Secret Management

import os
from functools import lru_cache

# Secret management abstraction
class SecretManager:
    """
    Abstracts secret retrieval. In production, backed by:
    - AWS Secrets Manager
    - HashiCorp Vault
    - GCP Secret Manager
    - Azure Key Vault
    """
    def __init__(self, backend: str = "env"):
        self.backend = backend
        self._cache = {}

    def get(self, secret_name: str) -> str:
        """Retrieve a secret. Never log the value returned."""
        if secret_name in self._cache:
            return self._cache[secret_name]

        if self.backend == "env":
            value = os.getenv(secret_name)
            if not value:
                raise EnvironmentError(
                    f"Secret '{secret_name}' not found in environment. "
                    f"Set the {secret_name} environment variable."
                )
            self._cache[secret_name] = value
            return value

        raise NotImplementedError(f"Backend '{self.backend}' not implemented")

# Global secret manager — all agents use this
secrets = SecretManager(backend="env")

# WRONG — never do this
# openai_key = "sk-abc123..."

# RIGHT — always retrieve from secret manager
def get_openai_client():
    api_key = secrets.get("OPENAI_API_KEY")
    # Return client (api_key is used but never logged or returned)
    return {"api_key_length": len(api_key), "configured": True}

# Secret in logs — NEVER do this
# print(f"Using key: {api_key}")  # BAD

# Safe alternative
# print(f"API key configured: {len(api_key)} chars")  # GOOD

# Redaction utility for safe logging
def redact_secrets(data: dict) -> dict:
    """Remove secret values from a dict before logging."""
    sensitive_keys = {"api_key", "password", "token", "secret", "credential"}
    return {
        k: "***REDACTED***" if any(s in k.lower() for s in sensitive_keys) else v
        for k, v in data.items()
    }

sample = {"query": "Python", "api_key": "sk-abc123", "timeout": 30}
print("Safe to log:", redact_secrets(sample))