aeat.adapters.persistence.storage.blob_store._materialisation module

Materialisation helpers for path-shaped secret consumers.

Some third-party libraries (Google’s google.oauth2.service_account.Credentials.from_service_account_file(), Playwright’s storage_state parameter, certain cert-based clients) demand a path on disk rather than bytes in memory. The substrate stores ciphertext; these helpers bridge the gap.

materialise_secret() is a context manager that yields a Path to a short-lived secure tempfile. The file is created under the OS tempdir with mode 0o600 (POSIX) via the same _write_bytes_secure primitive used by the master-key file backend; on context exit the file is unlinked.

export_to_temp_path() is the explicit-cleanup variant for callers that need the path beyond a single with block. It returns a (path, cleanup) tuple; the caller is responsible for invoking cleanup() when the consumer no longer needs the path.

Both helpers consult the active SecretStore via get_secret_store(), a process-singleton lazy factory keyed by the resolved Settings.

get_secret_store(*, settings=None)[source]

Return the process-wide singleton SecretStore.

The first call constructs the store from the resolved Settings; subsequent calls return the same instance. Tests should call override_secret_store() to inject a deterministic implementation.

Parameters:

settings (Settings | None) – Optional pre-built settings instance. When None, load_settings() is consulted on first use.

Return type:

SecretStore

Returns:

The singleton SecretStore.

override_secret_store(store)[source]

Test helper: install (or clear) a process-wide secret-store override.

Parameters:

store (SecretStore | None) – The SecretStore to install. None clears the override and reverts to the standard get_secret_store() resolution.

Return type:

None

materialise_secret(key, *, store=None, prefix='aeat-secret', suffix='')[source]

Context-managed secure tempfile holding the secret value.

The tempfile lives under the OS tempdir with mode 0o600 on POSIX (Windows inherits the parent ACL — out of scope for this helper). The file is unlinked on context exit, including on exception.

Parameters:

  • key (str) – Natural key passed to SecretStore.get().

  • store (SecretStore | None) – Optional SecretStore override. When None, the process-wide singleton from get_secret_store() is used.

  • prefix (str) – Filename prefix for the tempfile. Defaults to aeat-secret.

  • suffix (str) – Filename suffix (e.g. .json for a Google service-account JSON file). Defaults to empty.

Yields:

Path to the materialised file.

Return type:

Iterator[Path]

export_to_temp_path(key, *, store=None, prefix='aeat-secret', suffix='')[source]

Return (path, cleanup) for callers that need the path beyond a with block.

The caller is responsible for invoking cleanup() once the consumer no longer needs the path. cleanup() is idempotent: repeated calls are safe and cost nothing on the second-and-later invocations.

Parameters:
Return type:

tuple[Path, Callable[[], None]]

Returns:

A (path, cleanup) tuple.