update project knowledge function

2026-09-07 00:10:08 +09:00
parent e5fa21ecfd
commit 4cdd4fc98e
21 changed files with 3775 additions and 1 deletions
@@ -0,0 +1,91 @@
+"""Resolve Jira credentials for an identity without leaking them.
+
+Credentials come from the existing ``SecretStore`` interface so tests can
+inject a fake and production uses the OS keyring. The resolver never caches
+credentials beyond the call scope and never includes them in error messages,
+logs, or MCP payloads.
+
+Key naming convention:
+- Per-project: ``jira:<cowork_project_id>``
+- Global fallback: ``jira:default``
+
+The email is stored alongside the token under the same key as a JSON pair
+``{"email": "...", "api_token": "..."}`` so one secret-store entry carries
+both values atomically.
+"""
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from typing import Optional
+
+from ...infrastructure.secrets.secret_store import SecretStore
+from ...mcp_servers.project_context.foundation import IdentityContext, ProviderError
+
+
+@dataclass(frozen=True)
+class JiraCredentials:
+    """Immutable credential pair resolved for one call."""
+    email: str
+    api_token: str
+
+
+def _secret_key(cowork_project_id: str) -> str:
+    return f"jira:{cowork_project_id}"
+
+
+_GLOBAL_KEY = "jira:default"
+
+
+class JiraCredentialResolver:
+    """Resolve ``(email, api_token)`` from the secret store for one identity.
+
+    Raises ``UNAVAILABLE`` when no credentials are configured — never returns
+    empty strings that would cause a silent 401 at the HTTP layer.
+    """
+
+    def __init__(self, store: SecretStore) -> None:
+        self._store = store
+
+    def resolve(self, identity: IdentityContext) -> JiraCredentials:
+        """Look up credentials by project-specific key, then global fallback.
+
+        Raises:
+            ProviderError: When neither key exists or the stored value is
+                malformed.
+        """
+        raw = self._store.get(_secret_key(identity.project))
+        if not raw:
+            raw = self._store.get(_GLOBAL_KEY)
+        if not raw:
+            raise ProviderError(
+                "UNAVAILABLE",
+                "Jira credentials are not configured for this project.",
+                retryable=False,
+            )
+        try:
+            parsed = json.loads(raw)
+        except (json.JSONDecodeError, TypeError):
+            raise ProviderError(
+                "UNAVAILABLE",
+                "Stored Jira credentials are malformed; re-enter them in Connectors.",
+                retryable=False,
+            )
+        if not isinstance(parsed, dict):
+            raise ProviderError(
+                "UNAVAILABLE",
+                "Stored Jira credentials are malformed; re-enter them in Connectors.",
+                retryable=False,
+            )
+        email = str(parsed.get("email", "")).strip()
+        api_token = str(parsed.get("api_token", "")).strip()
+        if not email or not api_token:
+            raise ProviderError(
+                "UNAVAILABLE",
+                "Stored Jira credentials are incomplete; re-enter them in Connectors.",
+                retryable=False,
+            )
+        return JiraCredentials(email=email, api_token=api_token)
+
+
+__all__ = ["JiraCredentialResolver", "JiraCredentials"]