me
be87900794
Mechanical rename (package agent_credential_broker; entry points
agent-broker{,-mcp,-plugin}; env AGENT_BROKER_*; paths agent-broker;
agent-browser credential provider 'broker'; MCP server name agent-broker).
New backend 'openbao': stdlib-only HTTP client for OpenBao/Vault KV v2
(approle login or token file/env; metadata-only ref index; lazy re-login
on 401/403; token renewal). bitwarden-cli backend kept as transition.
59 lines
1.5 KiB
Python
59 lines
1.5 KiB
Python
"""Adapter registry. Adapters receive (item, policy, params, config)
|
|
in-process, inject the secret through an approved channel, execute a
|
|
bounded operation, and return sanitized metadata only."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from ..errors import denied
|
|
|
|
|
|
def _load():
|
|
from . import http, ssh, git, cli_profile, browser
|
|
return {
|
|
"http": http.run,
|
|
"ssh": ssh.run,
|
|
"git": git.run,
|
|
"cli-profile": cli_profile.run,
|
|
"browser": browser.run,
|
|
}
|
|
|
|
|
|
def _mods():
|
|
from . import http, ssh, git, cli_profile, browser
|
|
return {
|
|
"http": http,
|
|
"ssh": ssh,
|
|
"git": git,
|
|
"cli-profile": cli_profile,
|
|
"browser": browser,
|
|
}
|
|
|
|
|
|
class _Registry:
|
|
_impl = None
|
|
|
|
@classmethod
|
|
def _mod(cls, adapter):
|
|
if cls._impl is None:
|
|
cls._impl = _mods()
|
|
mod = cls._impl.get(adapter)
|
|
if mod is None:
|
|
raise denied(f"unknown adapter {adapter!r}")
|
|
return mod
|
|
|
|
@classmethod
|
|
def validate(cls, adapter, item, policy, params, config):
|
|
"""Pre-execution policy/argument validation -- runs BEFORE the
|
|
confirmation gate so target errors surface first."""
|
|
mod = cls._mod(adapter)
|
|
fn = getattr(mod, "validate", None)
|
|
if fn:
|
|
fn(item, policy, params, config)
|
|
|
|
@classmethod
|
|
def run(cls, adapter, item, policy, params, config):
|
|
return cls._mod(adapter).run(item, policy, params, config)
|
|
|
|
|
|
registry = _Registry()
|