cadrumo.adapters.persistence.storage.blob_store.materialisation module

Route-canonical SecretStore factory.

get_secret_store() is a route-aware lazy factory keyed by the resolved secret-store and blob-store roots from Settings. Stores are cached by normalized route so an explicit Settings route never inherits the first store constructed by an unrelated profile root; callers needing an isolated store inject one directly at the consuming boundary (a store= parameter on the secret-store consumer) rather than through a process-wide override.

This module previously also carried a path-shaped secret bridge (materialise_secret / export_to_temp_path) for third-party SDKs that demand a filesystem path rather than in-memory bytes. It was deleted as unexercised, security-adjacent dormant capability – a route to writing decrypted secrets to the OS tempdir that no production caller had ever taken, sitting in the public facade with an inviting docstring. Every current consumer of a secret (the certificate backend, OAuth flow, custody sessions) reads bytes from SecretStore directly. A future SDK that genuinely cannot consume in-memory bytes gets a purpose-built bridge declared and enrolled at the point it is needed, not one kept live “just in case.”

get_secret_store(*, settings=None)

Return the route-canonical SecretStore.

Stores are cached by normalized secret-store and blob-store roots, so an explicit Settings route never inherits the first store constructed by an unrelated profile root. Callers needing an isolated store inject it directly at the consuming boundary (the store= / settings= parameters on the secret-store consumers) rather than through a process-wide override.

Parameters:

settings (Settings | None) – Optional pre-built settings instance. When None, load_settings() is consulted for the current route.

Return type:

SecretStore

Returns:

The cached SecretStore for the resolved route.