Spaces:
Sleeping
Sleeping
| """ | |
| Prototype-only stand-in for ADR-0002's GCP KMS envelope encryption. No GCP project is | |
| provisioned yet (see docs/blueprint/blueprint.md), so mailbox credentials and contact PII | |
| are encrypted at rest here using a single symmetric Fernet key from CREDENTIAL_ENCRYPTION_KEY | |
| (.env) instead of KMS-wrapped per-record data keys. | |
| This is a real, working encryption layer — not a no-op — but it is NOT the security posture | |
| ADR-0002 commits to for production: one key, no envelope, no separate audit-logged access | |
| control. Every function here is the seam that gets replaced (same call signatures) once a | |
| GCP project with KMS exists. | |
| """ | |
| from __future__ import annotations | |
| import os | |
| from cryptography.fernet import Fernet | |
| _key = os.getenv("CREDENTIAL_ENCRYPTION_KEY") | |
| if not _key: | |
| # Auto-generated per-process when unset, matching the prior build's local-dev fallback. | |
| # Encrypted values won't survive a process restart with a fresh key — fine for tests | |
| # and throwaway local runs, NOT fine for anything meant to persist. Set | |
| # CREDENTIAL_ENCRYPTION_KEY in .env for a stable local key across restarts. | |
| _key = Fernet.generate_key().decode() | |
| _fernet = Fernet(_key.encode() if isinstance(_key, str) else _key) | |
| def encrypt(plaintext: str) -> str: | |
| return _fernet.encrypt(plaintext.encode()).decode() | |
| def decrypt(token: str) -> str: | |
| return _fernet.decrypt(token.encode()).decode() | |