Coverage for src / lexigram / contracts / security / stores.py: 0%

1"""Async persistent secret store protocol. 

2 

3Unlike the synchronous :class:`~lexigram.contracts.security.secrets.SecretStoreProtocol` 

4(which targets external secret managers such as Vault or AWS Secrets Manager), 

5this protocol targets database-backed secret tables where async I/O is required. 

6It is intentionally minimal — no rotation, no versioning — leaving those concerns 

7to the implementation layer. 

8 

9Implementations ship in ``lexigram-sql`` (``lexigram.sql.stores``) so they can share 

10the application's database connection pool. 

11 

12Example:: 

13 

14 from lexigram.contracts.security.stores import AsyncSecretStoreProtocol 

15 

16 store = await container.resolve(AsyncSecretStoreProtocol) 

17 token = await store.get("stripe_api_key") 

18""" 

19 

20from __future__ import annotations 

21 

22from typing import Protocol, runtime_checkable 

23 

24 

25@runtime_checkable 

26class AsyncSecretStoreProtocol(Protocol): 

27 """Async persistent store for sensitive named secret values. 

28 

29 Typical usage:: 

30 

31 store = await container.resolve(AsyncSecretStoreProtocol) 

32 token = await store.get("stripe_api_key") 

33 """ 

34 

35 async def get(self, name: str) -> str | None: 

36 """Return the secret value for *name*, or ``None`` if absent. 

37 

38 Args: 

39 name: Unique secret identifier. 

40 """ 

41 ... 

42 

43 async def get_bulk(self, *names: str) -> dict[str, str]: 

44 """Return a mapping of name → value for all requested secrets. 

45 

46 Args: 

47 names: One or more secret names. 

48 

49 Returns: 

50 Dict containing only the names that were found. 

51 """ 

52 ... 

53 

54 async def set(self, name: str, value: str) -> None: 

55 """Write or overwrite a secret value. 

56 

57 Args: 

58 name: Unique secret identifier. 

59 value: Plaintext secret value. 

60 """ 

61 ... 

62 

63 async def delete(self, name: str) -> None: 

64 """Remove a secret. No-op if absent. 

65 

66 Args: 

67 name: Unique secret identifier. 

68 """ 

69 ... 

70 

71 

72__all__ = ["AsyncSecretStoreProtocol"]