cadrumo.adapters.persistence.storage.certificate_secret_backend module

Concrete adapter for the application certificate-secret capability.

This module owns the encrypted secret-store record and its persistence errors. The application-facing contract receives only SecretStr values, absence, and non-secret mutation witnesses; storage records never cross that boundary.

Core types: SensitivityClass.

class SecureStorageCertificateSecretBackend(*, bucket_id, store)[source]

Bases: object

Persist named certificate passphrases through encrypted secure storage.

Parameters:
get(name)[source]

Return the persisted passphrase for name, or None when absent.

Return type:

SecretStr | None

Parameters:

name (str)

set(name, secret, *, operation_id=None, occurred_at=None)[source]

Persist (or rotate) the passphrase for name.

Return type:

None

Parameters:

  • name (str)

  • secret (SecretStr)

  • operation_id (str | None)

  • occurred_at (datetime | None)

remove(name)[source]

Remove the persisted passphrase for name; absent is a no-op.

Return type:

bool

Parameters:

name (str)

mutation_operation_id(name)[source]

Return the non-secret operation id stamped on name, if present.

Return type:

str | None

Parameters:

name (str)

request_witness(name, secret)[source]

Return a master-keyed witness for matching a retried set request.

Return type:

str

Parameters:

  • name (str)

  • secret (SecretStr)

build_certificate_secret_backend(*, bucket_id, settings)[source]

Build one bucket-scoped adapter from the explicit routed store.

Return type:

CertificateSecretBackend

Parameters: