Added KEEP_SECRET_FILES flag to not delete secrets in development environments

secret_manager/credentials_loader.py

@@ -3,10 +3,17 @@ import os
 from typing import Set
 
 logger = logging.getLogger(__name__)
+_TRUTHY = {"1", "true", "yes", "on"}
 
 class MissingCredentialError(RuntimeError):
 	"""Neither the environment variable nor the secret file provided a value."""
 
+def env_flag(name:str, default: bool = False) -> bool:
+	value = os.getenv(name)
+	if value is None:
+		return default
+	return value.strip().lower() in _TRUTHY
+
 def get_secret(env_var: str, path: str | None = None) -> str:
 	"""Resolve a secret from an environment variable, falling back to a file.
 
@@ -45,12 +52,17 @@ def return_credentials(path: str) -> str:
 		raise
 
 
-def cleanup_secret_files(secret_paths: Set[str]) -> None:
+def cleanup_secret_files(secret_paths: Set[str], *, force: bool = False) -> None:
 	"""Delete secret files after they've been loaded into memory.
+	Skipped when KEEP_SECRET_FILES is set (e.g. in development), unless force=True.
 
 	Args:
 		secret_paths: Set of file paths to delete
 	"""
+	if not force and env_flag("KEEP_SECRET_FILES"):
+		logger.info("KEEP_SECRET_FILES is set, not deleting secret files")
+		return
+
 	for path in secret_paths:
 		try:
 			if os.path.exists(path):