Secret manager: Passwords

Added the initial part of Secret Manager to manager passwords. The first
implementation is supported only plain passwords but a particular
`constructor` interface allow to implement more strict solutions in the
future. The secret manager follows the universal agent way so actual
password generation and saving is on the driver side. Single driver
`PasswordCapabilityDriver' has been added in the first implementation
that uses the PG database as a storage for passwords. An example, of
adding a password:

Request:
```curl
curl --location 'http://10.20.0.2:11010/v1/secret/passwords/' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <TOKEN>' \
--data '{
    "name": "my-password",
    "project_id": "c27f59fe-d3d3-4625-804c-5c9fd3bb3142",
    "method": "AUTO_HEX",
    "constructor": {
        "kind": "plain"
    }
}'

```

Response:
```curl
{
    "uuid": "985dad4b-161c-432c-8d9f-be78763df758",
    "created_at": "2025-06-25T20:39:50.095203Z",
    "updated_at": "2025-06-25T20:39:56.335798Z",
    "project_id": "c27f59fe-d3d3-4625-804c-5c9fd3bb3142",
    "name": "my-password",
    "description": "",
    "method": "AUTO_HEX",
    "status": "ACTIVE",
    "constructor": {
        "kind": "plain"
    },
    "value": "755eca35ece5bd921852c72996d1a790"
}
```

There are two supported method for generation: AUTO_HEX, AUTO_URL_SAFE

Signed-off-by: Anton Kremenetsky <anton.kremenetsky@gmail.com>

Author: akremenetsky

etc/genesis_universal_agent/genesis_universal_agent.conf

@@ -11,11 +11,11 @@ connection_pool_size = 2
 [universal_agent]
 orch_endpoint = http://localhost:11011
 status_endpoint = http://localhost:11012
-caps_drivers = CoreCapabilityDriver
+caps_drivers = CoreCapabilityDriver,PasswordCapabilityDriver
 
 
 [universal_agent_scheduler]
-capabilities = em_core_*
+capabilities = em_core_*,password
 
 
 [CoreCapabilityDriver]

genesis_core/agent/universal/driver.py …sis_core/agent/universal/drivers/core.pygenesis_core/agent/universal/driver.py renamed to genesis_core/agent/universal/drivers/core.py genesis_core/agent/universal/driver.py renamed to genesis_core/agent/universal/drivers/core.py

@@ -0,0 +1,121 @@
+#    Copyright 2025 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+from __future__ import annotations
+
+import secrets
+import logging
+import typing as tp
+
+from restalchemy.dm import filters as dm_filters
+from restalchemy.storage import exceptions as ra_exc
+from gcl_sdk.agents.universal.dm import models
+from gcl_sdk.agents.universal.clients.backend import base
+from gcl_sdk.agents.universal.clients.backend import exceptions
+
+from genesis_core.secret import constants as sc
+from genesis_core.secret.dm import models as secret_dm
+from genesis_core.agent.universal.drivers.secret.dm import models as driver_dm
+
+
+LOG = logging.getLogger(__name__)
+
+
+class DatabaseSecretBackendClient(base.AbstractBackendClient):
+    """Secret Backend client based on SQL database."""
+
+    def get(self, resource: models.Resource) -> dict[str, tp.Any]:
+        """Get the resource value in dictionary format."""
+        try:
+            driver_password = driver_dm.Password.objects.get_one(
+                filters={
+                    "uuid": dm_filters.EQ(resource.uuid),
+                },
+            )
+        except ra_exc.RecordNotFound:
+            raise exceptions.ResourceNotFound(resource=resource)
+
+        return driver_password.meta
+
+    def create(self, resource: models.Resource) -> dict[str, tp.Any]:
+        """Creates the resource. Returns the created resource."""
+        try:
+            self.get(resource)
+        except exceptions.ResourceNotFound:
+            pass
+        else:
+            raise exceptions.ResourceAlreadyExists(resource=resource)
+
+        password = secret_dm.Password.from_ua_resource(resource)
+
+        # Validate structure of password model
+        if (
+            sc.SecretMethod[password.method].is_auto
+            and password.value is not None
+        ):
+            raise ValueError("Cannot create auto-generated password.")
+
+        if (
+            not sc.SecretMethod[password.method].is_auto
+            and password.value is None
+        ):
+            raise ValueError("Cannot create non-auto-generated password.")
+
+        # Generate plain password
+        if sc.SecretMethod[password.method].is_auto:
+            if password.method == sc.SecretMethod.AUTO_HEX:
+                plain_password = secrets.token_hex(16)
+            elif password.method == sc.SecretMethod.AUTO_URL_SAFE:
+                plain_password = secrets.token_urlsafe(16)
+            else:
+                raise ValueError("Unknown auto-generated password method.")
+        else:
+            plain_password = password.value
+
+        # Build password from the plain view
+        pass_value = password.constructor.build(plain_password)
+
+        # Build storagable password and save
+        driver_password = driver_dm.Password.from_password_resource(
+            resource, pass_value
+        )
+        driver_password.save()
+        return driver_password.meta
+
+    def update(self, resource: models.Resource) -> dict[str, tp.Any]:
+        """Update the resource. Returns the updated resource."""
+
+        # The simplest implementation. Update via recreation.
+        self.delete(resource)
+        return self.create(resource)
+
+    def list(self, kind: str, **kwargs) -> list[dict[str, tp.Any]]:
+        """Lists all resources by kind."""
+        secrets = driver_dm.Password.objects.get_all()
+        return [s.meta for s in secrets]
+
+    def delete(self, resource: models.Resource) -> None:
+        """Delete the resource."""
+        try:
+            self.get(resource)
+        except exceptions.ResourceNotFound:
+            raise exceptions.ResourceNotFound(resource=resource)
+
+        password = driver_dm.Password.objects.get_one(
+            filters={
+                "uuid": dm_filters.EQ(resource.uuid),
+            }
+        )
+        password.delete()

genesis_core/agent/universal/drivers/secret/__init__.py

@@ -0,0 +1,61 @@
+#    Copyright 2025 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+from __future__ import annotations
+
+import typing as tp
+
+from restalchemy.dm import properties
+from restalchemy.dm import models
+from restalchemy.dm import types
+from restalchemy.storage.sql import orm
+from gcl_sdk.agents.universal.dm import models as ua_models
+
+from genesis_core.secret import constants as sc
+from genesis_core.secret.dm import models as secret_dm
+
+
+class Password(
+    models.ModelWithUUID,
+    models.ModelWithTimestamp,
+    orm.SQLStorableMixin,
+):
+    __tablename__ = "storage_passwords"
+
+    status = properties.property(
+        types.Enum([s.value for s in sc.SecretStatus]),
+        default=sc.SecretStatus.NEW.value,
+    )
+    value = properties.property(
+        types.String(min_length=1, max_length=512),
+        required=True,
+    )
+    # Some additional metadata about the secret
+    meta = properties.property(types.Dict(), default=lambda: {})
+
+    @classmethod
+    def from_password_resource(
+        cls, resource: ua_models.TargetResource, password_value: str
+    ) -> Password:
+        meta = resource.value.copy()
+        meta["value"] = password_value
+        meta["status"] = sc.SecretStatus.ACTIVE.value
+
+        return cls(
+            uuid=resource.uuid,
+            value=password_value,
+            status=sc.SecretStatus.ACTIVE.value,
+            meta=meta,
+        )

genesis_core/agent/universal/drivers/secret/backend/__init__.py

@@ -0,0 +1,44 @@
+#    Copyright 2025 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+from __future__ import annotations
+
+import logging
+
+from gcl_sdk.agents.universal.drivers import direct
+from gcl_sdk.agents.universal.storage import fs
+
+from genesis_core.agent.universal.drivers.secret.backend import db as db_back
+
+
+LOG = logging.getLogger(__name__)
+
+AGENT_WORK_DIR = "/var/lib/genesis/universal_agent/"
+
+
+class PasswordCapabilityDriver(direct.DirectAgentDriver):
+    """Password capability driver."""
+
+    def __init__(self):
+        storage = fs.FileAgentStorage(
+            AGENT_WORK_DIR, "password_cap_storage.json"
+        )
+        client = db_back.DatabaseSecretBackendClient()
+
+        super().__init__(storage=storage, client=client)
+
+    def get_capabilities(self) -> list[str]:
+        """Returns a list of capabilities supported by the driver."""
+        return ["password"]

genesis_core/agent/universal/drivers/secret/backend/db.py

@@ -39,7 +39,7 @@
 DEF_OUTDATE_MIN_PERIOD = datetime.timedelta(minutes=10)
 
 
-class ConfigService(basic.BasicService):
+class ConfigServiceBuilder(basic.BasicService):
 
     def _get_new_configs(
         self,

genesis_core/agent/universal/drivers/secret/dm/__init__.py

@@ -26,6 +26,7 @@
 from genesis_core.node.machine import service as n_machine_service
 from genesis_core.network import service as n_network_service
 from genesis_core.config import service as config_service
+from genesis_core.secret import service as secret_service
 
 
 LOG = logging.getLogger(__name__)
@@ -70,7 +71,8 @@ def __init__(self, iter_min_period=1, iter_pause=0.1):
         n_machine = n_machine_service.MachineAgentService(
             iter_min_period=1, iter_pause=0.1
         )
-        cfg_service = config_service.ConfigService()
+        cfg_service = config_service.ConfigServiceBuilder()
+        secret_svc = secret_service.SecretServiceBuilder()
         event_sender = senders.EventSenderService.build_from_config()
 
         self._services = [
@@ -79,6 +81,7 @@ def __init__(self, iter_min_period=1, iter_pause=0.1):
             n_builder,
             n_machine,
             cfg_service,
+            secret_svc,
             event_sender,
         ]