78 lines
1.9 KiB
Python
78 lines
1.9 KiB
Python
"""Encryption service for VoIdea.
|
|
|
|
Uses Fernet (symmetric AES-128-CBC with HMAC-SHA256).
|
|
Key loaded from ENCRYPTION_KEY env var (must be 32 url-safe base64 bytes).
|
|
"""
|
|
|
|
import base64
|
|
import os
|
|
|
|
from cryptography.fernet import Fernet
|
|
from cryptography.hazmat.primitives import hashes
|
|
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
|
|
|
|
from app.core.config import get_settings
|
|
|
|
|
|
def _derive_key(secret: str, salt: bytes | None = None) -> tuple[bytes, bytes]:
|
|
"""Derive a Fernet-compatible key from a secret string.
|
|
|
|
Args:
|
|
secret: Raw secret string (any length)
|
|
salt: Optional salt bytes (generated if None)
|
|
|
|
Returns:
|
|
Tuple of (key, salt) where key is 32 url-safe base64 bytes
|
|
"""
|
|
if salt is None:
|
|
salt = os.urandom(16)
|
|
kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=600_000)
|
|
key = base64.urlsafe_b64encode(kdf.derive(secret.encode()))
|
|
return key, salt
|
|
|
|
|
|
def get_fernet() -> Fernet | None:
|
|
"""Get Fernet instance from ENCRYPTION_KEY or generate ephemeral.
|
|
|
|
Returns:
|
|
Fernet instance or None if no key configured
|
|
"""
|
|
settings = get_settings()
|
|
if not settings.encryption_key:
|
|
return None
|
|
key, _ = _derive_key(settings.encryption_key)
|
|
return Fernet(key)
|
|
|
|
|
|
def encrypt(text: str) -> str | None:
|
|
"""Encrypt a string.
|
|
|
|
Args:
|
|
text: Plain text to encrypt
|
|
|
|
Returns:
|
|
Encrypted text (base64 string) or None if encryption not configured
|
|
"""
|
|
f = get_fernet()
|
|
if f is None:
|
|
return None
|
|
return f.encrypt(text.encode()).decode()
|
|
|
|
|
|
def decrypt(token: str) -> str | None:
|
|
"""Decrypt a string.
|
|
|
|
Args:
|
|
token: Encrypted text (base64 string)
|
|
|
|
Returns:
|
|
Decrypted plain text or None if decryption fails
|
|
"""
|
|
f = get_fernet()
|
|
if f is None:
|
|
return None
|
|
try:
|
|
return f.decrypt(token.encode()).decode()
|
|
except Exception:
|
|
return None
|