2569718930@qq.com
66 lines
1.8 KiB
Python
66 lines
1.8 KiB
Python
"""Runtime secret lookup helpers.
|
|
|
|
Secrets rotated from the ops UI live in the shared SQLite database so backend
|
|
processes can pick them up without host-level Docker access. Environment
|
|
variables remain the fallback source for bootstrapping and local development.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
from typing import Any
|
|
|
|
from src.database.db_manager import DBManager
|
|
|
|
|
|
def get_runtime_secret(key: str) -> str:
|
|
normalized_key = str(key or "").strip()
|
|
if not normalized_key:
|
|
return ""
|
|
try:
|
|
stored = DBManager().get_runtime_secret(normalized_key)
|
|
except Exception:
|
|
stored = None
|
|
if stored:
|
|
return str(stored).strip()
|
|
return str(os.getenv(normalized_key) or "").strip()
|
|
|
|
|
|
def get_runtime_secret_status(key: str) -> dict[str, Any]:
|
|
normalized_key = str(key or "").strip()
|
|
if not normalized_key:
|
|
return {
|
|
"key": "",
|
|
"configured": False,
|
|
"masked": "",
|
|
"updated_at": "",
|
|
"updated_by": "",
|
|
"source": "runtime_store",
|
|
}
|
|
try:
|
|
metadata = DBManager().get_runtime_secret_metadata(normalized_key)
|
|
except Exception:
|
|
metadata = {}
|
|
if isinstance(metadata, dict) and metadata.get("configured"):
|
|
return metadata
|
|
|
|
env_value = str(os.getenv(normalized_key) or "").strip()
|
|
if not env_value:
|
|
return {
|
|
"key": normalized_key,
|
|
"configured": False,
|
|
"masked": "",
|
|
"updated_at": "",
|
|
"updated_by": "",
|
|
"source": "runtime_store",
|
|
}
|
|
return {
|
|
"key": normalized_key,
|
|
"configured": True,
|
|
"masked": DBManager._mask_secret_value(env_value),
|
|
"length": len(env_value),
|
|
"updated_at": "",
|
|
"updated_by": "",
|
|
"source": "environment",
|
|
}
|