Metadata-Version: 2.4
Name: credential-vault-bridge-adapter
Version: 0.1.0
Summary: Sync Credential Vault env_file secrets into process environment
Author: Shivam Bhundiya
License: Proprietary
Keywords: dotenv,env,secrets,vault
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Requires-Python: >=3.10
Requires-Dist: python-dotenv>=1.0.0
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == 'dev'
Description-Content-Type: text/markdown

# credential-vault-bridge-adapter

Python SDK to sync Credential Vault **env_file** secrets into process environment on every service start.

## Install

Local (from this monorepo):

```bash
pip install -e ./sdk/credential-vault-bridge-adapter
```

Published package:

```bash
pip install credential-vault-bridge-adapter
```

Requires Python 3.10+.

## Quick start

1. In Vault **Access Sheet → Injection tokens**, generate a token for your project + environment.
2. Store it in a gitignored `.env` (plaintext is shown once at create/rotate):

```bash
PROJECT_ENV_INJECTION_TOKEN=cvt_stg_...

# optional
CREDENTIAL_VAULT_API_URL=http://localhost:8000
CREDENTIAL_VAULT_WRITE_CACHE=true
CREDENTIAL_VAULT_CACHE_PATH=.env.vault
```

3. Call `load_env()` **before** your app reads settings:

```python
from credential_vault_bridge_adapter import load_env

load_env()  # reads token from env or .env, merges Vault keys into os.environ
```

Vault keys overwrite existing `os.environ` values for the same names. Restart the process to pick up secret changes (no background polling in v1).

## CLI

```bash
credential-vault-bridge-adapter sync
credential-vault-bridge-adapter sync --write-cache --cache-path .env.vault
credential-vault-bridge-adapter --version
```

Useful in Docker entrypoints so every container start refreshes secrets.

### Docker entrypoint sample

```dockerfile
# Dockerfile (excerpt)
RUN pip install credential-vault-bridge-adapter
COPY docker/entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD ["python", "-m", "myapp"]
```

```sh
#!/bin/sh
# docker/entrypoint.sh
set -e
export CREDENTIAL_VAULT_WRITE_CACHE="${CREDENTIAL_VAULT_WRITE_CACHE:-true}"
credential-vault-bridge-adapter sync --write-cache
# Export synced keys into this shell, then exec the app.
set -a
. ./.env.vault
set +a
exec "$@"
```

Ensure `PROJECT_ENV_INJECTION_TOKEN` is provided via the container environment or a mounted `.env`. Add `.env.vault` to `.gitignore`.

Alternative: skip the cache file and call `load_env()` at the top of your Python process instead of sourcing `.env.vault`.

## Environment variables

| Variable | Required | Description |
|----------|----------|-------------|
| `PROJECT_ENV_INJECTION_TOKEN` | yes | Injection token (`cvt_...`) |
| `CREDENTIAL_VAULT_API_URL` | no | Vault API base URL (default: `http://localhost:8000`) |
| `CREDENTIAL_VAULT_WRITE_CACHE` | no | If `true`/`1`/`yes`, write local cache after sync |
| `CREDENTIAL_VAULT_CACHE_PATH` | no | Cache path (default: `.env.vault`) |

## Sync API

The SDK calls:

`GET /api/v1/injection/sync`

- Auth: `Authorization: Bearer <token>`
- Optional: `If-None-Match: <etag>` → HTTP 304 when unchanged
- User-Agent: `credential-vault-bridge-adapter/x.y.z`

## Publish

```bash
cd sdk/credential-vault-bridge-adapter
python -m build
twine upload dist/*
```

Version with semver; the package User-Agent tracks `credential_vault_bridge_adapter.__version__`.

## Development

```bash
pip install -e "./sdk/credential-vault-bridge-adapter[dev]"
pytest sdk/credential-vault-bridge-adapter/tests -q
```
