|
6 | 6 | import json |
7 | 7 | from abc import ABC, abstractmethod |
8 | 8 | from enum import Enum |
9 | | -from typing import cast |
| 9 | +from typing import TYPE_CHECKING, Any, cast |
| 10 | + |
| 11 | +from pydantic_core import CoreSchema, core_schema |
10 | 12 |
|
11 | 13 | from airbyte import exceptions as exc |
12 | 14 |
|
13 | 15 |
|
| 16 | +if TYPE_CHECKING: |
| 17 | + from pydantic import GetCoreSchemaHandler, GetJsonSchemaHandler, ValidationInfo |
| 18 | + from pydantic.json_schema import JsonSchemaValue |
| 19 | + |
| 20 | + |
14 | 21 | class SecretSourceEnum(str, Enum): |
15 | 22 | ENV = "env" |
16 | 23 | DOTENV = "dotenv" |
@@ -65,6 +72,49 @@ def parse_json(self) -> dict: |
65 | 72 | }, |
66 | 73 | ) from None |
67 | 74 |
|
| 75 | + # Pydantic compatibility |
| 76 | + |
| 77 | + @classmethod |
| 78 | + def validate( |
| 79 | + cls, |
| 80 | + v: Any, # noqa: ANN401 # Must allow `Any` to match Pydantic signature |
| 81 | + info: ValidationInfo, |
| 82 | + ) -> SecretString: |
| 83 | + """Validate the input value is valid as a secret string.""" |
| 84 | + _ = info # Unused |
| 85 | + if not isinstance(v, str): |
| 86 | + raise exc.PyAirbyteInputError( |
| 87 | + message="A valid `str` or `SecretString` object is required.", |
| 88 | + ) |
| 89 | + return cls(v) |
| 90 | + |
| 91 | + @classmethod |
| 92 | + def __get_pydantic_core_schema__( # noqa: PLW3201 # Pydantic dunder |
| 93 | + cls, |
| 94 | + source_type: Any, # noqa: ANN401 # Must allow `Any` to match Pydantic signature |
| 95 | + handler: GetCoreSchemaHandler, |
| 96 | + ) -> CoreSchema: |
| 97 | + return core_schema.with_info_after_validator_function( |
| 98 | + function=cls.validate, schema=handler(str), field_name=handler.field_name |
| 99 | + ) |
| 100 | + |
| 101 | + @classmethod |
| 102 | + def __get_pydantic_json_schema__( # noqa: PLW3201 # Pydantic dunder method |
| 103 | + cls, _core_schema: core_schema.CoreSchema, handler: GetJsonSchemaHandler |
| 104 | + ) -> JsonSchemaValue: |
| 105 | + """ |
| 106 | + Return a modified JSON schema for the secret string. |
| 107 | +
|
| 108 | + - `writeOnly=True` is the official way to prevent secrets from being exposed inadvertently. |
| 109 | + - `Format=password` is a popular and readable convention to indicate the field is sensitive. |
| 110 | + """ |
| 111 | + _ = _core_schema, handler # Unused |
| 112 | + return { |
| 113 | + "type": "string", |
| 114 | + "format": "password", |
| 115 | + "writeOnly": True, |
| 116 | + } |
| 117 | + |
68 | 118 |
|
69 | 119 | class SecretManager(ABC): |
70 | 120 | """Abstract base class for secret managers. |
|
0 commit comments