22 lines
856 B
Python
22 lines
856 B
Python
 
|
"""Secret encryption exposed to plugins (SPEC §10.2 vault).
|
||
|
|
|
||
|
|
Heavy plugins (calendar/contacts) store third-party credentials — CalDAV/CardDAV
|
||
|
|
passwords, ICS tokens — in their own ``secret_ct bytea`` columns. They encrypt via
|
||
|
|
this facade so those secrets are protected at rest with the same envelope scheme as
|
||
|
|
core account credentials, without importing ``app.security`` directly.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
from app.security.crypto import decrypt_secret, encrypt_secret
|
||
|
|
|
||
|
|
|
||
|
|
class PluginVault:
|
||
|
|
def encrypt(self, plaintext: bytes) -> bytes:
|
||
|
|
"""Envelope-encrypt ``plaintext`` for storage in a ``secret_ct`` column."""
|
||
|
|
return encrypt_secret(plaintext)
|
||
|
|
|
||
|
|
def decrypt(self, ciphertext: bytes) -> bytes:
|
||
|
|
"""Reverse :meth:`encrypt`. Raises on a wrong/rotated master key."""
|
||
|
|
return decrypt_secret(ciphertext)
|