Initial commit

src/infrastructure/vault/utils.py

@@ -0,0 +1,17 @@
+from __future__ import annotations
+import hvac
+
+
+def create_hvac_client(*, url: str, token: str, timeout: int = 5) -> hvac.Client:
+    client = hvac.Client(url=url, token=token, timeout=timeout)
+    if not client.is_authenticated():
+        raise RuntimeError("Vault authentication failed. Check VAULT_ADDR / VAULT_TOKEN")
+    return client
+
+
+def read_kv2_secret(*, client: hvac.Client, mount_point: str, path: str) -> dict:
+    secret = client.secrets.kv.v2.read_secret_version(
+        mount_point=mount_point,
+        path=path,
+    )
+    return secret["data"]["data"]