint=self._fingerprint(
                public=public, material=material, kid=kid
            ),
        )

import_key async

import_key(spec, material, *, public=None)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def import_key(
    self, spec: KeySpec, material: bytes, *, public: Optional[bytes] = None
) -> KeyRef:
    with self._lock:
        kid = _hash_hex(material if material else os.urandom(16))
        version = 1
        vdir = self._ver_dir(kid, version)
        _ensure_dir(vdir)

        if spec.klass == KeyClass.symmetric:
            if spec.export_policy == ExportPolicy.PUBLIC_ONLY:
                (vdir / "private.pem").write_text(
                    json.dumps({"kty": "oct", "k": None})
                )
                mat_out = None
            else:
                (vdir / "private.pem").write_text(
                    json.dumps({"kty": "oct", "k": _b64u(material)})
                )
                mat_out = material
            (vdir / "public.jwk").write_text(
                json.dumps({"kty": "oct", "alg": "A256GCM"})
            )
            pub_out = None
        else:
            if public:
                (vdir / "public.pem").write_bytes(public)
                pub_out = public
            else:
                try:
                    sk = serialization.load_pem_private_key(material, password=None)
                    pub_out = sk.public_key().public_bytes(
                        serialization.Encoding.PEM,
                        serialization.PublicFormat.SubjectPublicKeyInfo,
                    )
                    (vdir / "public.pem").write_bytes(pub_out)
                except Exception:
                    pub_out = None
            if spec.export_policy != ExportPolicy.PUBLIC_ONLY:
                (vdir / "private.pem").write_bytes(material)
                mat_out = material
            else:
                mat_out = None

        self._write_meta(
            kid,
            klass=spec.klass,
            alg=spec.alg,
            uses=spec.uses,
            export_policy=spec.export_policy,
            label=spec.label,
            tags=spec.tags,
        )

        return KeyRef(
            kid=kid,
            version=version,
            type="OPAQUE",
            uses=spec.uses,
            export_policy=spec.export_policy,
            public=pub_out,
            material=mat_out,
            tags={
                "label": spec.label,
                "alg": spec.alg.value,
                "imported": True,
                **(spec.tags or {}),
            },
            fingerprint=self._fingerprint(
                public=pub_out, material=mat_out, kid=kid
            ),
        )

rotate_key async

rotate_key(kid, *, spec_overrides=None)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def rotate_key(
    self, kid: str, *, spec_overrides: Optional[dict] = None
) -> KeyRef:
    with self._lock:
        meta = self._read_meta(kid)
        latest = self._latest_version(kid)
        next_v = latest + 1
        klass = KeyClass(meta["klass"])
        alg = KeyAlg(meta["alg"])
        uses = tuple(KeyUse(u) for u in meta["uses"])
        export_policy = ExportPolicy(meta["export_policy"])
        label = meta.get("label")
        tags = meta.get("tags") or {}

        vdir = self._ver_dir(kid, next_v)
        _ensure_dir(vdir)

        ov = spec_overrides or {}
        material: Optional[bytes] = None
        public: Optional[bytes] = None

        if klass == KeyClass.symmetric:
            raw = secrets.token_bytes(32)
            if export_policy != ExportPolicy.PUBLIC_ONLY:
                material = raw
                (vdir / "private.pem").write_text(
                    json.dumps({"kty": "oct", "k": _b64u(raw)})
                )
            (vdir / "public.jwk").write_text(
                json.dumps({"kty": "oct", "alg": "A256GCM"})
            )
        else:
            if alg == KeyAlg.ED25519:
                sk = ed25519.Ed25519PrivateKey.generate()
            elif alg == KeyAlg.X25519:
                sk = x25519.X25519PrivateKey.generate()
            elif alg in (KeyAlg.RSA_OAEP_SHA256, KeyAlg.RSA_PSS_SHA256):
                bits = int(ov.get("size_bits") or 3072)
                sk = rsa.generate_private_key(public_exponent=65537, key_size=bits)
            elif alg == KeyAlg.ECDSA_P256_SHA256:
                sk = ec.generate_private_key(ec.SECP256R1())
            else:
                raise ValueError(f"Unsupported alg during rotate: {alg}")

            tmp_spec = KeySpec(
                klass=klass,
                alg=alg,
                uses=uses,
                export_policy=export_policy,
            )
            public, material = _serialize_keypair(sk, tmp_spec)
            (vdir / "public.pem").write_bytes(public)
            if material is not None:
                (vdir / "private.pem").write_bytes(material)

        if ov:
            new_meta = dict(meta)
            if "label" in ov:
                new_meta["label"] = ov["label"]
                label = ov["label"]
            if "tags" in ov and isinstance(ov["tags"], dict):
                tags.update(ov["tags"])
                new_meta["tags"] = tags
            self._meta_path(kid).write_text(json.dumps(new_meta, indent=2))

        return KeyRef(
            kid=kid,
            version=next_v,
            type="OPAQUE",
            uses=uses,
            export_policy=export_policy,
            public=public,
            material=material,
            tags={"label": label, "alg": alg.value, **tags},
            fingerprint=self._fingerprint(
                public=public, material=material, kid=kid
            ),
        )

destroy_key async

destroy_key(kid, version=None)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def destroy_key(self, kid: str, version: Optional[int] = None) -> bool:
    with self._lock:
        kdir = self._key_dir(kid)
        if not kdir.exists():
            return False
        if version is None:
            shutil.rmtree(kdir, ignore_errors=True)
            return True
        vdir = self._ver_dir(kid, version)
        if vdir.exists():
            shutil.rmtree(vdir, ignore_errors=True)
        try:
            _ = self._latest_version(kid)
        except Exception:
            if self._meta_path(kid).exists():
                self._meta_path(kid).unlink(missing_ok=True)
            if kdir.exists():
                try:
                    kdir.rmdir()
                except Exception:
                    pass
        return True

get_key async

get_key(kid, version=None, *, include_secret=False)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def get_key(
    self, kid: str, version: Optional[int] = None, *, include_secret: bool = False
) -> KeyRef:
    with self._lock:
        meta = self._read_meta(kid)
        v = version or self._latest_version(kid)
        vdir = self._ver_dir(kid, v)
        if not vdir.exists():
            raise KeyError(f"unknown version: {kid}.v{v}")

        export_policy = ExportPolicy(meta["export_policy"])
        alg = KeyAlg(meta["alg"])
        uses = tuple(KeyUse(u) for u in meta["uses"])

        public: Optional[bytes] = None
        material: Optional[bytes] = None

        pem_pub = vdir / "public.pem"
        if pem_pub.exists():
            public = pem_pub.read_bytes()
        else:
            jwk_pub = vdir / "public.jwk"
            if jwk_pub.exists():
                public = jwk_pub.read_bytes()

        if include_secret and export_policy != ExportPolicy.PUBLIC_ONLY:
            pem_priv = vdir / "private.pem"
            if pem_priv.exists():
                try:
                    obj = json.loads(pem_priv.read_text())
                    if obj.get("kty") == "oct" and obj.get("k"):
                        material = base64.urlsafe_b64decode(obj["k"] + "==")
                    else:
                        material = pem_priv.read_bytes()
                except json.JSONDecodeError:
                    material = pem_priv.read_bytes()

        return KeyRef(
            kid=kid,
            version=v,
            type="OPAQUE",
            uses=uses,
            export_policy=export_policy,
            public=public,
            material=material,
            tags={
                "label": meta.get("label"),
                "alg": alg.value,
                **(meta.get("tags") or {}),
            },
            fingerprint=self._fingerprint(
                public=public, material=material, kid=kid
            ),
        )

list_versions async

list_versions(kid)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def list_versions(self, kid: str) -> Tuple[int, ...]:
    with self._lock:
        kd = self._key_dir(kid)
        if not kd.exists():
            raise KeyError(f"unknown kid: {kid}")
        vs: list[int] = []
        for entry in kd.iterdir():
            if entry.is_dir() and entry.name.startswith("v"):
                try:
                    vs.append(int(entry.name[1:]))
                except Exception:
                    pass
        if not vs:
            raise KeyError(f"no versions for kid: {kid}")
        vs.sort()
        return tuple(vs)

get_public_jwk async

get_public_jwk(kid, version=None)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def get_public_jwk(self, kid: str, version: Optional[int] = None) -> dict:
    ref = await self.get_key(kid, version, include_secret=False)
    alg = KeyAlg(ref.tags["alg"])

    if alg == KeyAlg.AES256_GCM:
        return {
            "kty": "oct",
            "alg": "A256GCM",
            "kid": f"{ref.kid}.{ref.version}",
        }

    if ref.public is None:
        vdir = self._ver_dir(ref.kid, ref.version)
        pem_pub = vdir / "public.pem"
        if not pem_pub.exists():
            raise RuntimeError("Public material unavailable for asymmetric key")
        pub_bytes = pem_pub.read_bytes()
    else:
        pub_bytes = ref.public

    pk = serialization.load_pem_public_key(pub_bytes)

    if alg == KeyAlg.ED25519:
        raw = pk.public_bytes(
            serialization.Encoding.Raw, serialization.PublicFormat.Raw
        )
        return {
            "kty": "OKP",
            "crv": "Ed25519",
            "x": _b64u(raw),
            "kid": f"{ref.kid}.{ref.version}",
        }

    if alg == KeyAlg.X25519:
        raw = pk.public_bytes(
            serialization.Encoding.Raw, serialization.PublicFormat.Raw
        )
        return {
            "kty": "OKP",
            "crv": "X25519",
            "x": _b64u(raw),
            "kid": f"{ref.kid}.{ref.version}",
        }

    if alg in (KeyAlg.RSA_OAEP_SHA256, KeyAlg.RSA_PSS_SHA256):
        nums = pk.public_numbers()
        n = nums.n.to_bytes((nums.n.bit_length() + 7) // 8, "big")
        e = nums.e.to_bytes((nums.e.bit_length() + 7) // 8, "big")
        return {
            "kty": "RSA",
            "n": _b64u(n),
            "e": _b64u(e),
            "kid": f"{ref.kid}.{ref.version}",
        }

    if alg == KeyAlg.ECDSA_P256_SHA256:
        nums = pk.public_numbers()
        x = nums.x.to_bytes(32, "big")
        y = nums.y.to_bytes(32, "big")
        return {
            "kty": "EC",
            "crv": "P-256",
            "x": _b64u(x),
            "y": _b64u(y),
            "kid": f"{ref.kid}.{ref.version}",
        }

    raise ValueError(f"Unsupported alg for JWK export: {alg}")

jwks async

jwks(*, prefix_kids=None)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def jwks(self, *, prefix_kids: Optional[str] = None) -> dict:
    with self._lock:
        out = []
        kroot = self.root / "keys"
        for kid_dir in kroot.iterdir():
            if not kid_dir.is_dir():
                continue
            kid = kid_dir.name
            if prefix_kids and not kid.startswith(prefix_kids):
                continue
            try:
                latest = self._latest_version(kid)
                out.append(await self.get_public_jwk(kid, latest))
            except Exception:
                continue
        return {"keys": out}

random_bytes async

random_bytes(n)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def random_bytes(self, n: int) -> bytes:
    return secrets.token_bytes(n)

hkdf async

hkdf(ikm, *, salt, info, length)

Source code in swarmauri_keyprovider_file/FileKeyProvider.py

async def hkdf(self, ikm: bytes, *, salt: bytes, info: bytes, length: int) -> bytes:
    return HKDF(
        algorithm=hashes.SHA256(), length=length, salt=salt, info=info
    ).derive(ikm)

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger

get_key_by_ref async

get_key_by_ref(key_ref, *, include_secret=False)

Resolve simple URI-style key references into :class:KeyRef objects.

Subclasses must implement provider-specific resolution logic.

Source code in swarmauri_base/keys/KeyProviderBase.py

async def get_key_by_ref(
    self,
    key_ref: str,
    *,
    include_secret: bool = False,
) -> KeyRef:
    """Resolve simple URI-style key references into :class:`KeyRef` objects.

    Subclasses must implement provider-specific resolution logic.
    """

    raise NotImplementedError("get_key_by_ref must be implemented by subclasses")