Redis

mail_intake.credentials.redis

Summary

Redis-backed credential persistence for Mail Intake.

This module provides a Redis-based implementation of the CredentialStore abstraction, enabling credential persistence across distributed and horizontally scaled deployments.

The Redis credential store is designed for environments where authentication credentials must be shared safely across multiple processes, containers, or nodes, such as container orchestration platforms and microservice architectures.

Key characteristics:

Distributed-safe, shared storage using Redis.
Explicit, caller-defined serialization and deserialization.
No reliance on unsafe mechanisms such as pickle.
Optional time-to-live (TTL) support for automatic credential expiry.

This module is responsible solely for persistence concerns. Credential validation, refresh, rotation, and acquisition remain the responsibility of authentication provider implementations.

Classes

RedisCredentialStore

RedisCredentialStore(
    redis_client: Any,
    key: str,
    serialize: Callable[[T], bytes],
    deserialize: Callable[[bytes], T],
    ttl_seconds: int | None = None,
)

Bases: CredentialStore[T]

Redis-backed implementation of CredentialStore.

This store persists credentials in Redis and is suitable for distributed and horizontally scaled deployments where credentials must be shared across multiple processes or nodes.

Notes

Responsibilities:

- This class is responsible only for persistence and retrieval.
- It does not interpret, validate, refresh, or otherwise manage the
  lifecycle of the credentials being stored.

Guarantees:

- The store is intentionally generic and delegates all serialization
  concerns to caller-provided functions.
- This avoids unsafe mechanisms such as `pickle` and allows
  credential formats to be explicitly controlled and audited.

Initialize a Redis-backed credential store.

Parameters:

Name	Type	Description	Default
`redis_client`	`Any`	Initialized Redis client instance used for persistence.	required
`key`	`str`	Storage key under which credentials are persisted.	required
`serialize`	`Callable[[T], bytes]`	Callable that encodes credentials to bytes for storage.	required
`deserialize`	`Callable[[bytes], T]`	Callable that decodes stored bytes back into credentials.	required
`ttl_seconds`	`int \| None`	Optional time-to-live in seconds after which stored credentials expire automatically. `None` disables expiry.	`None`

Functions

clear

clear() -> None

Remove stored credentials from Redis.

Notes

Lifecycle:

- This operation deletes the configured Redis key if it exists
- Implementations should treat this method as idempotent

load

load() -> T | None

Load credentials from Redis.

Returns:

Type	Description
`T \| None`	T \| None: An instance of type `T` if credentials are present and successfully deserialized; otherwise `None`.

Notes

Guarantees:

- If no value exists for the configured key, or if the stored
  payload cannot be successfully deserialized, this method
  returns `None`.
- The store does not attempt to validate the returned
  credentials or determine whether they are expired or
  otherwise usable.

save

save(credentials: T) -> None

Persist credentials to Redis.

Parameters:

Name	Type	Description	Default
`credentials`	`T`	The credential object to persist.	required

Notes

Responsibilities:

- Any previously stored credentials under the same key are overwritten
- If a TTL is configured, the credentials will expire automatically after the specified duration