37 lines
1.0 KiB
Python
37 lines
1.0 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""Fernet 加密 / 解密的薄封装。
|
|
|
|
不暴露 Fernet 对象；调用方只看 encrypt/decrypt 字符串。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from cryptography.fernet import Fernet, InvalidToken
|
|
|
|
from service.master_key import load_master_key
|
|
from service.secret_store import mask_secret
|
|
|
|
|
|
class CredentialDecryptError(Exception):
|
|
"""Decryption failed (bad key or corrupted ciphertext)."""
|
|
|
|
code = "ERR_CREDENTIAL_DECRYPT_FAILED"
|
|
|
|
|
|
def encrypt_secret(plaintext: str) -> str:
|
|
"""Encrypt using current master key; returns url-safe token string."""
|
|
key = load_master_key()
|
|
f = Fernet(key)
|
|
tok = f.encrypt(plaintext.encode("utf-8"))
|
|
return tok.decode("ascii")
|
|
|
|
|
|
def decrypt_secret(ciphertext: str) -> str:
|
|
"""Decrypt Fernet token string to plaintext."""
|
|
key = load_master_key()
|
|
f = Fernet(key)
|
|
try:
|
|
raw = f.decrypt(ciphertext.encode("ascii"))
|
|
return raw.decode("utf-8")
|
|
except InvalidToken as e:
|
|
raise CredentialDecryptError("Fernet decrypt failed") from e
|