|
| 1 | +"""BindingResolver protocol and built-in implementations. |
| 2 | +
|
| 3 | +This module defines the core extensibility contract for secret resolution. |
| 4 | +Each resolver encapsulates one binding source. Compose them into an ordered |
| 5 | +chain via :class:`ChainedResolver` — the first resolver that succeeds wins. |
| 6 | +
|
| 7 | +Protocol contract:: |
| 8 | +
|
| 9 | + resolver.resolve(module, instance, target) |
| 10 | +
|
| 11 | +- On success: populates ``target`` in-place, returns ``None`` |
| 12 | +- On failure: raises any exception; the chain tries the next resolver |
| 13 | +""" |
| 14 | + |
| 15 | +from __future__ import annotations |
| 16 | + |
| 17 | +from dataclasses import fields, is_dataclass |
| 18 | +from typing import Any, Protocol, runtime_checkable |
| 19 | + |
| 20 | + |
| 21 | +@runtime_checkable |
| 22 | +class Resolver(Protocol): |
| 23 | + """Contract for a single binding resolution strategy. |
| 24 | +
|
| 25 | + A ``BindingResolver`` reads credentials from one source and populates |
| 26 | + ``target`` in-place. Implementations raise on failure so that a |
| 27 | + :class:`ChainedResolver` can try the next strategy. |
| 28 | +
|
| 29 | + Any object implementing ``resolve`` with this signature satisfies the |
| 30 | + protocol — no inheritance required. |
| 31 | + """ |
| 32 | + |
| 33 | + def resolve(self, module: str, instance: str, target: Any) -> None: |
| 34 | + """Populate ``target`` with credentials for ``module``/``instance``. |
| 35 | +
|
| 36 | + Args: |
| 37 | + module: Service module name (e.g. ``"destination"``). |
| 38 | + instance: Instance identifier (e.g. ``"default"``). |
| 39 | + target: Dataclass instance whose ``str`` fields will be set. |
| 40 | +
|
| 41 | + Raises: |
| 42 | + Any exception on failure; the caller determines how to handle it. |
| 43 | + """ |
| 44 | + ... |
| 45 | + |
| 46 | + |
| 47 | +class ChainedResolver: |
| 48 | + """Tries each resolver in order; returns on the first success. |
| 49 | +
|
| 50 | + Collects failure messages from each resolver and raises a |
| 51 | + :class:`RuntimeError` with an aggregated report when all resolvers fail. |
| 52 | +
|
| 53 | + Args: |
| 54 | + resolvers: Ordered list of :class:`BindingResolver` implementations to try. |
| 55 | + base_var_name: Used only for the error guidance message. |
| 56 | + """ |
| 57 | + |
| 58 | + def __init__( |
| 59 | + self, |
| 60 | + resolvers: list[Resolver], |
| 61 | + base_var_name: str = "CLOUD_SDK_CFG", |
| 62 | + ) -> None: |
| 63 | + if not resolvers: |
| 64 | + raise ValueError("resolvers list must not be empty") |
| 65 | + self._resolvers = resolvers |
| 66 | + self._base_var_name = base_var_name |
| 67 | + |
| 68 | + def resolve(self, module: str, instance: str, target: Any) -> None: |
| 69 | + """Try each resolver in order; raise on total failure.""" |
| 70 | + if not is_dataclass(target) or isinstance(target, type): |
| 71 | + raise TypeError("target must be a dataclass instance") |
| 72 | + for f in fields(target): |
| 73 | + if f.type is not str and f.type != "str": |
| 74 | + raise TypeError( |
| 75 | + f"target field {f.name!r} is not a string (only str fields are supported)" |
| 76 | + ) |
| 77 | + |
| 78 | + errors: list[str] = [] |
| 79 | + for resolver in self._resolvers: |
| 80 | + try: |
| 81 | + resolver.resolve(module, instance, target) |
| 82 | + return |
| 83 | + except Exception as e: |
| 84 | + label = type(resolver).__name__ |
| 85 | + errors.append(f"{label} failed: {e}") |
| 86 | + |
| 87 | + raise RuntimeError( |
| 88 | + f"module={module!r} instance={instance!r} failed to read secrets from all resolvers: " |
| 89 | + f"{errors}. " |
| 90 | + "Options: mount secrets under the service binding path, set environment variables " |
| 91 | + f"like {self._base_var_name}_{module}_{instance}_<KEY> (uppercased), or set VCAP_SERVICES." |
| 92 | + ) |
0 commit comments