From 4f2a0945b87679ce60b84f4943f4c8971ef89167 Mon Sep 17 00:00:00 2001 From: azure-sdk Date: Thu, 22 Oct 2026 21:03:19 +0000 Subject: [PATCH] Configurations: 'specification/keyvault/data-plane/Secrets/tspconfig.yaml', API Version: 2026-03-01-preview, SDK Release Type: beta, and CommitSHA: 'f4f159a5a3412acc3fd8793d27ecedd2f99a751c' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6990599 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. --- .../azure-keyvault-secrets/CHANGELOG.md | 4 + .../azure-keyvault-secrets/MANIFEST.in | 3 +- .../azure-keyvault-secrets/_metadata.json | 9 +- .../apiview-properties.json | 3 +- .../azure-keyvault-secrets/azure/__init__.py | 5 - .../azure/keyvault/__init__.py | 5 - .../azure/keyvault/secrets/__init__.py | 22 +- .../azure/keyvault/secrets/_client.py | 494 -------------- .../keyvault/secrets/_generated/_client.py | 16 +- .../secrets/_generated/_configuration.py | 12 +- .../_generated/_operations/_operations.py | 104 +-- .../secrets/_generated/_operations/_patch.py | 1 - .../keyvault/secrets/_generated/_patch.py | 1 - .../secrets/_generated/_utils/model_base.py | 603 +++++++++++++++--- .../_generated/_utils/serialization.py | 144 ++++- .../keyvault/secrets/_generated/_version.py | 2 +- .../secrets/_generated/aio/_client.py | 16 +- .../secrets/_generated/aio/_configuration.py | 12 +- .../_generated/aio/_operations/_operations.py | 80 ++- .../_generated/aio/_operations/_patch.py | 1 - .../keyvault/secrets/_generated/aio/_patch.py | 1 - .../secrets/_generated/models/_enums.py | 6 +- .../secrets/_generated/models/_models.py | 16 +- .../secrets/_generated/models/_patch.py | 1 - .../keyvault/secrets/_generated/types.py | 113 ++++ .../azure/keyvault/secrets/_models.py | 399 ------------ .../azure/keyvault/secrets/_sdk_moniker.py | 7 - .../keyvault/secrets/_shared/__init__.py | 78 --- .../keyvault/secrets/_shared/_polling.py | 136 ---- .../secrets/_shared/_polling_async.py | 80 --- .../_shared/async_challenge_auth_policy.py | 304 --------- .../secrets/_shared/async_client_base.py | 117 ---- .../secrets/_shared/challenge_auth_policy.py | 394 ------------ .../keyvault/secrets/_shared/client_base.py | 162 ----- .../secrets/_shared/http_challenge.py | 186 ------ .../secrets/_shared/http_challenge_cache.py | 112 ---- .../azure/keyvault/secrets/_version.py | 6 - .../azure/keyvault/secrets/aio/__init__.py | 7 - .../azure/keyvault/secrets/aio/_client.py | 468 -------------- .../azure/keyvault/secrets/py.typed | 0 .../azure-keyvault-secrets/pyproject.toml | 68 +- .../azure-keyvault-secrets/sdk_packaging.toml | 2 - sdk/keyvault/azure-keyvault-secrets/setup.py | 72 +++ .../tests/test_challenge_auth.py | 9 +- .../tests/test_challenge_auth_async.py | 9 +- .../tests/test_challenge_auth_cas.py | 1 - .../tests/test_parse_id.py | 2 +- .../azure-keyvault-secrets/tsp-location.yaml | 4 +- 48 files changed, 1092 insertions(+), 3205 deletions(-) delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_client.py create mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/types.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_models.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_sdk_moniker.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/__init__.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/_polling.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/_polling_async.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_challenge_auth_policy.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_client_base.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/challenge_auth_policy.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/client_base.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge_cache.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_version.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/aio/__init__.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/aio/_client.py delete mode 100644 sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/py.typed delete mode 100644 sdk/keyvault/azure-keyvault-secrets/sdk_packaging.toml create mode 100644 sdk/keyvault/azure-keyvault-secrets/setup.py diff --git a/sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md b/sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md index 7e18efac072a..fb87b14bc786 100644 --- a/sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md +++ b/sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md @@ -1,5 +1,9 @@ # Release History +## 4.12.0b1 (2026-10-22) + +skip changelog generation for data-plane package and please add changelog manually. + ## 4.11.3 (Unreleased) ### Features Added diff --git a/sdk/keyvault/azure-keyvault-secrets/MANIFEST.in b/sdk/keyvault/azure-keyvault-secrets/MANIFEST.in index 91c95d391763..ff7a325b7774 100644 --- a/sdk/keyvault/azure-keyvault-secrets/MANIFEST.in +++ b/sdk/keyvault/azure-keyvault-secrets/MANIFEST.in @@ -1,7 +1,8 @@ include *.md include LICENSE -include azure/keyvault/secrets/py.typed +include azure/keyvault/secrets/_generated/py.typed recursive-include tests *.py recursive-include samples *.py *.md include azure/__init__.py include azure/keyvault/__init__.py +include azure/keyvault/secrets/__init__.py diff --git a/sdk/keyvault/azure-keyvault-secrets/_metadata.json b/sdk/keyvault/azure-keyvault-secrets/_metadata.json index 097cd2012c30..0b0c58fed5ab 100644 --- a/sdk/keyvault/azure-keyvault-secrets/_metadata.json +++ b/sdk/keyvault/azure-keyvault-secrets/_metadata.json @@ -1,10 +1,11 @@ { - "apiVersion": "2025-07-01", + "apiVersion": "2026-03-01-preview", "apiVersions": { - "KeyVault": "2025-07-01" + "KeyVault": "2026-03-01-preview" }, - "commit": "942c8b2fd38b3be3f322e219c97c5c3a75f2e97b", + "commit": "f4f159a5a3412acc3fd8793d27ecedd2f99a751c", "repository_url": "https://github.com/Azure/azure-rest-api-specs", "typespec_src": "specification/keyvault/data-plane/Secrets", - "emitterVersion": "0.61.1" + "emitterVersion": "0.63.10", + "httpClientPythonVersion": "0.39.0" } \ No newline at end of file diff --git a/sdk/keyvault/azure-keyvault-secrets/apiview-properties.json b/sdk/keyvault/azure-keyvault-secrets/apiview-properties.json index d3c0b4781300..3f44cc86b40b 100644 --- a/sdk/keyvault/azure-keyvault-secrets/apiview-properties.json +++ b/sdk/keyvault/azure-keyvault-secrets/apiview-properties.json @@ -38,5 +38,6 @@ "azure.keyvault.secrets._generated.aio.KeyVaultClient.backup_secret": "KeyVault.backupSecret", "azure.keyvault.secrets._generated.KeyVaultClient.restore_secret": "KeyVault.restoreSecret", "azure.keyvault.secrets._generated.aio.KeyVaultClient.restore_secret": "KeyVault.restoreSecret" - } + }, + "CrossLanguageVersion": "33d65af9408e" } \ No newline at end of file diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/__init__.py b/sdk/keyvault/azure-keyvault-secrets/azure/__init__.py index 125860bac907..d55ccad1f573 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/__init__.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/__init__.py @@ -1,6 +1 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -# pylint:disable=missing-docstring __path__ = __import__("pkgutil").extend_path(__path__, __name__) # type: ignore diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/__init__.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/__init__.py index 125860bac907..d55ccad1f573 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/__init__.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/__init__.py @@ -1,6 +1 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -# pylint:disable=missing-docstring __path__ = __import__("pkgutil").extend_path(__path__, __name__) # type: ignore diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/__init__.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/__init__.py index db5af5095fce..d55ccad1f573 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/__init__.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/__init__.py @@ -1,21 +1 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from ._generated.models import ContentType -from ._models import DeletedSecret, KeyVaultSecret, KeyVaultSecretIdentifier, SecretProperties -from ._shared.client_base import ApiVersion -from ._client import SecretClient - -__all__ = [ - "ApiVersion", - "ContentType", - "SecretClient", - "KeyVaultSecret", - "KeyVaultSecretIdentifier", - "SecretProperties", - "DeletedSecret" -] - -from ._version import VERSION -__version__ = VERSION +__path__ = __import__("pkgutil").extend_path(__path__, __name__) # type: ignore diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_client.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_client.py deleted file mode 100644 index 1945989fde8b..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_client.py +++ /dev/null @@ -1,494 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from datetime import datetime -from functools import partial -from typing import Any, cast, Dict, Optional, Union - -from azure.core.paging import ItemPaged -from azure.core.polling import LROPoller -from azure.core.tracing.decorator import distributed_trace - -from ._generated.models import ContentType -from ._models import KeyVaultSecret, DeletedSecret, SecretProperties -from ._shared import KeyVaultClientBase -from ._shared._polling import DeleteRecoverPollingMethod, KeyVaultOperationPoller - - -class SecretClient(KeyVaultClientBase): - """A high-level interface for managing a vault's secrets. - - :param str vault_url: URL of the vault the client will access. This is also called the vault's "DNS Name". - You should validate that this URL references a valid Key Vault resource. See https://aka.ms/azsdk/blog/vault-uri - for details. - :param credential: An object which can provide an access token for the vault, such as a credential from - :mod:`azure.identity` - :type credential: ~azure.core.credentials.TokenCredential - - :keyword api_version: Version of the service API to use. Defaults to the most recent. - :paramtype api_version: ~azure.keyvault.secrets.ApiVersion or str - :keyword bool verify_challenge_resource: Whether to verify the authentication challenge resource matches the Key - Vault domain. Defaults to True. - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START create_secret_client] - :end-before: [END create_secret_client] - :language: python - :caption: Create a new ``SecretClient`` - :dedent: 4 - """ - - # pylint:disable=protected-access - - @distributed_trace - def get_secret( - self, - name: str, - version: Optional[str] = None, - *, - out_content_type: Optional[Union[str, ContentType]] = None, - **kwargs: Any, - ) -> KeyVaultSecret: - """Get a secret. Requires the secrets/get permission. - - :param str name: The name of the secret - :param str version: (optional) Version of the secret to get. If unspecified, gets the latest version. - :keyword out_content_type: The desired media type of the certificate secret value. For certificate-backed - secrets, the service can convert supported values such as ``application/x-pem-file``. Accepted values - include members of :class:`~azure.keyvault.secrets.ContentType`. - :paramtype out_content_type: str or ~azure.keyvault.secrets.ContentType or None - - :returns: The fetched secret. - :rtype: ~azure.keyvault.secrets.KeyVaultSecret - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START get_secret] - :end-before: [END get_secret] - :language: python - :caption: Get a secret - :dedent: 8 - """ - client_kwargs = dict(kwargs) - if out_content_type is not None: - client_kwargs["out_content_type"] = out_content_type - - bundle = self._client.get_secret( - secret_name=name, - secret_version=version or "", - **client_kwargs - ) - return KeyVaultSecret._from_secret_bundle(bundle) - - @distributed_trace - def set_secret( - self, - name: str, - value: str, - *, - enabled: Optional[bool] = None, - tags: Optional[Dict[str, str]] = None, - content_type: Optional[str] = None, - not_before: Optional[datetime] = None, - expires_on: Optional[datetime] = None, - **kwargs: Any, - ) -> KeyVaultSecret: - """Set a secret value. If `name` is in use, create a new version of the secret. If not, create a new secret. - - Requires secrets/set permission. - - :param str name: The name of the secret - :param str value: The value of the secret - - :keyword bool enabled: Whether the secret is enabled for use. - :keyword tags: Application specific metadata in the form of key-value pairs. - :paramtype tags: Dict[str, str] or None - :keyword str content_type: An arbitrary string indicating the type of the secret, e.g. 'password' - :keyword ~datetime.datetime not_before: Not before date of the secret in UTC - :keyword ~datetime.datetime expires_on: Expiry date of the secret in UTC - - :returns: The created or updated secret. - :rtype: ~azure.keyvault.secrets.KeyVaultSecret - - :raises ~azure.core.exceptions.HttpResponseError: - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START set_secret] - :end-before: [END set_secret] - :language: python - :caption: Set a secret's value - :dedent: 8 - - """ - if enabled is not None or not_before is not None or expires_on is not None: - attributes = self._models.SecretAttributes( - enabled=enabled, not_before=not_before, expires=expires_on - ) - else: - attributes = None - - parameters = self._models.SecretSetParameters( - value=value, - tags=tags, - content_type=content_type, - secret_attributes=attributes - ) - - bundle = self._client.set_secret( - secret_name=name, - parameters=parameters, - **kwargs - ) - return KeyVaultSecret._from_secret_bundle(bundle) - - @distributed_trace - def update_secret_properties( - self, - name: str, - version: Optional[str] = None, - *, - enabled: Optional[bool] = None, - tags: Optional[Dict[str, str]] = None, - content_type: Optional[str] = None, - not_before: Optional[datetime] = None, - expires_on: Optional[datetime] = None, - **kwargs: Any, - ) -> SecretProperties: - """Update properties of a secret other than its value. Requires secrets/set permission. - - This method updates properties of the secret, such as whether it's enabled, but can't change the secret's - value. Use :func:`set_secret` to change the secret's value. - - :param str name: Name of the secret - :param str version: (optional) Version of the secret to update. If unspecified, the latest version is updated. - - :keyword bool enabled: Whether the secret is enabled for use. - :keyword tags: Application specific metadata in the form of key-value pairs. - :paramtype tags: Dict[str, str] or None - :keyword str content_type: An arbitrary string indicating the type of the secret, e.g. 'password' - :keyword ~datetime.datetime not_before: Not before date of the secret in UTC - :keyword ~datetime.datetime expires_on: Expiry date of the secret in UTC - - :returns: The updated secret properties. - :rtype: ~azure.keyvault.secrets.SecretProperties - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START update_secret] - :end-before: [END update_secret] - :language: python - :caption: Update a secret's attributes - :dedent: 8 - - """ - if enabled is not None or not_before is not None or expires_on is not None: - attributes = self._models.SecretAttributes( - enabled=enabled, not_before=not_before, expires=expires_on - ) - else: - attributes = None - - parameters = self._models.SecretUpdateParameters( - content_type=content_type, - secret_attributes=attributes, - tags=tags, - ) - - bundle = self._client.update_secret( - name, - secret_version=version or "", - parameters=parameters, - **kwargs - ) - return SecretProperties._from_secret_bundle(bundle) # pylint: disable=protected-access - - @distributed_trace - def list_properties_of_secrets(self, **kwargs: Any) -> ItemPaged[SecretProperties]: - """List identifiers and attributes of all secrets in the vault. Requires secrets/list permission. - - List items don't include secret values. Use :func:`get_secret` to get a secret's value. - - :returns: An iterator of secrets, excluding their values - :rtype: ~azure.core.paging.ItemPaged[~azure.keyvault.secrets.SecretProperties] - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START list_secrets] - :end-before: [END list_secrets] - :language: python - :caption: List all secrets - :dedent: 8 - - """ - return self._client.get_secrets( - maxresults=kwargs.pop("max_page_size", None), - cls=lambda objs: [SecretProperties._from_secret_item(x) for x in objs], - **kwargs - ) - - @distributed_trace - def list_properties_of_secret_versions(self, name: str, **kwargs: Any) -> ItemPaged[SecretProperties]: - """List properties of all versions of a secret, excluding their values. Requires secrets/list permission. - - List items don't include secret values. Use :func:`get_secret` to get a secret's value. - - :param str name: Name of the secret - - :returns: An iterator of secrets, excluding their values - :rtype: ~azure.core.paging.ItemPaged[~azure.keyvault.secrets.SecretProperties] - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START list_properties_of_secret_versions] - :end-before: [END list_properties_of_secret_versions] - :language: python - :caption: List all versions of a secret - :dedent: 8 - - """ - return self._client.get_secret_versions( - name, - maxresults=kwargs.pop("max_page_size", None), - cls=lambda objs: [SecretProperties._from_secret_item(x) for x in objs], - **kwargs - ) - - @distributed_trace - def backup_secret(self, name: str, **kwargs: Any) -> bytes: - """Back up a secret in a protected form useable only by Azure Key Vault. Requires secrets/backup permission. - - :param str name: Name of the secret to back up - - :returns: The backup result, in a protected bytes format that can only be used by Azure Key Vault. - :rtype: bytes - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START backup_secret] - :end-before: [END backup_secret] - :language: python - :caption: Back up a secret - :dedent: 8 - - """ - backup_result = self._client.backup_secret(name, **kwargs) - return cast(bytes, backup_result.value) - - @distributed_trace - def restore_secret_backup(self, backup: bytes, **kwargs: Any) -> SecretProperties: - """Restore a backed up secret. Requires the secrets/restore permission. - - :param bytes backup: A secret backup as returned by :func:`backup_secret` - - :returns: The restored secret - :rtype: ~azure.keyvault.secrets.SecretProperties - - :raises ~azure.core.exceptions.ResourceExistsError or ~azure.core.exceptions.HttpResponseError: - the former if the secret's name is already in use; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START restore_secret_backup] - :end-before: [END restore_secret_backup] - :language: python - :caption: Restore a backed up secret - :dedent: 8 - - """ - bundle = self._client.restore_secret( - parameters=self._models.SecretRestoreParameters(secret_bundle_backup=backup), - **kwargs - ) - return SecretProperties._from_secret_bundle(bundle) - - @distributed_trace - def begin_delete_secret(self, name: str, **kwargs: Any) -> LROPoller[DeletedSecret]: # pylint:disable=bad-option-value,delete-operation-wrong-return-type - """Delete all versions of a secret. Requires secrets/delete permission. - - When this method returns Key Vault has begun deleting the secret. Deletion may take several seconds in a vault - with soft-delete enabled. This method therefore returns a poller enabling you to wait for deletion to complete. - - :param str name: Name of the secret to delete. - - :returns: A poller for the delete operation. The poller's `result` method returns the - :class:`~azure.keyvault.secrets.DeletedSecret` without waiting for deletion to complete. If the vault has - soft-delete enabled and you want to permanently delete the secret with :func:`purge_deleted_secret`, call - the poller's `wait` method first. It will block until the deletion is complete. The `wait` method requires - secrets/get permission. - :rtype: ~azure.core.polling.LROPoller[~azure.keyvault.secrets.DeletedSecret] - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START delete_secret] - :end-before: [END delete_secret] - :language: python - :caption: Delete a secret - :dedent: 8 - - """ - polling_interval = kwargs.pop("_polling_interval", None) - if polling_interval is None: - polling_interval = 2 - # Ignore pyright warning about return type not being iterable because we use `cls` to return a tuple - pipeline_response, deleted_secret_bundle = self._client.delete_secret( - secret_name=name, - cls=lambda pipeline_response, deserialized, _: (pipeline_response, deserialized), - **kwargs, - ) # pyright: ignore[reportGeneralTypeIssues] - deleted_secret = DeletedSecret._from_deleted_secret_bundle(deleted_secret_bundle) - - command = partial(self.get_deleted_secret, name=name, **kwargs) - polling_method = DeleteRecoverPollingMethod( - # no recovery ID means soft-delete is disabled, in which case we initialize the poller as finished - finished=deleted_secret.recovery_id is None, - pipeline_response=pipeline_response, - command=command, - final_resource=deleted_secret, - interval=polling_interval, - ) - return KeyVaultOperationPoller(polling_method) - - @distributed_trace - def get_deleted_secret(self, name: str, **kwargs: Any) -> DeletedSecret: - """Get a deleted secret. Possible only in vaults with soft-delete enabled. Requires secrets/get permission. - - :param str name: Name of the deleted secret - - :returns: The deleted secret. - :rtype: ~azure.keyvault.secrets.DeletedSecret - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the deleted secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START get_deleted_secret] - :end-before: [END get_deleted_secret] - :language: python - :caption: Get a deleted secret - :dedent: 8 - - """ - bundle = self._client.get_deleted_secret(name, **kwargs) - return DeletedSecret._from_deleted_secret_bundle(bundle) - - @distributed_trace - def list_deleted_secrets(self, **kwargs: Any) -> ItemPaged[DeletedSecret]: - """Lists all deleted secrets. Possible only in vaults with soft-delete enabled. - - Requires secrets/list permission. - - :returns: An iterator of deleted secrets, excluding their values - :rtype: ~azure.core.paging.ItemPaged[~azure.keyvault.secrets.DeletedSecret] - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START list_deleted_secrets] - :end-before: [END list_deleted_secrets] - :language: python - :caption: List deleted secrets - :dedent: 8 - - """ - return self._client.get_deleted_secrets( - maxresults=kwargs.pop("max_page_size", None), - cls=lambda objs: [DeletedSecret._from_deleted_secret_item(x) for x in objs], - **kwargs - ) - - @distributed_trace - def purge_deleted_secret(self, name: str, **kwargs: Any) -> None: - """Permanently deletes a deleted secret. Possible only in vaults with soft-delete enabled. - - Performs an irreversible deletion of the specified secret, without possibility for recovery. The operation is - not available if the :py:attr:`~azure.keyvault.secrets.SecretProperties.recovery_level` does not specify - 'Purgeable'. This method is only necessary for purging a secret before its - :py:attr:`~azure.keyvault.secrets.DeletedSecret.scheduled_purge_date`. - - Requires secrets/purge permission. - - :param str name: Name of the deleted secret to purge - - :returns: None - - :raises ~azure.core.exceptions.HttpResponseError: - - Example: - .. code-block:: python - - # if the vault has soft-delete enabled, purge permanently deletes the secret - # (with soft-delete disabled, begin_delete_secret is permanent) - secret_client.purge_deleted_secret("secret-name") - - """ - self._client.purge_deleted_secret(name, **kwargs) - - @distributed_trace - def begin_recover_deleted_secret(self, name: str, **kwargs: Any) -> LROPoller[SecretProperties]: - """Recover a deleted secret to its latest version. Possible only in a vault with soft-delete enabled. - - Requires the secrets/recover permission. If the vault does not have soft-delete enabled, - :func:`begin_delete_secret` is permanent, and this method will return an error. Attempting to recover a - non-deleted secret will also return an error. When this method returns Key Vault has begun recovering the - secret. Recovery may take several seconds. This method therefore returns a poller enabling you to wait for - recovery to complete. Waiting is only necessary when you want to use the recovered secret in another operation - immediately. - - :param str name: Name of the deleted secret to recover - - :returns: A poller for the recovery operation. The poller's `result` method returns the recovered secret's - :class:`~azure.keyvault.secrets.SecretProperties` without waiting for recovery to complete. If you want to - use the recovered secret immediately, call the poller's `wait` method, which blocks until the secret is - ready to use. The `wait` method requires secrets/get permission. - :rtype: ~azure.core.polling.LROPoller[~azure.keyvault.secrets.SecretProperties] - - :raises ~azure.core.exceptions.HttpResponseError: - - Example: - .. literalinclude:: ../tests/test_samples_secrets.py - :start-after: [START recover_deleted_secret] - :end-before: [END recover_deleted_secret] - :language: python - :caption: Recover a deleted secret - :dedent: 8 - - """ - polling_interval = kwargs.pop("_polling_interval", None) - if polling_interval is None: - polling_interval = 2 - # Ignore pyright warning about return type not being iterable because we use `cls` to return a tuple - pipeline_response, recovered_secret_bundle = self._client.recover_deleted_secret( - secret_name=name, - cls=lambda pipeline_response, deserialized, _: (pipeline_response, deserialized), - **kwargs, - ) # pyright: ignore[reportGeneralTypeIssues] - recovered_secret = SecretProperties._from_secret_bundle(recovered_secret_bundle) - - command = partial(self.get_secret, name=name, **kwargs) - polling_method = DeleteRecoverPollingMethod( - finished=False, - pipeline_response=pipeline_response, - command=command, - final_resource=recovered_secret, - interval=polling_interval, - ) - return KeyVaultOperationPoller(polling_method) - - def __enter__(self) -> "SecretClient": - self._client.__enter__() - return self diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_client.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_client.py index 0ab087a35122..015cceaad92d 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_client.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_client.py @@ -7,8 +7,8 @@ # -------------------------------------------------------------------------- from copy import deepcopy +import sys from typing import Any, TYPE_CHECKING -from typing_extensions import Self from azure.core import PipelineClient from azure.core.pipeline import policies @@ -18,11 +18,16 @@ from ._operations import _KeyVaultClientOperationsMixin from ._utils.serialization import Deserializer, Serializer +if sys.version_info >= (3, 11): + from typing import Self +else: + from typing_extensions import Self # type: ignore + if TYPE_CHECKING: from azure.core.credentials import TokenCredential -class KeyVaultClient(_KeyVaultClientOperationsMixin): +class KeyVaultClient(_KeyVaultClientOperationsMixin): # pylint: disable=docstring-keyword-should-match-keyword-only """The key vault client performs cryptographic key operations and vault operations against the Key Vault service. @@ -30,9 +35,10 @@ class KeyVaultClient(_KeyVaultClientOperationsMixin): :type vault_base_url: str :param credential: Credential used to authenticate requests to the service. Required. :type credential: ~azure.core.credentials.TokenCredential - :keyword api_version: The API version to use for this operation. Known values are "2025-07-01". - Default value is "2025-07-01". Note that overriding this default value may result in - unsupported behavior. + :keyword api_version: The API version to use for this operation. Known values are + "2026-03-01-preview" and None. Default value is None. If not set, the operation's default API + version will be used. Note that overriding this default value may result in unsupported + behavior. :paramtype api_version: str """ diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_configuration.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_configuration.py index 4daa4ea251c0..1b9b389a6175 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_configuration.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_configuration.py @@ -1,3 +1,4 @@ +# pylint: disable=line-too-long,useless-suppression # coding=utf-8 # -------------------------------------------------------------------------- # Copyright (c) Microsoft Corporation. All rights reserved. @@ -16,7 +17,7 @@ from azure.core.credentials import TokenCredential -class KeyVaultClientConfiguration: # pylint: disable=too-many-instance-attributes +class KeyVaultClientConfiguration: # pylint: disable=too-many-instance-attributes,docstring-keyword-should-match-keyword-only """Configuration for KeyVaultClient. Note that all parameters used to create this instance are saved as instance @@ -26,14 +27,15 @@ class KeyVaultClientConfiguration: # pylint: disable=too-many-instance-attribut :type vault_base_url: str :param credential: Credential used to authenticate requests to the service. Required. :type credential: ~azure.core.credentials.TokenCredential - :keyword api_version: The API version to use for this operation. Known values are "2025-07-01". - Default value is "2025-07-01". Note that overriding this default value may result in - unsupported behavior. + :keyword api_version: The API version to use for this operation. Known values are + "2026-03-01-preview" and None. Default value is None. If not set, the operation's default API + version will be used. Note that overriding this default value may result in unsupported + behavior. :paramtype api_version: str """ def __init__(self, vault_base_url: str, credential: "TokenCredential", **kwargs: Any) -> None: - api_version: str = kwargs.pop("api_version", "2025-07-01") + api_version: str = kwargs.pop("api_version", "2026-03-01-preview") if vault_base_url is None: raise ValueError("Parameter 'vault_base_url' must not be None.") diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_operations/_operations.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_operations/_operations.py index b87db9f85cb9..75bfb1c9c03f 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_operations/_operations.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_operations/_operations.py @@ -29,14 +29,13 @@ from azure.core.tracing.decorator import distributed_trace from azure.core.utils import case_insensitive_dict -from .. import models as _models +from .. import models as _models, types as _types from .._configuration import KeyVaultClientConfiguration from .._utils.model_base import SdkJSONEncoder, _deserialize, _failsafe_deserialize from .._utils.serialization import Serializer from .._utils.utils import ClientMixinABC from .._validation import api_version_validation -JSON = MutableMapping[str, Any] T = TypeVar("T") ClsType = Optional[Callable[[PipelineResponse[HttpRequest, HttpResponse], T, dict[str, Any]], Any]] @@ -49,7 +48,7 @@ def build_key_vault_set_secret_request(secret_name: str, **kwargs: Any) -> HttpR _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -75,7 +74,7 @@ def build_key_vault_delete_secret_request(secret_name: str, **kwargs: Any) -> Ht _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -100,7 +99,7 @@ def build_key_vault_update_secret_request(secret_name: str, secret_version: str, _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -133,7 +132,7 @@ def build_key_vault_get_secret_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -160,7 +159,7 @@ def build_key_vault_get_secrets_request(*, maxresults: Optional[int] = None, **k _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -183,7 +182,7 @@ def build_key_vault_get_secret_versions_request( # pylint: disable=name-too-lon _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -211,7 +210,7 @@ def build_key_vault_get_deleted_secrets_request( # pylint: disable=name-too-lon _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -234,7 +233,7 @@ def build_key_vault_get_deleted_secret_request( # pylint: disable=name-too-long _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -259,7 +258,7 @@ def build_key_vault_purge_deleted_secret_request( # pylint: disable=name-too-lo ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) # Construct URL _url = "/deletedsecrets/{secret-name}" path_format_arguments = { @@ -280,7 +279,7 @@ def build_key_vault_recover_deleted_secret_request( # pylint: disable=name-too- _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -304,7 +303,7 @@ def build_key_vault_backup_secret_request(secret_name: str, **kwargs: Any) -> Ht _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -329,7 +328,7 @@ def build_key_vault_restore_secret_request(**kwargs: Any) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2026-03-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -381,7 +380,12 @@ def set_secret( @overload def set_secret( - self, secret_name: str, parameters: JSON, *, content_type: str = "application/json", **kwargs: Any + self, + secret_name: str, + parameters: _types.SecretSetParameters, + *, + content_type: str = "application/json", + **kwargs: Any ) -> _models.SecretBundle: """Sets a secret in a specified key vault. @@ -394,7 +398,7 @@ def set_secret( identifiable or sensitive information. Required. :type secret_name: str :param parameters: The parameters for setting the secret. Required. - :type parameters: JSON + :type parameters: ~azure.keyvault.secrets._generated.types.SecretSetParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -429,7 +433,10 @@ def set_secret( @distributed_trace def set_secret( - self, secret_name: str, parameters: Union[_models.SecretSetParameters, JSON, IO[bytes]], **kwargs: Any + self, + secret_name: str, + parameters: Union[_models.SecretSetParameters, _types.SecretSetParameters, IO[bytes]], + **kwargs: Any ) -> _models.SecretBundle: """Sets a secret in a specified key vault. @@ -441,10 +448,10 @@ def set_secret( the purpose of running the service. The value provided should not include personally identifiable or sensitive information. Required. :type secret_name: str - :param parameters: The parameters for setting the secret. Is one of the following types: - SecretSetParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.keyvault.secrets._generated.models.SecretSetParameters or JSON or - IO[bytes] + :param parameters: The parameters for setting the secret. Is either a SecretSetParameters type + or a IO[bytes] type. Required. + :type parameters: ~azure.keyvault.secrets._generated.models.SecretSetParameters or + ~azure.keyvault.secrets._generated.types.SecretSetParameters or IO[bytes] :return: SecretBundle. The SecretBundle is compatible with MutableMapping :rtype: ~azure.keyvault.secrets._generated.models.SecretBundle :raises ~azure.core.exceptions.HttpResponseError: @@ -621,7 +628,7 @@ def update_secret( self, secret_name: str, secret_version: str, - parameters: JSON, + parameters: _types.SecretUpdateParameters, *, content_type: str = "application/json", **kwargs: Any @@ -637,7 +644,7 @@ def update_secret( :param secret_version: The version of the secret. Required. :type secret_version: str :param parameters: The parameters for update secret operation. Required. - :type parameters: JSON + :type parameters: ~azure.keyvault.secrets._generated.types.SecretUpdateParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -681,7 +688,7 @@ def update_secret( self, secret_name: str, secret_version: str, - parameters: Union[_models.SecretUpdateParameters, JSON, IO[bytes]], + parameters: Union[_models.SecretUpdateParameters, _types.SecretUpdateParameters, IO[bytes]], **kwargs: Any ) -> _models.SecretBundle: """Updates the attributes associated with a specified secret in a given key vault. @@ -694,10 +701,10 @@ def update_secret( :type secret_name: str :param secret_version: The version of the secret. Required. :type secret_version: str - :param parameters: The parameters for update secret operation. Is one of the following types: - SecretUpdateParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.keyvault.secrets._generated.models.SecretUpdateParameters or JSON or - IO[bytes] + :param parameters: The parameters for update secret operation. Is either a + SecretUpdateParameters type or a IO[bytes] type. Required. + :type parameters: ~azure.keyvault.secrets._generated.models.SecretUpdateParameters or + ~azure.keyvault.secrets._generated.types.SecretUpdateParameters or IO[bytes] :return: SecretBundle. The SecretBundle is compatible with MutableMapping :rtype: ~azure.keyvault.secrets._generated.models.SecretBundle :raises ~azure.core.exceptions.HttpResponseError: @@ -773,7 +780,15 @@ def update_secret( @distributed_trace @api_version_validation( params_added_on={"2025-06-01-preview": ["out_content_type"]}, - api_versions_list=["7.5", "7.6-preview.2", "7.6", "2025-06-01-preview", "2025-07-01"], + api_versions_list=[ + "7.5", + "7.6-preview.2", + "7.6", + "2025-06-01-preview", + "2025-07-01", + "2026-01-01-preview", + "2026-03-01-preview", + ], ) def get_secret( self, @@ -917,7 +932,10 @@ def prepare_request(next_link=None): ) _next_request_params["api-version"] = self._config.api_version _request = HttpRequest( - "GET", urllib.parse.urljoin(next_link, _parsed_next_link.path), params=_next_request_params + "GET", + urllib.parse.urljoin(next_link, _parsed_next_link.path), + headers=_headers, + params=_next_request_params, ) path_format_arguments = { "vaultBaseUrl": self._serialize.url( @@ -1018,7 +1036,10 @@ def prepare_request(next_link=None): ) _next_request_params["api-version"] = self._config.api_version _request = HttpRequest( - "GET", urllib.parse.urljoin(next_link, _parsed_next_link.path), params=_next_request_params + "GET", + urllib.parse.urljoin(next_link, _parsed_next_link.path), + headers=_headers, + params=_next_request_params, ) path_format_arguments = { "vaultBaseUrl": self._serialize.url( @@ -1117,7 +1138,10 @@ def prepare_request(next_link=None): ) _next_request_params["api-version"] = self._config.api_version _request = HttpRequest( - "GET", urllib.parse.urljoin(next_link, _parsed_next_link.path), params=_next_request_params + "GET", + urllib.parse.urljoin(next_link, _parsed_next_link.path), + headers=_headers, + params=_next_request_params, ) path_format_arguments = { "vaultBaseUrl": self._serialize.url( @@ -1450,7 +1474,7 @@ def restore_secret( @overload def restore_secret( - self, parameters: JSON, *, content_type: str = "application/json", **kwargs: Any + self, parameters: _types.SecretRestoreParameters, *, content_type: str = "application/json", **kwargs: Any ) -> _models.SecretBundle: """Restores a backed up secret to a vault. @@ -1458,7 +1482,7 @@ def restore_secret( secrets/restore permission. :param parameters: The parameters to restore the secret. Required. - :type parameters: JSON + :type parameters: ~azure.keyvault.secrets._generated.types.SecretRestoreParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -1488,17 +1512,19 @@ def restore_secret( @distributed_trace def restore_secret( - self, parameters: Union[_models.SecretRestoreParameters, JSON, IO[bytes]], **kwargs: Any + self, + parameters: Union[_models.SecretRestoreParameters, _types.SecretRestoreParameters, IO[bytes]], + **kwargs: Any ) -> _models.SecretBundle: """Restores a backed up secret to a vault. Restores a backed up secret, and all its versions, to a vault. This operation requires the secrets/restore permission. - :param parameters: The parameters to restore the secret. Is one of the following types: - SecretRestoreParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.keyvault.secrets._generated.models.SecretRestoreParameters or JSON or - IO[bytes] + :param parameters: The parameters to restore the secret. Is either a SecretRestoreParameters + type or a IO[bytes] type. Required. + :type parameters: ~azure.keyvault.secrets._generated.models.SecretRestoreParameters or + ~azure.keyvault.secrets._generated.types.SecretRestoreParameters or IO[bytes] :return: SecretBundle. The SecretBundle is compatible with MutableMapping :rtype: ~azure.keyvault.secrets._generated.models.SecretBundle :raises ~azure.core.exceptions.HttpResponseError: diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_operations/_patch.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_operations/_patch.py index 87676c65a8f0..ea765788358a 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_operations/_patch.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_operations/_patch.py @@ -8,7 +8,6 @@ Follow our quickstart for examples: https://aka.ms/azsdk/python/dpcodegen/python/customize """ - __all__: list[str] = [] # Add all objects you want publicly available to users at this package level diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_patch.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_patch.py index 87676c65a8f0..ea765788358a 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_patch.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_patch.py @@ -8,7 +8,6 @@ Follow our quickstart for examples: https://aka.ms/azsdk/python/dpcodegen/python/customize """ - __all__: list[str] = [] # Add all objects you want publicly available to users at this package level diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_utils/model_base.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_utils/model_base.py index 7b7f8ba67b53..35d5fc024978 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_utils/model_base.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_utils/model_base.py @@ -23,14 +23,19 @@ from json import JSONEncoder import xml.etree.ElementTree as ET from collections.abc import MutableMapping -from typing_extensions import Self import isodate from azure.core.exceptions import DeserializationError from azure.core import CaseInsensitiveEnumMeta from azure.core.pipeline import PipelineResponse from azure.core.serialization import _Null + from azure.core.rest import HttpResponse +if sys.version_info >= (3, 11): + from typing import Self +else: + from typing_extensions import Self + _LOGGER = logging.getLogger(__name__) __all__ = ["SdkJSONEncoder", "Model", "rest_field", "rest_discriminator"] @@ -104,6 +109,29 @@ def _serialize_bytes(o, format: typing.Optional[str] = None) -> str: return encoded +def _serialize_duration(td: timedelta, format: typing.Optional[str] = None): + """Serialize a timedelta to its wire representation. + + For the ``seconds``/``milliseconds`` encodings the value is converted to a + numeric value, otherwise it falls back to an ISO 8601 duration string. + + :param timedelta td: The timedelta to serialize. + :param str format: The duration encoding format. + :rtype: int or float or str + :return: serialized duration + """ + seconds = td.total_seconds() + if format == "duration-seconds-int": + return int(seconds) + if format == "duration-seconds-float": + return seconds + if format == "duration-milliseconds-int": + return int(seconds * 1000) + if format == "duration-milliseconds-float": + return seconds * 1000 + return _timedelta_as_isostr(td) + + def _serialize_datetime(o, format: typing.Optional[str] = None): if hasattr(o, "year") and hasattr(o, "hour"): if format == "rfc7231": @@ -130,7 +158,15 @@ def _is_readonly(p): class SdkJSONEncoder(JSONEncoder): - """A JSON encoder that's capable of serializing datetime objects and bytes.""" + """A JSON encoder that's capable of serializing datetime objects and bytes. + + :param args: Additional positional arguments passed to the base ``JSONEncoder``. + :type args: typing.Any + :keyword exclude_readonly: Whether to exclude readonly properties. Defaults to False. + :paramtype exclude_readonly: bool + :keyword format: The format to use for serialization. Defaults to None. + :paramtype format: typing.Optional[str] + """ def __init__(self, *args, exclude_readonly: bool = False, format: typing.Optional[str] = None, **kwargs): super().__init__(*args, **kwargs) @@ -296,6 +332,12 @@ def _deserialize_duration(attr): return isodate.parse_duration(attr) +def _deserialize_duration_numeric(attr, unit): + if isinstance(attr, timedelta): + return attr + return timedelta(**{unit: float(attr)}) + + def _deserialize_decimal(attr): if isinstance(attr, decimal.Decimal): return attr @@ -308,6 +350,12 @@ def _deserialize_int_as_str(attr): return int(attr) +def _deserialize_bool_as_str(attr): + if isinstance(attr, bool): + return attr + return attr.lower() == "true" + + _DESERIALIZE_MAPPING = { datetime: _deserialize_datetime, date: _deserialize_date, @@ -325,12 +373,18 @@ def _deserialize_int_as_str(attr): "unix-timestamp": _deserialize_datetime_unix_timestamp, "base64": _deserialize_bytes, "base64url": _deserialize_bytes_base64, + "duration-seconds-int": functools.partial(_deserialize_duration_numeric, unit="seconds"), + "duration-seconds-float": functools.partial(_deserialize_duration_numeric, unit="seconds"), + "duration-milliseconds-int": functools.partial(_deserialize_duration_numeric, unit="milliseconds"), + "duration-milliseconds-float": functools.partial(_deserialize_duration_numeric, unit="milliseconds"), } def get_deserializer(annotation: typing.Any, rf: typing.Optional["_RestField"] = None): if annotation is int and rf and rf._format == "str": return _deserialize_int_as_str + if annotation is bool and rf and rf._format == "str": + return _deserialize_bool_as_str if annotation is str and rf and rf._format in _ARRAY_ENCODE_MAPPING: return functools.partial(_deserialize_array_encoded, _ARRAY_ENCODE_MAPPING[rf._format]) if rf and rf._format: @@ -420,21 +474,21 @@ def __ne__(self, other: typing.Any) -> bool: def keys(self) -> typing.KeysView[str]: """ - :returns: a set-like object providing a view on D's keys + :returns: a set-like object providing a view on the mapping's keys :rtype: ~typing.KeysView """ return self._data.keys() def values(self) -> typing.ValuesView[typing.Any]: """ - :returns: an object providing a view on D's values + :returns: an object providing a view on the mapping's values :rtype: ~typing.ValuesView """ return self._data.values() def items(self) -> typing.ItemsView[str, typing.Any]: """ - :returns: set-like object providing a view on D's items + :returns: a set-like object providing a view on the mapping's items :rtype: ~typing.ItemsView """ return self._data.items() @@ -444,7 +498,7 @@ def get(self, key: str, default: typing.Any = None) -> typing.Any: Get the value for key if key is in the dictionary, else default. :param str key: The key to look up. :param any default: The value to return if key is not in the dictionary. Defaults to None - :returns: D[k] if k in D, else d. + :returns: The value for key if key is in the dictionary, else default. :rtype: any """ try: @@ -479,19 +533,19 @@ def popitem(self) -> tuple[str, typing.Any]: Removes and returns some (key, value) pair :returns: The (key, value) pair. :rtype: tuple - :raises KeyError: if D is empty. + :raises KeyError: if the dictionary is empty. """ return self._data.popitem() def clear(self) -> None: """ - Remove all items from D. + Remove all items from the dictionary. """ self._data.clear() def update(self, *args: typing.Any, **kwargs: typing.Any) -> None: # pylint: disable=arguments-differ """ - Updates D from mapping/iterable E and F. + Update the dictionary from a mapping or an iterable of key-value pairs. :param any args: Either a mapping object or an iterable of key-value pairs. """ self._data.update(*args, **kwargs) @@ -504,10 +558,11 @@ def setdefault(self, key: str, default: typing.Any) -> typing.Any: ... # pylint def setdefault(self, key: str, default: typing.Any = _UNSET) -> typing.Any: """ - Same as calling D.get(k, d), and setting D[k]=d if k not found + Return the value for key if key is in the dictionary; otherwise set the key to + default and return default. :param str key: The key to look up. :param any default: The value to set if key is not in the dictionary - :returns: D[k] if k in D, else d. + :returns: The value for key if key is in the dictionary, else default. :rtype: any """ if default is _UNSET: @@ -559,7 +614,7 @@ def _serialize(o, format: typing.Optional[str] = None): # pylint: disable=too-m pass # Last, try datetime.timedelta try: - return _timedelta_as_isostr(o) + return _serialize_duration(o, format) except AttributeError: # This will be raised when it hits value.total_seconds in the method above pass @@ -585,6 +640,239 @@ def _create_value(rf: typing.Optional["_RestField"], value: typing.Any) -> typin return _serialize(value, rf._format) +# ============================================================================ +# Fast-path scalar deserializer functions for rest_field(deserializer=...) +# These are referenced from rest_field declarations to bypass the generic +# _deserialize -> _deserialize_with_callable chain. +# Only simple/primitive types — no models or container types. +# ============================================================================ + + +def _xml_deser_str(value): + if isinstance(value, ET.Element): + return value.text or "" + return str(value) if value is not None else None + + +def _xml_deser_int(value): + if isinstance(value, ET.Element): + return int(value.text) if value.text else None + return int(value) if value is not None else None + + +def _xml_deser_float(value): + if isinstance(value, ET.Element): + return float(value.text) if value.text else None + return float(value) if value is not None else None + + +def _xml_deser_bool(value): + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + if text in (True, False): + return text + return text.lower() == "true" + + +# pylint: disable=docstring-missing-param +def _xml_deser_bytes(value): + """Deserialize bytes from XML (base64).""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_bytes(text) + + +def _xml_deser_bytes_base64url(value): + """Deserialize bytes from XML (base64url).""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_bytes_base64(text) + + +def _xml_deser_datetime(value): + """Deserialize a datetime from XML (ISO 8601 / rfc3339).""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_datetime(text) + + +def _xml_deser_datetime_rfc7231(value): + """Deserialize a datetime from XML (RFC7231 format).""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_datetime_rfc7231(text) + + +def _xml_deser_datetime_unix_timestamp(value): + """Deserialize a datetime from XML (Unix timestamp).""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_datetime_unix_timestamp(float(text)) + + +def _xml_deser_date(value): + """Deserialize a date from XML (ISO 8601).""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_date(text) + + +def _xml_deser_time(value): + """Deserialize a time from XML (ISO 8601).""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_time(text) + + +def _xml_deser_duration(value): + """Deserialize a timedelta from XML (ISO 8601 duration).""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_duration(text) + + +def _xml_deser_decimal(value): + """Deserialize a Decimal from XML.""" + if isinstance(value, ET.Element): + text = value.text + else: + text = value + if text is None: + return None + return _deserialize_decimal(text) + + +def _xml_deser_enum_or_str(enum_cls, value): + """Deserialize a Union[EnumType, str] from XML.""" + text = value.text if isinstance(value, ET.Element) else value + if text is None: + return None + try: + return enum_cls(text) + except ValueError: + return text + + +def _extract_xml_model_type(rf_type): + """Extract the concrete Model class from a resolved rf._type partial chain. + + Unwraps ``Optional[Model]`` and ``_deserialize_model(Model, ...)`` + wrappers. Only handles Model and Optional[Model] — other composite + types (List, Dict, Union, etc.) return None and fall through to the + generic ``_deserialize`` path at runtime. + """ + if rf_type is None: + return None + if isinstance(rf_type, type) and _is_model(rf_type): + return rf_type + if not isinstance(rf_type, functools.partial): + return None + func = rf_type.func + args = rf_type.args + if func is _deserialize_with_optional and args: + return _extract_xml_model_type(args[0]) + if func is _deserialize_model and args: + cls = args[0] + return cls if isinstance(cls, type) and _is_model(cls) else None + return None + + +def _build_xml_field_plan( # pylint: disable=docstring-missing-return, docstring-missing-rtype, unused-variable + cls, attr_to_rest_field: dict +) -> list: + """Build a precomputed XML field plan for fast _init_from_xml iteration. + + Called once per model class in __new__. Returns a list of tuples: + (rest_name, xml_name, kind, deser, rf_type, is_optional, items_name) + + kind: 0=wrapped, 1=attribute, 2=unwrapped, 3=text + + For Model and Optional[Model] fields that lack a scalar + ``_deserializer``, this function precomputes the Model class as the + deserializer so ``_init_from_xml`` can call ``ModelClass(element)`` + directly instead of going through the expensive + ``_get_deserialize_callable_from_annotation`` chain at runtime. + """ + model_meta = getattr(cls, "_xml", {}) + model_ns = model_meta.get("ns") or model_meta.get("namespace") + plan = [] + + for rf in attr_to_rest_field.values(): + prop_meta = getattr(rf, "_xml", {}) + deser = rf._deserializer + + xml_name = prop_meta.get("name", rf._rest_name) + xml_ns = _resolve_xml_ns(prop_meta, model_meta) + if xml_ns: + xml_name = "{" + xml_ns + "}" + xml_name + + is_optional = rf._is_optional + + # For Model / Optional[Model] fields without a scalar deserializer, + # precompute the Model class as the deserializer. + if deser is None and rf._type is not None: + model_cls = _extract_xml_model_type(rf._type) + if model_cls is not None: + deser = model_cls + + if prop_meta.get("attribute", False): + plan.append((rf._rest_name, xml_name, 1, deser, rf._type, is_optional, None)) + elif prop_meta.get("unwrapped", False): + items_name = prop_meta.get("itemsName") + if items_name: + items_ns = prop_meta.get("itemsNs") + if items_ns is not None: + xml_ns = items_ns + if xml_ns: + items_name = "{" + xml_ns + "}" + items_name + else: + items_name = xml_name + plan.append((rf._rest_name, xml_name, 2, deser, rf._type, is_optional, items_name)) + elif prop_meta.get("text", False): + plan.append((rf._rest_name, xml_name, 3, deser, rf._type, is_optional, None)) + else: + plan.append((rf._rest_name, xml_name, 0, deser, rf._type, is_optional, None)) + + return plan + + +# pylint: enable=docstring-missing-param class Model(_MyMutableMapping): _is_model = True # label whether current class's _attr_to_rest_field has been calculated @@ -595,62 +883,10 @@ def __init__(self, *args: typing.Any, **kwargs: typing.Any) -> None: class_name = self.__class__.__name__ if len(args) > 1: raise TypeError(f"{class_name}.__init__() takes 2 positional arguments but {len(args) + 1} were given") - dict_to_pass = { - rest_field._rest_name: rest_field._default - for rest_field in self._attr_to_rest_field.values() - if rest_field._default is not _UNSET - } - if args: # pylint: disable=too-many-nested-blocks + dict_to_pass: dict[str, typing.Any] = {} + if args: if isinstance(args[0], ET.Element): - existed_attr_keys = [] - model_meta = getattr(self, "_xml", {}) - - for rf in self._attr_to_rest_field.values(): - prop_meta = getattr(rf, "_xml", {}) - xml_name = prop_meta.get("name", rf._rest_name) - xml_ns = prop_meta.get("ns", model_meta.get("ns", None)) - if xml_ns: - xml_name = "{" + xml_ns + "}" + xml_name - - # attribute - if prop_meta.get("attribute", False) and args[0].get(xml_name) is not None: - existed_attr_keys.append(xml_name) - dict_to_pass[rf._rest_name] = _deserialize(rf._type, args[0].get(xml_name)) - continue - - # unwrapped element is array - if prop_meta.get("unwrapped", False): - # unwrapped array could either use prop items meta/prop meta - if prop_meta.get("itemsName"): - xml_name = prop_meta.get("itemsName") - xml_ns = prop_meta.get("itemNs") - if xml_ns: - xml_name = "{" + xml_ns + "}" + xml_name - items = args[0].findall(xml_name) # pyright: ignore - if len(items) > 0: - existed_attr_keys.append(xml_name) - dict_to_pass[rf._rest_name] = _deserialize(rf._type, items) - elif not rf._is_optional: - existed_attr_keys.append(xml_name) - dict_to_pass[rf._rest_name] = [] - continue - - # text element is primitive type - if prop_meta.get("text", False): - if args[0].text is not None: - dict_to_pass[rf._rest_name] = _deserialize(rf._type, args[0].text) - continue - - # wrapped element could be normal property or array, it should only have one element - item = args[0].find(xml_name) - if item is not None: - existed_attr_keys.append(xml_name) - dict_to_pass[rf._rest_name] = _deserialize(rf._type, item) - - # rest thing is additional properties - for e in args[0]: - if e.tag not in existed_attr_keys: - dict_to_pass[e.tag] = _convert_element(e) + dict_to_pass.update(self._init_from_xml(args[0])) else: dict_to_pass.update( {k: _create_value(_get_rest_field(self._attr_to_rest_field, k), v) for k, v in args[0].items()} @@ -667,8 +903,117 @@ def __init__(self, *args: typing.Any, **kwargs: typing.Any) -> None: if v is not None } ) + # Apply client default values for fields the caller didn't set so that + # defaults are part of `_data` and therefore included during serialization. + for rf in self._attr_to_rest_field.values(): + if rf._default is _UNSET: + continue + if rf._rest_name in dict_to_pass: + continue + dict_to_pass[rf._rest_name] = _create_value(rf, rf._default) super().__init__(dict_to_pass) + def _init_from_xml( # pylint: disable=too-many-branches, too-many-statements + self, element: ET.Element + ) -> dict[str, typing.Any]: + """Deserialize an XML element into a dict mapping rest field names to values. + + :param ET.Element element: The XML element to deserialize from. + :returns: A dictionary of rest_name to deserialized value pairs. + :rtype: dict + """ + result: dict[str, typing.Any] = {} + existed_attr_keys: list[str] = [] + + field_plan = getattr(self, "_xml_field_plan", None) + if field_plan: + for rest_name, xml_name, kind, deser, rf_type, is_optional, items_name in field_plan: + if kind == 0: # wrapped element (most common) + item = element.find(xml_name) + if item is not None: + existed_attr_keys.append(xml_name) + if deser: + result[rest_name] = deser(item) + else: + result[rest_name] = _deserialize(rf_type, item) + elif kind == 1: # attribute + attr_val = element.get(xml_name) + if attr_val is not None: + existed_attr_keys.append(xml_name) + if deser: + result[rest_name] = deser(attr_val) + else: + result[rest_name] = attr_val + elif kind == 2: # unwrapped array + items = element.findall(items_name) # pyright: ignore + if len(items) > 0: + existed_attr_keys.append(items_name) + if deser: + result[rest_name] = deser(items) + else: + result[rest_name] = _deserialize(rf_type, items) + elif not is_optional: + existed_attr_keys.append(items_name) + result[rest_name] = [] + elif kind == 3: # text + if element.text is not None: + if deser: + result[rest_name] = deser(element.text) + else: + result[rest_name] = element.text + else: + model_meta = getattr(self, "_xml", {}) + for rf in self._attr_to_rest_field.values(): + prop_meta = getattr(rf, "_xml", {}) + xml_name = prop_meta.get("name", rf._rest_name) + xml_ns = _resolve_xml_ns(prop_meta, model_meta) + if xml_ns: + xml_name = "{" + xml_ns + "}" + xml_name + + # attribute + if prop_meta.get("attribute", False) and element.get(xml_name) is not None: + existed_attr_keys.append(xml_name) + result[rf._rest_name] = _deserialize(rf._type, element.get(xml_name)) + continue + + # unwrapped element is array + if prop_meta.get("unwrapped", False): + _items_name = prop_meta.get("itemsName") + if _items_name: + xml_name = _items_name + _items_ns = prop_meta.get("itemsNs") + if _items_ns is not None: + xml_ns = _items_ns + if xml_ns: + xml_name = "{" + xml_ns + "}" + xml_name + items = element.findall(xml_name) # pyright: ignore + if len(items) > 0: + existed_attr_keys.append(xml_name) + result[rf._rest_name] = _deserialize(rf._type, items) + elif not rf._is_optional: + existed_attr_keys.append(xml_name) + result[rf._rest_name] = [] + continue + + # text element is primitive type + if prop_meta.get("text", False): + if element.text is not None: + result[rf._rest_name] = _deserialize(rf._type, element.text) + continue + + # wrapped element could be normal property or array + item = element.find(xml_name) + if item is not None: + existed_attr_keys.append(xml_name) + result[rf._rest_name] = _deserialize(rf._type, item) + + # rest thing is additional properties + for e in element: + if e.tag not in existed_attr_keys: + result[e.tag] = _convert_element(e) + + return result + def copy(self) -> "Model": return Model(self.__dict__) @@ -693,6 +1038,9 @@ def __new__(cls, *args: typing.Any, **kwargs: typing.Any) -> Self: if not rf._rest_name_input: rf._rest_name_input = attr cls._attr_to_rest_field: dict[str, _RestField] = dict(attr_to_rest_field.items()) + # Build XML field plan for fast _init_from_xml (only for XML models) + if getattr(cls, "_xml", None): + cls._xml_field_plan = _build_xml_field_plan(cls, attr_to_rest_field) cls._calculated.add(f"{cls.__module__}.{cls.__qualname__}") return super().__new__(cls) @@ -721,7 +1069,7 @@ def _deserialize(cls, data, exist_discriminators): model_meta = getattr(cls, "_xml", {}) prop_meta = getattr(discriminator, "_xml", {}) xml_name = prop_meta.get("name", discriminator._rest_name) - xml_ns = prop_meta.get("ns", model_meta.get("ns", None)) + xml_ns = _resolve_xml_ns(prop_meta, model_meta) if xml_ns: xml_name = "{" + xml_ns + "}" + xml_name @@ -1067,6 +1415,7 @@ def __init__( format: typing.Optional[str] = None, is_multipart_file_input: bool = False, xml: typing.Optional[dict[str, typing.Any]] = None, + deserializer: typing.Optional[typing.Callable] = None, ): self._type = type self._rest_name_input = name @@ -1079,6 +1428,7 @@ def __init__( self._format = format self._is_multipart_file_input = is_multipart_file_input self._xml = xml if xml is not None else {} + self._deserializer = deserializer @property def _class_type(self) -> typing.Any: @@ -1098,7 +1448,10 @@ def __get__(self, obj: Model, type=None): # pylint: disable=redefined-builtin # by this point, type and rest_name will have a value bc we default # them in __new__ of the Model class # Use _data.get() directly to avoid triggering __getitem__ which clears the cache - item = obj._data.get(self._rest_name) + item = obj._data.get(self._rest_name, _UNSET) + if item is _UNSET: + # Field not set by user; return the client default if one exists, otherwise None + return self._default if self._default is not _UNSET else None if item is None: return item if self._is_model: @@ -1111,7 +1464,11 @@ def __get__(self, obj: Model, type=None): # pylint: disable=redefined-builtin # Return the value from _data directly (it's been deserialized in place) return obj._data.get(self._rest_name) - deserialized = _deserialize(self._type, _serialize(item, self._format), rf=self) + # Fast path: use _deserializer directly (avoids _serialize/_deserialize chain) + if self._deserializer: + deserialized = self._deserializer(item) + else: + deserialized = _deserialize(self._type, _serialize(item, self._format), rf=self) # For mutable types, store the deserialized value back in _data # so mutations directly affect _data @@ -1157,6 +1514,7 @@ def rest_field( format: typing.Optional[str] = None, is_multipart_file_input: bool = False, xml: typing.Optional[dict[str, typing.Any]] = None, + deserializer: typing.Optional[typing.Callable] = None, ) -> typing.Any: return _RestField( name=name, @@ -1166,6 +1524,7 @@ def rest_field( format=format, is_multipart_file_input=is_multipart_file_input, xml=xml, + deserializer=deserializer, ) @@ -1190,6 +1549,56 @@ def serialize_xml(model: Model, exclude_readonly: bool = False) -> str: return ET.tostring(_get_element(model, exclude_readonly), encoding="unicode") # type: ignore +def _get_xml_ns(meta: dict[str, typing.Any]) -> typing.Optional[str]: + """Return the XML namespace from a metadata dict, checking both 'ns' (old-style) and 'namespace' (DPG) keys. + + :param dict meta: The metadata dictionary to extract namespace from. + :returns: The namespace string if 'ns' or 'namespace' key is present, None otherwise. + :rtype: str or None + """ + ns = meta.get("ns") + if ns is None: + ns = meta.get("namespace") + return ns + + +def _resolve_xml_ns( + prop_meta: dict[str, typing.Any], model_meta: typing.Optional[dict[str, typing.Any]] = None +) -> typing.Optional[str]: + """Resolve XML namespace for a property, falling back to model namespace when appropriate. + + Checks the property metadata first; if no namespace is found and the model does not declare + an explicit prefix, falls back to the model-level namespace. + + :param dict prop_meta: The property metadata dictionary. + :param dict model_meta: The model metadata dictionary, used as fallback. + :returns: The resolved namespace string, or None. + :rtype: str or None + """ + ns = _get_xml_ns(prop_meta) + if ns is None and model_meta is not None and not model_meta.get("prefix"): + ns = _get_xml_ns(model_meta) + return ns + + +def _set_xml_attribute(element: ET.Element, name: str, value: typing.Any, prop_meta: dict[str, typing.Any]) -> None: + """Set an XML attribute on an element, handling namespace prefix registration. + + :param ET.Element element: The element to set the attribute on. + :param str name: The default attribute name (wire name). + :param any value: The attribute value. + :param dict prop_meta: The property metadata dictionary. + """ + xml_name = prop_meta.get("name", name) + _attr_ns = _get_xml_ns(prop_meta) + if _attr_ns: + _attr_prefix = prop_meta.get("prefix") + if _attr_prefix: + _safe_register_namespace(_attr_prefix, _attr_ns) + xml_name = "{" + _attr_ns + "}" + xml_name + element.set(xml_name, _get_primitive_type_value(value)) + + def _get_element( o: typing.Any, exclude_readonly: bool = False, @@ -1201,10 +1610,16 @@ def _get_element( # if prop is a model, then use the prop element directly, else generate a wrapper of model if wrapped_element is None: + # When serializing as an array item (parent_meta is set), check if the parent has an + # explicit itemsName. This ensures correct element names for unwrapped arrays (where + # the element tag is the property/items name, not the model type name). + _items_name = parent_meta.get("itemsName") if parent_meta is not None else None + element_name = _items_name if _items_name else (model_meta.get("name") or o.__class__.__name__) + _model_ns = _get_xml_ns(model_meta) wrapped_element = _create_xml_element( - model_meta.get("name", o.__class__.__name__), + element_name, model_meta.get("prefix"), - model_meta.get("ns"), + _model_ns, ) readonly_props = [] @@ -1226,7 +1641,9 @@ def _get_element( # additional properties will not have rest field, use the wire name as xml name prop_meta = {"name": k} - # if no ns for prop, use model's + # Propagate model namespace to properties only for old-style "ns"-keyed models. + # DPG-generated models use the "namespace" key and explicitly declare namespace on + # each property that needs it, so propagation is intentionally skipped for them. if prop_meta.get("ns") is None and model_meta.get("ns"): prop_meta["ns"] = model_meta.get("ns") prop_meta["prefix"] = model_meta.get("prefix") @@ -1238,12 +1655,7 @@ def _get_element( # text could only set on primitive type wrapped_element.text = _get_primitive_type_value(v) elif prop_meta.get("attribute", False): - xml_name = prop_meta.get("name", k) - if prop_meta.get("ns"): - ET.register_namespace(prop_meta.get("prefix"), prop_meta.get("ns")) # pyright: ignore - xml_name = "{" + prop_meta.get("ns") + "}" + xml_name # pyright: ignore - # attribute should be primitive type - wrapped_element.set(xml_name, _get_primitive_type_value(v)) + _set_xml_attribute(wrapped_element, k, v, prop_meta) else: # other wrapped prop element wrapped_element.append(_get_wrapped_element(v, exclude_readonly, prop_meta)) @@ -1252,6 +1664,7 @@ def _get_element( return [_get_element(x, exclude_readonly, parent_meta) for x in o] # type: ignore if isinstance(o, dict): result = [] + _dict_ns = _get_xml_ns(parent_meta) if parent_meta else None for k, v in o.items(): result.append( _get_wrapped_element( @@ -1259,7 +1672,7 @@ def _get_element( exclude_readonly, { "name": k, - "ns": parent_meta.get("ns") if parent_meta else None, + "ns": _dict_ns, "prefix": parent_meta.get("prefix") if parent_meta else None, }, ) @@ -1268,13 +1681,16 @@ def _get_element( # primitive case need to create element based on parent_meta if parent_meta: + _items_ns = parent_meta.get("itemsNs") + if _items_ns is None: + _items_ns = _get_xml_ns(parent_meta) return _get_wrapped_element( o, exclude_readonly, { "name": parent_meta.get("itemsName", parent_meta.get("name")), "prefix": parent_meta.get("itemsPrefix", parent_meta.get("prefix")), - "ns": parent_meta.get("itemsNs", parent_meta.get("ns")), + "ns": _items_ns, }, ) @@ -1286,8 +1702,9 @@ def _get_wrapped_element( exclude_readonly: bool, meta: typing.Optional[dict[str, typing.Any]], ) -> ET.Element: + _meta_ns = _get_xml_ns(meta) if meta else None wrapped_element = _create_xml_element( - meta.get("name") if meta else None, meta.get("prefix") if meta else None, meta.get("ns") if meta else None + meta.get("name") if meta else None, meta.get("prefix") if meta else None, _meta_ns ) if isinstance(v, (dict, list)): wrapped_element.extend(_get_element(v, exclude_readonly, meta)) @@ -1308,11 +1725,29 @@ def _get_primitive_type_value(v) -> str: return str(v) +def _safe_register_namespace(prefix: str, ns: str) -> None: + """Register an XML namespace prefix, handling reserved prefix patterns. + + Some prefixes (e.g. 'ns2') match Python's reserved 'ns\\d+' pattern used for + auto-generated prefixes, causing register_namespace to raise ValueError. + Falls back to directly registering in the internal namespace map. + + :param str prefix: The namespace prefix to register. + :param str ns: The namespace URI. + """ + try: + ET.register_namespace(prefix, ns) + except ValueError: + _ns_map = getattr(ET, "_namespace_map", None) + if _ns_map is not None: + _ns_map[ns] = prefix + + def _create_xml_element( tag: typing.Any, prefix: typing.Optional[str] = None, ns: typing.Optional[str] = None ) -> ET.Element: if prefix and ns: - ET.register_namespace(prefix, ns) + _safe_register_namespace(prefix, ns) if ns: return ET.Element("{" + ns + "}" + tag) return ET.Element(tag) @@ -1323,6 +1758,8 @@ def _deserialize_xml( value: str, ) -> typing.Any: element = ET.fromstring(value) # nosec + if _is_model(deserializer): + return deserializer._deserialize(element, []) return _deserialize(deserializer, element) diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_utils/serialization.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_utils/serialization.py index 81ec1de5922b..ae08f9d89f74 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_utils/serialization.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_utils/serialization.py @@ -39,11 +39,15 @@ import xml.etree.ElementTree as ET import isodate # type: ignore -from typing_extensions import Self from azure.core.exceptions import DeserializationError, SerializationError from azure.core.serialization import NULL as CoreNull +if sys.version_info >= (3, 11): + from typing import Self +else: + from typing_extensions import Self + _BOM = codecs.BOM_UTF8.decode(encoding="utf-8") JSON = MutableMapping[str, Any] @@ -476,7 +480,11 @@ def _decode_attribute_map_key(key): class Serializer: # pylint: disable=too-many-public-methods - """Request object model serializer.""" + """Request object model serializer. + + :param classes: Mapping of model names to model types, used to resolve models during serialization. + :type classes: typing.Optional[typing.Mapping[str, type]] + """ basic_types = {str: "str", int: "int", bool: "bool", float: "float"} @@ -516,6 +524,10 @@ def __init__(self, classes: Optional[Mapping[str, type]] = None) -> None: "rfc-1123": Serializer.serialize_rfc, "unix-time": Serializer.serialize_unix, "duration": Serializer.serialize_duration, + "duration-seconds-int": Serializer.serialize_duration_seconds_int, + "duration-seconds-float": Serializer.serialize_duration_seconds_float, + "duration-milliseconds-int": Serializer.serialize_duration_milliseconds_int, + "duration-milliseconds-float": Serializer.serialize_duration_milliseconds_float, "date": Serializer.serialize_date, "time": Serializer.serialize_time, "decimal": Serializer.serialize_decimal, @@ -1105,6 +1117,61 @@ def serialize_duration(attr, **kwargs): # pylint: disable=unused-argument attr = isodate.parse_duration(attr) return isodate.duration_isoformat(attr) + @staticmethod + def _serialize_duration_numeric(attr, scale, as_int): + """Serialize a TimeDelta into a numeric value scaled to the wire unit. + + :param TimeDelta attr: Object to be serialized. + :param int scale: Multiplier applied to total seconds (1 for seconds, 1000 for milliseconds). + :param bool as_int: Whether to truncate the result to an int. + :rtype: int or float + :return: serialized duration + """ + if isinstance(attr, str): + attr = isodate.parse_duration(attr) + value = attr.total_seconds() * scale if isinstance(attr, datetime.timedelta) else attr + return int(value) if as_int else float(value) + + @staticmethod + def serialize_duration_seconds_int(attr, **kwargs): # pylint: disable=unused-argument + """Serialize TimeDelta object into an integer number of seconds. + + :param TimeDelta attr: Object to be serialized. + :rtype: int + :return: serialized duration + """ + return Serializer._serialize_duration_numeric(attr, 1, True) + + @staticmethod + def serialize_duration_seconds_float(attr, **kwargs): # pylint: disable=unused-argument + """Serialize TimeDelta object into a floating point number of seconds. + + :param TimeDelta attr: Object to be serialized. + :rtype: float + :return: serialized duration + """ + return Serializer._serialize_duration_numeric(attr, 1, False) + + @staticmethod + def serialize_duration_milliseconds_int(attr, **kwargs): # pylint: disable=unused-argument + """Serialize TimeDelta object into an integer number of milliseconds. + + :param TimeDelta attr: Object to be serialized. + :rtype: int + :return: serialized duration + """ + return Serializer._serialize_duration_numeric(attr, 1000, True) + + @staticmethod + def serialize_duration_milliseconds_float(attr, **kwargs): # pylint: disable=unused-argument + """Serialize TimeDelta object into a floating point number of milliseconds. + + :param TimeDelta attr: Object to be serialized. + :rtype: float + :return: serialized duration + """ + return Serializer._serialize_duration_numeric(attr, 1000, False) + @staticmethod def serialize_rfc(attr, **kwargs): # pylint: disable=unused-argument """Serialize Datetime object into RFC-1123 formatted string. @@ -1377,6 +1444,10 @@ def __init__(self, classes: Optional[Mapping[str, type]] = None) -> None: "rfc-1123": Deserializer.deserialize_rfc, "unix-time": Deserializer.deserialize_unix, "duration": Deserializer.deserialize_duration, + "duration-seconds-int": Deserializer.deserialize_duration_seconds, + "duration-seconds-float": Deserializer.deserialize_duration_seconds, + "duration-milliseconds-int": Deserializer.deserialize_duration_milliseconds, + "duration-milliseconds-float": Deserializer.deserialize_duration_milliseconds, "date": Deserializer.deserialize_date, "time": Deserializer.deserialize_time, "decimal": Deserializer.deserialize_decimal, @@ -1389,6 +1460,10 @@ def __init__(self, classes: Optional[Mapping[str, type]] = None) -> None: } self.deserialize_expected_types = { "duration": (isodate.Duration, datetime.timedelta), + "duration-seconds-int": (isodate.Duration, datetime.timedelta), + "duration-seconds-float": (isodate.Duration, datetime.timedelta), + "duration-milliseconds-int": (isodate.Duration, datetime.timedelta), + "duration-milliseconds-float": (isodate.Duration, datetime.timedelta), "iso-8601": (datetime.datetime), } self.dependencies: dict[str, type] = dict(classes) if classes else {} @@ -1401,7 +1476,7 @@ def __init__(self, classes: Optional[Mapping[str, type]] = None) -> None: # Otherwise, result are unexpected self.additional_properties_detection = True - def __call__(self, target_obj, response_data, content_type=None): + def __call__(self, target_obj, response_data, content_type=None): # pylint: disable=too-many-return-statements """Call the deserializer to process a REST response. :param str target_obj: Target data type to deserialize to. @@ -1411,6 +1486,27 @@ def __call__(self, target_obj, response_data, content_type=None): :return: Deserialized object. :rtype: object """ + # Fast path for header deserialization: response_data is a plain str or None + # and target_obj is a simple scalar type. This avoids the expensive + # _unpack_content → _deserialize → _classify_target → deserialize_data chain. + if response_data is None: + return None + if target_obj == "str" and isinstance(response_data, str): + return response_data + if isinstance(response_data, str): + if target_obj == "int": + return int(response_data) + if target_obj == "bool": + if response_data in ("true", "1", "True"): + return True + if response_data in ("false", "0", "False"): + return False + return bool(response_data) + if target_obj == "rfc-1123": + return Deserializer.deserialize_rfc(response_data) + if target_obj == "bytearray": + return Deserializer.deserialize_bytearray(response_data) + data = self._unpack_content(response_data, content_type) return self._deserialize(target_obj, data) @@ -1929,6 +2025,48 @@ def deserialize_duration(attr): raise DeserializationError(msg) from err return duration + @staticmethod + def _deserialize_duration_numeric(attr, unit): + """Deserialize a numeric duration value into a TimeDelta object. + + :param float attr: response value to be deserialized. + :param str unit: The wire unit, used as the ``timedelta`` keyword + (``"seconds"`` or ``"milliseconds"``). + :return: Deserialized duration + :rtype: TimeDelta + :raises DeserializationError: if value is invalid. + """ + if isinstance(attr, ET.Element): + attr = attr.text + try: + duration = datetime.timedelta(**{unit: float(attr)}) # type: ignore + except (ValueError, OverflowError, TypeError) as err: + msg = "Cannot deserialize duration object." + raise DeserializationError(msg) from err + return duration + + @staticmethod + def deserialize_duration_seconds(attr): + """Deserialize a numeric number of seconds into a TimeDelta object. + + :param float attr: response value to be deserialized. + :return: Deserialized duration + :rtype: TimeDelta + :raises DeserializationError: if value is invalid. + """ + return Deserializer._deserialize_duration_numeric(attr, "seconds") + + @staticmethod + def deserialize_duration_milliseconds(attr): + """Deserialize a numeric number of milliseconds into a TimeDelta object. + + :param float attr: response value to be deserialized. + :return: Deserialized duration + :rtype: TimeDelta + :raises DeserializationError: if value is invalid. + """ + return Deserializer._deserialize_duration_numeric(attr, "milliseconds") + @staticmethod def deserialize_date(attr): """Deserialize ISO-8601 formatted string into Date object. diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_version.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_version.py index 2e2a864184cb..c8302cef558b 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_version.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/_version.py @@ -6,4 +6,4 @@ # Changes may cause incorrect behavior and will be lost if the code is regenerated. # -------------------------------------------------------------------------- -VERSION = "4.11.0" +VERSION = "4.12.0b1" diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_client.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_client.py index 11ddf0a7723c..f5a1cd0ea8da 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_client.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_client.py @@ -7,8 +7,8 @@ # -------------------------------------------------------------------------- from copy import deepcopy +import sys from typing import Any, Awaitable, TYPE_CHECKING -from typing_extensions import Self from azure.core import AsyncPipelineClient from azure.core.pipeline import policies @@ -18,11 +18,16 @@ from ._configuration import KeyVaultClientConfiguration from ._operations import _KeyVaultClientOperationsMixin +if sys.version_info >= (3, 11): + from typing import Self +else: + from typing_extensions import Self # type: ignore + if TYPE_CHECKING: from azure.core.credentials_async import AsyncTokenCredential -class KeyVaultClient(_KeyVaultClientOperationsMixin): +class KeyVaultClient(_KeyVaultClientOperationsMixin): # pylint: disable=docstring-keyword-should-match-keyword-only """The key vault client performs cryptographic key operations and vault operations against the Key Vault service. @@ -30,9 +35,10 @@ class KeyVaultClient(_KeyVaultClientOperationsMixin): :type vault_base_url: str :param credential: Credential used to authenticate requests to the service. Required. :type credential: ~azure.core.credentials_async.AsyncTokenCredential - :keyword api_version: The API version to use for this operation. Known values are "2025-07-01". - Default value is "2025-07-01". Note that overriding this default value may result in - unsupported behavior. + :keyword api_version: The API version to use for this operation. Known values are + "2026-03-01-preview" and None. Default value is None. If not set, the operation's default API + version will be used. Note that overriding this default value may result in unsupported + behavior. :paramtype api_version: str """ diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_configuration.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_configuration.py index 19a630dc43ac..2aa55e3be6b3 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_configuration.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_configuration.py @@ -1,3 +1,4 @@ +# pylint: disable=line-too-long,useless-suppression # coding=utf-8 # -------------------------------------------------------------------------- # Copyright (c) Microsoft Corporation. All rights reserved. @@ -16,7 +17,7 @@ from azure.core.credentials_async import AsyncTokenCredential -class KeyVaultClientConfiguration: # pylint: disable=too-many-instance-attributes +class KeyVaultClientConfiguration: # pylint: disable=too-many-instance-attributes,docstring-keyword-should-match-keyword-only """Configuration for KeyVaultClient. Note that all parameters used to create this instance are saved as instance @@ -26,14 +27,15 @@ class KeyVaultClientConfiguration: # pylint: disable=too-many-instance-attribut :type vault_base_url: str :param credential: Credential used to authenticate requests to the service. Required. :type credential: ~azure.core.credentials_async.AsyncTokenCredential - :keyword api_version: The API version to use for this operation. Known values are "2025-07-01". - Default value is "2025-07-01". Note that overriding this default value may result in - unsupported behavior. + :keyword api_version: The API version to use for this operation. Known values are + "2026-03-01-preview" and None. Default value is None. If not set, the operation's default API + version will be used. Note that overriding this default value may result in unsupported + behavior. :paramtype api_version: str """ def __init__(self, vault_base_url: str, credential: "AsyncTokenCredential", **kwargs: Any) -> None: - api_version: str = kwargs.pop("api_version", "2025-07-01") + api_version: str = kwargs.pop("api_version", "2026-03-01-preview") if vault_base_url is None: raise ValueError("Parameter 'vault_base_url' must not be None.") diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_operations/_operations.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_operations/_operations.py index 6a157578fc7f..f6bb37296edf 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_operations/_operations.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_operations/_operations.py @@ -30,7 +30,7 @@ from azure.core.tracing.decorator_async import distributed_trace_async from azure.core.utils import case_insensitive_dict -from ... import models as _models +from ... import models as _models, types as _types from ..._operations._operations import ( build_key_vault_backup_secret_request, build_key_vault_delete_secret_request, @@ -50,7 +50,6 @@ from ..._validation import api_version_validation from .._configuration import KeyVaultClientConfiguration -JSON = MutableMapping[str, Any] T = TypeVar("T") ClsType = Optional[Callable[[PipelineResponse[HttpRequest, AsyncHttpResponse], T, dict[str, Any]], Any]] @@ -90,7 +89,12 @@ async def set_secret( @overload async def set_secret( - self, secret_name: str, parameters: JSON, *, content_type: str = "application/json", **kwargs: Any + self, + secret_name: str, + parameters: _types.SecretSetParameters, + *, + content_type: str = "application/json", + **kwargs: Any ) -> _models.SecretBundle: """Sets a secret in a specified key vault. @@ -103,7 +107,7 @@ async def set_secret( identifiable or sensitive information. Required. :type secret_name: str :param parameters: The parameters for setting the secret. Required. - :type parameters: JSON + :type parameters: ~azure.keyvault.secrets._generated.types.SecretSetParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -138,7 +142,10 @@ async def set_secret( @distributed_trace_async async def set_secret( - self, secret_name: str, parameters: Union[_models.SecretSetParameters, JSON, IO[bytes]], **kwargs: Any + self, + secret_name: str, + parameters: Union[_models.SecretSetParameters, _types.SecretSetParameters, IO[bytes]], + **kwargs: Any ) -> _models.SecretBundle: """Sets a secret in a specified key vault. @@ -150,10 +157,10 @@ async def set_secret( the purpose of running the service. The value provided should not include personally identifiable or sensitive information. Required. :type secret_name: str - :param parameters: The parameters for setting the secret. Is one of the following types: - SecretSetParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.keyvault.secrets._generated.models.SecretSetParameters or JSON or - IO[bytes] + :param parameters: The parameters for setting the secret. Is either a SecretSetParameters type + or a IO[bytes] type. Required. + :type parameters: ~azure.keyvault.secrets._generated.models.SecretSetParameters or + ~azure.keyvault.secrets._generated.types.SecretSetParameters or IO[bytes] :return: SecretBundle. The SecretBundle is compatible with MutableMapping :rtype: ~azure.keyvault.secrets._generated.models.SecretBundle :raises ~azure.core.exceptions.HttpResponseError: @@ -330,7 +337,7 @@ async def update_secret( self, secret_name: str, secret_version: str, - parameters: JSON, + parameters: _types.SecretUpdateParameters, *, content_type: str = "application/json", **kwargs: Any @@ -346,7 +353,7 @@ async def update_secret( :param secret_version: The version of the secret. Required. :type secret_version: str :param parameters: The parameters for update secret operation. Required. - :type parameters: JSON + :type parameters: ~azure.keyvault.secrets._generated.types.SecretUpdateParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -390,7 +397,7 @@ async def update_secret( self, secret_name: str, secret_version: str, - parameters: Union[_models.SecretUpdateParameters, JSON, IO[bytes]], + parameters: Union[_models.SecretUpdateParameters, _types.SecretUpdateParameters, IO[bytes]], **kwargs: Any ) -> _models.SecretBundle: """Updates the attributes associated with a specified secret in a given key vault. @@ -403,10 +410,10 @@ async def update_secret( :type secret_name: str :param secret_version: The version of the secret. Required. :type secret_version: str - :param parameters: The parameters for update secret operation. Is one of the following types: - SecretUpdateParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.keyvault.secrets._generated.models.SecretUpdateParameters or JSON or - IO[bytes] + :param parameters: The parameters for update secret operation. Is either a + SecretUpdateParameters type or a IO[bytes] type. Required. + :type parameters: ~azure.keyvault.secrets._generated.models.SecretUpdateParameters or + ~azure.keyvault.secrets._generated.types.SecretUpdateParameters or IO[bytes] :return: SecretBundle. The SecretBundle is compatible with MutableMapping :rtype: ~azure.keyvault.secrets._generated.models.SecretBundle :raises ~azure.core.exceptions.HttpResponseError: @@ -482,7 +489,15 @@ async def update_secret( @distributed_trace_async @api_version_validation( params_added_on={"2025-06-01-preview": ["out_content_type"]}, - api_versions_list=["7.5", "7.6-preview.2", "7.6", "2025-06-01-preview", "2025-07-01"], + api_versions_list=[ + "7.5", + "7.6-preview.2", + "7.6", + "2025-06-01-preview", + "2025-07-01", + "2026-01-01-preview", + "2026-03-01-preview", + ], ) async def get_secret( self, @@ -627,7 +642,10 @@ def prepare_request(next_link=None): ) _next_request_params["api-version"] = self._config.api_version _request = HttpRequest( - "GET", urllib.parse.urljoin(next_link, _parsed_next_link.path), params=_next_request_params + "GET", + urllib.parse.urljoin(next_link, _parsed_next_link.path), + headers=_headers, + params=_next_request_params, ) path_format_arguments = { "vaultBaseUrl": self._serialize.url( @@ -729,7 +747,10 @@ def prepare_request(next_link=None): ) _next_request_params["api-version"] = self._config.api_version _request = HttpRequest( - "GET", urllib.parse.urljoin(next_link, _parsed_next_link.path), params=_next_request_params + "GET", + urllib.parse.urljoin(next_link, _parsed_next_link.path), + headers=_headers, + params=_next_request_params, ) path_format_arguments = { "vaultBaseUrl": self._serialize.url( @@ -828,7 +849,10 @@ def prepare_request(next_link=None): ) _next_request_params["api-version"] = self._config.api_version _request = HttpRequest( - "GET", urllib.parse.urljoin(next_link, _parsed_next_link.path), params=_next_request_params + "GET", + urllib.parse.urljoin(next_link, _parsed_next_link.path), + headers=_headers, + params=_next_request_params, ) path_format_arguments = { "vaultBaseUrl": self._serialize.url( @@ -1159,7 +1183,7 @@ async def restore_secret( @overload async def restore_secret( - self, parameters: JSON, *, content_type: str = "application/json", **kwargs: Any + self, parameters: _types.SecretRestoreParameters, *, content_type: str = "application/json", **kwargs: Any ) -> _models.SecretBundle: """Restores a backed up secret to a vault. @@ -1167,7 +1191,7 @@ async def restore_secret( secrets/restore permission. :param parameters: The parameters to restore the secret. Required. - :type parameters: JSON + :type parameters: ~azure.keyvault.secrets._generated.types.SecretRestoreParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -1197,17 +1221,19 @@ async def restore_secret( @distributed_trace_async async def restore_secret( - self, parameters: Union[_models.SecretRestoreParameters, JSON, IO[bytes]], **kwargs: Any + self, + parameters: Union[_models.SecretRestoreParameters, _types.SecretRestoreParameters, IO[bytes]], + **kwargs: Any ) -> _models.SecretBundle: """Restores a backed up secret to a vault. Restores a backed up secret, and all its versions, to a vault. This operation requires the secrets/restore permission. - :param parameters: The parameters to restore the secret. Is one of the following types: - SecretRestoreParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.keyvault.secrets._generated.models.SecretRestoreParameters or JSON or - IO[bytes] + :param parameters: The parameters to restore the secret. Is either a SecretRestoreParameters + type or a IO[bytes] type. Required. + :type parameters: ~azure.keyvault.secrets._generated.models.SecretRestoreParameters or + ~azure.keyvault.secrets._generated.types.SecretRestoreParameters or IO[bytes] :return: SecretBundle. The SecretBundle is compatible with MutableMapping :rtype: ~azure.keyvault.secrets._generated.models.SecretBundle :raises ~azure.core.exceptions.HttpResponseError: diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_operations/_patch.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_operations/_patch.py index 87676c65a8f0..ea765788358a 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_operations/_patch.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_operations/_patch.py @@ -8,7 +8,6 @@ Follow our quickstart for examples: https://aka.ms/azsdk/python/dpcodegen/python/customize """ - __all__: list[str] = [] # Add all objects you want publicly available to users at this package level diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_patch.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_patch.py index 87676c65a8f0..ea765788358a 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_patch.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/aio/_patch.py @@ -8,7 +8,6 @@ Follow our quickstart for examples: https://aka.ms/azsdk/python/dpcodegen/python/customize """ - __all__: list[str] = [] # Add all objects you want publicly available to users at this package level diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_enums.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_enums.py index 6d0a4b65fa3c..e827cc2a01d9 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_enums.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_enums.py @@ -34,16 +34,16 @@ class DeletionRecoveryLevel(str, Enum, metaclass=CaseInsensitiveEnumMeta): """Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the - subscription is cancelled. System will permanently delete it after 90 days, if not recovered.""" + subscription is cancelled. System wil permanently delete it after 90 days, if not recovered.""" RECOVERABLE = "Recoverable" """Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. - System will permanently delete it after 90 days, if not recovered.""" + System wil permanently delete it after 90 days, if not recovered.""" RECOVERABLE_PROTECTED_SUBSCRIPTION = "Recoverable+ProtectedSubscription" """Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in - which the subscription itself cannot be permanently canceled. System will permanently delete it + which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered.""" CUSTOMIZED_RECOVERABLE_PURGEABLE = "CustomizedRecoverable+Purgeable" """Denotes a vault state in which deletion is recoverable, and which also permits immediate and diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_models.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_models.py index 59ab3d0b7a52..0b3514152619 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_models.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_models.py @@ -27,7 +27,7 @@ class BackupSecretResult(_Model): """The backup blob containing the backed up secret.""" -class DeletedSecretBundle(_Model): +class DeletedSecretBundle(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """A Deleted Secret consisting of its previous id, attributes and its tags, as well as information on when it will be purged. @@ -122,7 +122,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DeletedSecretItem(_Model): +class DeletedSecretItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The deleted secret item containing metadata about the deleted secret. :ivar id: Secret identifier. @@ -225,7 +225,7 @@ class KeyVaultErrorError(_Model): """The key vault server error.""" -class SecretAttributes(_Model): +class SecretAttributes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The secret management attributes. :ivar enabled: Determines whether the object is enabled. @@ -297,7 +297,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SecretBundle(_Model): +class SecretBundle(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """A secret consisting of a value, id and its attributes. :ivar value: The secret value. @@ -371,7 +371,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SecretItem(_Model): +class SecretItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The secret item containing secret metadata. :ivar id: Secret identifier. @@ -424,7 +424,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SecretRestoreParameters(_Model): +class SecretRestoreParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The secret restore parameters. :ivar secret_bundle_backup: The backup blob associated with a secret bundle. Required. @@ -454,7 +454,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SecretSetParameters(_Model): +class SecretSetParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The secret set parameters. :ivar value: The value of the secret. Required. @@ -501,7 +501,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SecretUpdateParameters(_Model): +class SecretUpdateParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The secret update parameters. :ivar content_type: Type of the secret value such as a password. diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_patch.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_patch.py index 87676c65a8f0..ea765788358a 100644 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_patch.py +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/models/_patch.py @@ -8,7 +8,6 @@ Follow our quickstart for examples: https://aka.ms/azsdk/python/dpcodegen/python/customize """ - __all__: list[str] = [] # Add all objects you want publicly available to users at this package level diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/types.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/types.py new file mode 100644 index 000000000000..ce61b33d775f --- /dev/null +++ b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_generated/types.py @@ -0,0 +1,113 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) Python Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- + +from typing import TYPE_CHECKING, Union +from typing_extensions import Required, TypedDict + +if TYPE_CHECKING: + from .models import DeletionRecoveryLevel + + +class SecretAttributes(TypedDict, total=False): + """The secret management attributes. + + :ivar enabled: Determines whether the object is enabled. + :vartype enabled: bool + :ivar nbf: Not before date in UTC. + :vartype nbf: int + :ivar exp: Expiry date in UTC. + :vartype exp: int + :ivar created: Creation time in UTC. + :vartype created: int + :ivar updated: Last updated time in UTC. + :vartype updated: int + :ivar recoverableDays: softDelete data retention days. Value should be >=7 and <=90 when + softDelete enabled, otherwise 0. + :vartype recoverableDays: int + :ivar recoveryLevel: Reflects the deletion recovery level currently in effect for secrets in + the current vault. If it contains 'Purgeable', the secret can be permanently deleted by a + privileged user; otherwise, only the system can purge the secret, at the end of the retention + interval. Known values are: "Purgeable", "Recoverable+Purgeable", "Recoverable", + "Recoverable+ProtectedSubscription", "CustomizedRecoverable+Purgeable", + "CustomizedRecoverable", and "CustomizedRecoverable+ProtectedSubscription". + :vartype recoveryLevel: Union[str, "DeletionRecoveryLevel"] + """ + + enabled: bool + """Determines whether the object is enabled.""" + nbf: int + """Not before date in UTC.""" + exp: int + """Expiry date in UTC.""" + created: int + """Creation time in UTC.""" + updated: int + """Last updated time in UTC.""" + recoverableDays: int + """softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise + 0.""" + recoveryLevel: Union[str, "DeletionRecoveryLevel"] + """Reflects the deletion recovery level currently in effect for secrets in the current vault. If + it contains 'Purgeable', the secret can be permanently deleted by a privileged user; otherwise, + only the system can purge the secret, at the end of the retention interval. Known values are: + \"Purgeable\", \"Recoverable+Purgeable\", \"Recoverable\", + \"Recoverable+ProtectedSubscription\", \"CustomizedRecoverable+Purgeable\", + \"CustomizedRecoverable\", and \"CustomizedRecoverable+ProtectedSubscription\".""" + + +class SecretRestoreParameters(TypedDict, total=False): + """The secret restore parameters. + + :ivar value: The backup blob associated with a secret bundle. Required. + :vartype value: str + """ + + value: Required[str] + """The backup blob associated with a secret bundle. Required.""" + + +class SecretSetParameters(TypedDict, total=False): + """The secret set parameters. + + :ivar value: The value of the secret. Required. + :vartype value: str + :ivar tags: Application specific metadata in the form of key-value pairs. + :vartype tags: dict[str, str] + :ivar contentType: Type of the secret value such as a password. + :vartype contentType: str + :ivar attributes: The secret management attributes. + :vartype attributes: "SecretAttributes" + """ + + value: Required[str] + """The value of the secret. Required.""" + tags: dict[str, str] + """Application specific metadata in the form of key-value pairs.""" + contentType: str + """Type of the secret value such as a password.""" + attributes: "SecretAttributes" + """The secret management attributes.""" + + +class SecretUpdateParameters(TypedDict, total=False): + """The secret update parameters. + + :ivar contentType: Type of the secret value such as a password. + :vartype contentType: str + :ivar attributes: The secret management attributes. + :vartype attributes: "SecretAttributes" + :ivar tags: Application specific metadata in the form of key-value pairs. + :vartype tags: dict[str, str] + """ + + contentType: str + """Type of the secret value such as a password.""" + attributes: "SecretAttributes" + """The secret management attributes.""" + tags: dict[str, str] + """Application specific metadata in the form of key-value pairs.""" diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_models.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_models.py deleted file mode 100644 index 60c626f0b9a3..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_models.py +++ /dev/null @@ -1,399 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from datetime import datetime - -from typing import Any, Dict, Optional, Union - -from ._generated import models as _models -from ._shared import parse_key_vault_id - - -class SecretProperties(object): - """A secret's ID and attributes.""" - - def __init__(self, *args: Any, **kwargs: Any) -> None: - self._attributes: Optional[_models.SecretAttributes] = args[0] if args else kwargs.get("attributes", None) - self._id: Optional[str] = args[1] if len(args) > 1 else kwargs.get("vault_id", None) - self._vault_id = KeyVaultSecretIdentifier(self._id) if self._id else None - self._content_type = kwargs.get("content_type", None) - self._key_id = kwargs.get("key_id", None) - self._managed = kwargs.get("managed", None) - self._previous_version = kwargs.get("previous_version", None) - self._tags = kwargs.get("tags", None) - - def __repr__(self) -> str: - return f""[:1024] - - @classmethod - def _from_secret_bundle( - cls, secret_bundle: Union[_models.DeletedSecretBundle, _models.SecretBundle] - ) -> "SecretProperties": - return cls( - secret_bundle.attributes, - secret_bundle.id, - content_type=secret_bundle.content_type, - key_id=secret_bundle.kid, - managed=secret_bundle.managed, - previous_version=secret_bundle.previous_version, - tags=secret_bundle.tags, - ) - - @classmethod - def _from_secret_item(cls, secret_item: Union[_models.DeletedSecretItem, _models.SecretItem]) -> "SecretProperties": - return cls( - secret_item.attributes, - secret_item.id, - content_type=secret_item.content_type, - managed=secret_item.managed, - previous_version=getattr(secret_item, "previous_version", None), - tags=secret_item.tags, - ) - - @property - def content_type(self) -> Optional[str]: - """An arbitrary string indicating the type of the secret. - - :returns: The content type of the secret. - :rtype: str or None - """ - return self._content_type - - @property - def id(self) -> Optional[str]: - """The secret's ID. - - :returns: The secret's ID. - :rtype: str or None - """ - return self._id - - @property - def key_id(self) -> Optional[str]: - """If this secret backs a certificate, this property is the identifier of the corresponding key. - - :returns: The ID of the key backing the certificate that's backed by this secret. If the secret isn't backing a - certificate, this is None. - :rtype: str or None - """ - return self._key_id - - @property - def enabled(self) -> Optional[bool]: - """Whether the secret is enabled for use. - - :returns: True if the secret is enabled for use; False otherwise. - :rtype: bool or None - """ - return self._attributes.enabled if self._attributes else None - - @property - def not_before(self) -> Optional[datetime]: - """The time before which the secret cannot be used, in UTC. - - :returns: The time before which the secret cannot be used, in UTC. - :rtype: ~datetime.datetime or None - """ - return self._attributes.not_before if self._attributes else None - - @property - def expires_on(self) -> Optional[datetime]: - """When the secret expires, in UTC. - - :returns: When the secret expires, in UTC. - :rtype: ~datetime.datetime or None - """ - return self._attributes.expires if self._attributes else None - - @property - def created_on(self) -> Optional[datetime]: - """When the secret was created, in UTC. - - :returns: When the secret was created, in UTC. - :rtype: ~datetime.datetime or None - """ - return self._attributes.created if self._attributes else None - - @property - def updated_on(self) -> Optional[datetime]: - """When the secret was last updated, in UTC. - - :returns: When the secret was last updated, in UTC. - :rtype: ~datetime.datetime or None - """ - return self._attributes.updated if self._attributes else None - - @property - def recoverable_days(self) -> Optional[int]: - """The number of days the key is retained before being deleted from a soft-delete enabled Key Vault. - - :returns: The number of days the key is retained before being deleted from a soft-delete enabled Key Vault. - :rtype: int or None - """ - # recoverable_days was added in 7.1-preview - if self._attributes and hasattr(self._attributes, "recoverable_days"): - return self._attributes.recoverable_days - return None - - @property - def recovery_level(self) -> Optional[str]: - """The vault's deletion recovery level for secrets. - - :returns: The vault's deletion recovery level for secrets. - :rtype: str or None - """ - return self._attributes.recovery_level if self._attributes else None - - @property - def vault_url(self) -> Optional[str]: - """URL of the vault containing the secret. - - :returns: URL of the vault containing the secret. - :rtype: str or None - """ - return self._vault_id.vault_url if self._vault_id else None - - @property - def name(self) -> Optional[str]: - """The secret's name. - - :returns: The secret's name. - :rtype: str or None - """ - return self._vault_id.name if self._vault_id else None - - @property - def version(self) -> Optional[str]: - """The secret's version. - - :returns: The secret's version. - :rtype: str or None - """ - return self._vault_id.version if self._vault_id else None - - @property - def tags(self) -> Optional[Dict[str, str]]: - """Application specific metadata in the form of key-value pairs. - - :returns: A dictionary of tags attached to this secret. - :rtype: dict or None - """ - return self._tags - - @property - def managed(self) -> Optional[bool]: - """Whether the secret's lifetime is managed by Key Vault. If the secret backs a certificate, this will be true. - - :returns: True if the secret's lifetime is managed by Key Vault; False otherwise. - :rtype: bool or None - """ - return self._managed - - @property - def previous_version(self) -> Optional[str]: - """The previous version identifier for certificate-backed secrets, if available. - - :returns: The previous version identifier. - :rtype: str or None - """ - return self._previous_version - - -class KeyVaultSecret(object): - """All of a secret's properties, and its value. - - :param properties: The secret's properties. - :type properties: ~azure.keyvault.secrets.SecretProperties - :param value: The value of the secret. - :type value: str or None - """ - - def __init__(self, properties: SecretProperties, value: Optional[str]) -> None: - self._properties = properties - self._value = value - - def __repr__(self) -> str: - return f""[:1024] - - @classmethod - def _from_secret_bundle(cls, secret_bundle: _models.SecretBundle) -> "KeyVaultSecret": - return cls( - properties=SecretProperties._from_secret_bundle(secret_bundle), # pylint: disable=protected-access - value=secret_bundle.value, - ) - - @property - def name(self) -> Optional[str]: - """The secret's name. - - :returns: The secret's name. - :rtype: str or None - """ - return self._properties.name - - @property - def id(self) -> Optional[str]: - """The secret's ID. - - :returns: The secret's ID. - :rtype: str or None - """ - return self._properties.id - - @property - def properties(self) -> SecretProperties: - """The secret's properties. - - :returns: The secret's properties. - :rtype: ~azure.keyvault.secrets.SecretProperties - """ - return self._properties - - @property - def value(self) -> Optional[str]: - """The secret's value. - - :returns: The secret's value. - :rtype: str or None - """ - return self._value - - -class KeyVaultSecretIdentifier(object): - """Information about a KeyVaultSecret parsed from a secret ID. - - :param str source_id: the full original identifier of a secret - - :raises ValueError: if the secret ID is improperly formatted - - Example: - .. literalinclude:: ../tests/test_parse_id.py - :start-after: [START parse_key_vault_secret_id] - :end-before: [END parse_key_vault_secret_id] - :language: python - :caption: Parse a secret's ID - :dedent: 8 - """ - - def __init__(self, source_id: str) -> None: - self._resource_id = parse_key_vault_id(source_id) - - @property - def source_id(self) -> str: - return self._resource_id.source_id - - @property - def vault_url(self) -> str: - return self._resource_id.vault_url - - @property - def name(self) -> str: - return self._resource_id.name - - @property - def version(self) -> Optional[str]: - return self._resource_id.version - - -class DeletedSecret(object): - """A deleted secret's properties and information about its deletion. - - If soft-delete is enabled, returns information about its recovery as well. - - :param properties: The deleted secret's properties. - :type properties: ~azure.keyvault.secrets.SecretProperties - :param deleted_date: When the secret was deleted, in UTC. - :type deleted_date: ~datetime.datetime or None - :param recovery_id: An identifier used to recover the deleted secret. - :type recovery_id: str or None - :param scheduled_purge_date: When the secret is scheduled to be purged by Key Vault, in UTC. - :type scheduled_purge_date: ~datetime.datetime or None - """ - - def __init__( - self, - properties: SecretProperties, - deleted_date: Optional[datetime] = None, - recovery_id: Optional[str] = None, - scheduled_purge_date: Optional[datetime] = None, - ) -> None: - self._properties = properties - self._deleted_date = deleted_date - self._recovery_id = recovery_id - self._scheduled_purge_date = scheduled_purge_date - - def __repr__(self) -> str: - return f""[:1024] - - @classmethod - def _from_deleted_secret_bundle(cls, deleted_secret_bundle: _models.DeletedSecretBundle) -> "DeletedSecret": - return cls( - properties=SecretProperties._from_secret_bundle(deleted_secret_bundle), # pylint: disable=protected-access - deleted_date=deleted_secret_bundle.deleted_date, - recovery_id=deleted_secret_bundle.recovery_id, - scheduled_purge_date=deleted_secret_bundle.scheduled_purge_date, - ) - - @classmethod - def _from_deleted_secret_item(cls, deleted_secret_item: _models.DeletedSecretItem) -> "DeletedSecret": - return cls( - properties=SecretProperties._from_secret_item(deleted_secret_item), # pylint: disable=protected-access - deleted_date=deleted_secret_item.deleted_date, - recovery_id=deleted_secret_item.recovery_id, - scheduled_purge_date=deleted_secret_item.scheduled_purge_date, - ) - - @property - def name(self) -> Optional[str]: - """The secret's name. - - :returns: The secret's name. - :rtype: str or None - """ - return self._properties.name - - @property - def id(self) -> Optional[str]: - """The secret's ID. - - :returns: The secret's ID. - :rtype: str or None - """ - return self._properties.id - - @property - def properties(self) -> SecretProperties: - """The properties of the deleted secret. - - :returns: The properties of the deleted secret. - :rtype: ~azure.keyvault.secrets.SecretProperties - """ - return self._properties - - @property - def deleted_date(self) -> Optional[datetime]: - """When the secret was deleted, in UTC. - - :returns: When the secret was deleted, in UTC. - :rtype: ~datetime.datetime or None - """ - return self._deleted_date - - @property - def recovery_id(self) -> Optional[str]: - """An identifier used to recover the deleted secret. - - :returns: An identifier used to recover the deleted secret. - :rtype: str or None - """ - return self._recovery_id - - @property - def scheduled_purge_date(self) -> Optional[datetime]: - """When the secret is scheduled to be purged by Key Vault, in UTC. - - :returns: When the secret is scheduled to be purged by Key Vault, in UTC. - :rtype: ~datetime.datetime or None - """ - return self._scheduled_purge_date diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_sdk_moniker.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_sdk_moniker.py deleted file mode 100644 index 43fd4b4a87ac..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_sdk_moniker.py +++ /dev/null @@ -1,7 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from ._version import VERSION - -SDK_MONIKER = f"keyvault-secrets/{VERSION}" diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/__init__.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/__init__.py deleted file mode 100644 index cb088e31ad23..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/__init__.py +++ /dev/null @@ -1,78 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from typing import Optional -from urllib import parse - -from .challenge_auth_policy import ChallengeAuthPolicy -from .client_base import KeyVaultClientBase -from .http_challenge import HttpChallenge -from . import http_challenge_cache - -HttpChallengeCache = http_challenge_cache # to avoid aliasing pylint error (C4745) - - -__all__ = [ - "ChallengeAuthPolicy", - "HttpChallenge", - "HttpChallengeCache", - "KeyVaultClientBase", -] - - -class KeyVaultResourceId: - """Represents a Key Vault identifier and its parsed contents. - - :param str source_id: The complete identifier received from Key Vault - :param str vault_url: The vault URL - :param str name: The name extracted from the ID - :param str version: The version extracted from the ID - """ - - def __init__( - self, - source_id: str, - vault_url: str, - name: str, - version: "Optional[str]" = None, - ) -> None: - self.source_id = source_id - self.vault_url = vault_url - self.name = name - self.version = version - - -def parse_key_vault_id(source_id: str) -> KeyVaultResourceId: - try: - parsed_uri = parse.urlparse(source_id) - except Exception as exc: - raise ValueError(f"'{source_id}' is not a valid ID") from exc - if not (parsed_uri.scheme and parsed_uri.hostname): - raise ValueError(f"'{source_id}' is not a valid ID") - - path = list(filter(None, parsed_uri.path.split("/"))) - - if len(path) < 2 or len(path) > 3: - raise ValueError(f"'{source_id}' is not a valid ID") - - vault_url = f"{parsed_uri.scheme}://{parsed_uri.hostname}" - if parsed_uri.port: - vault_url += f":{parsed_uri.port}" - - return KeyVaultResourceId( - source_id=source_id, - vault_url=vault_url, - name=path[1], - version=path[2] if len(path) == 3 else None, - ) - - -try: - # pylint:disable=unused-import - from .async_challenge_auth_policy import AsyncChallengeAuthPolicy - from .async_client_base import AsyncKeyVaultClientBase - - __all__.extend(["AsyncChallengeAuthPolicy", "AsyncKeyVaultClientBase"]) -except (SyntaxError, ImportError): - pass diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/_polling.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/_polling.py deleted file mode 100644 index ff0c398bba6d..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/_polling.py +++ /dev/null @@ -1,136 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -import threading -import uuid -from typing import Any, Callable, cast, Optional - -from azure.core.exceptions import ResourceNotFoundError, HttpResponseError -from azure.core.pipeline import PipelineResponse -from azure.core.pipeline.transport import HttpTransport -from azure.core.polling import PollingMethod, LROPoller, NoPolling - -from azure.core.tracing.decorator import distributed_trace -from azure.core.tracing.common import with_current_context - - -class KeyVaultOperationPoller(LROPoller): - """Poller for long running operations where calling result() doesn't wait for operation to complete. - - :param polling_method: The poller's polling method. - :type polling_method: ~azure.core.polling.PollingMethod - """ - - def __init__(self, polling_method: PollingMethod) -> None: - super(KeyVaultOperationPoller, self).__init__(None, None, lambda *_: None, NoPolling()) - self._polling_method = polling_method - - # pylint: disable=arguments-differ - def result(self) -> "Any": # type: ignore - """Returns a representation of the final resource without waiting for the operation to complete. - - :returns: The deserialized resource of the long running operation - :rtype: Any - - :raises ~azure.core.exceptions.HttpResponseError: Server problem with the query. - """ - return self._polling_method.resource() - - @distributed_trace - def wait(self, timeout: Optional[float] = None) -> None: - """Wait on the long running operation for a number of seconds. - - You can check if this call has ended with timeout with the "done()" method. - - :param float timeout: Period of time to wait for the long running operation to complete (in seconds). - - :raises ~azure.core.exceptions.HttpResponseError: Server problem with the query. - """ - - if not self._polling_method.finished(): - self._done = threading.Event() - self._thread = threading.Thread( - target=with_current_context(self._start), name=f"KeyVaultOperationPoller({uuid.uuid4()})" - ) - self._thread.daemon = True - self._thread.start() - - if self._thread is None: - return - self._thread.join(timeout=timeout) - try: - # Let's handle possible None in forgiveness here - raise self._exception # type: ignore - except TypeError: # Was None - pass - - -class DeleteRecoverPollingMethod(PollingMethod): - """Poller for deleting resources, and recovering deleted resources, in vaults with soft-delete enabled. - - This works by polling for the existence of the deleted or recovered resource. When a resource is deleted, Key Vault - immediately removes it from its collection. However, the resource will not immediately appear in the deleted - collection. Key Vault will therefore respond 404 to GET requests for the deleted resource; when it responds 2xx, - the resource exists in the deleted collection i.e. its deletion is complete. - - Similarly, while recovering a deleted resource, Key Vault will respond 404 to GET requests for the non-deleted - resource; when it responds 2xx, the resource exists in the non-deleted collection, i.e. its recovery is complete. - - :param pipeline_response: The operation's original pipeline response. - :type pipeline_response: PipelineResponse - :param command: A callable to invoke when polling. - :type command: Callable - :param final_resource: The final resource returned by the polling operation. - :type final_resource: Any - :param bool finished: Whether or not the polling operation is completed. - :param int interval: The polling interval, in seconds. - """ - - def __init__( - self, - pipeline_response: PipelineResponse, - command: Callable, - final_resource: Any, - finished: bool, - interval: int = 2, - ) -> None: - self._pipeline_response = pipeline_response - self._command = command - self._resource = final_resource - self._polling_interval = interval - self._finished = finished - - def _update_status(self) -> None: - try: - self._command() - self._finished = True - except ResourceNotFoundError: - pass - except HttpResponseError as e: - # If we are polling on get_deleted_* and we don't have get permissions, we will get - # ResourceNotFoundError until the resource is recovered, at which point we'll get a 403. - if e.status_code == 403: - self._finished = True - else: - raise - - def initialize(self, client: Any, initial_response: Any, deserialization_callback: Callable) -> None: - pass - - def run(self) -> None: - while not self.finished(): - self._update_status() - if not self.finished(): - # We should always ask the client's transport to sleep, instead of sleeping directly - transport: HttpTransport = cast(HttpTransport, self._pipeline_response.context.transport) - transport.sleep(self._polling_interval) - - def finished(self) -> bool: - return self._finished - - def resource(self) -> Any: - return self._resource - - def status(self) -> str: - return "finished" if self._finished else "polling" diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/_polling_async.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/_polling_async.py deleted file mode 100644 index 16168229af08..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/_polling_async.py +++ /dev/null @@ -1,80 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from typing import Any, Callable, cast - -from azure.core.exceptions import ResourceNotFoundError, HttpResponseError -from azure.core.pipeline import PipelineResponse -from azure.core.pipeline.transport import AsyncHttpTransport -from azure.core.polling import AsyncPollingMethod - - -class AsyncDeleteRecoverPollingMethod(AsyncPollingMethod): - """Poller for deleting resources, and recovering deleted resources, in vaults with soft-delete enabled. - - This works by polling for the existence of the deleted or recovered resource. When a resource is deleted, Key Vault - immediately removes it from its collection. However, the resource will not immediately appear in the deleted - collection. Key Vault will therefore respond 404 to GET requests for the deleted resource; when it responds 2xx, - the resource exists in the deleted collection i.e. its deletion is complete. - - Similarly, while recovering a deleted resource, Key Vault will respond 404 to GET requests for the non-deleted - resource; when it responds 2xx, the resource exists in the non-deleted collection, i.e. its recovery is complete. - - :param pipeline_response: The operation's original pipeline response. - :type pipeline_response: PipelineResponse - :param command: An awaitable to invoke when polling. - :type command: Callable - :param final_resource: The final resource returned by the polling operation. - :type final_resource: Any - :param bool finished: Whether or not the polling operation is completed. - :param int interval: The polling interval, in seconds. - """ - - def __init__( - self, - pipeline_response: PipelineResponse, - command: Callable, - final_resource: Any, - finished: bool, - interval: int = 2, - ) -> None: - self._pipeline_response = pipeline_response - self._command = command - self._resource = final_resource - self._polling_interval = interval - self._finished = finished - - def initialize(self, client, initial_response, deserialization_callback): - pass - - async def _update_status(self) -> None: - try: - await self._command() - self._finished = True - except ResourceNotFoundError: - pass - except HttpResponseError as e: - # If we are polling on get_deleted_* and we don't have get permissions, we will get - # ResourceNotFoundError until the resource is recovered, at which point we'll get a 403. - if e.status_code == 403: - self._finished = True - else: - raise - - async def run(self) -> None: - while not self.finished(): - await self._update_status() - if not self.finished(): - # We should always ask the client's transport to sleep, instead of sleeping directly - transport: AsyncHttpTransport = cast(AsyncHttpTransport, self._pipeline_response.context.transport) - await transport.sleep(self._polling_interval) - - def finished(self) -> bool: - return self._finished - - def resource(self) -> Any: - return self._resource - - def status(self) -> str: - return "finished" if self._finished else "polling" diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_challenge_auth_policy.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_challenge_auth_policy.py deleted file mode 100644 index 90c8720d1ba8..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_challenge_auth_policy.py +++ /dev/null @@ -1,304 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -"""Policy implementing Key Vault's challenge authentication protocol. - -Normally the protocol is only used for the client's first service request, upon which: -1. The challenge authentication policy sends a copy of the request, without authorization or content. -2. Key Vault responds 401 with a header (the 'challenge') detailing how the client should authenticate such a request. -3. The policy authenticates according to the challenge and sends the original request with authorization. - -The policy caches the challenge and thus knows how to authenticate future requests. However, authentication -requirements can change. For example, a vault may move to a new tenant. In such a case the policy will attempt the -protocol again. -""" - -from copy import deepcopy -import sys -import time -from typing import Any, Callable, cast, Optional, overload, TypeVar, Union - -from typing_extensions import ParamSpec - -from azure.core.credentials import AccessToken, AccessTokenInfo, TokenRequestOptions -from azure.core.credentials_async import AsyncSupportsTokenInfo, AsyncTokenCredential, AsyncTokenProvider -from azure.core.pipeline import PipelineRequest, PipelineResponse -from azure.core.pipeline.policies import AsyncBearerTokenCredentialPolicy -from azure.core.rest import AsyncHttpResponse, HttpRequest - -from .http_challenge import HttpChallenge -from . import http_challenge_cache as ChallengeCache -from .challenge_auth_policy import ( - _enforce_tls, - _has_claims, - _update_challenge, - _validate_challenge_resource, - _request_origin, - _get_challenge_info, - _get_challenge_candidate, - _remove_challenge_for_request, - _restore_request, - _CHALLENGE_INFO_KEY, - _CHALLENGE_CACHE_KEY, - _REQUEST_COPY_KEY, -) - -if sys.version_info < (3, 9): - from typing import Awaitable -else: - from collections.abc import Awaitable - - -P = ParamSpec("P") -T = TypeVar("T") - - -@overload -async def await_result(func: Callable[P, Awaitable[T]], *args: P.args, **kwargs: P.kwargs) -> T: ... - - -@overload -async def await_result(func: Callable[P, T], *args: P.args, **kwargs: P.kwargs) -> T: ... - - -async def await_result(func: Callable[P, Union[T, Awaitable[T]]], *args: P.args, **kwargs: P.kwargs) -> T: - """If func returns an awaitable, await it. - - :param func: The function to run. - :type func: callable - :param args: The positional arguments to pass to the function. - :type args: list - :rtype: any - :return: The result of the function - """ - result = func(*args, **kwargs) - if isinstance(result, Awaitable): - return await result - return result - - - -class AsyncChallengeAuthPolicy(AsyncBearerTokenCredentialPolicy): - """Policy for handling HTTP authentication challenges. - - :param credential: An object which can provide an access token for the vault, such as a credential from - :mod:`azure.identity.aio` - :type credential: ~azure.core.credentials_async.AsyncTokenProvider - """ - - def __init__(self, credential: AsyncTokenProvider, *scopes: str, **kwargs: Any) -> None: - # Pass `enable_cae` so `enable_cae=True` is always passed through self.authorize_request - super().__init__(credential, *scopes, enable_cae=True, **kwargs) - self._credential: AsyncTokenProvider = credential - self._token: Optional[Union["AccessToken", "AccessTokenInfo"]] = None - self._verify_challenge_resource = kwargs.pop("verify_challenge_resource", True) - - async def send( - self, request: PipelineRequest[HttpRequest] - ) -> PipelineResponse[HttpRequest, AsyncHttpResponse]: - """Authorize request with a bearer token and send it to the next policy. - - We implement this method to account for the valid scenario where a Key Vault authentication challenge is - immediately followed by a CAE claims challenge. The base class's implementation would return the second 401 to - the caller, but we should handle that second challenge as well (and only return any third 401 response). - - :param request: The pipeline request object - :type request: ~azure.core.pipeline.PipelineRequest - :return: The pipeline response object - :rtype: ~azure.core.pipeline.PipelineResponse - """ - await await_result(self.on_request, request) - response: PipelineResponse[HttpRequest, AsyncHttpResponse] - try: - response = await self.next.send(request) - except Exception: # pylint:disable=broad-except - await await_result(self.on_exception, request) - raise - await await_result(self.on_response, request, response) - - if response.http_response.status_code == 401: - return await self.handle_challenge_flow(request, response) - return response - - async def handle_challenge_flow( - self, - request: PipelineRequest[HttpRequest], - response: PipelineResponse[HttpRequest, AsyncHttpResponse], - consecutive_challenge: bool = False, - ) -> PipelineResponse[HttpRequest, AsyncHttpResponse]: - """Handle the challenge flow of Key Vault and CAE authentication. - - :param request: The pipeline request object - :type request: ~azure.core.pipeline.PipelineRequest - :param response: The pipeline response object - :type response: ~azure.core.pipeline.PipelineResponse - :param bool consecutive_challenge: Whether the challenge is arriving immediately after another challenge. - Consecutive challenges can only be valid if a Key Vault challenge is followed by a CAE claims challenge. - True if the preceding challenge was a Key Vault challenge; False otherwise. - - :return: The pipeline response object - :rtype: ~azure.core.pipeline.PipelineResponse - """ - self._token = None # any cached token is invalid - if "WWW-Authenticate" in response.http_response.headers: - # If the previous challenge was a KV challenge and this one is too, return the 401 - claims_challenge = _has_claims(response.http_response.headers["WWW-Authenticate"]) - if consecutive_challenge and not claims_challenge: - _remove_challenge_for_request(request) - return response - - request_authorized = await self.on_challenge(request, response) - if request_authorized: - # if we receive a challenge response, we retrieve a new token - # which matches the new target. In this case, we don't want to remove - # token from the request so clear the 'insecure_domain_change' tag - request.context.options.pop("insecure_domain_change", False) - try: - response = await self.next.send(request) - except Exception: # pylint:disable=broad-except - await await_result(self.on_exception, request) - raise - - # If consecutive_challenge == True, this could be a third consecutive 401 - if response.http_response.status_code == 401 and not consecutive_challenge: - # If the previous challenge wasn't from CAE, we can try this function one more time - if not claims_challenge: - return await self.handle_challenge_flow(request, response, consecutive_challenge=True) - await await_result(self.on_response, request, response) - if response.http_response.status_code == 401 and "WWW-Authenticate" not in response.http_response.headers: - self._token = None - _remove_challenge_for_request(request) - return response - - - async def on_request(self, request: PipelineRequest) -> None: - _enforce_tls(request) - request.context.pop(_CHALLENGE_INFO_KEY, None) - challenge = ChallengeCache.get_challenge_for_url(request.http_request.url) - request.context[_CHALLENGE_CACHE_KEY] = (_request_origin(request.http_request.url), challenge) - if challenge: - try: - # A shared cache entry may have been stored by a client that disabled resource verification. - scope = challenge.get_scope() or challenge.get_resource() + "/.default" - if self._verify_challenge_resource: - _validate_challenge_resource(scope, request.http_request.url) - except ValueError: - self._token = None - request.http_request.headers.pop("Authorization", None) - ChallengeCache.remove_challenge_for_url_if_matches(request.http_request.url, challenge) - raise - request.context[_CHALLENGE_INFO_KEY] = ( - _request_origin(request.http_request.url), - scope, - challenge.tenant_id, - ) - # Note that if the vault has moved to a new tenant since our last request for it, this request will fail. - if self._need_new_token(): - await self._request_kv_token(scope, challenge) - - _restore_request(request) - bearer_token = cast(Union[AccessToken, AccessTokenInfo], self._token).token - request.http_request.headers["Authorization"] = f"Bearer {bearer_token}" - return - - # else: discover authentication information by eliciting a challenge from Key Vault. Remove any request data, - # saving it for later. Key Vault will reject the request as unauthorized and respond with a challenge. - # on_challenge will parse that challenge, use the original request including the body, authorize the - # request, and tell super to send it again. - # The original request is stashed on the request's context (per-request), so it cannot leak into a later - # request made by the same client. A restored request must be stripped again if the cache is evicted on retry. - request.http_request.headers.pop("Authorization", None) - if request.http_request.content: - request.context[_REQUEST_COPY_KEY] = request.http_request - bodiless_request = HttpRequest( - method=request.http_request.method, - url=request.http_request.url, - headers=deepcopy(request.http_request.headers), - ) - bodiless_request.headers["Content-Length"] = "0" - request.http_request = bodiless_request - - async def on_challenge(self, request: PipelineRequest, response: PipelineResponse) -> bool: - _enforce_tls(request) - previous_challenge = request.context.pop(_CHALLENGE_INFO_KEY, None) - try: - challenge = _update_challenge(request, response) - except ValueError: - self._token = None - request.http_request.headers.pop("Authorization", None) - _remove_challenge_for_request(request) - return False - - if challenge.claims: - # Another request may have evicted or replaced the cache while this request was in flight. - try: - old_scope, old_tenant = _get_challenge_info( - request.http_request.url, - previous_challenge, - self._verify_challenge_resource, - _get_challenge_candidate(request), - ) - except ValueError: - self._token = None - request.http_request.headers.pop("Authorization", None) - raise - if old_scope: - challenge._parameters["scope"] = old_scope # pylint:disable=protected-access - challenge.tenant_id = old_tenant - # azure-identity credentials require an AADv2 scope but the challenge may specify an AADv1 resource - try: - scope = challenge.get_scope() or challenge.get_resource() + "/.default" - if self._verify_challenge_resource: - _validate_challenge_resource(scope, request.http_request.url) - except ValueError: - self._token = None - request.http_request.headers.pop("Authorization", None) - _remove_challenge_for_request(request) - raise - - ChallengeCache.set_challenge_for_url(request.http_request.url, challenge) - request.context[_CHALLENGE_CACHE_KEY] = (_request_origin(request.http_request.url), challenge) - request.context[_CHALLENGE_INFO_KEY] = (_request_origin(request.http_request.url), scope, challenge.tenant_id) - - # If we stashed the original request in on_request, use it now to send along the original body content - _restore_request(request) - - # The tenant parsed from AD FS challenges is "adfs"; we don't actually need a tenant for AD FS authentication - # For AD FS we skip cross-tenant authentication per https://github.com/Azure/azure-sdk-for-python/issues/28648 - if challenge.tenant_id and challenge.tenant_id.lower().endswith("adfs"): - await self.authorize_request(request, scope, claims=challenge.claims) - else: - await self.authorize_request( - request, scope, claims=challenge.claims, tenant_id=challenge.tenant_id - ) - - return True - - def _need_new_token(self) -> bool: - now = time.time() - refresh_on = getattr(self._token, "refresh_on", None) - return not self._token or (refresh_on and refresh_on <= now) or self._token.expires_on - now < 300 - - async def _request_kv_token(self, scope: str, challenge: HttpChallenge) -> None: - """Implementation of BearerTokenCredentialPolicy's _request_token method, but specific to Key Vault. - - :param str scope: The scope for which to request a token. - :param challenge: The challenge for the request being made. - :type challenge: HttpChallenge - """ - # Exclude tenant for AD FS authentication - exclude_tenant = challenge.tenant_id and challenge.tenant_id.lower().endswith("adfs") - # The AsyncSupportsTokenInfo protocol needs TokenRequestOptions for token requests instead of kwargs - if hasattr(self._credential, "get_token_info"): - options: TokenRequestOptions = {"enable_cae": True} - if challenge.tenant_id and not exclude_tenant: - options["tenant_id"] = challenge.tenant_id - self._token = await cast(AsyncSupportsTokenInfo, self._credential).get_token_info(scope, options=options) - else: - if exclude_tenant: - self._token = await self._credential.get_token(scope, enable_cae=True) - else: - self._token = await cast(AsyncTokenCredential, self._credential).get_token( - scope, tenant_id=challenge.tenant_id, enable_cae=True - ) diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_client_base.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_client_base.py deleted file mode 100644 index 3e1a2bec8fc4..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/async_client_base.py +++ /dev/null @@ -1,117 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -import sys -from typing import Any - -from azure.core.credentials_async import AsyncTokenCredential -from azure.core.pipeline.policies import HttpLoggingPolicy -from azure.core.rest import AsyncHttpResponse, HttpRequest -from azure.core.tracing.decorator_async import distributed_trace_async - -from . import AsyncChallengeAuthPolicy -from .client_base import ApiVersion, DEFAULT_VERSION, _format_api_version, _SERIALIZER -from .._sdk_moniker import SDK_MONIKER -from .._generated.aio import KeyVaultClient as _KeyVaultClient -from .._generated import models as _models - -if sys.version_info < (3, 9): - from typing import Awaitable -else: - from collections.abc import Awaitable - - -class AsyncKeyVaultClientBase(object): - # pylint:disable=protected-access - def __init__(self, vault_url: str, credential: AsyncTokenCredential, **kwargs: Any) -> None: - if not credential: - raise ValueError( - "credential should be an object supporting the AsyncTokenCredential protocol, " - "such as a credential from azure-identity" - ) - if not vault_url: - raise ValueError("vault_url must be the URL of an Azure Key Vault") - - try: - self.api_version = kwargs.pop("api_version", DEFAULT_VERSION) - # If API version was provided as an enum value, need to make a plain string for 3.11 compatibility - if hasattr(self.api_version, "value"): - self.api_version = self.api_version.value - self._vault_url = vault_url.strip(" /") - - client = kwargs.get("generated_client") - if client: - # caller provided a configured client -> only models left to initialize - self._client = client - models = kwargs.get("generated_models") - self._models = models or _models - return - - http_logging_policy = HttpLoggingPolicy(**kwargs) - http_logging_policy.allowed_header_names.update( - {"x-ms-keyvault-network-info", "x-ms-keyvault-region", "x-ms-keyvault-service-version"} - ) - - verify_challenge = kwargs.pop("verify_challenge_resource", True) - self._client = _KeyVaultClient( - credential=credential, - vault_base_url=self._vault_url, - api_version=self.api_version, - authentication_policy=AsyncChallengeAuthPolicy(credential, verify_challenge_resource=verify_challenge), - sdk_moniker=SDK_MONIKER, - http_logging_policy=http_logging_policy, - **kwargs, - ) - self._models = _models - except ValueError as exc: - # Ignore pyright error that comes from not identifying ApiVersion as an iterable enum - raise NotImplementedError( - f"This package doesn't support API version '{self.api_version}'. " - + "Supported versions: " - + f"{', '.join(v.value for v in ApiVersion)}" # pyright: ignore[reportGeneralTypeIssues] - ) from exc - - @property - def vault_url(self) -> str: - return self._vault_url - - async def __aenter__(self) -> "AsyncKeyVaultClientBase": - await self._client.__aenter__() - return self - - async def __aexit__(self, *args: Any) -> None: - await self._client.__aexit__(*args) - - async def close(self) -> None: - """Close sockets opened by the client. - - Calling this method is unnecessary when using the client as a context manager. - """ - await self._client.close() - - @distributed_trace_async - def send_request( - self, request: HttpRequest, *, stream: bool = False, **kwargs: Any - ) -> Awaitable[AsyncHttpResponse]: - """Runs a network request using the client's existing pipeline. - - The request URL can be relative to the vault URL. The service API version used for the request is the same as - the client's unless otherwise specified. This method does not raise if the response is an error; to raise an - exception, call `raise_for_status()` on the returned response object. For more information about how to send - custom requests with this method, see https://aka.ms/azsdk/dpcodegen/python/send_request. - - :param request: The network request you want to make. - :type request: ~azure.core.rest.HttpRequest - - :keyword bool stream: Whether the response payload will be streamed. Defaults to False. - - :return: The response of your network call. Does not do error handling on your response. - :rtype: ~azure.core.rest.AsyncHttpResponse - """ - request_copy = _format_api_version(request, self.api_version) - path_format_arguments = { - "vaultBaseUrl": _SERIALIZER.url("vault_base_url", self._vault_url, "str", skip_quote=True), - } - request_copy.url = self._client._client.format_url(request_copy.url, **path_format_arguments) - return self._client._client.send_request(request_copy, stream=stream, **kwargs) diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/challenge_auth_policy.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/challenge_auth_policy.py deleted file mode 100644 index b0879800c14d..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/challenge_auth_policy.py +++ /dev/null @@ -1,394 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -"""Policy implementing Key Vault's challenge authentication protocol. - -Normally the protocol is only used for the client's first service request, upon which: -1. The challenge authentication policy sends a copy of the request, without authorization or content. -2. Key Vault responds 401 with a header (the 'challenge') detailing how the client should authenticate such a request. -3. The policy authenticates according to the challenge and sends the original request with authorization. - -The policy caches the challenge and thus knows how to authenticate future requests. However, authentication -requirements can change. For example, a vault may move to a new tenant. In such a case the policy will attempt the -protocol again. -""" - -from copy import deepcopy -import time -from typing import Any, cast, Optional, Tuple, Union -from urllib.parse import urlparse - -from azure.core.credentials import ( - AccessToken, - AccessTokenInfo, - TokenCredential, - TokenProvider, - TokenRequestOptions, - SupportsTokenInfo, -) -from azure.core.exceptions import ServiceRequestError -from azure.core.pipeline import PipelineRequest, PipelineResponse -from azure.core.pipeline.policies import BearerTokenCredentialPolicy -from azure.core.rest import HttpRequest, HttpResponse - -from .http_challenge import HttpChallenge -from . import http_challenge_cache as ChallengeCache - - -# Key under which the original request is stashed on the per-request pipeline context during the challenge flow. -# Storing this per-request (rather than on the policy instance) prevents the body of one request from leaking into a -# subsequent request made by the same client. -_REQUEST_COPY_KEY = "key_vault_request_copy" -_CHALLENGE_INFO_KEY = "key_vault_challenge_info" -_ChallengeInfo = Tuple[str, str, Optional[str]] -# Eviction identity is separate from the immutable accepted scope and tenant. -_CHALLENGE_CACHE_KEY = "key_vault_challenge_cache" -_ChallengeCacheEntry = Tuple[str, Optional[HttpChallenge]] - - -def _enforce_tls(request: PipelineRequest) -> None: - # URL parsers used by transports can interpret backslashes as authority delimiters. - if "\\" in urlparse(request.http_request.url).netloc: - raise ValueError("Key Vault request URL must not contain backslashes in its authority.") - if not request.http_request.url.lower().startswith("https"): - raise ServiceRequestError( - "Bearer token authentication is not permitted for non-TLS protected (non-https) URLs." - ) - - -def _has_claims(challenge: str) -> bool: - """Check if a challenge header contains claims. - - :param challenge: The challenge header to check. - :type challenge: str - - :returns: True if the challenge contains claims; False otherwise. - :rtype: bool - """ - # Split the challenge into its scheme and parameters, then check if any parameter contains claims - parameters = challenge.strip().partition(" ")[2] - return any("claims=" in item for item in parameters.split(",")) - - -def _update_challenge(request: PipelineRequest, challenger: PipelineResponse) -> HttpChallenge: - """Parse challenge from a challenge response and return it. - - :param request: The pipeline request that prompted the challenge response. - :type request: ~azure.core.pipeline.PipelineRequest - :param challenger: The pipeline response containing the authentication challenge. - :type challenger: ~azure.core.pipeline.PipelineResponse - - :returns: An HttpChallenge object representing the authentication challenge. - :rtype: HttpChallenge - """ - - challenge_header = challenger.http_response.headers.get("WWW-Authenticate") - # HttpChallenge expects a scheme followed by a space and parameters. - if not challenge_header or " " not in challenge_header.strip(): - raise ValueError("Invalid challenge header") - challenge = HttpChallenge( - request.http_request.url, - challenge_header, - response_headers=challenger.http_response.headers, - ) - return challenge - - -def _request_origin(url: str) -> str: - # Use the same authority equivalence as the cache, but don't share authentication across schemes. - authority = ChallengeCache._get_cache_key(url).lower() # pylint:disable=protected-access - return urlparse(url).scheme.lower() + "://" + authority - - -def _get_challenge_info( - request_url: str, - previous: Optional[_ChallengeInfo], - verify_resource: bool, - expected_challenge: Optional[HttpChallenge], -) -> Tuple[Optional[str], Optional[str]]: - try: - if previous and previous[0] == _request_origin(request_url): - scope, tenant = previous[1:] - else: - cached = ChallengeCache.get_challenge_for_url(request_url) - if not cached or _request_origin(cached.source_uri) != _request_origin(request_url): - return None, None - expected_challenge = cached - scope = cached.get_scope() or cached.get_resource() + "/.default" - tenant = cached.tenant_id - if verify_resource: - _validate_challenge_resource(scope, request_url) - except ValueError: - ChallengeCache.remove_challenge_for_url_if_matches(request_url, expected_challenge) - raise - return scope, tenant - - -def _get_challenge_candidate(request: PipelineRequest) -> Optional[HttpChallenge]: - entry: Optional[_ChallengeCacheEntry] = request.context.get(_CHALLENGE_CACHE_KEY) - if entry and entry[0] == _request_origin(request.http_request.url): - return entry[1] - return None - - -def _remove_challenge_for_request(request: PipelineRequest) -> None: - ChallengeCache.remove_challenge_for_url_if_matches(request.http_request.url, _get_challenge_candidate(request)) - - -def _restore_request(request: PipelineRequest) -> None: - request_copy = request.context.pop(_REQUEST_COPY_KEY, None) - if request_copy and request_copy.method == request.http_request.method: - # Preserve header changes made during discovery, including redirect cleanup. - content_length = request_copy.headers.get("Content-Length") - headers = deepcopy(request.http_request.headers) - request_copy.headers.clear() - request_copy.headers.update(headers) - if content_length is None: - request_copy.headers.pop("Content-Length", None) - else: - request_copy.headers["Content-Length"] = content_length - request_copy.url = request.http_request.url - request.http_request = request_copy - - -def _validate_challenge_resource(scope: str, request_url: str) -> None: - resource_domain = urlparse(scope).netloc - if not resource_domain: - raise ValueError(f"The challenge contains invalid scope '{scope}'.") - - request_domain = urlparse(request_url).netloc - if request_domain.lower().endswith(f".{resource_domain.lower()}"): - return - - # Preserve existing authority matches and HTTPS request default-port equivalence for all resource schemes. - request_domain = ChallengeCache._get_cache_key(request_url) # pylint:disable=protected-access - resource_authority = ChallengeCache._get_cache_key("https://" + resource_domain) # pylint:disable=protected-access - if not request_domain.lower().endswith(f".{resource_authority.lower()}"): - raise ValueError( - f"The challenge resource '{resource_domain}' does not match the requested domain. Pass " - "`verify_challenge_resource=False` to your client's constructor to disable this verification. " - "See https://aka.ms/azsdk/blog/vault-uri for more information." - ) - - -class ChallengeAuthPolicy(BearerTokenCredentialPolicy): - """Policy for handling HTTP authentication challenges. - - :param credential: An object which can provide an access token for the vault, such as a credential from - :mod:`azure.identity` - :type credential: ~azure.core.credentials.TokenProvider - :param str scopes: Lets you specify the type of access needed. - """ - - def __init__(self, credential: TokenProvider, *scopes: str, **kwargs: Any) -> None: - # Pass `enable_cae` so `enable_cae=True` is always passed through self.authorize_request - super(ChallengeAuthPolicy, self).__init__(credential, *scopes, enable_cae=True, **kwargs) - self._credential: TokenProvider = credential - self._token: Optional[Union["AccessToken", "AccessTokenInfo"]] = None - self._verify_challenge_resource = kwargs.pop("verify_challenge_resource", True) - - def send(self, request: PipelineRequest[HttpRequest]) -> PipelineResponse[HttpRequest, HttpResponse]: - """Authorize request with a bearer token and send it to the next policy. - - We implement this method to account for the valid scenario where a Key Vault authentication challenge is - immediately followed by a CAE claims challenge. The base class's implementation would return the second 401 to - the caller, but we should handle that second challenge as well (and only return any third 401 response). - - :param request: The pipeline request object - :type request: ~azure.core.pipeline.PipelineRequest - - :return: The pipeline response object - :rtype: ~azure.core.pipeline.PipelineResponse - """ - self.on_request(request) - try: - response = self.next.send(request) - except Exception: # pylint:disable=broad-except - self.on_exception(request) - raise - - self.on_response(request, response) - if response.http_response.status_code == 401: - return self.handle_challenge_flow(request, response) - return response - - def handle_challenge_flow( - self, - request: PipelineRequest[HttpRequest], - response: PipelineResponse[HttpRequest, HttpResponse], - consecutive_challenge: bool = False, - ) -> PipelineResponse[HttpRequest, HttpResponse]: - """Handle the challenge flow of Key Vault and CAE authentication. - - :param request: The pipeline request object - :type request: ~azure.core.pipeline.PipelineRequest - :param response: The pipeline response object - :type response: ~azure.core.pipeline.PipelineResponse - :param bool consecutive_challenge: Whether the challenge is arriving immediately after another challenge. - Consecutive challenges can only be valid if a Key Vault challenge is followed by a CAE claims challenge. - True if the preceding challenge was a Key Vault challenge; False otherwise. - - :return: The pipeline response object - :rtype: ~azure.core.pipeline.PipelineResponse - """ - self._token = None # any cached token is invalid - if "WWW-Authenticate" in response.http_response.headers: - # If the previous challenge was a KV challenge and this one is too, return the 401 - claims_challenge = _has_claims(response.http_response.headers["WWW-Authenticate"]) - if consecutive_challenge and not claims_challenge: - _remove_challenge_for_request(request) - return response - - request_authorized = self.on_challenge(request, response) - if request_authorized: - # if we receive a challenge response, we retrieve a new token - # which matches the new target. In this case, we don't want to remove - # token from the request so clear the 'insecure_domain_change' tag - request.context.options.pop("insecure_domain_change", False) - try: - response = self.next.send(request) - except Exception: # pylint:disable=broad-except - self.on_exception(request) - raise - - # If consecutive_challenge == True, this could be a third consecutive 401 - if response.http_response.status_code == 401 and not consecutive_challenge: - # If the previous challenge wasn't from CAE, we can try this function one more time - if not claims_challenge: - return self.handle_challenge_flow(request, response, consecutive_challenge=True) - self.on_response(request, response) - if response.http_response.status_code == 401 and "WWW-Authenticate" not in response.http_response.headers: - self._token = None - _remove_challenge_for_request(request) - return response - - def on_request(self, request: PipelineRequest) -> None: - _enforce_tls(request) - request.context.pop(_CHALLENGE_INFO_KEY, None) - challenge = ChallengeCache.get_challenge_for_url(request.http_request.url) - request.context[_CHALLENGE_CACHE_KEY] = (_request_origin(request.http_request.url), challenge) - if challenge: - try: - # A shared cache entry may have been stored by a client that disabled resource verification. - scope = challenge.get_scope() or challenge.get_resource() + "/.default" - if self._verify_challenge_resource: - _validate_challenge_resource(scope, request.http_request.url) - except ValueError: - self._token = None - request.http_request.headers.pop("Authorization", None) - ChallengeCache.remove_challenge_for_url_if_matches(request.http_request.url, challenge) - raise - request.context[_CHALLENGE_INFO_KEY] = ( - _request_origin(request.http_request.url), - scope, - challenge.tenant_id, - ) - # Note that if the vault has moved to a new tenant since our last request for it, this request will fail. - if self._need_new_token: - self._request_kv_token(scope, challenge) - - _restore_request(request) - bearer_token = cast(Union["AccessToken", "AccessTokenInfo"], self._token).token - request.http_request.headers["Authorization"] = f"Bearer {bearer_token}" - return - - # else: discover authentication information by eliciting a challenge from Key Vault. Remove any request data, - # saving it for later. Key Vault will reject the request as unauthorized and respond with a challenge. - # on_challenge will parse that challenge, use the original request including the body, authorize the - # request, and tell super to send it again. - # The original request is stashed on the request's context (per-request), so it cannot leak into a later - # request made by the same client. A restored request must be stripped again if the cache is evicted on retry. - request.http_request.headers.pop("Authorization", None) - if request.http_request.content: - request.context[_REQUEST_COPY_KEY] = request.http_request - bodiless_request = HttpRequest( - method=request.http_request.method, - url=request.http_request.url, - headers=deepcopy(request.http_request.headers), - ) - bodiless_request.headers["Content-Length"] = "0" - request.http_request = bodiless_request - - def on_challenge(self, request: PipelineRequest, response: PipelineResponse) -> bool: - _enforce_tls(request) - previous_challenge = request.context.pop(_CHALLENGE_INFO_KEY, None) - try: - challenge = _update_challenge(request, response) - except ValueError: - self._token = None - request.http_request.headers.pop("Authorization", None) - _remove_challenge_for_request(request) - return False - - if challenge.claims: - # Another request may have evicted or replaced the cache while this request was in flight. - try: - old_scope, old_tenant = _get_challenge_info( - request.http_request.url, - previous_challenge, - self._verify_challenge_resource, - _get_challenge_candidate(request), - ) - except ValueError: - self._token = None - request.http_request.headers.pop("Authorization", None) - raise - if old_scope: - challenge._parameters["scope"] = old_scope # pylint:disable=protected-access - challenge.tenant_id = old_tenant - # azure-identity credentials require an AADv2 scope but the challenge may specify an AADv1 resource - try: - scope = challenge.get_scope() or challenge.get_resource() + "/.default" - if self._verify_challenge_resource: - _validate_challenge_resource(scope, request.http_request.url) - except ValueError: - self._token = None - request.http_request.headers.pop("Authorization", None) - _remove_challenge_for_request(request) - raise - - ChallengeCache.set_challenge_for_url(request.http_request.url, challenge) - request.context[_CHALLENGE_CACHE_KEY] = (_request_origin(request.http_request.url), challenge) - request.context[_CHALLENGE_INFO_KEY] = (_request_origin(request.http_request.url), scope, challenge.tenant_id) - - # If we stashed the original request in on_request, use it now to send along the original body content - _restore_request(request) - - # The tenant parsed from AD FS challenges is "adfs"; we don't actually need a tenant for AD FS authentication - # For AD FS we skip cross-tenant authentication per https://github.com/Azure/azure-sdk-for-python/issues/28648 - if challenge.tenant_id and challenge.tenant_id.lower().endswith("adfs"): - self.authorize_request(request, scope, claims=challenge.claims) - else: - self.authorize_request(request, scope, claims=challenge.claims, tenant_id=challenge.tenant_id) - - return True - - @property - def _need_new_token(self) -> bool: - now = time.time() - refresh_on = getattr(self._token, "refresh_on", None) - return not self._token or (refresh_on and refresh_on <= now) or self._token.expires_on - now < 300 - - def _request_kv_token(self, scope: str, challenge: HttpChallenge) -> None: - """Implementation of BearerTokenCredentialPolicy's _request_token method, but specific to Key Vault. - - :param str scope: The scope for which to request a token. - :param challenge: The challenge for the request being made. - :type challenge: HttpChallenge - """ - # Exclude tenant for AD FS authentication - exclude_tenant = challenge.tenant_id and challenge.tenant_id.lower().endswith("adfs") - # The SupportsTokenInfo protocol needs TokenRequestOptions for token requests instead of kwargs - if hasattr(self._credential, "get_token_info"): - options: TokenRequestOptions = {"enable_cae": True} - if challenge.tenant_id and not exclude_tenant: - options["tenant_id"] = challenge.tenant_id - self._token = cast(SupportsTokenInfo, self._credential).get_token_info(scope, options=options) - else: - if exclude_tenant: - self._token = self._credential.get_token(scope, enable_cae=True) - else: - self._token = cast(TokenCredential, self._credential).get_token( - scope, tenant_id=challenge.tenant_id, enable_cae=True - ) diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/client_base.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/client_base.py deleted file mode 100644 index 9e721ef6cfe2..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/client_base.py +++ /dev/null @@ -1,162 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from copy import deepcopy -from enum import Enum -from typing import Any -from urllib.parse import urlparse - -from azure.core import CaseInsensitiveEnumMeta -from azure.core.credentials import TokenCredential -from azure.core.pipeline.policies import HttpLoggingPolicy -from azure.core.rest import HttpRequest, HttpResponse -from azure.core.tracing.decorator import distributed_trace - -from . import ChallengeAuthPolicy -from .._generated import KeyVaultClient as _KeyVaultClient -from .._generated import models as _models -from .._generated._utils.serialization import Serializer -from .._sdk_moniker import SDK_MONIKER - - -class ApiVersion(str, Enum, metaclass=CaseInsensitiveEnumMeta): - """Key Vault API versions supported by this package""" - - #: this is the default version - V2025_07_01 = "2025-07-01" - V7_6 = "7.6" - V7_5 = "7.5" - V7_4 = "7.4" - V7_3 = "7.3" - V7_2 = "7.2" - V7_1 = "7.1" - V7_0 = "7.0" - V2016_10_01 = "2016-10-01" - - -DEFAULT_VERSION = ApiVersion.V2025_07_01 - -_SERIALIZER = Serializer() -_SERIALIZER.client_side_validation = False - - -def _format_api_version(request: HttpRequest, api_version: str) -> HttpRequest: - """Returns a request copy that includes an api-version query parameter if one wasn't originally present. - - :param request: The HTTP request being sent. - :type request: ~azure.core.rest.HttpRequest - :param str api_version: The service API version that the request should include. - - :returns: A copy of the request that includes an api-version query parameter. - :rtype: azure.core.rest.HttpRequest - """ - request_copy = deepcopy(request) - params = {"api-version": api_version} # By default, we want to use the client's API version - query = urlparse(request_copy.url).query - - if query: - request_copy.url = request_copy.url.partition("?")[0] - existing_params = {p[0]: p[-1] for p in [p.partition("=") for p in query.split("&")]} - params.update(existing_params) # If an api-version was provided, this will overwrite our default - - # Reconstruct the query parameters onto the URL - query_params = [] - for k, v in params.items(): - query_params.append("{}={}".format(k, v)) - query = "?" + "&".join(query_params) - request_copy.url = request_copy.url + query - return request_copy - - -class KeyVaultClientBase(object): - # pylint:disable=protected-access - def __init__(self, vault_url: str, credential: TokenCredential, **kwargs: Any) -> None: - if not credential: - raise ValueError( - "credential should be an object supporting the TokenCredential protocol, " - "such as a credential from azure-identity" - ) - if not vault_url: - raise ValueError("vault_url must be the URL of an Azure Key Vault") - - try: - self.api_version = kwargs.pop("api_version", DEFAULT_VERSION) - # If API version was provided as an enum value, need to make a plain string for 3.11 compatibility - if hasattr(self.api_version, "value"): - self.api_version = self.api_version.value - self._vault_url = vault_url.strip(" /") - - client = kwargs.get("generated_client") - if client: - # caller provided a configured client -> only models left to initialize - self._client = client - models = kwargs.get("generated_models") - self._models = models or _models - return - - http_logging_policy = HttpLoggingPolicy(**kwargs) - http_logging_policy.allowed_header_names.update( - {"x-ms-keyvault-network-info", "x-ms-keyvault-region", "x-ms-keyvault-service-version"} - ) - - verify_challenge = kwargs.pop("verify_challenge_resource", True) - self._client = _KeyVaultClient( - credential=credential, - vault_base_url=self._vault_url, - api_version=self.api_version, - authentication_policy=ChallengeAuthPolicy(credential, verify_challenge_resource=verify_challenge), - sdk_moniker=SDK_MONIKER, - http_logging_policy=http_logging_policy, - **kwargs, - ) - self._models = _models - except ValueError as exc: - # Ignore pyright error that comes from not identifying ApiVersion as an iterable enum - raise NotImplementedError( - f"This package doesn't support API version '{self.api_version}'. " - + "Supported versions: " - + f"{', '.join(v.value for v in ApiVersion)}" # pyright: ignore[reportGeneralTypeIssues] - ) from exc - - @property - def vault_url(self) -> str: - return self._vault_url - - def __enter__(self) -> "KeyVaultClientBase": - self._client.__enter__() - return self - - def __exit__(self, *args: Any) -> None: - self._client.__exit__(*args) - - def close(self) -> None: - """Close sockets opened by the client. - - Calling this method is unnecessary when using the client as a context manager. - """ - self._client.close() - - @distributed_trace - def send_request(self, request: HttpRequest, *, stream: bool = False, **kwargs: Any) -> HttpResponse: - """Runs a network request using the client's existing pipeline. - - The request URL can be relative to the vault URL. The service API version used for the request is the same as - the client's unless otherwise specified. This method does not raise if the response is an error; to raise an - exception, call `raise_for_status()` on the returned response object. For more information about how to send - custom requests with this method, see https://aka.ms/azsdk/dpcodegen/python/send_request. - - :param request: The network request you want to make. - :type request: ~azure.core.rest.HttpRequest - - :keyword bool stream: Whether the response payload will be streamed. Defaults to False. - - :return: The response of your network call. Does not do error handling on your response. - :rtype: ~azure.core.rest.HttpResponse - """ - request_copy = _format_api_version(request, self.api_version) - path_format_arguments = { - "vaultBaseUrl": _SERIALIZER.url("vault_base_url", self._vault_url, "str", skip_quote=True), - } - request_copy.url = self._client._client.format_url(request_copy.url, **path_format_arguments) - return self._client._client.send_request(request_copy, stream=stream, **kwargs) diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge.py deleted file mode 100644 index 8b14b999de78..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge.py +++ /dev/null @@ -1,186 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -import base64 -from typing import Dict, MutableMapping, Optional -from urllib import parse - - -class HttpChallenge(object): - """An object representing the content of a Key Vault authentication challenge. - - :param str request_uri: The URI of the HTTP request that prompted this challenge. - :param str challenge: The WWW-Authenticate header of the challenge response. - :param response_headers: Optional. The headers attached to the challenge response. - :type response_headers: MutableMapping[str, str] or None - """ - - def __init__( - self, request_uri: str, challenge: str, response_headers: "Optional[MutableMapping[str, str]]" = None - ) -> None: - """Parses an HTTP WWW-Authentication Bearer challenge from a server. - - Example challenge with claims: - Bearer authorization="https://login.windows-ppe.net/", error="invalid_token", - error_description="User session has been revoked", - claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwgInZhbHVlIjoiMTYwMzc0MjgwMCJ9fX0=" - """ - self.source_authority = self._validate_request_uri(request_uri) - self.source_uri = request_uri - self._parameters: "Dict[str, str]" = {} - - # get the scheme of the challenge and remove from the challenge string - trimmed_challenge = self._validate_challenge(challenge) - split_challenge = trimmed_challenge.split(" ", 1) - self.scheme = split_challenge[0] - trimmed_challenge = split_challenge[1] - - self.claims = None - # split trimmed challenge into comma-separated name=value pairs. Values are expected - # to be surrounded by quotes which are stripped here. - for item in trimmed_challenge.split(","): - # Special case for claims, which can contain = symbols as padding. Assume at most one claim per challenge - if "claims=" in item: - encoded_claims = item[item.index("=") + 1 :].strip(" \"'") - padding_needed = -len(encoded_claims) % 4 - try: - decoded_claims = base64.urlsafe_b64decode(encoded_claims + "=" * padding_needed).decode() - self.claims = decoded_claims - except Exception: # pylint:disable=broad-except - continue - # process name=value pairs - else: - comps = item.split("=") - if len(comps) == 2: - key = comps[0].strip(' "') - value = comps[1].strip(' "') - if key: - self._parameters[key] = value - - # minimum set of parameters - if not self._parameters: - raise ValueError("Invalid challenge parameters") - - # must specify authorization or authorization_uri - if "authorization" not in self._parameters and "authorization_uri" not in self._parameters: - raise ValueError("Invalid challenge parameters") - - authorization_uri = self.get_authorization_server() - # the authorization server URI should look something like https://login.windows.net/tenant-id - raw_uri_path = str(parse.urlparse(authorization_uri).path) - uri_path = raw_uri_path.lstrip("/") - self.tenant_id = uri_path.split("/", maxsplit=1)[0] or None - - # if the response headers were supplied - if response_headers: - # get the message signing key and message key encryption key from the headers - self.server_signature_key = response_headers.get("x-ms-message-signing-key", None) - self.server_encryption_key = response_headers.get("x-ms-message-encryption-key", None) - - def is_bearer_challenge(self) -> bool: - """Tests whether the HttpChallenge is a Bearer challenge. - - :returns: True if the challenge is a Bearer challenge; False otherwise. - :rtype: bool - """ - if not self.scheme: - return False - - return self.scheme.lower() == "bearer" - - def is_pop_challenge(self) -> bool: - """Tests whether the HttpChallenge is a proof of possession challenge. - - :returns: True if the challenge is a proof of possession challenge; False otherwise. - :rtype: bool - """ - if not self.scheme: - return False - - return self.scheme.lower() == "pop" - - def get_value(self, key: str) -> "Optional[str]": - return self._parameters.get(key) - - def get_authorization_server(self) -> str: - """Returns the URI for the authorization server if present, otherwise an empty string. - - :returns: The URI for the authorization server if present, otherwise an empty string. - :rtype: str - """ - value = "" - for key in ["authorization_uri", "authorization"]: - value = self.get_value(key) or "" - if value: - break - return value - - def get_resource(self) -> str: - """Returns the resource if present, otherwise an empty string. - - :returns: The challenge resource if present, otherwise an empty string. - :rtype: str - """ - return self.get_value("resource") or "" - - def get_scope(self) -> str: - """Returns the scope if present, otherwise an empty string. - - :returns: The challenge scope if present, otherwise an empty string. - :rtype: str - """ - return self.get_value("scope") or "" - - def supports_pop(self) -> bool: - """Returns True if the challenge supports proof of possession token auth; False otherwise. - - :returns: True if the challenge supports proof of possession token auth; False otherwise. - :rtype: bool - """ - return self._parameters.get("supportspop", "").lower() == "true" - - def supports_message_protection(self) -> bool: - """Returns True if the challenge vault supports message protection; False otherwise. - - :returns: True if the challenge vault supports message protection; False otherwise. - :rtype: bool - """ - return self.supports_pop() and self.server_encryption_key and self.server_signature_key # type: ignore - - def _validate_challenge( - self, challenge: str - ) -> str: # pylint:disable=bad-option-value,useless-option-value,no-self-use - """Verifies that the challenge is a valid auth challenge and returns the key=value pairs. - - :param str challenge: The WWW-Authenticate header of the challenge response. - - :returns: The challenge key/value pairs, with whitespace removed, as a string. - :rtype: str - """ - if not challenge: - raise ValueError("Challenge cannot be empty") - - return challenge.strip() - - def _validate_request_uri( - self, uri: str - ) -> str: # pylint:disable=bad-option-value,useless-option-value,no-self-use - """Extracts the host authority from the given URI. - - :param str uri: The URI of the HTTP request that prompted the challenge. - - :returns: The challenge host authority. - :rtype: str - """ - if not uri: - raise ValueError("request_uri cannot be empty") - - parsed = parse.urlparse(uri) - if not parsed.netloc: - raise ValueError("request_uri must be an absolute URI") - - if parsed.scheme.lower() not in ["http", "https"]: - raise ValueError("request_uri must be HTTP or HTTPS") - - return parsed.netloc diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge_cache.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge_cache.py deleted file mode 100644 index a01cf0806540..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge_cache.py +++ /dev/null @@ -1,112 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -import threading -from typing import Dict, Optional -from urllib import parse - -from .http_challenge import HttpChallenge - - -_cache: "Dict[str, HttpChallenge]" = {} -_lock = threading.Lock() - - -def get_challenge_for_url(url: str) -> "Optional[HttpChallenge]": - """Gets the challenge for the cached URL. - - :param str url: the URL the challenge is cached for. - - :returns: The challenge for the cached request URL, or None if the request URL isn't cached. - :rtype: HttpChallenge or None - """ - - if not url: - raise ValueError("URL cannot be None") - - key = _get_cache_key(url) - - with _lock: - return _cache.get(key.lower()) - - -def _get_cache_key(url: str) -> str: - """Use the URL's netloc as cache key except when the URL specifies the default port for its scheme. In that case - use the netloc without the port. That is to say, https://foo.bar and https://foo.bar:443 are considered equivalent. - - This equivalency prevents an unnecessary challenge when using Key Vault's paging API. The Key Vault client doesn't - specify ports, but Key Vault's next page links do, so a redundant challenge would otherwise be executed when the - client requests the next page. - - :param str url: The HTTP request URL. - - :returns: The URL's `netloc`, minus any port attached to the URL. - :rtype: str - """ - - parsed = parse.urlparse(url) - if parsed.scheme == "https" and parsed.port == 443: - return parsed.netloc[:-4] - return parsed.netloc - - -def remove_challenge_for_url(url: str, expected_challenge: Optional[HttpChallenge] = None) -> None: - """Removes the cached challenge for the specified URL. - - :param str url: the URL for which to remove the cached challenge - :param expected_challenge: Remove only this challenge, if it is still cached. None removes any cached challenge. - :type expected_challenge: HttpChallenge or None - """ - if not url: - raise ValueError("URL cannot be empty") - - key = _get_cache_key(url).lower() - with _lock: - if expected_challenge is None or _cache.get(key) is expected_challenge: - _cache.pop(key, None) - - -def remove_challenge_for_url_if_matches(url: str, expected_challenge: Optional[HttpChallenge]) -> None: - """Remove only the cached challenge observed by the caller. - - :param str url: The URL for which to remove the cached challenge. - :param expected_challenge: The observed challenge, or None when no challenge was observed. - :type expected_challenge: HttpChallenge or None - """ - if not url: - raise ValueError("URL cannot be empty") - - key = _get_cache_key(url).lower() - with _lock: - if expected_challenge is not None and _cache.get(key) is expected_challenge: - _cache.pop(key, None) - - -def set_challenge_for_url(url: str, challenge: "HttpChallenge") -> None: - """Caches the challenge for the specified URL. - - :param str url: the URL for which to cache the challenge - :param challenge: the challenge to cache - :type challenge: HttpChallenge - """ - if not url: - raise ValueError("URL cannot be empty") - - if not challenge: - raise ValueError("Challenge cannot be empty") - - src_url = parse.urlparse(url) - if src_url.netloc.lower() != challenge.source_authority.lower(): - raise ValueError("Source URL and Challenge URL do not match") - - key = _get_cache_key(url) - with _lock: - _cache[key.lower()] = challenge - - -def clear() -> None: - """Clears the cache.""" - - with _lock: - _cache.clear() diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_version.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_version.py deleted file mode 100644 index bb65661c34de..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_version.py +++ /dev/null @@ -1,6 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ - -VERSION = "4.11.3" diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/aio/__init__.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/aio/__init__.py deleted file mode 100644 index 44967833f2df..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/aio/__init__.py +++ /dev/null @@ -1,7 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from ._client import SecretClient - -__all__ = ["SecretClient"] diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/aio/_client.py b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/aio/_client.py deleted file mode 100644 index e9c048af41d9..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/aio/_client.py +++ /dev/null @@ -1,468 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -from datetime import datetime -from typing import Any, cast, Dict, Optional, Union -from functools import partial - -from azure.core.tracing.decorator import distributed_trace -from azure.core.tracing.decorator_async import distributed_trace_async -from azure.core.async_paging import AsyncItemPaged - -from .._generated.models import ContentType -from .._models import KeyVaultSecret, DeletedSecret, SecretProperties -from .._shared import AsyncKeyVaultClientBase -from .._shared._polling_async import AsyncDeleteRecoverPollingMethod - - -class SecretClient(AsyncKeyVaultClientBase): - """A high-level asynchronous interface for managing a vault's secrets. - - :param str vault_url: URL of the vault the client will access. This is also called the vault's "DNS Name". - You should validate that this URL references a valid Key Vault resource. See https://aka.ms/azsdk/blog/vault-uri - for details. - :param credential: An object which can provide an access token for the vault, such as a credential from - :mod:`azure.identity.aio` - :type credential: ~azure.core.credentials_async.AsyncTokenCredential - - :keyword api_version: Version of the service API to use. Defaults to the most recent. - :paramtype api_version: ~azure.keyvault.secrets.ApiVersion or str - :keyword bool verify_challenge_resource: Whether to verify the authentication challenge resource matches the Key - Vault domain. Defaults to True. - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START create_secret_client] - :end-before: [END create_secret_client] - :language: python - :caption: Create a new ``SecretClient`` - :dedent: 4 - """ - - # pylint:disable=protected-access - - @distributed_trace_async - async def get_secret( - self, - name: str, - version: Optional[str] = None, - *, - out_content_type: Optional[Union[str, ContentType]] = None, - **kwargs: Any, - ) -> KeyVaultSecret: - """Get a secret. Requires the secrets/get permission. - - :param str name: The name of the secret - :param str version: (optional) Version of the secret to get. If unspecified, gets the latest version. - :keyword out_content_type: The desired media type of the certificate secret value. For certificate-backed - secrets, the service can convert supported values such as ``application/x-pem-file``. Accepted values - include members of :class:`~azure.keyvault.secrets.ContentType`. - :paramtype out_content_type: str or ~azure.keyvault.secrets.ContentType or None - - :returns: The fetched secret. - :rtype: ~azure.keyvault.secrets.KeyVaultSecret - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START get_secret] - :end-before: [END get_secret] - :language: python - :caption: Get a secret - :dedent: 8 - """ - client_kwargs = dict(kwargs) - if out_content_type is not None: - client_kwargs["out_content_type"] = out_content_type - - bundle = await self._client.get_secret(name, version or "", **client_kwargs) - return KeyVaultSecret._from_secret_bundle(bundle) - - @distributed_trace_async - async def set_secret( - self, - name: str, - value: str, - *, - enabled: Optional[bool] = None, - tags: Optional[Dict[str, str]] = None, - content_type: Optional[str] = None, - not_before: Optional[datetime] = None, - expires_on: Optional[datetime] = None, - **kwargs: Any, - ) -> KeyVaultSecret: - """Set a secret value. If `name` is in use, create a new version of the secret. If not, create a new secret. - - Requires secrets/set permission. - - :param str name: The name of the secret - :param str value: The value of the secret - - :keyword bool enabled: Whether the secret is enabled for use. - :keyword tags: Application specific metadata in the form of key-value pairs. - :paramtype tags: Dict[str, str] or None - :keyword str content_type: An arbitrary string indicating the type of the secret, e.g. 'password' - :keyword ~datetime.datetime not_before: Not before date of the secret in UTC - :keyword ~datetime.datetime expires_on: Expiry date of the secret in UTC - - :returns: The created or updated secret. - :rtype: ~azure.keyvault.secrets.KeyVaultSecret - - :raises ~azure.core.exceptions.HttpResponseError: - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START set_secret] - :end-before: [END set_secret] - :language: python - :caption: Set a secret's value - :dedent: 8 - """ - if enabled is not None or not_before is not None or expires_on is not None: - attributes = self._models.SecretAttributes(enabled=enabled, not_before=not_before, expires=expires_on) - else: - attributes = None - - parameters = self._models.SecretSetParameters( - value=value, - tags=tags, - content_type=content_type, - secret_attributes=attributes - ) - - bundle = await self._client.set_secret( - name, - parameters=parameters, - **kwargs - ) - return KeyVaultSecret._from_secret_bundle(bundle) - - @distributed_trace_async - async def update_secret_properties( - self, - name: str, - version: Optional[str] = None, - *, - enabled: Optional[bool] = None, - tags: Optional[Dict[str, str]] = None, - content_type: Optional[str] = None, - not_before: Optional[datetime] = None, - expires_on: Optional[datetime] = None, - **kwargs: Any, - ) -> SecretProperties: - """Update properties of a secret other than its value. Requires secrets/set permission. - - This method updates properties of the secret, such as whether it's enabled, but can't change the secret's - value. Use :func:`set_secret` to change the secret's value. - - :param str name: Name of the secret - :param str version: (optional) Version of the secret to update. If unspecified, the latest version is updated. - - :keyword bool enabled: Whether the secret is enabled for use. - :keyword tags: Application specific metadata in the form of key-value pairs. - :paramtype tags: Dict[str, str] or None - :keyword str content_type: An arbitrary string indicating the type of the secret, e.g. 'password' - :keyword ~datetime.datetime not_before: Not before date of the secret in UTC - :keyword ~datetime.datetime expires_on: Expiry date of the secret in UTC - - :returns: The updated secret properties. - :rtype: ~azure.keyvault.secrets.SecretProperties - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START update_secret] - :end-before: [END update_secret] - :language: python - :caption: Updates a secret's attributes - :dedent: 8 - """ - if enabled is not None or not_before is not None or expires_on is not None: - attributes = self._models.SecretAttributes(enabled=enabled, not_before=not_before, expires=expires_on) - else: - attributes = None - - parameters = self._models.SecretUpdateParameters( - content_type=content_type, - secret_attributes=attributes, - tags=tags, - ) - - bundle = await self._client.update_secret( - name, - secret_version=version or "", - parameters=parameters, - **kwargs - ) - return SecretProperties._from_secret_bundle(bundle) # pylint: disable=protected-access - - @distributed_trace - def list_properties_of_secrets(self, **kwargs: Any) -> AsyncItemPaged[SecretProperties]: - """List identifiers and attributes of all secrets in the vault. Requires secrets/list permission. - - List items don't include secret values. Use :func:`get_secret` to get a secret's value. - - :returns: An iterator of secrets - :rtype: ~azure.core.async_paging.AsyncItemPaged[~azure.keyvault.secrets.SecretProperties] - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START list_secrets] - :end-before: [END list_secrets] - :language: python - :caption: Lists all secrets - :dedent: 8 - """ - return self._client.get_secrets( - maxresults=kwargs.pop("max_page_size", None), - cls=lambda objs: [SecretProperties._from_secret_item(x) for x in objs], - **kwargs - ) - - @distributed_trace - def list_properties_of_secret_versions(self, name: str, **kwargs: Any) -> AsyncItemPaged[SecretProperties]: - """List properties of all versions of a secret, excluding their values. Requires secrets/list permission. - - List items don't include secret values. Use :func:`get_secret` to get a secret's value. - - :param str name: Name of the secret - - :returns: An iterator of secrets, excluding their values - :rtype: ~azure.core.async_paging.AsyncItemPaged[~azure.keyvault.secrets.SecretProperties] - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START list_properties_of_secret_versions] - :end-before: [END list_properties_of_secret_versions] - :language: python - :caption: List all versions of a secret - :dedent: 8 - """ - return self._client.get_secret_versions( - name, - maxresults=kwargs.pop("max_page_size", None), - cls=lambda objs: [SecretProperties._from_secret_item(x) for x in objs], - **kwargs - ) - - @distributed_trace_async - async def backup_secret(self, name: str, **kwargs: Any) -> bytes: - """Back up a secret in a protected form useable only by Azure Key Vault. Requires secrets/backup permission. - - :param str name: Name of the secret to back up - - :returns: The backup result, in a protected bytes format that can only be used by Azure Key Vault. - :rtype: bytes - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START backup_secret] - :end-before: [END backup_secret] - :language: python - :caption: Back up a secret - :dedent: 8 - """ - backup_result = await self._client.backup_secret(name, **kwargs) - return cast(bytes, backup_result.value) - - @distributed_trace_async - async def restore_secret_backup(self, backup: bytes, **kwargs: Any) -> SecretProperties: - """Restore a backed up secret. Requires the secrets/restore permission. - - :param bytes backup: A secret backup as returned by :func:`backup_secret` - - :returns: The restored secret - :rtype: ~azure.keyvault.secrets.SecretProperties - - :raises ~azure.core.exceptions.ResourceExistsError or ~azure.core.exceptions.HttpResponseError: - the former if the secret's name is already in use; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START restore_secret_backup] - :end-before: [END restore_secret_backup] - :language: python - :caption: Restore a backed up secret - :dedent: 8 - """ - bundle = await self._client.restore_secret( - parameters=self._models.SecretRestoreParameters(secret_bundle_backup=backup), - **kwargs - ) - return SecretProperties._from_secret_bundle(bundle) - - @distributed_trace_async - async def delete_secret(self, name: str, **kwargs: Any) -> DeletedSecret: - """Delete all versions of a secret. Requires secrets/delete permission. - - If the vault has soft-delete enabled, deletion may take several seconds to complete. - - :param str name: Name of the secret to delete. - - :returns: The deleted secret. - :rtype: ~azure.keyvault.secrets.DeletedSecret - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START delete_secret] - :end-before: [END delete_secret] - :language: python - :caption: Delete a secret - :dedent: 8 - """ - polling_interval = kwargs.pop("_polling_interval", None) - if polling_interval is None: - polling_interval = 2 - # Ignore pyright warning about return type not being iterable because we use `cls` to return a tuple - pipeline_response, deleted_secret_bundle = await self._client.delete_secret( - secret_name=name, - cls=lambda pipeline_response, deserialized, _: (pipeline_response, deserialized), - **kwargs, - ) # pyright: ignore[reportGeneralTypeIssues] - deleted_secret = DeletedSecret._from_deleted_secret_bundle(deleted_secret_bundle) - - polling_method = AsyncDeleteRecoverPollingMethod( - # no recovery ID means soft-delete is disabled, in which case we initialize the poller as finished - pipeline_response=pipeline_response, - command=partial(self.get_deleted_secret, name=name, **kwargs), - final_resource=deleted_secret, - finished=deleted_secret.recovery_id is None, - interval=polling_interval, - ) - await polling_method.run() - - return polling_method.resource() - - @distributed_trace_async - async def get_deleted_secret(self, name: str, **kwargs: Any) -> DeletedSecret: - """Get a deleted secret. Possible only in vaults with soft-delete enabled. Requires secrets/get permission. - - :param str name: Name of the deleted secret - - :returns: The deleted secret. - :rtype: ~azure.keyvault.secrets.DeletedSecret - - :raises ~azure.core.exceptions.ResourceNotFoundError or ~azure.core.exceptions.HttpResponseError: - the former if the deleted secret doesn't exist; the latter for other errors - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START get_deleted_secret] - :end-before: [END get_deleted_secret] - :language: python - :caption: Get a deleted secret - :dedent: 8 - """ - bundle = await self._client.get_deleted_secret(name, **kwargs) - return DeletedSecret._from_deleted_secret_bundle(bundle) - - @distributed_trace - def list_deleted_secrets(self, **kwargs: Any) -> AsyncItemPaged[DeletedSecret]: - """Lists all deleted secrets. Possible only in vaults with soft-delete enabled. - - Requires secrets/list permission. - - :returns: An iterator of deleted secrets, excluding their values - :rtype: ~azure.core.async_paging.AsyncItemPaged[~azure.keyvault.secrets.DeletedSecret] - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START list_deleted_secrets] - :end-before: [END list_deleted_secrets] - :language: python - :caption: Lists deleted secrets - :dedent: 8 - """ - return self._client.get_deleted_secrets( - maxresults=kwargs.pop("max_page_size", None), - cls=lambda objs: [DeletedSecret._from_deleted_secret_item(x) for x in objs], - **kwargs - ) - - @distributed_trace_async - async def purge_deleted_secret(self, name: str, **kwargs: Any) -> None: - """Permanently delete a deleted secret. Possible only in vaults with soft-delete enabled. - - Performs an irreversible deletion of the specified secret, without possibility for recovery. The operation is - not available if the :py:attr:`~azure.keyvault.secrets.SecretProperties.recovery_level` does not specify - 'Purgeable'. This method is only necessary for purging a secret before its - :py:attr:`~azure.keyvault.secrets.DeletedSecret.scheduled_purge_date`. - - Requires secrets/purge permission. - - :param str name: Name of the deleted secret to purge - - :returns: None - - :raises ~azure.core.exceptions.HttpResponseError: - - Example: - .. code-block:: python - - # if the vault has soft-delete enabled, purge permanently deletes the secret - # (with soft-delete disabled, delete_secret is permanent) - await secret_client.purge_deleted_secret("secret-name") - - """ - await self._client.purge_deleted_secret(name, **kwargs) - - @distributed_trace_async - async def recover_deleted_secret(self, name: str, **kwargs: Any) -> SecretProperties: - """Recover a deleted secret to its latest version. This is possible only in vaults with soft-delete enabled. - - Requires the secrets/recover permission. If the vault does not have soft-delete enabled, :func:`delete_secret` - is permanent, and this method will raise an error. Attempting to recover a non-deleted secret will also raise an - error. - - :param str name: Name of the deleted secret to recover - - :returns: The recovered secret's properties. - :rtype: ~azure.keyvault.secrets.SecretProperties - - :raises ~azure.core.exceptions.HttpResponseError: - - Example: - .. literalinclude:: ../tests/test_samples_secrets_async.py - :start-after: [START recover_deleted_secret] - :end-before: [END recover_deleted_secret] - :language: python - :caption: Recover a deleted secret - :dedent: 8 - """ - polling_interval = kwargs.pop("_polling_interval", None) - if polling_interval is None: - polling_interval = 2 - # Ignore pyright warning about return type not being iterable because we use `cls` to return a tuple - pipeline_response, recovered_secret_bundle = await self._client.recover_deleted_secret( - secret_name=name, - cls=lambda pipeline_response, deserialized, _: (pipeline_response, deserialized), - **kwargs, - ) # pyright: ignore[reportGeneralTypeIssues] - recovered_secret = SecretProperties._from_secret_bundle(recovered_secret_bundle) - - command = partial(self.get_secret, name=name, **kwargs) - polling_method = AsyncDeleteRecoverPollingMethod( - pipeline_response=pipeline_response, - command=command, - final_resource=recovered_secret, - finished=False, - interval=polling_interval - ) - await polling_method.run() - - return polling_method.resource() - - async def __aenter__(self) -> "SecretClient": - await self._client.__aenter__() - return self diff --git a/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/py.typed b/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/py.typed deleted file mode 100644 index e69de29bb2d1..000000000000 diff --git a/sdk/keyvault/azure-keyvault-secrets/pyproject.toml b/sdk/keyvault/azure-keyvault-secrets/pyproject.toml index ab529a71dd6c..416053a7a0ad 100644 --- a/sdk/keyvault/azure-keyvault-secrets/pyproject.toml +++ b/sdk/keyvault/azure-keyvault-secrets/pyproject.toml @@ -1,16 +1,21 @@ [build-system] -requires = ["setuptools>=61.0.0", "wheel"] # Requires 61.0.0 for dynamic version +requires = [ + "setuptools>=61.0.0", + "wheel", +] build-backend = "setuptools.build_meta" [project] name = "azure-keyvault-secrets" authors = [ - {name = "Microsoft Corporation", email = "azpysdkhelp@microsoft.com"}, + { name = "Microsoft Corporation", email = "azpysdkhelp@microsoft.com" }, ] description = "Microsoft Corporation Key Vault Secrets Client Library for Python" -keywords = ["azure", "azure sdk"] +keywords = [ + "azure", + "azure sdk", +] requires-python = ">=3.9" -license = {text = "MIT License"} classifiers = [ "Development Status :: 5 - Production/Stable", "Programming Language :: Python", @@ -28,28 +33,57 @@ dependencies = [ "azure-core>=1.31.0", "typing-extensions>=4.6.0", ] -dynamic = ["version", "readme"] +dynamic = [ + "version", + "readme", +] + +[project.license] +text = "MIT License" [project.urls] repository = "https://github.com/Azure/azure-sdk-for-python/tree/main/sdk" -[tool.setuptools.dynamic] -version = {attr = "azure.keyvault.secrets._version.VERSION"} -readme = {file = ["README.md", "CHANGELOG.md"], content-type = "text/markdown"} +[tool.setuptools.dynamic.version] +attr = "azure.keyvault.secrets._version.VERSION" + +[tool.setuptools.dynamic.readme] +file = [ + "README.md", + "CHANGELOG.md", +] +content-type = "text/markdown" [tool.setuptools.packages.find] -exclude = ["samples*", "tests*", "azure", "azure.keyvault"] +exclude = [ + "samples*", + "tests*", + "azure", + "azure.keyvault", +] [tool.setuptools.package-data] -pytyped = ["py.typed"] +pytyped = [ + "py.typed", +] [tool.azure-sdk-build] -[tool.uv.sources] -azure-core = { path = "../../core/azure-core" } -azure-identity = { path = "../../identity/azure-identity" } -azure-keyvault-nspkg = { path = "../../nspkg/azure-keyvault-nspkg" } -azure-sdk-tools = { path = "../../../eng/tools/azure-sdk-tools" } +[tool.uv.sources.azure-core] +path = "../../core/azure-core" + +[tool.uv.sources.azure-identity] +path = "../../identity/azure-identity" + +[tool.uv.sources.azure-keyvault-nspkg] +path = "../../nspkg/azure-keyvault-nspkg" + +[tool.uv.sources.azure-sdk-tools] +path = "../../../eng/tools/azure-sdk-tools" + +[tool.azure-sdk-conda] +in_bundle = true +bundle_name = "azure-keyvault" [dependency-groups] dev = [ @@ -62,9 +96,5 @@ dev = [ "python-dateutil>=2.8.0", ] -[tool.azure-sdk-conda] -in_bundle = true -bundle_name = "azure-keyvault" - [packaging] auto_update = false diff --git a/sdk/keyvault/azure-keyvault-secrets/sdk_packaging.toml b/sdk/keyvault/azure-keyvault-secrets/sdk_packaging.toml deleted file mode 100644 index e7687fdae93b..000000000000 --- a/sdk/keyvault/azure-keyvault-secrets/sdk_packaging.toml +++ /dev/null @@ -1,2 +0,0 @@ -[packaging] -auto_update = false \ No newline at end of file diff --git a/sdk/keyvault/azure-keyvault-secrets/setup.py b/sdk/keyvault/azure-keyvault-secrets/setup.py new file mode 100644 index 000000000000..7f237922fc69 --- /dev/null +++ b/sdk/keyvault/azure-keyvault-secrets/setup.py @@ -0,0 +1,72 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) Python Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- + + +import os +import re +from setuptools import setup, find_packages + +PACKAGE_NAME = "azure-keyvault-secrets" +PACKAGE_PPRINT_NAME = "Key Vault Secrets" +PACKAGE_NAMESPACE = "azure.keyvault.secrets._generated" + +# a.b.c => a/b/c +package_folder_path = PACKAGE_NAMESPACE.replace(".", "/") + +# Version extraction inspired from 'requests' +with open(os.path.join(package_folder_path, "_version.py"), "r") as fd: + version = re.search(r'^VERSION\s*=\s*[\'"]([^\'"]*)[\'"]', fd.read(), re.MULTILINE).group(1) + +if not version: + raise RuntimeError("Cannot find version information") + + +setup( + name=PACKAGE_NAME, + version=version, + description="Microsoft Corporation {} Client Library for Python".format(PACKAGE_PPRINT_NAME), + long_description=open("README.md", "r").read(), + long_description_content_type="text/markdown", + license="MIT License", + author="Microsoft Corporation", + author_email="azpysdkhelp@microsoft.com", + url="https://github.com/Azure/azure-sdk-for-python/tree/main/sdk", + keywords="azure, azure sdk", + classifiers=[ + "Development Status :: 5 - Production/Stable", + "Programming Language :: Python", + "Programming Language :: Python :: 3 :: Only", + "Programming Language :: Python :: 3", + "Programming Language :: Python :: 3.10", + "Programming Language :: Python :: 3.11", + "Programming Language :: Python :: 3.12", + "Programming Language :: Python :: 3.13", + "Programming Language :: Python :: 3.14", + "License :: OSI Approved :: MIT License", + ], + zip_safe=False, + packages=find_packages( + exclude=[ + "tests", + # Exclude packages that will be covered by PEP420 or nspkg + "azure", + "azure.keyvault", + "azure.keyvault.secrets", + ] + ), + include_package_data=True, + package_data={ + "azure.keyvault.secrets._generated": ["py.typed"], + }, + install_requires=[ + "isodate>=0.6.1", + "azure-core>=1.37.0", + "typing-extensions>=4.6.0", + ], + python_requires=">=3.10", +) diff --git a/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth.py b/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth.py index 6039c851e30a..4496cf590fee 100644 --- a/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth.py +++ b/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth.py @@ -1,3 +1,4 @@ +# pylint: disable=line-too-long,useless-suppression,too-many-lines # ------------------------------------ # Copyright (c) Microsoft Corporation. # Licensed under the MIT License. @@ -282,7 +283,9 @@ def test_rejected_challenge_is_not_cached(fresh_policy): url = "https://example.net/secrets/canary" challenge = Mock( status_code=401, - headers={"WWW-Authenticate": 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net'}, + headers={ + "WWW-Authenticate": 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net' + }, ) class Requests: @@ -329,7 +332,9 @@ def test_request_body_not_reused_across_requests(token_type): second_url = get_random_url() challenge = Mock( status_code=401, - headers={"WWW-Authenticate": 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net'}, + headers={ + "WWW-Authenticate": 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net' + }, ) class Requests: diff --git a/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_async.py b/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_async.py index 3a25584c996b..36dc82bbe041 100644 --- a/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_async.py +++ b/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_async.py @@ -1,3 +1,4 @@ +# pylint: disable=line-too-long,useless-suppression # ------------------------------------ # Copyright (c) Microsoft Corporation. # Licensed under the MIT License. @@ -170,7 +171,9 @@ async def test_rejected_challenge_is_not_cached(fresh_policy): url = "https://example.net/secrets/canary" challenge = Mock( status_code=401, - headers={"WWW-Authenticate": 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net'}, + headers={ + "WWW-Authenticate": 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net' + }, ) class Requests: @@ -220,7 +223,9 @@ async def test_request_body_not_reused_across_requests(token_type): second_url = get_random_url() challenge = Mock( status_code=401, - headers={"WWW-Authenticate": 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net'}, + headers={ + "WWW-Authenticate": 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net' + }, ) class Requests: diff --git a/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_cas.py b/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_cas.py index e3febcded48d..d4eb97b3fda5 100644 --- a/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_cas.py +++ b/sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_cas.py @@ -27,7 +27,6 @@ get_random_url, ) - HEADER = 'Bearer authorization="https://authority.net/tenant", resource=https://vault.azure.net' CLAIMS = 'Bearer authorization="https://authority.net/replacement", scope=https://vault.azure.net/new, claims="e30="' FLOWS = { diff --git a/sdk/keyvault/azure-keyvault-secrets/tests/test_parse_id.py b/sdk/keyvault/azure-keyvault-secrets/tests/test_parse_id.py index de7c2e08a806..eeff11fc2b82 100644 --- a/sdk/keyvault/azure-keyvault-secrets/tests/test_parse_id.py +++ b/sdk/keyvault/azure-keyvault-secrets/tests/test_parse_id.py @@ -13,7 +13,7 @@ class TestParseId(KeyVaultTestCase): - @pytest.mark.parametrize("api_version", [(DEFAULT_VERSION)]) + @pytest.mark.parametrize("api_version", [DEFAULT_VERSION]) @SecretsClientPreparer() @recorded_by_proxy def test_parse_secret_id_with_version(self, client, **kwargs): diff --git a/sdk/keyvault/azure-keyvault-secrets/tsp-location.yaml b/sdk/keyvault/azure-keyvault-secrets/tsp-location.yaml index c19c2bfb833f..a2ce331570d6 100644 --- a/sdk/keyvault/azure-keyvault-secrets/tsp-location.yaml +++ b/sdk/keyvault/azure-keyvault-secrets/tsp-location.yaml @@ -1,5 +1,5 @@ directory: specification/keyvault/data-plane/Secrets -commit: 942c8b2fd38b3be3f322e219c97c5c3a75f2e97b +commit: f4f159a5a3412acc3fd8793d27ecedd2f99a751c repo: Azure/azure-rest-api-specs -additionalDirectories: +additionalDirectories: - specification/keyvault/data-plane/Secrets/common