Linting, refactoring, security fixes

pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "lib-secret-manager"
-version = "0.3.1"
+version = "0.3.2"
 description = "Shared secret manager that consumes secrets"
 readme = "README.md"
 requires-python = ">=3.10"
 authors = [{ name = "Florian Gänsejunge" }]
 
 [project.optional-dependencies]
-encryption = ["cryptography==46.0.2"]
+encryption = ["cryptography==50.0.2"]
 
 [build-system]
 requires = ["setuptools>=61", "wheel"]

secret_manager/__init__.py

@@ -1,5 +1,6 @@
 import logging
-from .credentials_loader import get_secret, cleanup_secret_files, MissingCredentialError
+
+from .credentials_loader import MissingCredentialError, cleanup_secret_files, get_secret
 
 logging.getLogger(__name__).addHandler(logging.NullHandler())
-__all__ = ["get_secret","cleanup_secret_files","MissingCredentialError"]
+__all__ = ["MissingCredentialError", "cleanup_secret_files", "get_secret"]

secret_manager/credentials_loader.py

@@ -1,6 +1,5 @@
 import logging
 import os
-from typing import Set
 
 logger = logging.getLogger(__name__)
 _TRUTHY = {"1", "true", "yes", "on"}
@@ -52,7 +51,7 @@ def return_credentials(path: str) -> str:
 		raise
 
 
-def cleanup_secret_files(secret_paths: Set[str], *, force: bool = False) -> None:
+def cleanup_secret_files(secret_paths: set[str], *, force: bool = False) -> None:
 	"""Delete secret files after they've been loaded into memory.
 	Skipped when KEEP_SECRET_FILES is set (e.g. in development), unless force=True.
 
@@ -70,5 +69,6 @@ def cleanup_secret_files(secret_paths: Set[str], *, force: bool = False) -> None
 				logger.debug(f"Deleted secret file: {path}")
 			else:
 				logger.debug(f"Secret file already removed: {path}")
-		except Exception as e:
+		except Exception:
-			logger.warning(f"Could not delete secret file {path}: {e}")
+			logger.exception(f"Could not delete secret file {path}")
+			raise

secret_manager/fernet_encryption.py

@@ -1,18 +1,13 @@
+import logging
+from os import getenv
+
 from cryptography.fernet import Fernet
-from simple_logger_handler import setup_logger
 
-logger = setup_logger(__name__)
+from secret_manager import get_secret
 
-try:
+logger = logging.getLogger(__name__)
-	with open("/etc/secrets/encryption_key", "rb") as file:
-		encryption_key = file.read()
-except FileNotFoundError:
-	logger.fatal("[FATAL] Encryption key not found")
-	raise
-except Exception as e:
-	logger.fatal(f"[FATAL] Failed to read encryption key: {e}")
-	raise
 
+encryption_key = get_secret(getenv("ENCRYPTION_KEY",""),"/etc/secrets/encryption_key")
 fernet = Fernet(encryption_key)