25 lines
612 B
Python
25 lines
612 B
Python
|
"""Symmetric encryption for secrets at rest (OAuth tokens, partner API keys).
|
||
|
|
|
||
|
|
Key is derived from GOGO_SECRET_KEY; rotate by re-encrypting after a key change.
|
||
|
|
"""
|
||
|
|
|
||
|
|
import base64
|
||
|
|
import hashlib
|
||
|
|
|
||
|
|
from cryptography.fernet import Fernet
|
||
|
|
|
||
|
|
from gogo.config import get_settings
|
||
|
|
|
||
|
|
|
||
|
|
def _fernet() -> Fernet:
|
||
|
|
key = hashlib.sha256(get_settings().secret_key.encode()).digest()
|
||
|
|
return Fernet(base64.urlsafe_b64encode(key))
|
||
|
|
|
||
|
|
|
||
|
|
def encrypt(plaintext: str) -> str:
|
||
|
|
return _fernet().encrypt(plaintext.encode()).decode()
|
||
|
|
|
||
|
|
|
||
|
|
def decrypt(ciphertext: str) -> str:
|
||
|
|
return _fernet().decrypt(ciphertext.encode()).decode()
|