Secrets Payloads

`chaos.lib.args.dataclasses.SecretsContext`

Bases: BasePayload

Payload representing the environment context when interacting with secrets.

Attributes:

Name	Type	Description
`team`	`str \| None`	The team string (e.g., 'company.team.person') used to resolve secrets and sops file paths.
`sops_file_override`	`str \| None`	Optional explicit path overriding the default .sops.yaml location.
`secrets_file_override`	`str \| None`	Optional explicit path overriding the default secrets.yml location.
`provider_config`	`ProviderConfigPayload \| dict[str, Any] \| None`	The ephemeral secret provider configuration to use for operations.
`i_know_what_im_doing`	`bool`	If True, suppresses interactive confirmation prompts.

`chaos.lib.args.dataclasses.ProviderConfigPayload`

Bases: BasePayload

Payload containing configuration for secret providers, usually governing ephemeral decryption keys.

Attributes:

Name	Type	Description
`provider`	`str \| None`	The name of the provider backend mapped in the global config (e.g., 'bw.age').
`ephemeral_provider_args`	`dict[str, Any] \| None`	A dictionary mapping specific provider CLI flags to their arguments (e.g., {'from_bw': ('item_id', 'age')}).

`chaos.lib.args.dataclasses.SecretsExportPayload`

Bases: BasePayload

Payload for exporting a master secret key (age, gpg, vault) to an external secret provider.

Attributes:

Name	Type	Description
`provider_name`	`str`	The CLI name of the provider to use for the export (e.g., 'bw').
`key_type`	`Literal`	The type of key being exported ('age', 'gpg', 'vault').
`no_import`	`bool`	If True, adds a `# NO-IMPORT` flag to the secret to prevent it from being re-imported later.
`save_to_config`	`bool`	If True, saves the resulting item ID/URL to the global chaos configuration.
`item_name`	`str \| None`	The name or title of the item to be created in the provider's vault.
`keys`	`str \| None`	The path to the local file containing the keys to export (e.g., age or vault key files).
`vault_addr`	`str \| None`	The address of the HashiCorp Vault server, if exporting a vault token.
`fingerprints`	`list[str] \| None`	A list of GPG fingerprints to export.
`provider_specific_args`	`ProviderExportArgs \| None`	A subclass of ProviderExportArgs containing provider-specific options.

`chaos.lib.args.dataclasses.SecretsImportPayload`

Bases: BasePayload

Payload for importing a master secret key (age, gpg, vault) from an external secret provider to the local machine.

Attributes:

Name	Type	Description
`provider_name`	`str`	The CLI name of the provider to use for the import (e.g., 'bw').
`key_type`	`Literal`	The type of key being imported ('age', 'gpg', 'vault').
`item_id`	`str \| None`	The provider's unique identifier or URL for the item containing the key.
`provider_specific_args`	`ProviderImportArgs \| None`	A subclass of ProviderImportArgs containing provider-specific options.
`confirmed`	`bool`	Internal state tracking whether the user confirmed overriding an existing local key.

`chaos.lib.args.dataclasses.SecretsRotatePayload`

Bases: BasePayload

Payload for adding or removing an encryption key from a .sops.yaml configuration file.

Attributes:

Name	Type	Description
`type`	`Literal`	The type of key being rotated ('age', 'pgp', 'vault').
`keys`	`list[str]`	The list of keys (e.g., public age keys, GPG fingerprints, Vault URIs) to add or remove.
`context`	`SecretsContext \| dict[str, Any]`	The context resolving the target `.sops.yaml` file and team.
`index`	`int \| None`	The specific rule index in the `.sops.yaml` file to modify. If None, affects all applicable rules.
`pgp_server`	`str \| None`	Optional PGP keyserver to download missing public keys from.
`create`	`bool`	If True, creates a new key group if it doesn't already exist.
`update_confirmed`	`bool`	Internal state tracking whether the user confirmed applying `sops updatekeys` after the rotation.

`chaos.lib.args.dataclasses.SecretsListPayload`

Bases: BasePayload

Payload for listing all active encryption keys of a specific type within a .sops.yaml configuration file.

Attributes:

Name	Type	Description
`type`	`Literal`	The type of key to search for and list ('age', 'pgp', 'vault').
`context`	`SecretsContext \| dict[str, Any]`	The context resolving the target `.sops.yaml` file.
`no_pretty`	`bool`	If True, disables rich CLI formatting for the output.
`json`	`bool`	If True, formats the output as a JSON array.
`value`	`bool`	If True, prints only the raw key values, one per line (useful for shell piping).

`chaos.lib.args.dataclasses.SecretsEditPayload`

Bases: BasePayload

Payload for securely editing a secrets file using sops.

Attributes:

Name	Type	Description
`context`	`SecretsContext \| dict[str, Any]`	The context containing the paths to the secrets file, SOPS config, and the provider used for decryption.
`edit_sops_file`	`bool`	If True, opens the `.sops.yaml` configuration file for editing instead of the encrypted secrets file.

`chaos.lib.args.dataclasses.SecretsPrintPayload`

Bases: BasePayload

Payload for decrypting and printing an entire secrets file to standard output.

Attributes:

Name	Type	Description
`context`	`SecretsContext \| dict[str, Any]`	The context containing the file paths and provider for decryption.
`print_sops_file`	`bool`	If True, prints the unencrypted `.sops.yaml` configuration file instead.
`as_json`	`bool`	If True, parses the decrypted secrets and outputs them as a JSON string.

`chaos.lib.args.dataclasses.SecretsCatPayload`

Bases: BasePayload

Payload for decrypting a secrets file and querying specific keys from it.

Attributes:

Name	Type	Description
`keys`	`list[str]`	A list of keys (using dot notation) to extract from the decrypted secrets file.
`context`	`SecretsContext \| dict[str, Any]`	The context containing the file paths and provider for decryption.
`cat_sops_file`	`bool`	If True, queries the `.sops.yaml` configuration file instead.
`as_json`	`bool`	If True, formats the queried output as JSON.
`value_only`	`bool`	If True, prints only the raw value of the keys without keys names or formatting (useful for piping).

`chaos.lib.args.dataclasses.SecretsSetShamirPayload`

Bases: BasePayload

Payload for configuring Shamir's Secret Sharing threshold for a specific rule in a .sops.yaml configuration file.

Attributes:

Name	Type	Description
`index`	`int`	The index of the creation rule to modify in the `.sops.yaml` file.
`share`	`int`	The required number of key shares (threshold) to decrypt the secret. Setting this to 0 removes the threshold.
`context`	`SecretsContext \| dict[str, Any]`	The context resolving the target `.sops.yaml` file.
`confirmed`	`bool`	Internal state tracking whether the user confirmed the removal of a threshold.
`update_confirmed`	`bool`	Internal state tracking whether the user confirmed updating existing secrets to apply the new threshold.

`chaos.lib.args.dataclasses.ProviderExportArgs`

Bases: BasePayload

Base payload representing provider-specific export arguments.

This class is intended to be subclassed by specific providers (e.g., Bitwarden, 1Password) to define their unique export options.

`chaos.lib.args.dataclasses.ProviderImportArgs`

Bases: BasePayload

Base payload representing provider-specific import arguments.

This class is intended to be subclassed by specific providers to define their unique import options.