feat(cbc): support PEM cert values via env vars and cert_path/key_path params

Replace the cert tuple parameter with symmetric cert_path/key_path params.
Add CLOUD_SDK_CBC_CERT / CLOUD_SDK_CBC_KEY env vars so PEM values can be
supplied directly (e.g. from K8s secrets) without writing to disk first —
create_client() handles the temp-file lifecycle automatically.

Author: soumyadey

src/sap_cloud_sdk/cbc/client.py

@@ -117,8 +117,8 @@ class DefaultClient:
 
     **Production** (any ``https://`` or non-loopback URL): subdomain-per-tenant
     routing rewrites the URL subdomain to the ``cbc_tenant_id`` for each request;
-    mTLS credentials must be provided via ``cert``, ``cert_pem``/``key_pem``, or
-    ``ssl_context``.
+    mTLS credentials must be provided via ``cert_path``/``key_path``,
+    ``cert_pem``/``key_pem``, or ``ssl_context``.
 
     **Local / mock** (``http://localhost``, ``http://127.0.0.1``, ``http://[::1]``):
     no subdomain replacement, no mTLS — detected automatically from the URL.
@@ -138,7 +138,8 @@ class DefaultClient:
 
         client = DefaultClient(
             base_url="https://cbc.example.ondemand.com",
-            cert=(Path("/run/secrets/tls.crt"), Path("/run/secrets/tls.key")),
+            cert_path=Path("/run/secrets/tls.crt"),
+            key_path=Path("/run/secrets/tls.key"),
         )
 
     Args:
@@ -147,10 +148,10 @@ class DefaultClient:
         http_client: Optional pre-configured ``httpx.Client`` — takes full
             precedence over all mTLS arguments.  Use for testing.
         ssl_context: Optional pre-built :class:`ssl.SSLContext` with mTLS loaded.
-        cert: ``(cert_path, key_path)`` tuple of :class:`pathlib.Path` objects.
-        cert_pem: Raw PEM string for the client certificate.  Requires
-            ``key_pem`` to also be set.  Written to a temp file deleted after
-            the first connection.
+        cert_path: Path to the PEM client certificate file.  Requires ``key_path``.
+        key_path: Path to the PEM private key file.  Requires ``cert_path``.
+        cert_pem: Raw PEM string for the client certificate.  Requires ``key_pem``.
+            Written to a temp file deleted after the first connection.
         key_pem: Raw PEM string for the private key.  Requires ``cert_pem``.
     """
 
@@ -159,7 +160,8 @@ def __init__(
         base_url: str,
         http_client: httpx.Client | None = None,
         ssl_context: ssl.SSLContext | None = None,
-        cert: tuple[Path, Path] | None = None,
+        cert_path: Path | None = None,
+        key_path: Path | None = None,
         cert_pem: str | None = None,
         key_pem: str | None = None,
         replace_subdomain: bool | None = None,
@@ -176,8 +178,8 @@ def __init__(
         )
 
         if http_client is None and ssl_context is None:
-            if cert is not None:
-                transport = _LazyCertTransport(str(cert[0]), str(cert[1]))
+            if cert_path is not None and key_path is not None:
+                transport = _LazyCertTransport(str(cert_path), str(key_path))
                 http_client = httpx.Client(transport=transport)
             elif cert_pem is not None and key_pem is not None:
                 with tempfile.NamedTemporaryFile(delete=False, suffix=".pem") as cf:
@@ -444,13 +446,11 @@ def create_client(*, config: CBCConfig | None = None) -> CBCClient:
     from sap_cloud_sdk.cbc.config import load_from_env
 
     resolved: CBCConfig = config if config is not None else load_from_env()
-    cert = (
-        (resolved.cert_path, resolved.key_path)
-        if resolved.cert_path and resolved.key_path
-        else None
-    )
     return DefaultClient(
         base_url=resolved.base_url,
-        cert=cert,
+        cert_path=resolved.cert_path,
+        key_path=resolved.key_path,
+        cert_pem=resolved.cert_pem,
+        key_pem=resolved.key_pem,
         replace_subdomain=resolved.replace_subdomain,
     )

src/sap_cloud_sdk/cbc/config.py

@@ -7,6 +7,8 @@
     CLOUD_SDK_CBC_URL         CBC service base URL (required)
     CLOUD_SDK_CBC_CERT_PATH   Path to PEM client certificate file
     CLOUD_SDK_CBC_KEY_PATH    Path to PEM private key file
+    CLOUD_SDK_CBC_CERT        PEM client certificate value (alternative to CERT_PATH)
+    CLOUD_SDK_CBC_KEY         PEM private key value (alternative to KEY_PATH)
 """
 
 from __future__ import annotations
@@ -20,6 +22,8 @@
 ENV_URL = "CLOUD_SDK_CBC_URL"
 ENV_CERT_PATH = "CLOUD_SDK_CBC_CERT_PATH"
 ENV_KEY_PATH = "CLOUD_SDK_CBC_KEY_PATH"
+ENV_CERT = "CLOUD_SDK_CBC_CERT"
+ENV_KEY = "CLOUD_SDK_CBC_KEY"
 ENV_REPLACE_SUBDOMAIN = "CLOUD_SDK_CBC_REPLACE_SUBDOMAIN"
 
 
@@ -31,6 +35,8 @@ class CBCConfig:
         base_url: CBC service base URL.
         cert_path: Path to the PEM client certificate file, or ``None`` for local/mock mode.
         key_path: Path to the PEM private key file, or ``None`` for local/mock mode.
+        cert_pem: PEM client certificate value. Alternative to ``cert_path``.
+        key_pem: PEM private key value. Alternative to ``key_path``.
         replace_subdomain: Whether to rewrite the URL subdomain to the CBC tenant ID
             on each request. ``None`` (default) auto-detects: loopback URLs disable it,
             all others enable it. Set explicitly to ``False`` for HTTPS mock servers.
@@ -39,6 +45,8 @@ class CBCConfig:
     base_url: str
     cert_path: Path | None = None
     key_path: Path | None = None
+    cert_pem: str | None = None
+    key_pem: str | None = None
     replace_subdomain: bool | None = None
 
 
@@ -47,10 +55,13 @@ def load_from_env() -> CBCConfig:
 
     Resolution order (first match wins):
 
-    1. **Credential triplet** — ``CLOUD_SDK_CBC_CERT_PATH``,
-       ``CLOUD_SDK_CBC_KEY_PATH``, and ``CLOUD_SDK_CBC_URL`` must all be set.
-       The path vars must point to existing PEM files.
-    2. **URL only** — loopback addresses (``http://localhost``,
+    1. **Path triplet** — ``CLOUD_SDK_CBC_CERT_PATH``, ``CLOUD_SDK_CBC_KEY_PATH``,
+       and ``CLOUD_SDK_CBC_URL`` must all be set. The path vars must point to
+       existing PEM files.
+    2. **Value triplet** — ``CLOUD_SDK_CBC_CERT``, ``CLOUD_SDK_CBC_KEY``, and
+       ``CLOUD_SDK_CBC_URL`` must all be set. PEM values are written to temp
+       files deleted after the first connection.
+    3. **URL only** — loopback addresses (``http://localhost``,
        ``http://127.0.0.1``) trigger local/mock mode (no mTLS, no subdomain
        replacement). Non-loopback URLs produce a client without mTLS.
 
@@ -63,28 +74,45 @@ def load_from_env() -> CBCConfig:
             path env var points to a non-existent file.
     """
     url = os.environ.get(ENV_URL)
+    replace_subdomain = _read_env_bool(ENV_REPLACE_SUBDOMAIN)
 
-    cert = _read_env_path(ENV_CERT_PATH)
-    key = _read_env_path(ENV_KEY_PATH)
-    if cert and key and url:
+    cert_path = _read_env_path(ENV_CERT_PATH)
+    key_path = _read_env_path(ENV_KEY_PATH)
+    if cert_path and key_path and url:
         return CBCConfig(
             base_url=url,
-            cert_path=cert,
-            key_path=key,
-            replace_subdomain=_read_env_bool(ENV_REPLACE_SUBDOMAIN),
+            cert_path=cert_path,
+            key_path=key_path,
+            replace_subdomain=replace_subdomain,
         )
-    if cert or key:
+    if cert_path or key_path:
         raise CBCConfigError(
             "CBC env-var credential triplet is incomplete. "
             f"Set all of {ENV_CERT_PATH}, {ENV_KEY_PATH}, and {ENV_URL} — or none."
         )
 
+    cert_pem = os.environ.get(ENV_CERT)
+    key_pem = os.environ.get(ENV_KEY)
+    if cert_pem and key_pem and url:
+        return CBCConfig(
+            base_url=url,
+            cert_pem=cert_pem,
+            key_pem=key_pem,
+            replace_subdomain=replace_subdomain,
+        )
+    if cert_pem or key_pem:
+        raise CBCConfigError(
+            "CBC env-var credential pair is incomplete. "
+            f"Set both {ENV_CERT} and {ENV_KEY} together with {ENV_URL} — or none."
+        )
+
     if url:
-        return CBCConfig(base_url=url, replace_subdomain=_read_env_bool(ENV_REPLACE_SUBDOMAIN))
+        return CBCConfig(base_url=url, replace_subdomain=replace_subdomain)
 
     raise CBCConfigError(
         f"No CBC configuration found. Set {ENV_URL} at minimum, "
-        f"or provide mTLS credentials via {ENV_CERT_PATH} / {ENV_KEY_PATH}."
+        f"or provide mTLS credentials via {ENV_CERT_PATH} / {ENV_KEY_PATH} "
+        f"or {ENV_CERT} / {ENV_KEY}."
     )
 
 

src/sap_cloud_sdk/cbc/user-guide.md

@@ -134,12 +134,16 @@ except CBCNetworkError:
 | Variable | Required | Description |
 |---|---|---|
 | `CLOUD_SDK_CBC_URL` | yes | Base URL of the CBC service |
-| `CLOUD_SDK_CBC_CERT_PATH` | prod only | Path to the mTLS client certificate (PEM) |
-| `CLOUD_SDK_CBC_KEY_PATH` | prod only | Path to the mTLS private key (PEM) |
+| `CLOUD_SDK_CBC_CERT_PATH` | prod only | Path to the mTLS client certificate (PEM file) |
+| `CLOUD_SDK_CBC_KEY_PATH` | prod only | Path to the mTLS private key (PEM file) |
+| `CLOUD_SDK_CBC_CERT` | prod only | mTLS client certificate value (PEM string, alternative to `CERT_PATH`) |
+| `CLOUD_SDK_CBC_KEY` | prod only | mTLS private key value (PEM string, alternative to `KEY_PATH`) |
 | `CLOUD_SDK_CBC_REPLACE_SUBDOMAIN` | no | Override subdomain replacement (`true`/`false`). Auto-detected from URL when unset. |
 
 Local mode (loopback URL) requires only `CLOUD_SDK_CBC_URL`.
 
+`CERT_PATH`/`KEY_PATH` (file paths) take precedence over `CERT`/`KEY` (values) when both are set.
+
 ## Using a test double
 
 `CBCClient` is a `Protocol` — implement it directly in tests:

tests/cbc/unit/test_config.py

@@ -5,7 +5,9 @@
 import pytest
 
 from sap_cloud_sdk.cbc.config import (
+    ENV_CERT,
     ENV_CERT_PATH,
+    ENV_KEY,
     ENV_KEY_PATH,
     ENV_URL,
     _read_env_path,
@@ -58,6 +60,24 @@ def test_raises_for_incomplete_triplet(self, monkeypatch, tmp_path):
         with pytest.raises(CBCConfigError, match="incomplete"):
             load_from_env()
 
+    def test_raises_for_incomplete_cert_pem_pair(self, monkeypatch):
+        monkeypatch.setenv(ENV_CERT, "-----BEGIN CERTIFICATE-----")
+        monkeypatch.delenv(ENV_KEY, raising=False)
+        monkeypatch.setenv(ENV_URL, "https://cbc.example.ondemand.com")
+        with pytest.raises(CBCConfigError, match="incomplete"):
+            load_from_env()
+
+    def test_returns_config_with_cert_pem_pair(self, monkeypatch):
+        monkeypatch.setenv(ENV_CERT, "-----BEGIN CERTIFICATE-----")
+        monkeypatch.setenv(ENV_KEY, "-----BEGIN PRIVATE KEY-----")
+        monkeypatch.setenv(ENV_URL, "https://cbc.example.ondemand.com")
+        monkeypatch.delenv(ENV_CERT_PATH, raising=False)
+        monkeypatch.delenv(ENV_KEY_PATH, raising=False)
+        cfg = load_from_env()
+        assert cfg.cert_pem == "-----BEGIN CERTIFICATE-----"
+        assert cfg.key_pem == "-----BEGIN PRIVATE KEY-----"
+        assert cfg.cert_path is None
+
     def test_raises_for_missing_cert_file(self, monkeypatch, tmp_path):
         monkeypatch.setenv(ENV_CERT_PATH, str(tmp_path / "missing.crt"))
         with pytest.raises(CBCConfigError, match="does not exist"):