Merged
Conversation
## Summary
- Add full Vault module implementation with complete API coverage
- Implement local encryption/decryption using AES-GCM with WorkOS-managed keys
- Add comprehensive test coverage with 28 passing tests
- Include all Vault operations: CRUD, data key management, and crypto operations
## Key Features
- **Key-Value Operations**: Create, read, update, delete vault objects
- **Object Versioning**: List and manage object version history
- **Data Key Management**: Generate and decrypt data keys for local encryption
- **Local Encryption**: AES-GCM encryption with WorkOS key management
- **Context-based Keys**: Flexible key derivation using user-defined contexts
- **Type Safety**: Full Pydantic model integration with strict typing
## Implementation Details
- VaultModule protocol with complete method signatures and documentation
- Vault class implementing all protocol methods with proper error handling
- KeyContext using Pydantic v2 RootModel for dictionary validation
- CryptoProvider for secure AES-GCM encryption operations
- Comprehensive test suite with mock fixtures and roundtrip validation
## API Endpoints Covered
- `/vault/v1/kv` - Object CRUD operations
- `/vault/v1/kv/{id}/versions` - Version management
- `/vault/v1/keys/data-key` - Data key generation
- `/vault/v1/keys/decrypt` - Data key decryption
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
PR Summary
Comprehensive implementation of the WorkOS Vault feature in the Python SDK, providing secure key-value storage with encryption capabilities and object versioning.
- New
workos/vault.pyimplements complete Vault functionality with AES-GCM encryption, proper key management, and comprehensive type safety - Added
workos/utils/crypto_provider.pyfor secure encryption operations using envelope encryption pattern and authenticated encryption - Introduced well-structured type definitions in
workos/types/vault/for VaultObject, DataKey, and KeyContext with Pydantic validation - Comprehensive test suite in
tests/test_vault.pycovering 28 test cases for CRUD, versioning, and cryptographic operations - Modified
workos/types/list_resource.pyto support Vault object pagination with proper type checking
8 files reviewed, 3 comments
Edit PR Review Bot Settings | Greptile
Comment on lines
+1
to
+2
| from .key import * | ||
| from .object import * |
Contributor
There was a problem hiding this comment.
style: Use explicit imports instead of wildcard imports (*) to make imported symbols clear and prevent namespace pollution. Example: from .key import Key, DataKey
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
- Format crypto_provider.py and test_vault.py with black - Update vault API endpoints from data_keys to keys/data-key and keys/decrypt - Remove duplicate test case in test_vault.py 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds complete Vault functionality to the WorkOS Python SDK, including key-value operations, object versioning, data key management, and local encryption/decryption capabilities.
Features Added
Implementation Details
Core Components
API Coverage
POST /vault/v1/kv- Create vault objectsGET /vault/v1/kv- List vault objects (with pagination)GET /vault/v1/kv/{id}- Read vault objectPUT /vault/v1/kv/{id}- Update vault objectDELETE /vault/v1/kv/{id}- Delete vault objectGET /vault/v1/kv/{id}/versions- List object versionsPOST /vault/v1/keys/data-key- Generate data keysPOST /vault/v1/keys/decrypt- Decrypt data keysSecurity Features
Test Plan
All tests pass (28/28):
Breaking Changes
None - this is a new feature addition that doesn't affect existing functionality.
Dependencies
cryptographylibrary for AES-GCM encryption (already in requirements.txt)🤖 Generated with Claude Code
Documentation
Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.
If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.