Files
govoplan-files/src/govoplan_files/backend/storage/content_protection.py
T

94 lines
2.7 KiB
Python

from __future__ import annotations
from govoplan_core.core.encryption import (
ContentProtectionRequest,
ContentUnprotectionRequest,
ProtectedContent,
encryption_content_cipher,
)
from govoplan_files.backend.runtime import get_registry
from govoplan_files.backend.storage.common import FileStorageError
FILES_PROTECTION_PROFILE = "files-server-envelope-v1"
def protect_blob_content(
session: object,
*,
tenant_id: str,
blob_id: str,
vault_id: str,
ciphertext_ref: str,
plaintext: bytes,
actor_id: str,
content_type: str | None,
) -> ProtectedContent:
capability = encryption_content_cipher(get_registry())
if capability is None:
raise FileStorageError(
"File encryption was requested, but the Encryption module is unavailable."
)
try:
return capability.protect_content(
session,
request=ContentProtectionRequest(
tenant_id=tenant_id,
owner_module="files",
resource_type="file_blob",
resource_id=blob_id,
profile_id=FILES_PROTECTION_PROFILE,
vault_id=vault_id,
ciphertext_ref=ciphertext_ref,
plaintext=plaintext,
policy_decision_ref="files:explicit-vault-selection:v1",
idempotency_key=f"file-blob:{blob_id}:content:v1",
actor_id=actor_id,
metadata={
"content_type": content_type or "application/octet-stream",
},
),
)
except Exception as exc:
raise FileStorageError(
"Managed file content could not be protected by the configured vault."
) from exc
def unprotect_blob_content(
session: object,
*,
tenant_id: str,
blob_id: str,
envelope_id: str,
ciphertext: bytes,
) -> bytes:
capability = encryption_content_cipher(get_registry())
if capability is None:
raise FileStorageError(
"This file is encrypted and cannot be read while Encryption is unavailable."
)
try:
return capability.unprotect_content(
session,
request=ContentUnprotectionRequest(
tenant_id=tenant_id,
owner_module="files",
resource_type="file_blob",
resource_id=blob_id,
envelope_id=envelope_id,
ciphertext=ciphertext,
),
)
except Exception as exc:
raise FileStorageError(
"Managed file content could not be opened with its protection envelope."
) from exc
__all__ = [
"FILES_PROTECTION_PROFILE",
"protect_blob_content",
"unprotect_blob_content",
]