GovOPlaN/govoplan-files
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: support optional encrypted file content

Browse Source
This commit is contained in:
zemion
2026-08-02 03:40:54 +02:00
parent 233ce40983
commit 359c4e9570
11 changed files with 478 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/govoplan_files/backend/storage/archives.py
+6
View File
@@ -185,6 +185,7 @@ def extract_archive_upload(
conflict_resolutions: Iterable[FileConflictResolution] | None = None,
metadata: dict[str, Any] | None = None,
is_admin: bool = False,
encryption_vault_id: str | None = None,
max_entries: int = ARCHIVE_UPLOAD_MAX_ENTRIES,
max_file_bytes: int = 50 * 1024 * 1024,
max_expanded_bytes: int = 2 * 1024 * 1024 * 1024,
@@ -235,6 +236,7 @@ def extract_archive_upload(
conflict_resolutions=conflict_resolutions,
metadata=metadata,
is_admin=is_admin,
encryption_vault_id=encryption_vault_id,
)
@@ -252,6 +254,7 @@ def extract_zip_upload(
conflict_resolutions: Iterable[FileConflictResolution] | None = None,
metadata: dict[str, Any] | None = None,
is_admin: bool = False,
encryption_vault_id: str | None = None,
max_files: int = ZIP_UPLOAD_MAX_FILES,
max_file_bytes: int = 50 * 1024 * 1024,
max_total_bytes: int = 250 * 1024 * 1024,
@@ -272,6 +275,7 @@ def extract_zip_upload(
conflict_resolutions=conflict_resolutions,
metadata=metadata,
is_admin=is_admin,
encryption_vault_id=encryption_vault_id,
max_entries=max_files,
max_file_bytes=max_file_bytes,
max_expanded_bytes=max_total_bytes,
@@ -584,6 +588,7 @@ def _store_archive_members(
conflict_resolutions: Iterable[FileConflictResolution] | None,
metadata: dict[str, Any] | None,
is_admin: bool,
encryption_vault_id: str | None,
) -> list[UploadedStoredFile]:
uploaded: list[UploadedStoredFile] = []
base_folder = normalize_folder(folder)
@@ -608,6 +613,7 @@ def _store_archive_members(
conflict_strategy=conflict_strategy,
conflict_resolutions=conflict_resolutions,
is_admin=is_admin,
encryption_vault_id=encryption_vault_id,
)
)
return uploaded
src/govoplan_files/backend/storage/content_protection.py
+93
View File
@@ -0,0 +1,93 @@
from __future__ import annotations
from govoplan_core.core.encryption import (
ContentProtectionRequest,
ContentUnprotectionRequest,
ProtectedContent,
encryption_content_cipher,
)
from govoplan_files.backend.runtime import get_registry
from govoplan_files.backend.storage.common import FileStorageError
FILES_PROTECTION_PROFILE = "files-server-envelope-v1"
def protect_blob_content(
session: object,
*,
tenant_id: str,
blob_id: str,
vault_id: str,
ciphertext_ref: str,
plaintext: bytes,
actor_id: str,
content_type: str | None,
) -> ProtectedContent:
capability = encryption_content_cipher(get_registry())
if capability is None:
raise FileStorageError(
"File encryption was requested, but the Encryption module is unavailable."
)
try:
return capability.protect_content(
session,
request=ContentProtectionRequest(
tenant_id=tenant_id,
owner_module="files",
resource_type="file_blob",
resource_id=blob_id,
profile_id=FILES_PROTECTION_PROFILE,
vault_id=vault_id,
ciphertext_ref=ciphertext_ref,
plaintext=plaintext,
policy_decision_ref="files:explicit-vault-selection:v1",
idempotency_key=f"file-blob:{blob_id}:content:v1",
actor_id=actor_id,
metadata={
"content_type": content_type or "application/octet-stream",
},
),
)
except Exception as exc:
raise FileStorageError(
"Managed file content could not be protected by the configured vault."
) from exc
def unprotect_blob_content(
session: object,
*,
tenant_id: str,
blob_id: str,
envelope_id: str,
ciphertext: bytes,
) -> bytes:
capability = encryption_content_cipher(get_registry())
if capability is None:
raise FileStorageError(
"This file is encrypted and cannot be read while Encryption is unavailable."
)
try:
return capability.unprotect_content(
session,
request=ContentUnprotectionRequest(
tenant_id=tenant_id,
owner_module="files",
resource_type="file_blob",
resource_id=blob_id,
envelope_id=envelope_id,
ciphertext=ciphertext,
),
)
except Exception as exc:
raise FileStorageError(
"Managed file content could not be opened with its protection envelope."
) from exc
__all__ = [
"FILES_PROTECTION_PROFILE",
"protect_blob_content",
"unprotect_blob_content",
]
src/govoplan_files/backend/storage/files.py
+68 -6
View File
@@ -72,12 +72,16 @@ def _get_or_create_blob(
data: bytes,
filename: str,
content_type: str | None,
actor_id: str,
encryption_vault_id: str | None = None,
) -> FileBlob:
checksum = hashlib.sha256(data).hexdigest()
size = len(data)
vault_id = str(encryption_vault_id or "").strip() or None
protection_discriminator = f"vault:{vault_id}" if vault_id else "plaintext"
blob = (
session.query(FileBlob)
.filter(FileBlob.tenant_id == tenant_id, FileBlob.checksum_sha256 == checksum, FileBlob.size_bytes == size)
.filter(FileBlob.tenant_id == tenant_id, FileBlob.checksum_sha256 == checksum, FileBlob.size_bytes == size, FileBlob.protection_discriminator == protection_discriminator)
.one_or_none()
)
if blob:
@@ -93,8 +97,28 @@ def _get_or_create_blob(
except StorageBackendError as exc:
raise FileStorageError(str(exc)) from exc
if repair_required:
stored_data = data
if vault_id:
from govoplan_files.backend.storage.content_protection import protect_blob_content
protected = protect_blob_content(
session,
tenant_id=tenant_id,
blob_id=blob.id,
vault_id=vault_id,
ciphertext_ref=blob.storage_key,
plaintext=data,
actor_id=actor_id,
content_type=content_type,
)
if blob.encryption_envelope_id not in {None, protected.envelope.envelope_id}:
raise FileStorageError("The existing encrypted blob has another protection envelope.")
stored_data = protected.ciphertext
blob.encryption_envelope_id = protected.envelope.envelope_id
blob.storage_checksum_sha256 = hashlib.sha256(stored_data).hexdigest()
blob.storage_size_bytes = len(stored_data)
try:
backend.put_bytes(blob.storage_key, data, content_type=content_type)
backend.put_bytes(blob.storage_key, stored_data, content_type="application/octet-stream" if vault_id else content_type)
except StorageBackendError as exc:
raise FileStorageError(str(exc)) from exc
blob.integrity_status = "verified"
@@ -105,19 +129,42 @@ def _get_or_create_blob(
session.add(blob)
return blob
blob_id = str(uuid4())
storage_key = _storage_key(tenant_id=tenant_id, checksum=checksum, filename=filename)
stored_data = data
envelope_id = None
if vault_id:
from govoplan_files.backend.storage.content_protection import protect_blob_content
protected = protect_blob_content(
session,
tenant_id=tenant_id,
blob_id=blob_id,
vault_id=vault_id,
ciphertext_ref=storage_key,
plaintext=data,
actor_id=actor_id,
content_type=content_type,
)
stored_data = protected.ciphertext
envelope_id = protected.envelope.envelope_id
backend = get_storage_backend()
try:
backend.put_bytes(storage_key, data, content_type=content_type)
backend.put_bytes(storage_key, stored_data, content_type="application/octet-stream" if vault_id else content_type)
except StorageBackendError as exc:
raise FileStorageError(str(exc)) from exc
blob = FileBlob(
id=blob_id,
tenant_id=tenant_id,
storage_backend=_storage_backend_name(),
storage_bucket=_storage_bucket_name(),
storage_key=storage_key,
checksum_sha256=checksum,
size_bytes=size,
protection_discriminator=protection_discriminator,
encryption_envelope_id=envelope_id,
storage_checksum_sha256=hashlib.sha256(stored_data).hexdigest() if vault_id else None,
storage_size_bytes=len(stored_data) if vault_id else None,
content_type=content_type,
ref_count=1,
integrity_status="verified",
@@ -146,6 +193,7 @@ def create_file_asset(
conflict_strategy: str = "reject",
conflict_resolutions: Iterable[FileConflictResolution] | None = None,
is_admin: bool = False,
encryption_vault_id: str | None = None,
) -> UploadedStoredFile:
owner_type = owner_type.lower().strip()
ensure_owner_access(session, tenant_id=tenant_id, owner_type=owner_type, owner_id=owner_id, user_id=user_id, is_admin=is_admin)
@@ -173,7 +221,7 @@ def create_file_asset(
elif action == "rename":
logical_path = _next_available_logical_path(session, tenant_id=tenant_id, owner_type=owner_type, owner_id=owner_id, desired_path=logical_path)
blob = _get_or_create_blob(session, tenant_id=tenant_id, data=data, filename=safe_filename, content_type=content_type)
blob = _get_or_create_blob(session, tenant_id=tenant_id, data=data, filename=safe_filename, content_type=content_type, actor_id=user_id, encryption_vault_id=encryption_vault_id)
asset = FileAsset(
tenant_id=tenant_id,
owner_type=owner_type,
@@ -305,6 +353,7 @@ def update_file_asset_content(
data: bytes,
content_type: str | None,
metadata: dict[str, Any],
encryption_vault_id: str | None = None,
) -> tuple[UploadedStoredFile, str]:
if asset.tenant_id != tenant_id or asset.deleted_at is not None:
raise FileStorageError("File not found")
@@ -315,10 +364,23 @@ def update_file_asset_content(
checksum = hashlib.sha256(data).hexdigest()
asset.metadata_ = metadata
session.add(asset)
if current_blob.checksum_sha256 == checksum and current_blob.size_bytes == len(data):
inherited_vault_id = encryption_vault_id
if inherited_vault_id is None and current_blob.encryption_envelope_id:
prefix = "vault:"
if current_blob.protection_discriminator.startswith(prefix):
inherited_vault_id = current_blob.protection_discriminator[len(prefix) :]
inherited_vault_id = str(inherited_vault_id or "").strip() or None
target_protection = (
f"vault:{inherited_vault_id}" if inherited_vault_id else "plaintext"
)
if (
current_blob.checksum_sha256 == checksum
and current_blob.size_bytes == len(data)
and current_blob.protection_discriminator == target_protection
):
return UploadedStoredFile(asset=asset, version=current_version, blob=current_blob), "unchanged"
blob = _get_or_create_blob(session, tenant_id=tenant_id, data=data, filename=safe_filename, content_type=content_type)
blob = _get_or_create_blob(session, tenant_id=tenant_id, data=data, filename=safe_filename, content_type=content_type, actor_id=user_id, encryption_vault_id=inherited_vault_id)
version = FileVersion(
tenant_id=tenant_id,
file_asset_id=asset.id,
src/govoplan_files/backend/storage/integrity.py
+29 -8
View File
@@ -3,7 +3,7 @@ from __future__ import annotations
import hashlib
from dataclasses import dataclass
from sqlalchemy.orm import Session
from sqlalchemy.orm import Session, object_session
from govoplan_files.backend.db.models import (
FileBlob,
@@ -115,11 +115,13 @@ def inspect_blob(
backend: StorageBackend,
verify_checksum: bool = True,
) -> BlobInspection:
expected_size = blob.storage_size_bytes if blob.storage_size_bytes is not None else blob.size_bytes
expected_checksum = blob.storage_checksum_sha256 if blob.storage_checksum_sha256 is not None else blob.checksum_sha256
try:
info = backend.stat(blob.storage_key)
except StorageObjectMissing:
return BlobInspection(valid=False, kind="missing")
if info.size_bytes != blob.size_bytes:
if info.size_bytes != expected_size:
return BlobInspection(
valid=False,
kind="size_mismatch",
@@ -137,14 +139,14 @@ def inspect_blob(
observed_size += len(chunk)
digest.update(chunk)
observed_checksum = digest.hexdigest()
if observed_size != blob.size_bytes:
if observed_size != expected_size:
return BlobInspection(
valid=False,
kind="size_mismatch",
observed_size_bytes=observed_size,
observed_checksum_sha256=observed_checksum,
)
if observed_checksum != blob.checksum_sha256:
if observed_checksum != expected_checksum:
return BlobInspection(
valid=False,
kind="checksum_mismatch",
@@ -196,14 +198,33 @@ def read_verified_blob_bytes(
data = backend.get_bytes(blob.storage_key)
except StorageBackendError as exc:
raise FileStorageError("Managed file content is not available") from exc
if len(data) != blob.size_bytes:
expected_storage_size = blob.storage_size_bytes if blob.storage_size_bytes is not None else blob.size_bytes
expected_storage_checksum = blob.storage_checksum_sha256 if blob.storage_checksum_sha256 is not None else blob.checksum_sha256
if len(data) != expected_storage_size:
raise FileStorageError(
"Managed file content failed its recorded size verification"
)
if hashlib.sha256(data).hexdigest() != blob.checksum_sha256:
if hashlib.sha256(data).hexdigest() != expected_storage_checksum:
raise FileStorageError(
"Managed file content failed its recorded checksum verification"
)
if blob.encryption_envelope_id:
session = object_session(blob)
if session is None:
raise FileStorageError("Encrypted managed content requires an attached database session")
from govoplan_files.backend.storage.content_protection import unprotect_blob_content
data = unprotect_blob_content(
session,
tenant_id=blob.tenant_id,
blob_id=blob.id,
envelope_id=blob.encryption_envelope_id,
ciphertext=data,
)
if len(data) != blob.size_bytes:
raise FileStorageError("Decrypted managed file content failed its recorded size verification")
if hashlib.sha256(data).hexdigest() != blob.checksum_sha256:
raise FileStorageError("Decrypted managed file content failed its recorded checksum verification")
return data
@@ -432,8 +453,8 @@ def _record_blob_finding(
kind=inspection.kind,
blob_id=blob.id,
storage_key=blob.storage_key,
expected_size_bytes=blob.size_bytes,
expected_checksum_sha256=blob.checksum_sha256,
expected_size_bytes=blob.storage_size_bytes if blob.storage_size_bytes is not None else blob.size_bytes,
expected_checksum_sha256=blob.storage_checksum_sha256 if blob.storage_checksum_sha256 is not None else blob.checksum_sha256,
)
_update_finding_from_inspection(finding, inspection)
session.add(finding)