Skip to content

Commit b6051f2

Browse files
scaleway-botscaleway-bot
authored
feat: add secret protection (#248)
1 parent daae507 commit b6051f2

File tree

6 files changed

+200
-4
lines changed

6 files changed

+200
-4
lines changed

‎scaleway-async/scaleway_async/secret/v1alpha1/api.py

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,70 @@ async def delete_secret(
363363
self._throw_on_error(res)
364364
return None
365365

366+
async def protect_secret(
367+
self,
368+
*,
369+
secret_id: str,
370+
region: Optional[Region] = None,
371+
) -> Secret:
372+
"""
373+
Protect a secret.
374+
Protect a given secret specified by the `secret_id` parameter. A protected secret can be read and modified but cannot be deleted.
375+
:param region: Region to target. If none is passed will use default region from the config.
376+
:param secret_id: ID of the secret to protect.
377+
:return: :class:`Secret <Secret>`
378+
379+
Usage:
380+
::
381+
382+
result = await api.protect_secret(secret_id="example")
383+
"""
384+
385+
param_region = validate_path_param(
386+
"region", region or self.client.default_region
387+
)
388+
param_secret_id = validate_path_param("secret_id", secret_id)
389+
390+
res = self._request(
391+
"POST",
392+
f"/secret-manager/v1alpha1/regions/{param_region}/secrets/{param_secret_id}/protect",
393+
)
394+
395+
self._throw_on_error(res)
396+
return unmarshal_Secret(res.json())
397+
398+
async def unprotect_secret(
399+
self,
400+
*,
401+
secret_id: str,
402+
region: Optional[Region] = None,
403+
) -> Secret:
404+
"""
405+
Unprotect a secret.
406+
Unprotect a given secret specified by the `secret_id` parameter. An unprotected secret can be read, modified and deleted.
407+
:param region: Region to target. If none is passed will use default region from the config.
408+
:param secret_id: ID of the secret to unprotect.
409+
:return: :class:`Secret <Secret>`
410+
411+
Usage:
412+
::
413+
414+
result = await api.unprotect_secret(secret_id="example")
415+
"""
416+
417+
param_region = validate_path_param(
418+
"region", region or self.client.default_region
419+
)
420+
param_secret_id = validate_path_param("secret_id", secret_id)
421+
422+
res = self._request(
423+
"POST",
424+
f"/secret-manager/v1alpha1/regions/{param_region}/secrets/{param_secret_id}/unprotect",
425+
)
426+
427+
self._throw_on_error(res)
428+
return unmarshal_Secret(res.json())
429+
366430
async def add_secret_owner(
367431
self,
368432
*,

‎scaleway-async/scaleway_async/secret/v1alpha1/marshalling.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ def unmarshal_Secret(data: Any) -> Secret:
4848
field = data.get("is_managed", None)
4949
args["is_managed"] = field
5050

51+
field = data.get("is_protected", None)
52+
args["is_protected"] = field
53+
5154
field = data.get("name", None)
5255
args["name"] = field
5356

‎scaleway-async/scaleway_async/secret/v1alpha1/types.py

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ class Secret:
194194
status: SecretStatus
195195
"""
196196
Current status of the secret.
197-
* `ready`: the secret is ready.
198-
* `locked`: the secret is locked.
197+
* `ready`: the secret can be read, modified and deleted.
198+
* `locked`: no action can be performed on the secret. This status can only be applied and removed by Scaleway.
199199
"""
200200

201201
created_at: Optional[datetime]
@@ -228,6 +228,11 @@ class Secret:
228228
Returns `true` for secrets that are managed by another product.
229229
"""
230230

231+
is_protected: bool
232+
"""
233+
Returns `true` for protected secrets that cannot be deleted.
234+
"""
235+
231236
type_: SecretType
232237
"""
233238
Type of the secret.
@@ -433,6 +438,32 @@ class DeleteSecretRequest:
433438
"""
434439

435440

441+
@dataclass
442+
class ProtectSecretRequest:
443+
region: Optional[Region]
444+
"""
445+
Region to target. If none is passed will use default region from the config.
446+
"""
447+
448+
secret_id: str
449+
"""
450+
ID of the secret to protect.
451+
"""
452+
453+
454+
@dataclass
455+
class UnprotectSecretRequest:
456+
region: Optional[Region]
457+
"""
458+
Region to target. If none is passed will use default region from the config.
459+
"""
460+
461+
secret_id: str
462+
"""
463+
ID of the secret to unprotect.
464+
"""
465+
466+
436467
@dataclass
437468
class AddSecretOwnerRequest:
438469
region: Optional[Region]

‎scaleway/scaleway/secret/v1alpha1/api.py

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,70 @@ def delete_secret(
363363
self._throw_on_error(res)
364364
return None
365365

366+
def protect_secret(
367+
self,
368+
*,
369+
secret_id: str,
370+
region: Optional[Region] = None,
371+
) -> Secret:
372+
"""
373+
Protect a secret.
374+
Protect a given secret specified by the `secret_id` parameter. A protected secret can be read and modified but cannot be deleted.
375+
:param region: Region to target. If none is passed will use default region from the config.
376+
:param secret_id: ID of the secret to protect.
377+
:return: :class:`Secret <Secret>`
378+
379+
Usage:
380+
::
381+
382+
result = api.protect_secret(secret_id="example")
383+
"""
384+
385+
param_region = validate_path_param(
386+
"region", region or self.client.default_region
387+
)
388+
param_secret_id = validate_path_param("secret_id", secret_id)
389+
390+
res = self._request(
391+
"POST",
392+
f"/secret-manager/v1alpha1/regions/{param_region}/secrets/{param_secret_id}/protect",
393+
)
394+
395+
self._throw_on_error(res)
396+
return unmarshal_Secret(res.json())
397+
398+
def unprotect_secret(
399+
self,
400+
*,
401+
secret_id: str,
402+
region: Optional[Region] = None,
403+
) -> Secret:
404+
"""
405+
Unprotect a secret.
406+
Unprotect a given secret specified by the `secret_id` parameter. An unprotected secret can be read, modified and deleted.
407+
:param region: Region to target. If none is passed will use default region from the config.
408+
:param secret_id: ID of the secret to unprotect.
409+
:return: :class:`Secret <Secret>`
410+
411+
Usage:
412+
::
413+
414+
result = api.unprotect_secret(secret_id="example")
415+
"""
416+
417+
param_region = validate_path_param(
418+
"region", region or self.client.default_region
419+
)
420+
param_secret_id = validate_path_param("secret_id", secret_id)
421+
422+
res = self._request(
423+
"POST",
424+
f"/secret-manager/v1alpha1/regions/{param_region}/secrets/{param_secret_id}/unprotect",
425+
)
426+
427+
self._throw_on_error(res)
428+
return unmarshal_Secret(res.json())
429+
366430
def add_secret_owner(
367431
self,
368432
*,

‎scaleway/scaleway/secret/v1alpha1/marshalling.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ def unmarshal_Secret(data: Any) -> Secret:
4848
field = data.get("is_managed", None)
4949
args["is_managed"] = field
5050

51+
field = data.get("is_protected", None)
52+
args["is_protected"] = field
53+
5154
field = data.get("name", None)
5255
args["name"] = field
5356

‎scaleway/scaleway/secret/v1alpha1/types.py

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ class Secret:
194194
status: SecretStatus
195195
"""
196196
Current status of the secret.
197-
* `ready`: the secret is ready.
198-
* `locked`: the secret is locked.
197+
* `ready`: the secret can be read, modified and deleted.
198+
* `locked`: no action can be performed on the secret. This status can only be applied and removed by Scaleway.
199199
"""
200200

201201
created_at: Optional[datetime]
@@ -228,6 +228,11 @@ class Secret:
228228
Returns `true` for secrets that are managed by another product.
229229
"""
230230

231+
is_protected: bool
232+
"""
233+
Returns `true` for protected secrets that cannot be deleted.
234+
"""
235+
231236
type_: SecretType
232237
"""
233238
Type of the secret.
@@ -433,6 +438,32 @@ class DeleteSecretRequest:
433438
"""
434439

435440

441+
@dataclass
442+
class ProtectSecretRequest:
443+
region: Optional[Region]
444+
"""
445+
Region to target. If none is passed will use default region from the config.
446+
"""
447+
448+
secret_id: str
449+
"""
450+
ID of the secret to protect.
451+
"""
452+
453+
454+
@dataclass
455+
class UnprotectSecretRequest:
456+
region: Optional[Region]
457+
"""
458+
Region to target. If none is passed will use default region from the config.
459+
"""
460+
461+
secret_id: str
462+
"""
463+
ID of the secret to unprotect.
464+
"""
465+
466+
436467
@dataclass
437468
class AddSecretOwnerRequest:
438469
region: Optional[Region]

0 commit comments

Comments
 (0)