Spaces:
Running
Running
File size: 3,150 Bytes
1028375 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 | """Secret-safe runtime configuration helpers.
Credentials are read only from the process environment. This module never
writes secrets to disk and never returns raw values in diagnostic payloads.
"""
from __future__ import annotations
import os
from dataclasses import dataclass
from typing import Mapping
_PLACEHOLDERS = {
"",
"placeholder",
"changeme",
"replace_me",
"your_token_here",
"your_api_key_here",
"hf_...",
"ghp_...",
}
@dataclass(frozen=True)
class SecretStatus:
"""Non-sensitive status for one environment-backed credential."""
name: str
configured: bool
shape_valid: bool
source: str = "environment"
@property
def usable(self) -> bool:
return self.configured and self.shape_valid
def public_dict(self) -> dict[str, object]:
return {
"name": self.name,
"configured": self.configured,
"shape_valid": self.shape_valid,
"usable": self.usable,
"source": self.source,
}
def read_secret(name: str, *, environ: Mapping[str, str] | None = None) -> str:
"""Read a secret from the environment without fallback or persistence."""
values = os.environ if environ is None else environ
return str(values.get(name, "")).strip()
def is_placeholder(value: str) -> bool:
normalized = value.strip().lower()
return normalized in _PLACEHOLDERS or normalized.endswith("_placeholder")
def validate_secret(name: str, *, prefix: str | None = None, environ: Mapping[str, str] | None = None) -> SecretStatus:
value = read_secret(name, environ=environ)
configured = bool(value) and not is_placeholder(value)
shape_valid = configured and (prefix is None or value.startswith(prefix))
return SecretStatus(name=name, configured=configured, shape_valid=shape_valid)
def mask_secret(value: str) -> str:
"""Return a stable non-reversible display form for diagnostics."""
if not value:
return "<unset>"
if len(value) <= 8:
return "<configured>"
return f"{value[:3]}…{value[-2:]}"
def runtime_secret_status(*, environ: Mapping[str, str] | None = None) -> dict[str, dict[str, object]]:
"""Return connection readiness without exposing credential values."""
return {
"HF_TOKEN": validate_secret("HF_TOKEN", prefix="hf_", environ=environ).public_dict(),
"GITHUB_TOKEN": validate_secret("GITHUB_TOKEN", environ=environ).public_dict(),
"OPENAI_API_KEY": validate_secret("OPENAI_API_KEY", prefix="sk-", environ=environ).public_dict(),
"GROQ_API_KEY": validate_secret("GROQ_API_KEY", prefix="gsk_", environ=environ).public_dict(),
"DEEPSEEK_API_KEY": validate_secret("DEEPSEEK_API_KEY", environ=environ).public_dict(),
"GEMINI_API_KEY": validate_secret("GEMINI_API_KEY", environ=environ).public_dict(),
"TOGETHER_API_KEY": validate_secret("TOGETHER_API_KEY", environ=environ).public_dict(),
"FIREWORKS_API_KEY": validate_secret("FIREWORKS_API_KEY", environ=environ).public_dict(),
"AIMLAPI_KEY": validate_secret("AIMLAPI_KEY", environ=environ).public_dict(),
}
|