Initial commit: VoIdeaAI - voice-first AI idea assistant

app/services/crypto_service.py

@@ -0,0 +1,77 @@
+"""Encryption service for VoIdea.
+
+Uses Fernet (symmetric AES-128-CBC with HMAC-SHA256).
+Key loaded from ENCRYPTION_KEY env var (must be 32 url-safe base64 bytes).
+"""
+
+import base64
+import os
+
+from cryptography.fernet import Fernet
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+
+from app.core.config import get_settings
+
+
+def _derive_key(secret: str, salt: bytes | None = None) -> tuple[bytes, bytes]:
+    """Derive a Fernet-compatible key from a secret string.
+
+    Args:
+        secret: Raw secret string (any length)
+        salt: Optional salt bytes (generated if None)
+
+    Returns:
+        Tuple of (key, salt) where key is 32 url-safe base64 bytes
+    """
+    if salt is None:
+        salt = os.urandom(16)
+    kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=600_000)
+    key = base64.urlsafe_b64encode(kdf.derive(secret.encode()))
+    return key, salt
+
+
+def get_fernet() -> Fernet | None:
+    """Get Fernet instance from ENCRYPTION_KEY or generate ephemeral.
+
+    Returns:
+        Fernet instance or None if no key configured
+    """
+    settings = get_settings()
+    if not settings.encryption_key:
+        return None
+    key, _ = _derive_key(settings.encryption_key)
+    return Fernet(key)
+
+
+def encrypt(text: str) -> str | None:
+    """Encrypt a string.
+
+    Args:
+        text: Plain text to encrypt
+
+    Returns:
+        Encrypted text (base64 string) or None if encryption not configured
+    """
+    f = get_fernet()
+    if f is None:
+        return None
+    return f.encrypt(text.encode()).decode()
+
+
+def decrypt(token: str) -> str | None:
+    """Decrypt a string.
+
+    Args:
+        token: Encrypted text (base64 string)
+
+    Returns:
+        Decrypted plain text or None if decryption fails
+    """
+    f = get_fernet()
+    if f is None:
+        return None
+    try:
+        return f.decrypt(token.encode()).decode()
+    except Exception:
+        return None