Add transient NPM certificate material

2026-09-20 00:27:47 -04:00
parent 381119a6b5
commit 2b4a6eea79
3 changed files with 344 additions and 10 deletions
@@ -0,0 +1,51 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, repr=False)
+class CertificateMaterial:
+    """
+    Secret-bearing certificate material for transient use only.
+
+    Instances must never be persisted, placed in generic reconciliation
+    objects, or included in logs.
+    """
+
+    certificate: bytes
+    certificate_key: bytes
+    intermediate_certificate: bytes | None = None
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.certificate, bytes) or not self.certificate:
+            raise ValueError(
+                "Certificate material requires certificate bytes"
+            )
+
+        if (
+            not isinstance(self.certificate_key, bytes)
+            or not self.certificate_key
+        ):
+            raise ValueError(
+                "Certificate material requires certificate-key bytes"
+            )
+
+        if self.intermediate_certificate is not None and (
+            not isinstance(self.intermediate_certificate, bytes)
+            or not self.intermediate_certificate
+        ):
+            raise ValueError(
+                "Intermediate certificate must be non-empty bytes"
+            )
+
+    def __repr__(self) -> str:
+        intermediate = (
+            "<redacted>"
+            if self.intermediate_certificate is not None
+            else "None"
+        )
+        return (
+            "CertificateMaterial("
+            "certificate=<redacted>, "
+            "certificate_key=<redacted>, "
+            f"intermediate_certificate={intermediate}"
+            ")"
+        )