aeat.adapters.persistence.storage.secret_store package

Secret-store substrate: keyed secret records over encrypted blobs.

Public surface for the keyed-secret persistence layer. Exposes the typed SecretRecord payload and the SecretStore repository that wraps records in adapters.persistence.storage.envelope.Envelope, persists them via adapters.persistence.storage.blob_store.EncryptedBlobStore, and indexes natural keys by HMAC-SHA256 lookup digest.

The index is deliberately not a plaintext inventory: secret keys, payload bytes, and blob digests are kept out of user-facing miss, collision, corruption, and cleanup messages. SECRET and SESSION records must also carry explicit expiry before write. Consumers that need a filesystem path for an SDK should use adapters.persistence.storage.blob_store.materialise_secret() or adapters.persistence.storage.blob_store.export_to_temp_path(); this package owns opaque secret persistence, not tempfile lifecycle.

Submodules

• aeat.adapters.persistence.storage.secret_store._secret_store module
  • SecretRecord
    • SecretRecord.key
    • SecretRecord.value
    • SecretRecord.classification
    • SecretRecord.metadata
    • SecretRecord.created_at
    • SecretRecord.expires_at
  • SecretStore
    • SecretStore.store_dir
    • SecretStore.put()
    • SecretStore.get()
    • SecretStore.delete()
    • SecretStore.list_digests()
    • SecretStore.rotate()