Skip to content

cloud_keys

cloud_keys

Read the desktop app's cloud API keys from the macOS Keychain.

The desktop app stores provider keys in the Keychain (service "Diapason Cloud Keys") and injects them as environment variables into the server it spawns. But on a machine where the server runs as a LaunchAgent — started at login, before the app — the app finds a healthy server already on the port, reuses it, and the injection never happens. The key the user pastes into Settings then never reaches the process that needs it, and the voice bridge reports "not configured" forever.

This module closes that gap from the other side: the server falls back to reading the same Keychain entries when the environment variable is absent. The environment still wins, so a deliberate override keeps working.

The value never touches a logger, and lookups go through security, the system CLI — no extra dependency, and the Keychain's own access control still applies (macOS may ask the user once to allow access).

Functions:

get_cloud_key 

get_cloud_key(*names: str) -> str

First value found for any of names: environment, then Keychain.

Returns "" when nothing is found anywhere, which callers already treat as "not configured". Never logs the value.

Source code in src/diapason/core/cloud_keys.py 
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
def get_cloud_key(*names: str) -> str:
    """First value found for any of ``names``: environment, then Keychain.

    Returns "" when nothing is found anywhere, which callers already treat
    as "not configured". Never logs the value.
    """
    import os

    for name in names:
        value = os.environ.get(name)
        if value:
            return value

    now = time.monotonic()
    for name in names:
        if not name.endswith("_API_KEY") or not _VALID_NAME.match(name):
            continue
        cached = _cache.get(name)
        if cached is not None and now - cached[0] < _CACHE_TTL_S:
            value = cached[1]
        else:
            value = _read_keychain(name)
            _cache[name] = (now, value)
        if value:
            return value
    return ""