U Enj @sdZddlZddlZddlmZmZddlmZddlZeee dddZ e dZ iZ e Ze ZeZdd d Zdd d ZddZdS)a DB-backed secrets for the pipeline. Reads API keys/tokens from the `app_secret` table (encrypted at rest) instead of the .env file, and reports auth/expiry errors back onto the row so the admin panel can surface them. Bootstrap: MYSQL_URI and SECRETS_ENC_KEY still come from .env (you can't store the DB connection string inside the DB it connects to). Migration-safe: if a key has no stored value yet (or the DB/decrypt fails), get_secret() falls back to os.getenv(key) so nothing breaks mid-migration. N) create_enginetext) load_dotenv MYSQL_URIT) pool_pre_pingZSECRETS_ENC_KEYc Cs|r0t"|tkr&t|W5QRSW5QRXd}zPt}|tdd|i}W5QRX|r|drtrt |dt}Wn6t k r}zt d|d|W5d}~XYnX|st |}t|t|<W5QRX|S)zReturn the secret value for `key` from the DB (decrypted), or fall back to the same-named .env variable if it isn't stored/decryptable yet.Nz9SELECT secret_value FROM app_secret WHERE secret_key = :kkrz[SECRETS] DB read failed for : )_lock_cache_engineconnectexecuterfetchone_ENC_KEY secret_cryptodecrypt Exceptionprintosgetenv)keyZ use_cachevalueconnrowerM/var/www/api.dyntland.com/public_html/python_social_comments/secrets_store.py get_secret s( & rerrorc Cst0|tkrW5QRdSt|t|W5QRXzbt*}|td|t |dd|dW5QRXt d|d|dt |ddWn6t k r}zt d |d|W5d}~XYnXdS) zRecord an auth/expiry failure against a key (shown in the admin panel). Fires at most once per key per process run to avoid hammering the DB.Nz UPDATE app_secret SET status = :s, last_error = :m, last_error_at = NOW() WHERE secret_key = :k i)smrz[SECRETS] Recorded z for rxz%[SECRETS] Could not record error for ) r _reported_erroradd _marked_okdiscardr beginr rstrrr)rmessagestatusrrrrrreport_secret_error<s   *r*c Cst.|tks|tkr$W5QRdSt|W5QRXz,t}|tdd|iW5QRXWn6tk r}zt d|d|W5d}~XYnXdS)zAMark a key healthy after a successful call. Once per key per run.Nz UPDATE app_secret SET status = 'active', last_ok_at = NOW(), last_error = NULL, last_error_at = NULL WHERE secret_key = :k rz [SECRETS] Could not mark ok for r) r r$r"r#r r&r rrr)rrrrrrmark_secret_okPs  r+)T)r)__doc__r threading sqlalchemyrrdotenvrrrr rr setr$r"Lockr rr*r+rrrrs