secrets.py

transcription_pipeline/secrets.py

1. """API tokens come from the environment or the macOS Keychain, never a file.
3. security add-generic-password -a "$USER" -s transcription-pipeline.deepinfra -w
4. security add-generic-password -a "$USER" -s transcription-pipeline.huggingface -w
6. (-w with no value prompts, so the token never lands in shell history.)
7. """
9. from __future__ import annotations
11. import os
12. import shutil
13. import subprocess
15. SERVICES = {
16. "DEEPINFRA_TOKEN": "transcription-pipeline.deepinfra",
17. "HF_TOKEN": "transcription-pipeline.huggingface",
18. }
21. def get_secret(name: str) -> str | None:
22. value = os.environ.get(name, "").strip()
23. if value:
24. return value
25. service = SERVICES.get(name)
26. if service and shutil.which("security"):
27. try:
28. out = subprocess.run(["security", "find-generic-password", "-s", service, "-w"],
29. capture_output=True, text=True, timeout=10)
30. except (OSError, subprocess.TimeoutExpired):
31. return None
32. if out.returncode == 0 and out.stdout.strip():
33. return out.stdout.strip()
34. return None