Senhasegura

# Azure DevOps Pipeline with Senhasegura DSM Integration
# Fetches secrets from Senhasegura and injects them into the pipeline

trigger:
  branches:
    include:
      - main
      - develop

pr:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

variables:
  - group: senhasegura-credentials  # Variable group containing SENHASEGURA_* vars
  - name: APPLICATION_NAME
    value: 'my-application'
  - name: SYSTEM_NAME
    value: 'production'
  - name: ENVIRONMENT
    value: 'prod'

stages:
  - stage: Build
    displayName: 'Build and Test'
    jobs:
      - job: BuildJob
        displayName: 'Build Application'
        steps:
          - checkout: self

          - task: Bash@3
            displayName: 'Install DSM CLI'
            inputs:
              targetType: 'inline'
              script: |
                curl -LO https://github.com/senhasegura/dsmcli/releases/latest/download/dsm-linux-amd64
                chmod +x dsm-linux-amd64
                sudo mv dsm-linux-amd64 /usr/local/bin/dsm
                dsm --version

          - task: Bash@3
            displayName: 'Fetch Secrets from Senhasegura'
            inputs:
              targetType: 'inline'
              script: |
                dsm runb \
                  --tool-name azure-devops \
                  --application "$(APPLICATION_NAME)" \
                  --system "$(SYSTEM_NAME)" \
                  --environment "$(ENVIRONMENT)"
            env:
              SENHASEGURA_URL: $(SENHASEGURA_URL)
              SENHASEGURA_CLIENT_ID: $(SENHASEGURA_CLIENT_ID)
              SENHASEGURA_CLIENT_SECRET: $(SENHASEGURA_CLIENT_SECRET)

          - task: Bash@3
            displayName: 'Load Secrets'
            inputs:
              targetType: 'inline'
              script: |
                # Source secrets and export as pipeline variables
                while IFS='=' read -r key value; do
                  # Skip empty lines and comments
                  [[ -z "$key" || "$key" =~ ^# ]] && continue
                  # Set as pipeline variable
                  echo "##vso[task.setvariable variable=$key;issecret=true]$value"
                done < .runb.vars

          - task: NodeTool@0
            displayName: 'Use Node.js'
            inputs:
              versionSpec: '20.x'

          - task: Bash@3
            displayName: 'Install Dependencies'
            inputs:
              targetType: 'inline'
              script: npm ci

          - task: Bash@3
            displayName: 'Build Application'
            inputs:
              targetType: 'inline'
              script: npm run build

          - task: Bash@3
            displayName: 'Run Tests'
            inputs:
              targetType: 'inline'
              script: npm test

          - task: Bash@3
            displayName: 'Cleanup Secrets'
            condition: always()
            inputs:
              targetType: 'inline'
              script: rm -f .runb.vars

          - task: PublishBuildArtifacts@1
            displayName: 'Publish Artifacts'
            inputs:
              pathToPublish: '$(Build.SourcesDirectory)/dist'
              artifactName: 'app'

  - stage: Deploy
    displayName: 'Deploy to Production'
    dependsOn: Build
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: DeployJob
        displayName: 'Deploy Application'
        environment: 'production'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: Bash@3
                  displayName: 'Install DSM CLI'
                  inputs:
                    targetType: 'inline'
                    script: |
                      curl -LO https://github.com/senhasegura/dsmcli/releases/latest/download/dsm-linux-amd64
                      chmod +x dsm-linux-amd64
                      sudo mv dsm-linux-amd64 /usr/local/bin/dsm

                - task: Bash@3
                  displayName: 'Fetch Deploy Secrets'
                  inputs:
                    targetType: 'inline'
                    script: |
                      dsm runb \
                        --tool-name azure-devops \
                        --application "$(APPLICATION_NAME)" \
                        --system "$(SYSTEM_NAME)" \
                        --environment "prod"
                  env:
                    SENHASEGURA_URL: $(SENHASEGURA_URL)
                    SENHASEGURA_CLIENT_ID: $(SENHASEGURA_CLIENT_ID)
                    SENHASEGURA_CLIENT_SECRET: $(SENHASEGURA_CLIENT_SECRET)

                - task: Bash@3
                  displayName: 'Deploy to Kubernetes'
                  inputs:
                    targetType: 'inline'
                    script: |
                      source .runb.vars
                      kubectl set image deployment/myapp myapp=$DOCKER_IMAGE
                      kubectl rollout status deployment/myapp

                - task: Bash@3
                  displayName: 'Cleanup'
                  condition: always()
                  inputs:
                    targetType: 'inline'
                    script: rm -f .runb.vars

# Senhasegura DSM CLI Configuration
# Location: ~/.senhasegura/config.yaml or specify with SENHASEGURA_CONFIG_FILE

# =============================================================================
# REQUIRED SETTINGS
# =============================================================================

# Your Senhasegura instance URL (no trailing slash)
SENHASEGURA_URL: "https://senhasegura.example.com"

# OAuth 2.0 Client ID from A2A application
SENHASEGURA_CLIENT_ID: "your-oauth2-client-id"

# OAuth 2.0 Client Secret from A2A application
SENHASEGURA_CLIENT_SECRET: "your-oauth2-client-secret"


# =============================================================================
# OPTIONAL SETTINGS
# =============================================================================

# Path to mapping file for registering/updating secrets from pipeline
# SENHASEGURA_MAPPING_FILE: "/path/to/mapping.json"

# Output file for secrets (default: .runb.vars)
SENHASEGURA_SECRETS_FILE: ".runb.vars"

# Disable runb mode (0 = enabled, 1 = disabled)
SENHASEGURA_DISABLE_RUNB: 0

# Skip SSL certificate verification (NOT recommended for production)
# SENHASEGURA_INSECURE: false

# Request timeout in seconds
# SENHASEGURA_TIMEOUT: 30


# =============================================================================
# GITLAB INTEGRATION (Optional)
# =============================================================================

# GitLab access token for variable injection
# GITLAB_ACCESS_TOKEN: "glpat-xxxxxxxxxxxx"

# GitLab API URL
# CI_API_V4_URL: "https://gitlab.example.com/api/v4"

# GitLab project ID
# CI_PROJECT_ID: "12345"


# =============================================================================
# KUBERNETES INTEGRATION (Optional)
# =============================================================================

# Kubernetes secret injection path
# SENHASEGURA_K8S_SECRET_PATH: "/var/run/secrets/senhasegura"

# Kubernetes namespace for secrets
# SENHASEGURA_K8S_NAMESPACE: "default"

# Senhasegura ExternalSecret Examples
# Syncs secrets from Senhasegura DSM to Kubernetes

---
# Example 1: Database Credentials with explicit key mapping
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
  namespace: default
  labels:
    app.kubernetes.io/name: myapp
    app.kubernetes.io/component: database
spec:
  # How often to sync secrets
  refreshInterval: 1h

  # Reference to SecretStore
  secretStoreRef:
    name: senhasegura-dsm
    kind: SecretStore

  # Target Kubernetes secret configuration
  target:
    name: db-secret
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      type: Opaque
      metadata:
        labels:
          app.kubernetes.io/name: myapp
        annotations:
          managed-by: external-secrets

  # Map specific keys from Senhasegura
  data:
    - secretKey: DB_HOST
      remoteRef:
        key: database-prod  # Secret identifier in Senhasegura
        property: host

    - secretKey: DB_PORT
      remoteRef:
        key: database-prod
        property: port

    - secretKey: DB_USERNAME
      remoteRef:
        key: database-prod
        property: username

    - secretKey: DB_PASSWORD
      remoteRef:
        key: database-prod
        property: password

    - secretKey: DB_NAME
      remoteRef:
        key: database-prod
        property: database

---
# Example 2: API Configuration - Extract all fields
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: api-configuration
  namespace: default
spec:
  refreshInterval: 30m
  secretStoreRef:
    name: senhasegura-dsm
    kind: SecretStore
  target:
    name: api-config
    creationPolicy: Owner
  # Extract all fields from the secret
  dataFrom:
    - extract:
        key: api-settings-prod
        # All fields from api-settings-prod become secret keys

---
# Example 3: Multiple secrets combined
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: application-secrets
  namespace: default
spec:
  refreshInterval: 15m
  secretStoreRef:
    name: senhasegura-dsm
    kind: SecretStore
  target:
    name: app-secrets
    creationPolicy: Owner
  data:
    # From database secret
    - secretKey: DATABASE_URL
      remoteRef:
        key: database-prod
        property: connection_string

    # From redis secret
    - secretKey: REDIS_URL
      remoteRef:
        key: redis-prod
        property: url

    # From JWT secret
    - secretKey: JWT_SECRET
      remoteRef:
        key: jwt-keys-prod
        property: secret

    # From external API
    - secretKey: EXTERNAL_API_KEY
      remoteRef:
        key: third-party-api
        property: api_key

---
# Example 4: Using ClusterSecretStore
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: shared-credentials
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: senhasegura-dsm-global
    kind: ClusterSecretStore  # Reference ClusterSecretStore
  target:
    name: shared-secret
    creationPolicy: Owner
  dataFrom:
    - extract:
        key: shared-services-prod

---
# Example 5: Secret with templating
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: connection-string
  namespace: default
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: senhasegura-dsm
    kind: SecretStore
  target:
    name: connection-strings
    creationPolicy: Owner
    template:
      type: Opaque
      data:
        # Template the connection string
        DATABASE_URL: |
          postgresql://{{ .username }}:{{ .password }}@{{ .host }}:{{ .port }}/{{ .database }}?sslmode=require
        REDIS_URL: |
          redis://:{{ .redis_password }}@{{ .redis_host }}:6379/0
  data:
    - secretKey: username
      remoteRef:
        key: database-prod
        property: username
    - secretKey: password
      remoteRef:
        key: database-prod
        property: password
    - secretKey: host
      remoteRef:
        key: database-prod
        property: host
    - secretKey: port
      remoteRef:
        key: database-prod
        property: port
    - secretKey: database
      remoteRef:
        key: database-prod
        property: database
    - secretKey: redis_host
      remoteRef:
        key: redis-prod
        property: host
    - secretKey: redis_password
      remoteRef:
        key: redis-prod
        property: password

---
# Example 6: TLS Certificate from Senhasegura
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: tls-certificate
  namespace: default
spec:
  refreshInterval: 24h  # Check daily for certificate rotation
  secretStoreRef:
    name: senhasegura-dsm
    kind: SecretStore
  target:
    name: app-tls
    creationPolicy: Owner
    template:
      type: kubernetes.io/tls
      data:
        tls.crt: "{{ .certificate }}"
        tls.key: "{{ .private_key }}"
  data:
    - secretKey: certificate
      remoteRef:
        key: app-tls-cert-prod
        property: certificate
    - secretKey: private_key
      remoteRef:
        key: app-tls-cert-prod
        property: private_key

# GitHub Actions Workflow with Senhasegura DSM Integration
# Fetches secrets from Senhasegura and injects them into the pipeline

name: Deploy with Senhasegura Secrets

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  APPLICATION_NAME: my-application
  SYSTEM_NAME: production
  ENVIRONMENT: prod

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # For OIDC if needed

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install DSM CLI
        run: |
          curl -LO https://github.com/senhasegura/dsmcli/releases/latest/download/dsm-linux-amd64
          chmod +x dsm-linux-amd64
          sudo mv dsm-linux-amd64 /usr/local/bin/dsm
          dsm --version

      - name: Fetch secrets from Senhasegura
        env:
          SENHASEGURA_URL: ${{ secrets.SENHASEGURA_URL }}
          SENHASEGURA_CLIENT_ID: ${{ secrets.SENHASEGURA_CLIENT_ID }}
          SENHASEGURA_CLIENT_SECRET: ${{ secrets.SENHASEGURA_CLIENT_SECRET }}
        run: |
          dsm runb \
            --tool-name github \
            --application "$APPLICATION_NAME" \
            --system "$SYSTEM_NAME" \
            --environment "$ENVIRONMENT"

      - name: Load secrets into environment
        run: |
          # Source the secrets file
          source .runb.vars
          # Export for subsequent steps
          cat .runb.vars >> $GITHUB_ENV

      - name: Build application
        run: |
          # Secrets are now available as environment variables
          echo "Building with database at: $DB_HOST"
          npm ci
          npm run build

      - name: Run tests
        run: |
          npm test

      - name: Deploy to production
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: |
          # Use secrets for deployment
          ./scripts/deploy.sh

      - name: Cleanup secrets
        if: always()
        run: |
          rm -f .runb.vars
          # Clear sensitive env vars
          unset DB_PASSWORD
          unset API_SECRET

  # Alternative: Using direct API calls
  api-integration:
    runs-on: ubuntu-latest
    needs: build-and-deploy
    if: github.ref == 'refs/heads/main'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Get OAuth Token
        id: auth
        env:
          SENHASEGURA_URL: ${{ secrets.SENHASEGURA_URL }}
          SENHASEGURA_CLIENT_ID: ${{ secrets.SENHASEGURA_CLIENT_ID }}
          SENHASEGURA_CLIENT_SECRET: ${{ secrets.SENHASEGURA_CLIENT_SECRET }}
        run: |
          TOKEN=$(curl -s -X POST "$SENHASEGURA_URL/iso/oauth2/token" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -d "grant_type=client_credentials" \
            -d "client_id=$SENHASEGURA_CLIENT_ID" \
            -d "client_secret=$SENHASEGURA_CLIENT_SECRET" | jq -r '.access_token')
          echo "::add-mask::$TOKEN"
          echo "token=$TOKEN" >> $GITHUB_OUTPUT

      - name: Get database password
        id: db-creds
        env:
          SENHASEGURA_URL: ${{ secrets.SENHASEGURA_URL }}
          TOKEN: ${{ steps.auth.outputs.token }}
        run: |
          RESPONSE=$(curl -s -X GET "$SENHASEGURA_URL/iso/coe/senha?credentialId=123" \
            -H "Authorization: Bearer $TOKEN" \
            -H "Content-Type: application/json")
          PASSWORD=$(echo $RESPONSE | jq -r '.response.credential.password')
          echo "::add-mask::$PASSWORD"
          echo "password=$PASSWORD" >> $GITHUB_OUTPUT

      - name: Use credentials
        env:
          DB_PASSWORD: ${{ steps.db-creds.outputs.password }}
        run: |
          echo "Connecting to database..."
          # Use $DB_PASSWORD in your scripts

      - name: Release credential custody
        if: always()
        env:
          SENHASEGURA_URL: ${{ secrets.SENHASEGURA_URL }}
          TOKEN: ${{ steps.auth.outputs.token }}
        run: |
          curl -X DELETE "$SENHASEGURA_URL/iso/pam/credential/custody/123" \
            -H "Authorization: Bearer $TOKEN"

# GitLab CI Pipeline with Senhasegura DSM Integration
# Fetches secrets from Senhasegura and injects them into the pipeline

stages:
  - build
  - test
  - deploy

variables:
  APPLICATION_NAME: my-application
  SYSTEM_NAME: production
  # SENHASEGURA_URL, SENHASEGURA_CLIENT_ID, SENHASEGURA_CLIENT_SECRET
  # should be defined in GitLab CI/CD Variables (Settings > CI/CD > Variables)

# Cache DSM CLI between jobs
.dsm_setup: &dsm_setup
  before_script:
    - |
      if [ ! -f /usr/local/bin/dsm ]; then
        curl -LO https://github.com/senhasegura/dsmcli/releases/latest/download/dsm-linux-amd64
        chmod +x dsm-linux-amd64
        mv dsm-linux-amd64 /usr/local/bin/dsm
      fi
      dsm --version

build:
  stage: build
  image: node:20-alpine
  <<: *dsm_setup
  script:
    # Fetch secrets
    - |
      dsm runb \
        --tool-name gitlab \
        --application "$APPLICATION_NAME" \
        --system "$SYSTEM_NAME" \
        --environment "$CI_ENVIRONMENT_NAME"
    # Load secrets
    - source .runb.vars
    # Build
    - npm ci
    - npm run build
  after_script:
    - rm -f .runb.vars
  artifacts:
    paths:
      - dist/
    expire_in: 1 hour
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

test:
  stage: test
  image: node:20-alpine
  <<: *dsm_setup
  script:
    # Fetch test secrets
    - |
      dsm runb \
        --tool-name gitlab \
        --application "$APPLICATION_NAME" \
        --system "$SYSTEM_NAME" \
        --environment "test"
    - source .runb.vars
    - npm ci
    - npm test
  after_script:
    - rm -f .runb.vars
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# Deploy to staging
deploy_staging:
  stage: deploy
  image: alpine:latest
  environment:
    name: staging
    url: https://staging.example.com
  <<: *dsm_setup
  script:
    - apk add --no-cache curl kubectl
    # Fetch staging secrets
    - |
      dsm runb \
        --tool-name gitlab \
        --application "$APPLICATION_NAME" \
        --system "$SYSTEM_NAME" \
        --environment "staging"
    - source .runb.vars
    # Deploy
    - kubectl config use-context staging
    - kubectl apply -f k8s/
    - kubectl rollout status deployment/myapp
  after_script:
    - rm -f .runb.vars
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# Deploy to production
deploy_production:
  stage: deploy
  image: alpine:latest
  environment:
    name: production
    url: https://app.example.com
  <<: *dsm_setup
  script:
    - apk add --no-cache curl kubectl
    # Fetch production secrets
    - |
      dsm runb \
        --tool-name gitlab \
        --application "$APPLICATION_NAME" \
        --system "$SYSTEM_NAME" \
        --environment "prod"
    - source .runb.vars
    # Deploy with approval
    - kubectl config use-context production
    - kubectl apply -f k8s/
    - kubectl rollout status deployment/myapp
  after_script:
    - rm -f .runb.vars
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual
  needs:
    - deploy_staging

# Secret rotation job - runs weekly
rotate_secrets:
  stage: deploy
  image: alpine:latest
  <<: *dsm_setup
  script:
    - apk add --no-cache curl jq
    # Get OAuth token
    - |
      TOKEN=$(curl -s -X POST "$SENHASEGURA_URL/iso/oauth2/token" \
        -d "grant_type=client_credentials" \
        -d "client_id=$SENHASEGURA_CLIENT_ID" \
        -d "client_secret=$SENHASEGURA_CLIENT_SECRET" | jq -r '.access_token')
    # Trigger rotation for specific credentials
    - |
      curl -X POST "$SENHASEGURA_URL/api/pam/credential/123/rotate" \
        -H "Authorization: Bearer $TOKEN"
    - echo "Credentials rotated successfully"
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  only:
    refs:
      - schedules

{
  "$schema": "https://raw.githubusercontent.com/senhasegura/dsmcli/main/schema/mapping.json",
  "_comment": "DSM CLI Mapping File - Maps environment variables to Senhasegura secrets",

  "access_keys": [
    {
      "name": "AWS_PRODUCTION",
      "type": "aws",
      "description": "AWS credentials for production workloads",
      "fields": {
        "access_key_id": "AWS_ACCESS_KEY_ID",
        "secret_access_key": "AWS_SECRET_ACCESS_KEY"
      }
    },
    {
      "name": "AZURE_PRODUCTION",
      "type": "azure",
      "description": "Azure service principal credentials",
      "fields": {
        "client_id": "AZURE_CLIENT_ID",
        "client_secret": "AZURE_CLIENT_SECRET",
        "tenant_id": "AZURE_TENANT_ID",
        "subscription_id": "AZURE_SUBSCRIPTION_ID"
      }
    },
    {
      "name": "GCP_PRODUCTION",
      "type": "gcp",
      "description": "Google Cloud service account",
      "fields": {
        "service_account_json": "GOOGLE_APPLICATION_CREDENTIALS_JSON"
      }
    }
  ],

  "credentials": [
    {
      "name": "DATABASE_POSTGRES",
      "description": "PostgreSQL database credentials",
      "fields": {
        "user": "DB_USER",
        "password": "DB_PASSWORD",
        "host": "DB_HOST",
        "port": "DB_PORT",
        "database": "DB_NAME"
      }
    },
    {
      "name": "DATABASE_REDIS",
      "description": "Redis cache credentials",
      "fields": {
        "host": "REDIS_HOST",
        "port": "REDIS_PORT",
        "password": "REDIS_PASSWORD"
      }
    },
    {
      "name": "DOCKER_REGISTRY",
      "description": "Container registry authentication",
      "fields": {
        "user": "DOCKER_USERNAME",
        "password": "DOCKER_PASSWORD",
        "host": "DOCKER_REGISTRY_URL"
      }
    },
    {
      "name": "SSH_DEPLOY_KEY",
      "description": "SSH key for deployment",
      "fields": {
        "user": "SSH_USER",
        "password": "SSH_PRIVATE_KEY",
        "host": "SSH_HOST"
      }
    }
  ],

  "key_value": [
    {
      "name": "API_TOKENS",
      "description": "Various API tokens and secrets",
      "fields": [
        "API_KEY",
        "API_SECRET",
        "WEBHOOK_SECRET",
        "ENCRYPTION_KEY"
      ]
    },
    {
      "name": "JWT_CONFIGURATION",
      "description": "JWT signing keys",
      "fields": [
        "JWT_SECRET",
        "JWT_PRIVATE_KEY",
        "JWT_PUBLIC_KEY"
      ]
    },
    {
      "name": "THIRD_PARTY_INTEGRATIONS",
      "description": "External service API keys",
      "fields": [
        "STRIPE_SECRET_KEY",
        "SENDGRID_API_KEY",
        "SLACK_WEBHOOK_URL",
        "DATADOG_API_KEY"
      ]
    },
    {
      "name": "MONITORING",
      "description": "Monitoring and observability credentials",
      "fields": [
        "GRAFANA_API_KEY",
        "PROMETHEUS_TOKEN",
        "SENTRY_DSN"
      ]
    }
  ]
}

"""
Senhasegura A2A API Client for Python
OAuth 2.0 authentication with credential management
"""

import os
import time
from dataclasses import dataclass
from datetime import datetime, timedelta
from typing import Any, Callable, TypeVar
from contextlib import contextmanager

import requests
from requests.auth import AuthBase


@dataclass
class Credential:
    """Credential model"""
    id: str
    identifier: str
    username: str
    hostname: str
    ip: str | None = None
    credential_type: str = "Local User"
    additional_info: str | None = None
    tags: list[str] | None = None


@dataclass
class CredentialPassword:
    """Credential password model"""
    id: str
    password: str
    expiration: datetime


class OAuth2Auth(AuthBase):
    """OAuth 2.0 authentication handler for requests"""

    def __init__(self, base_url: str, client_id: str, client_secret: str):
        self.base_url = base_url
        self.client_id = client_id
        self.client_secret = client_secret
        self.access_token: str | None = None
        self.token_expiry: datetime | None = None

    def _get_token(self) -> str:
        """Obtain new access token"""
        response = requests.post(
            f"{self.base_url}/iso/oauth2/token",
            data={
                "grant_type": "client_credentials",
                "client_id": self.client_id,
                "client_secret": self.client_secret,
            },
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            timeout=30,
        )
        response.raise_for_status()

        data = response.json()
        self.access_token = data["access_token"]
        # Set expiry with 1 minute buffer
        self.token_expiry = datetime.now() + timedelta(seconds=data["expires_in"] - 60)
        return self.access_token

    def __call__(self, request):
        if not self.access_token or not self.token_expiry or self.token_expiry < datetime.now():
            self._get_token()
        request.headers["Authorization"] = f"Bearer {self.access_token}"
        return request


class SenhaseguraClient:
    """Senhasegura A2A API Client"""

    def __init__(
        self,
        base_url: str | None = None,
        client_id: str | None = None,
        client_secret: str | None = None,
        timeout: int = 30,
    ):
        self.base_url = base_url or os.environ["SENHASEGURA_URL"]
        self.timeout = timeout
        self.auth = OAuth2Auth(
            self.base_url,
            client_id or os.environ["SENHASEGURA_CLIENT_ID"],
            client_secret or os.environ["SENHASEGURA_CLIENT_SECRET"],
        )
        self.session = requests.Session()
        self.session.auth = self.auth

    def _request(
        self,
        method: str,
        endpoint: str,
        params: dict[str, Any] | None = None,
        json: dict[str, Any] | None = None,
    ) -> dict[str, Any]:
        """Make authenticated API request"""
        response = self.session.request(
            method,
            f"{self.base_url}{endpoint}",
            params=params,
            json=json,
            timeout=self.timeout,
        )
        response.raise_for_status()
        return response.json()

    def list_credentials(self) -> list[Credential]:
        """List all credentials"""
        data = self._request("GET", "/api/pam/credential")
        return [
            Credential(
                id=c["id"],
                identifier=c["identifier"],
                username=c["username"],
                hostname=c["hostname"],
                ip=c.get("ip"),
                credential_type=c.get("type", "Local User"),
                additional_info=c.get("additional_info"),
                tags=c.get("tags"),
            )
            for c in data["response"]["credentials"]
        ]

    def get_credential(self, credential_id: str) -> Credential:
        """Get credential by ID"""
        data = self._request("GET", f"/api/pam/credential/{credential_id}")
        c = data["response"]["credential"]
        return Credential(
            id=c["id"],
            identifier=c["identifier"],
            username=c["username"],
            hostname=c["hostname"],
            ip=c.get("ip"),
            credential_type=c.get("type", "Local User"),
        )

    def get_password(self, credential_id: str) -> CredentialPassword:
        """Get credential password"""
        data = self._request(
            "GET",
            "/iso/coe/senha",
            params={"credentialId": credential_id},
        )
        cred = data["response"]["credential"]
        return CredentialPassword(
            id=cred["id"],
            password=cred["password"],
            expiration=datetime.fromisoformat(cred["expiration"].replace("Z", "+00:00")),
        )

    def create_credential(
        self,
        identifier: str,
        username: str,
        password: str,
        hostname: str,
        **kwargs,
    ) -> Credential:
        """Create new credential"""
        payload = {
            "identifier": identifier,
            "username": username,
            "password": password,
            "hostname": hostname,
            **kwargs,
        }
        data = self._request("POST", "/api/pam/credential", json=payload)
        c = data["response"]["credential"]
        return Credential(
            id=c["id"],
            identifier=c["identifier"],
            username=c["username"],
            hostname=c["hostname"],
        )

    def update_credential(self, credential_id: str, **updates) -> Credential:
        """Update credential"""
        data = self._request(
            "PUT",
            f"/api/pam/credential/{credential_id}",
            json=updates,
        )
        c = data["response"]["credential"]
        return Credential(
            id=c["id"],
            identifier=c["identifier"],
            username=c["username"],
            hostname=c["hostname"],
        )

    def release_custody(self, credential_id: str) -> None:
        """Release credential custody"""
        self._request("DELETE", f"/iso/pam/credential/custody/{credential_id}")

    @contextmanager
    def password_context(self, credential_id: str):
        """Context manager for password with automatic custody release"""
        cred = self.get_password(credential_id)
        try:
            yield cred.password
        finally:
            self.release_custody(credential_id)


# DSM Client for DevOps Secrets
class DSMClient(SenhaseguraClient):
    """Senhasegura DSM (DevOps Secrets Manager) Client"""

    def list_secrets(self, application: str | None = None) -> list[dict[str, Any]]:
        """List all secrets"""
        params = {}
        if application:
            params["application"] = application
        data = self._request("GET", "/api/dsm/secret", params=params)
        return data["response"]["secrets"]

    def get_secret(self, identifier: str) -> dict[str, Any]:
        """Get secret by identifier"""
        data = self._request("GET", f"/api/dsm/secret/{identifier}")
        return data["response"]["secret"]

    def create_secret(
        self,
        identifier: str,
        data: dict[str, str],
        application: str,
        system: str,
        environment: str,
    ) -> dict[str, Any]:
        """Create new secret"""
        payload = {
            "identifier": identifier,
            "data": data,
            "application": application,
            "system": system,
            "environment": environment,
        }
        response = self._request("POST", "/api/dsm/secret", json=payload)
        return response["response"]["secret"]

    def update_secret(self, identifier: str, data: dict[str, str]) -> dict[str, Any]:
        """Update secret"""
        response = self._request(
            "PUT",
            f"/api/dsm/secret/{identifier}",
            json={"data": data},
        )
        return response["response"]["secret"]

    def delete_secret(self, identifier: str) -> None:
        """Delete secret"""
        self._request("DELETE", f"/api/dsm/secret/{identifier}")


def main():
    """Example usage"""
    # Initialize client (uses environment variables)
    client = SenhaseguraClient()

    # List credentials
    credentials = client.list_credentials()
    for cred in credentials:
        print(f"  {cred.identifier}: {cred.username}@{cred.hostname}")

    # Get password with automatic custody release
    with client.password_context("123") as password:
        print(f"Using password for connection...")
        # Use password here

    # DSM example
    dsm = DSMClient()
    secrets = dsm.list_secrets(application="my-app")
    for secret in secrets:
        print(f"  Secret: {secret['identifier']}")


if __name__ == "__main__":
    main()

# Senhasegura DSM SecretStore for External Secrets Operator
# Prerequisites:
# 1. External Secrets Operator installed
# 2. Authentication secret created (see auth-secret.yaml)

---
# Authentication Secret
apiVersion: v1
kind: Secret
metadata:
  name: senhasegura-auth
  namespace: external-secrets
  labels:
    app.kubernetes.io/name: senhasegura
    app.kubernetes.io/component: auth
type: Opaque
stringData:
  clientId: "your-oauth2-client-id"
  clientSecret: "your-oauth2-client-secret"

---
# Namespace-scoped SecretStore
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: senhasegura-dsm
  namespace: default
  labels:
    app.kubernetes.io/name: senhasegura
    app.kubernetes.io/component: secretstore
spec:
  provider:
    senhasegura:
      # Your senhasegura instance URL
      url: "https://senhasegura.example.com"
      # Module to use: DSM for DevOps Secrets Management
      module: DSM
      auth:
        # Client ID reference
        clientId:
          secretRef:
            name: senhasegura-auth
            key: clientId
            namespace: external-secrets
        # Client Secret reference
        clientSecretSecretRef:
          name: senhasegura-auth
          key: clientSecret
          namespace: external-secrets
      # Optional: Skip TLS verification (NOT recommended for production)
      # ignoreSslCertificate: false

---
# ClusterSecretStore for multi-namespace access
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: senhasegura-dsm-global
  labels:
    app.kubernetes.io/name: senhasegura
    app.kubernetes.io/component: clustersecretstore
spec:
  provider:
    senhasegura:
      url: "https://senhasegura.example.com"
      module: DSM
      auth:
        clientId:
          secretRef:
            name: senhasegura-auth
            key: clientId
            namespace: external-secrets
        clientSecretSecretRef:
          name: senhasegura-auth
          key: clientSecret
          namespace: external-secrets
  # Optional: Restrict which namespaces can use this ClusterSecretStore
  conditions:
    - namespaceSelector:
        matchLabels:
          senhasegura-enabled: "true"

/**
 * Senhasegura A2A API Client for TypeScript
 * OAuth 2.0 authentication with credential management
 */

interface SenhaseguraConfig {
  baseUrl: string;
  clientId: string;
  clientSecret: string;
  timeout?: number;
}

interface TokenResponse {
  access_token: string;
  token_type: string;
  expires_in: number;
}

interface Credential {
  id: string;
  identifier: string;
  username: string;
  hostname: string;
  ip?: string;
  type: string;
  additional_info?: string;
  tags?: string[];
}

interface CredentialPassword {
  id: string;
  password: string;
  expiration: string;
}

interface ApiResponse<T> {
  response: {
    status: number;
    message: string;
    error: boolean;
    error_code: number;
  } & T;
}

export class SenhaseguraClient {
  private config: SenhaseguraConfig;
  private accessToken: string | null = null;
  private tokenExpiry: Date | null = null;

  constructor(config: SenhaseguraConfig) {
    this.config = {
      timeout: 30000,
      ...config,
    };
  }

  /**
   * Authenticate and obtain access token
   */
  async authenticate(): Promise<void> {
    const response = await fetch(`${this.config.baseUrl}/iso/oauth2/token`, {
      method: "POST",
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
      },
      body: new URLSearchParams({
        grant_type: "client_credentials",
        client_id: this.config.clientId,
        client_secret: this.config.clientSecret,
      }),
      signal: AbortSignal.timeout(this.config.timeout!),
    });

    if (!response.ok) {
      throw new Error(`Authentication failed: ${response.status} ${response.statusText}`);
    }

    const data: TokenResponse = await response.json();
    this.accessToken = data.access_token;
    this.tokenExpiry = new Date(Date.now() + data.expires_in * 1000 - 60000); // 1 min buffer
  }

  /**
   * Ensure we have a valid token
   */
  private async ensureAuthenticated(): Promise<void> {
    if (!this.accessToken || !this.tokenExpiry || this.tokenExpiry < new Date()) {
      await this.authenticate();
    }
  }

  /**
   * Make authenticated API request
   */
  private async request<T>(
    method: string,
    endpoint: string,
    options?: { body?: unknown; params?: Record<string, string> }
  ): Promise<T> {
    await this.ensureAuthenticated();

    const url = new URL(`${this.config.baseUrl}${endpoint}`);
    if (options?.params) {
      Object.entries(options.params).forEach(([key, value]) => {
        url.searchParams.set(key, value);
      });
    }

    const response = await fetch(url.toString(), {
      method,
      headers: {
        Authorization: `Bearer ${this.accessToken}`,
        "Content-Type": "application/json",
      },
      body: options?.body ? JSON.stringify(options.body) : undefined,
      signal: AbortSignal.timeout(this.config.timeout!),
    });

    if (!response.ok) {
      throw new Error(`API request failed: ${response.status} ${response.statusText}`);
    }

    return response.json();
  }

  /**
   * List all credentials
   */
  async listCredentials(): Promise<Credential[]> {
    const response = await this.request<ApiResponse<{ credentials: Credential[] }>>(
      "GET",
      "/api/pam/credential"
    );
    return response.response.credentials;
  }

  /**
   * Get credential by ID
   */
  async getCredential(id: string): Promise<Credential> {
    const response = await this.request<ApiResponse<{ credential: Credential }>>(
      "GET",
      `/api/pam/credential/${id}`
    );
    return response.response.credential;
  }

  /**
   * Get credential password
   */
  async getPassword(credentialId: string): Promise<CredentialPassword> {
    const response = await this.request<ApiResponse<{ credential: CredentialPassword }>>(
      "GET",
      "/iso/coe/senha",
      { params: { credentialId } }
    );
    return response.response.credential;
  }

  /**
   * Create new credential
   */
  async createCredential(credential: Omit<Credential, "id">): Promise<Credential> {
    const response = await this.request<ApiResponse<{ credential: Credential }>>(
      "POST",
      "/api/pam/credential",
      { body: credential }
    );
    return response.response.credential;
  }

  /**
   * Update credential
   */
  async updateCredential(id: string, updates: Partial<Credential>): Promise<Credential> {
    const response = await this.request<ApiResponse<{ credential: Credential }>>(
      "PUT",
      `/api/pam/credential/${id}`,
      { body: updates }
    );
    return response.response.credential;
  }

  /**
   * Release credential custody
   */
  async releaseCustody(credentialId: string): Promise<void> {
    await this.request("DELETE", `/iso/pam/credential/custody/${credentialId}`);
  }

  /**
   * Get password with automatic custody release
   */
  async withPassword<T>(
    credentialId: string,
    callback: (password: string) => Promise<T>
  ): Promise<T> {
    const { password } = await this.getPassword(credentialId);
    try {
      return await callback(password);
    } finally {
      await this.releaseCustody(credentialId);
    }
  }
}

// Example usage
async function main() {
  const client = new SenhaseguraClient({
    baseUrl: process.env.SENHASEGURA_URL!,
    clientId: process.env.SENHASEGURA_CLIENT_ID!,
    clientSecret: process.env.SENHASEGURA_CLIENT_SECRET!,
  });

  // List all credentials
  const credentials = await client.listCredentials();
  console.log("Credentials:", credentials);

  // Get password with automatic custody release
  const result = await client.withPassword("123", async (password) => {
    console.log("Using password for database connection...");
    // Use password here
    return { success: true };
  });

  console.log("Result:", result);
}

export default SenhaseguraClient;

#!/usr/bin/env bun
/**
 * Senhasegura MCP Server
 *
 * Exposes core senhasegura PAM operations as MCP tools.
 * Run via Bun. See ../References/McpIntegration.md for client wiring.
 *
 * Required environment variables:
 *   SENHASEGURA_URL
 *   SENHASEGURA_CLIENT_ID
 *   SENHASEGURA_CLIENT_SECRET
 */

import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import {
  CallToolRequestSchema,
  ListToolsRequestSchema,
} from "@modelcontextprotocol/sdk/types.js";

interface SenhaseguraConfig {
  baseUrl: string;
  clientId: string;
  clientSecret: string;
}

class SenhaseguraClient {
  private accessToken: string | null = null;
  private tokenExpiry: Date | null = null;

  constructor(private config: SenhaseguraConfig) {}

  async authenticate(): Promise<void> {
    const response = await fetch(`${this.config.baseUrl}/iso/oauth2/token`, {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({
        grant_type: "client_credentials",
        client_id: this.config.clientId,
        client_secret: this.config.clientSecret,
      }),
    });

    if (!response.ok) {
      throw new Error(
        `senhasegura auth failed: ${response.status} ${response.statusText}`,
      );
    }

    const data = (await response.json()) as {
      access_token: string;
      expires_in: number;
    };
    this.accessToken = data.access_token;
    // Refresh at expiry minus 60s — see SKILL.md Gotcha #2
    this.tokenExpiry = new Date(Date.now() + data.expires_in * 1000 - 60_000);
  }

  private async ensureAuth(): Promise<void> {
    if (
      !this.accessToken ||
      !this.tokenExpiry ||
      this.tokenExpiry < new Date()
    ) {
      await this.authenticate();
    }
  }

  async request(
    method: string,
    endpoint: string,
    body?: unknown,
  ): Promise<unknown> {
    await this.ensureAuth();
    const response = await fetch(`${this.config.baseUrl}${endpoint}`, {
      method,
      headers: {
        Authorization: `Bearer ${this.accessToken}`,
        "Content-Type": "application/json",
      },
      body: body ? JSON.stringify(body) : undefined,
    });
    if (!response.ok) {
      throw new Error(
        `senhasegura ${method} ${endpoint} failed: ${response.status} ${response.statusText}`,
      );
    }
    return response.json();
  }

  async releaseCustody(credentialId: string): Promise<void> {
    await this.request("DELETE", `/iso/pam/credential/custody/${credentialId}`);
  }
}

const requireEnv = (name: string): string => {
  const v = process.env[name];
  if (!v) throw new Error(`Missing required env var: ${name}`);
  return v;
};

const client = new SenhaseguraClient({
  baseUrl: requireEnv("SENHASEGURA_URL"),
  clientId: requireEnv("SENHASEGURA_CLIENT_ID"),
  clientSecret: requireEnv("SENHASEGURA_CLIENT_SECRET"),
});

const server = new Server(
  { name: "senhasegura-mcp", version: "1.0.0" },
  { capabilities: { tools: {} } },
);

server.setRequestHandler(ListToolsRequestSchema, async () => ({
  tools: [
    {
      name: "senhasegura_list_credentials",
      description: "List all credentials visible to this A2A authorization.",
      inputSchema: { type: "object", properties: {} },
    },
    {
      name: "senhasegura_get_credential",
      description: "Get credential metadata by ID (no password).",
      inputSchema: {
        type: "object",
        properties: {
          id: { type: "string", description: "Credential ID" },
        },
        required: ["id"],
      },
    },
    {
      name: "senhasegura_get_password",
      description:
        "Retrieve the password for a credential. Custody is released automatically after retrieval.",
      inputSchema: {
        type: "object",
        properties: {
          credentialId: { type: "string", description: "Credential ID" },
        },
        required: ["credentialId"],
      },
    },
    {
      name: "senhasegura_list_ssh_keys",
      description: "List all SSH keys registered in PAM Core.",
      inputSchema: { type: "object", properties: {} },
    },
    {
      name: "senhasegura_get_ssh_key",
      description: "Get an SSH key by ID (includes private key).",
      inputSchema: {
        type: "object",
        properties: {
          id: { type: "string", description: "SSH key ID" },
        },
        required: ["id"],
      },
    },
    {
      name: "senhasegura_rotate_ssh_key",
      description: "Trigger immediate rotation for an SSH key.",
      inputSchema: {
        type: "object",
        properties: {
          id: { type: "string", description: "SSH key ID" },
        },
        required: ["id"],
      },
    },
    {
      name: "senhasegura_dsm_list_secrets",
      description:
        "List secrets in DevOps Secret Manager, optionally filtered by application.",
      inputSchema: {
        type: "object",
        properties: {
          application: {
            type: "string",
            description: "Optional application filter",
          },
        },
      },
    },
    {
      name: "senhasegura_dsm_get_secret",
      description: "Get a DSM secret by identifier.",
      inputSchema: {
        type: "object",
        properties: {
          identifier: { type: "string", description: "Secret identifier" },
        },
        required: ["identifier"],
      },
    },
  ],
}));

server.setRequestHandler(CallToolRequestSchema, async (request) => {
  const { name, arguments: args } = request.params;
  const a = args as Record<string, string | undefined>;

  const text = (data: unknown) => ({
    content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }],
  });

  switch (name) {
    case "senhasegura_list_credentials": {
      return text(await client.request("GET", "/api/pam/credential"));
    }

    case "senhasegura_get_credential": {
      if (!a.id) throw new Error("id is required");
      return text(await client.request("GET", `/api/pam/credential/${a.id}`));
    }

    case "senhasegura_get_password": {
      const credentialId = a.credentialId;
      if (!credentialId) throw new Error("credentialId is required");
      try {
        return text(
          await client.request(
            "GET",
            `/iso/coe/senha?credentialId=${encodeURIComponent(credentialId)}`,
          ),
        );
      } finally {
        // Always release custody — see SKILL.md Gotcha #1
        await client.releaseCustody(credentialId).catch(() => {
          // Swallow release errors; the primary call result has already been returned.
          // Operators should monitor for orphaned custody via senhasegura's audit reports.
        });
      }
    }

    case "senhasegura_list_ssh_keys": {
      return text(await client.request("GET", "/api/pam/sshkey"));
    }

    case "senhasegura_get_ssh_key": {
      if (!a.id) throw new Error("id is required");
      return text(await client.request("GET", `/api/pam/sshkey/${a.id}`));
    }

    case "senhasegura_rotate_ssh_key": {
      if (!a.id) throw new Error("id is required");
      return text(
        await client.request("POST", `/api/pam/sshkey/${a.id}/rotate`),
      );
    }

    case "senhasegura_dsm_list_secrets": {
      const endpoint = a.application
        ? `/api/dsm/secret?application=${encodeURIComponent(a.application)}`
        : "/api/dsm/secret";
      return text(await client.request("GET", endpoint));
    }

    case "senhasegura_dsm_get_secret": {
      if (!a.identifier) throw new Error("identifier is required");
      return text(
        await client.request(
          "GET",
          `/api/dsm/secret/${encodeURIComponent(a.identifier)}`,
        ),
      );
    }

    default:
      throw new Error(`Unknown tool: ${name}`);
  }
});

const transport = new StdioServerTransport();
await server.connect(transport);