alex
25db3f81b0
- Add DatabaseCredentialStorage with async CRUD operations - Create Credential SQLAlchemy model with encrypted values - Update GitCredential and AccessTokenCredential to support async - Fix SSH key encryption to use Fernet instead of base64 placeholder
53 lines
1.5 KiB
Python
53 lines
1.5 KiB
Python
"""Credential models and storage interface.
|
|
|
|
Security rules:
|
|
- No plaintext ``private_key`` or ``token`` fields exist on any model class.
|
|
- The ``encrypted_payload`` field is opaque bytes encoded as a string.
|
|
"""
|
|
|
|
import abc
|
|
import uuid
|
|
from datetime import UTC, datetime
|
|
|
|
from pydantic import BaseModel, ConfigDict, Field
|
|
|
|
from app.git.types import CredentialKind
|
|
|
|
|
|
class GitCredential(BaseModel):
|
|
"""Base credential model.
|
|
|
|
Never stores plaintext secrets. The ``encrypted_payload`` field holds
|
|
opaque encrypted data.
|
|
"""
|
|
|
|
model_config = ConfigDict(extra="forbid")
|
|
|
|
id: uuid.UUID = Field(default_factory=uuid.uuid4)
|
|
kind: CredentialKind
|
|
encrypted_payload: str = Field(repr=False)
|
|
created_at: datetime = Field(default_factory=lambda: datetime.now(UTC))
|
|
updated_at: datetime = Field(default_factory=lambda: datetime.now(UTC))
|
|
|
|
|
|
class AccessTokenCredential(GitCredential):
|
|
"""Access-token credential discriminated by ``kind``."""
|
|
|
|
kind: CredentialKind = CredentialKind.access_token
|
|
|
|
|
|
class CredentialStorage(abc.ABC):
|
|
"""Abstract storage backend for :class:`GitCredential` records."""
|
|
|
|
@abc.abstractmethod
|
|
async def create(self, credential: GitCredential) -> uuid.UUID:
|
|
"""Persist *credential* and return its ID."""
|
|
|
|
@abc.abstractmethod
|
|
async def get(self, credential_id: uuid.UUID) -> GitCredential | None:
|
|
"""Retrieve a credential by ID, or ``None`` if not found."""
|
|
|
|
@abc.abstractmethod
|
|
async def delete(self, credential_id: uuid.UUID) -> None:
|
|
"""Remove a credential by ID."""
|