lexigram-secrets

Secret vaults with rotation, tenant isolation, and audit logging for the Lexigram Framework. Supports HashiCorp Vault and in-memory backends with automatic key rotation, version tracking, and tenant-scoped secret stores.

Overview

lexigram-secrets provides a RotatableSecretStoreProtocol-based secret management system with versioned rotation, tenant isolation, audit logging, and pluggable backends. All services are wired via SecretsProvider, which registers the secret store and rotation decorator with the DI container.

Full documentation: docs.lexigram.dev

Install

uv add lexigram-secrets
# Optional extras
uv add "lexigram-secrets[vault]"    # HashiCorp Vault backend
uv add "lexigram-secrets[aws]"      # AWS Secrets Manager backend
uv add "lexigram-secrets[gcp]"      # GCP Secret Manager backend

Quick Start

from lexigram import Application
from lexigram.di.module import Module, module
from lexigram.secrets import SecretsModule

@module(imports=[SecretsModule.configure()])
class AppModule(Module):
    pass

app = Application(modules=[AppModule])
if __name__ == "__main__":
    app.run()

Module Factory Methods

Key Features

• Versioned secrets — Every set and rotate creates a new version; full history retained
• Automatic rotation — RotationDecorator wraps any service method with age-checked rotation
• Tenant isolation — TenantScopedSecretStore prefixes keys per tenant for multi-tenant apps
• Audit logging — SecretAuditDecorator logs all store operations through AuditLoggerProtocol
• Pluggable backends — HashicorpVaultStore (KV v2) and in-memory (FakeRotatableSecretStore)
• Bulk operations — get_bulk for fetching multiple secrets at once
• Version introspection — list_versions and get_version for audit and rollback workflows

Testing

from lexigram.testing.fakes import FakeRotatableSecretStore
from lexigram.testing.compliance import StoreConformanceSuite

class TestMyStore(StoreConformanceSuite):
    @pytest.fixture
    def make_store(self):
        return FakeRotatableSecretStore

Key Source Files

Config Reference