94 lines
2.7 KiB
Python
94 lines
2.7 KiB
Python
from __future__ import annotations
|
|
|
|
from govoplan_core.core.encryption import (
|
|
ContentProtectionRequest,
|
|
ContentUnprotectionRequest,
|
|
ProtectedContent,
|
|
encryption_content_cipher,
|
|
)
|
|
from govoplan_files.backend.runtime import get_registry
|
|
from govoplan_files.backend.storage.common import FileStorageError
|
|
|
|
|
|
FILES_PROTECTION_PROFILE = "files-server-envelope-v1"
|
|
|
|
|
|
def protect_blob_content(
|
|
session: object,
|
|
*,
|
|
tenant_id: str,
|
|
blob_id: str,
|
|
vault_id: str,
|
|
ciphertext_ref: str,
|
|
plaintext: bytes,
|
|
actor_id: str,
|
|
content_type: str | None,
|
|
) -> ProtectedContent:
|
|
capability = encryption_content_cipher(get_registry())
|
|
if capability is None:
|
|
raise FileStorageError(
|
|
"File encryption was requested, but the Encryption module is unavailable."
|
|
)
|
|
try:
|
|
return capability.protect_content(
|
|
session,
|
|
request=ContentProtectionRequest(
|
|
tenant_id=tenant_id,
|
|
owner_module="files",
|
|
resource_type="file_blob",
|
|
resource_id=blob_id,
|
|
profile_id=FILES_PROTECTION_PROFILE,
|
|
vault_id=vault_id,
|
|
ciphertext_ref=ciphertext_ref,
|
|
plaintext=plaintext,
|
|
policy_decision_ref="files:explicit-vault-selection:v1",
|
|
idempotency_key=f"file-blob:{blob_id}:content:v1",
|
|
actor_id=actor_id,
|
|
metadata={
|
|
"content_type": content_type or "application/octet-stream",
|
|
},
|
|
),
|
|
)
|
|
except Exception as exc:
|
|
raise FileStorageError(
|
|
"Managed file content could not be protected by the configured vault."
|
|
) from exc
|
|
|
|
|
|
def unprotect_blob_content(
|
|
session: object,
|
|
*,
|
|
tenant_id: str,
|
|
blob_id: str,
|
|
envelope_id: str,
|
|
ciphertext: bytes,
|
|
) -> bytes:
|
|
capability = encryption_content_cipher(get_registry())
|
|
if capability is None:
|
|
raise FileStorageError(
|
|
"This file is encrypted and cannot be read while Encryption is unavailable."
|
|
)
|
|
try:
|
|
return capability.unprotect_content(
|
|
session,
|
|
request=ContentUnprotectionRequest(
|
|
tenant_id=tenant_id,
|
|
owner_module="files",
|
|
resource_type="file_blob",
|
|
resource_id=blob_id,
|
|
envelope_id=envelope_id,
|
|
ciphertext=ciphertext,
|
|
),
|
|
)
|
|
except Exception as exc:
|
|
raise FileStorageError(
|
|
"Managed file content could not be opened with its protection envelope."
|
|
) from exc
|
|
|
|
|
|
__all__ = [
|
|
"FILES_PROTECTION_PROFILE",
|
|
"protect_blob_content",
|
|
"unprotect_blob_content",
|
|
]
|