Metadata-Version: 2.4
Name: coreason_vault
Version: 0.3.1
Summary: A new Python project.
License: # The Prosperity Public License 3.0.0
         
         Contributor: CoReason, Inc.
         
         Source Code: https://github.com/CoReason-AI/coreason_vault
         
         ## Purpose
         
         This license allows you to use and share this software for noncommercial purposes for free and to try this software for commercial purposes for thirty days.
         
         ## Agreement
         
         In order to receive this license, you have to agree to its rules.  Those rules are both obligations under that agreement and conditions to your license.  Don't do anything with this software that triggers a rule you can't or won't follow.
         
         ## Notices
         
         Make sure everyone who gets a copy of any part of this software from you, with or without changes, also gets the text of this license and the contributor and source code lines above.
         
         ## Commercial Trial
         
         Limit your use of this software for commercial purposes to a thirty-day trial period.  If you use this software for work, your company gets one trial period for all personnel, not one trial per person.
         
         ## Contributions Back
         
         Developing feedback, changes, or additions that you contribute back to the contributor on the terms of a standardized public software license such as [the Blue Oak Model License 1.0.0](https://blueoakcouncil.org/license/1.0.0), [the Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0.html), [the MIT license](https://spdx.org/licenses/MIT.html), or [the two-clause BSD license](https://spdx.org/licenses/BSD-2-Clause.html) doesn't count as use for a commercial purpose.
         
         ## Personal Uses
         
         Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, doesn't count as use for a commercial purpose.
         
         ## Noncommercial Organizations
         
         Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution doesn't count as use for a commercial purpose regardless of the source of funding or obligations resulting from the funding.
         
         ## Defense
         
         Don't make any legal claim against anyone accusing this software, with or without changes, alone or with other technology, of infringing any patent.
         
         ## Copyright
         
         The contributor licenses you to do everything with this software that would otherwise infringe their copyright in it.
         
         ## Patent
         
         The contributor licenses you to do everything with this software that would otherwise infringe any patents they can license or become able to license.
         
         ## Reliability
         
         The contributor can't revoke this license.
         
         ## Excuse
         
         You're excused for unknowingly breaking [Notices](#notices) if you take all practical steps to comply within thirty days of learning you broke the rule.
         
         ## No Liability
         
         ***As far as the law allows, this software comes as is, without any warranty or condition, and the contributor won't be liable to anyone for any damages related to this software or this license, under any kind of legal claim.***
License-File: LICENSE
License-File: NOTICE
Author: Gowtham A Rao
Author-email: gowtham.rao@coreason.ai
Requires-Python: >=3.11
Classifier: License :: Other/Proprietary License
Classifier: Programming Language :: Python :: 3.12
Classifier: Operating System :: OS Independent
Requires-Dist: aiofiles (>=25.1.0,<26.0.0)
Requires-Dist: anyio (>=4.12.1,<5.0.0)
Requires-Dist: cachetools (>=6.2.6,<7.0.0)
Requires-Dist: httpx (>=0.28.1,<0.29.0)
Requires-Dist: loguru (>=0.7.2,<0.8.0)
Requires-Dist: pydantic (>=2.12.5,<3.0.0)
Requires-Dist: pydantic-settings (>=2.12.0,<3.0.0)
Requires-Dist: tenacity (>=9.1.2,<10.0.0)
Project-URL: Documentation, https://github.com/CoReason-AI/coreason_vault
Project-URL: Homepage, https://github.com/CoReason-AI/coreason_vault
Project-URL: Repository, https://github.com/CoReason-AI/coreason_vault
Description-Content-Type: text/markdown

# coreason-vault (The Safe)

![License](https://img.shields.io/badge/license-Prosperity%203.0-blue)
![CI Status](https://github.com/CoReason-AI/coreason-vault/actions/workflows/ci.yml/badge.svg)
![Code Style: Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)
[![Documentation](https://img.shields.io/badge/docs-Product%20Requirements-informational)](docs/product_requirements.md)

**The centralized guardian of secrets for the CoReason platform.**

`coreason-vault` manages secrets at rest and in memory, replacing legacy local encryption and unsafe environment variable practices with a robust, centralized Vault-based architecture.

## Mission

*   **Secure Retrieval:** Fetch API keys and database credentials securely from HashiCorp Vault.
*   **Key Rotation & Leases:** Handle dynamic secrets with lease management.
*   **Encryption as a Service (EaaS):** Delegate encryption of sensitive user data to Vault's Transit Engine, ensuring the application never handles encryption keys.

## Features

*   **"The Safe" Philosophy:** Application code never sees long-lived credentials or performs its own encryption.
*   **Transit Engine Integration:** Replaces local `crypto.py` by offloading encryption/decryption to Vault.
*   **Just-in-Time Secrets:** Fetches secrets on demand with caching (TTL ~60s) to prevent API hammering.
*   **Dynamic Secrets:** Supports retrieval of dynamic secrets with lease information.
*   **Automated Authentication:** Seamlessly handles AppRole (local/VM) and Kubernetes (Prod) authentication with auto-renewal.
*   **Resilience:** Built-in retries and circuit breaking for Vault connection issues.

## Installation

```bash
pip install coreason-vault
```

## Usage

```python
from coreason_vault import VaultManager, VaultConfig
from coreason_vault.exceptions import SecretNotFoundError

# 1. Initialize
# Automatically reads configuration from environment variables:
# VAULT_ADDR, VAULT_ROLE_ID/SECRET_ID (or K8S Auth), etc.
config = VaultConfig()
vault = VaultManager(config)

# 2. Fetch Secret (KV Version 2)
try:
    # Fetches from 'secret/data/coreason/services/openai' (mount point defaults to 'secret')
    creds = vault.secrets.get("coreason/services/openai")
    print(f"Using API Key: {creds['api_key'][:4]}...")
except SecretNotFoundError:
    print("Fatal: OpenAI credentials missing")

# 3. Encrypt Sensitive Data (Transit Engine)
# The app never sees the encryption key. Vault handles the cryptography.
ciphertext = vault.cipher.encrypt(
    plaintext="Sensitive Patient Data",
    key_name="patient-data-key",
    context="user_123"  # Optional: Key derivation context for extra security
)
print(f"Stored in DB: {ciphertext}")
# Output example: vault:v1:QmF...

# 4. Decrypt Data
original_plaintext = vault.cipher.decrypt(
    ciphertext=ciphertext,
    key_name="patient-data-key",
    context="user_123"
)
print(f"Decrypted: {original_plaintext}")
```

## Configuration

The library uses `pydantic-settings` to load configuration from environment variables.

| Variable | Description | Default |
| :--- | :--- | :--- |
| `VAULT_ADDR` | **Required.** The URL of the Vault server. | - |
| `VAULT_NAMESPACE` | The Vault namespace (Enterprise/Cloud). | `None` |
| `VAULT_ROLE_ID` | AppRole Role ID. | `None` |
| `VAULT_SECRET_ID` | AppRole Secret ID. | `None` |
| `VAULT_K8S_ROLE` | Kubernetes Role Name (for K8s auth). | `None` |
| `KUBERNETES_SERVICE_ACCOUNT_TOKEN` | K8s SA Token (injected by K8s). | `None` |
| `VAULT_MOUNT_POINT` | KV v2 Mount Point. | `secret` |
| `VAULT_VERIFY_SSL` | Verify SSL certificates. | `True` |
| `VAULT_TOKEN_TTL` | Token validation interval in seconds. | `60` |

## License

This software is licensed under the **Prosperity Public License 3.0**.
Commercial use beyond a 30-day trial requires a separate license.
See [LICENSE](LICENSE) for details.

