apify 2.6.1b7__tar.gz → 2.6.1b8__tar.gz

{apify-2.6.1b7 → apify-2.6.1b8}/CHANGELOG.md

@@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file.
 ### 🚀 Features
 
 - Expose `logger` argument on `Actor.call` to control log redirection from started Actor run ([#487](https://github.com/apify/apify-sdk-python/pull/487)) ([aa6fa47](https://github.com/apify/apify-sdk-python/commit/aa6fa4750ea1bc7909be1191c0d276a2046930c2)) by [@Pijukatel](https://github.com/Pijukatel)
+- **crypto:** Decrypt secret objects ([#482](https://github.com/apify/apify-sdk-python/pull/482)) ([ce9daf7](https://github.com/apify/apify-sdk-python/commit/ce9daf7381212b8dc194e8a643e5ca0dedbc0078)) by [@MFori](https://github.com/MFori)
 
 
 <!-- git-cliff-unreleased-end -->

{apify-2.6.1b7 → apify-2.6.1b8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apify
-Version: 2.6.1b7
+Version: 2.6.1b8
 Summary: Apify SDK for Python
 Project-URL: Apify Homepage, https://apify.com
 Project-URL: Changelog, https://docs.apify.com/sdk/python/docs/changelog

{apify-2.6.1b7 → apify-2.6.1b8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "apify"
-version = "2.6.1b7"
+version = "2.6.1b8"
 description = "Apify SDK for Python"
 authors = [{ name = "Apify Technologies s.r.o.", email = "support@apify.com" }]
 license = { file = "LICENSE" }

apify-2.6.1b8/src/apify/_consts.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+import re
+from datetime import timedelta
+
+EVENT_LISTENERS_TIMEOUT = timedelta(seconds=5)
+
+BASE64_REGEXP = '[-A-Za-z0-9+/]*={0,3}'
+ENCRYPTED_STRING_VALUE_PREFIX = 'ENCRYPTED_VALUE'
+ENCRYPTED_JSON_VALUE_PREFIX = 'ENCRYPTED_JSON'
+ENCRYPTED_INPUT_VALUE_REGEXP = re.compile(
+    f'^({ENCRYPTED_STRING_VALUE_PREFIX}|{ENCRYPTED_JSON_VALUE_PREFIX}):(?:({BASE64_REGEXP}):)?({BASE64_REGEXP}):({BASE64_REGEXP})$'
+)

{apify-2.6.1b7 → apify-2.6.1b8}/src/apify/_crypto.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import base64
 import hashlib
 import hmac
+import json
 import string
 from typing import Any
 
@@ -14,7 +15,7 @@ from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
 from apify_shared.utils import ignore_docs
 from crawlee._utils.crypto import crypto_random_object_id
 
-from apify._consts import ENCRYPTED_INPUT_VALUE_REGEXP
+from apify._consts import ENCRYPTED_INPUT_VALUE_REGEXP, ENCRYPTED_JSON_VALUE_PREFIX, ENCRYPTED_STRING_VALUE_PREFIX
 
 ENCRYPTION_KEY_LENGTH = 32
 ENCRYPTION_IV_LENGTH = 16
@@ -147,14 +148,20 @@ def decrypt_input_secrets(private_key: rsa.RSAPrivateKey, input_data: Any) -> An
         if isinstance(value, str):
             match = ENCRYPTED_INPUT_VALUE_REGEXP.fullmatch(value)
             if match:
-                encrypted_password = match.group(1)
-                encrypted_value = match.group(2)
-                input_data[key] = private_decrypt(
+                prefix = match.group(1)
+                encrypted_password = match.group(3)
+                encrypted_value = match.group(4)
+                decrypted_value = private_decrypt(
                     encrypted_password,
                     encrypted_value,
                     private_key=private_key,
                 )
 
+                if prefix == ENCRYPTED_STRING_VALUE_PREFIX:
+                    input_data[key] = decrypted_value
+                elif prefix == ENCRYPTED_JSON_VALUE_PREFIX:
+                    input_data[key] = json.loads(decrypted_value)
+
     return input_data
 
 

{apify-2.6.1b7 → apify-2.6.1b8}/tests/unit/actor/test_actor_key_value_store.py

@@ -9,7 +9,7 @@ from apify_shared.utils import json_dumps
 
 from ..test_crypto import PRIVATE_KEY_PASSWORD, PRIVATE_KEY_PEM_BASE64, PUBLIC_KEY
 from apify import Actor
-from apify._consts import ENCRYPTED_INPUT_VALUE_PREFIX
+from apify._consts import ENCRYPTED_JSON_VALUE_PREFIX, ENCRYPTED_STRING_VALUE_PREFIX
 from apify._crypto import public_encrypt
 
 if TYPE_CHECKING:
@@ -74,11 +74,42 @@ async def test_get_input_with_encrypted_secrets(
     monkeypatch.setenv(ApifyEnvVars.INPUT_SECRETS_PRIVATE_KEY_PASSPHRASE, PRIVATE_KEY_PASSWORD)
 
     input_key = 'INPUT'
+    secret_string_legacy = 'secret-string'
     secret_string = 'secret-string'
-    encrypted_secret = public_encrypt(secret_string, public_key=PUBLIC_KEY)
+    secret_object = {'foo': 'bar', 'baz': 'qux'}
+    secret_array = ['foo', 'bar', 'baz']
+
+    # The legacy encryption format uses ENCRYPTED_STRING_VALUE_PREFIX prefix, value in raw string and does
+    # not include schemahash. The new format uses ENCRYPTED_JSON_VALUE_PREFIX prefix, value in JSON format
+    # and includes schemahash. We are testing both formats to ensure backward compatibility.
+
+    encrypted_string_legacy = public_encrypt(secret_string_legacy, public_key=PUBLIC_KEY)
+    encrypted_string = public_encrypt(json_dumps(secret_string), public_key=PUBLIC_KEY)
+    encrypted_object = public_encrypt(json_dumps(secret_object), public_key=PUBLIC_KEY)
+    encrypted_array = public_encrypt(json_dumps(secret_array), public_key=PUBLIC_KEY)
+
     input_with_secret = {
         'foo': 'bar',
-        'secret': f'{ENCRYPTED_INPUT_VALUE_PREFIX}:{encrypted_secret["encrypted_password"]}:{encrypted_secret["encrypted_value"]}',  # noqa: E501
+        'secret_string_legacy': (
+            f'{ENCRYPTED_STRING_VALUE_PREFIX}:'
+            f'{encrypted_string_legacy["encrypted_password"]}:'
+            f'{encrypted_string_legacy["encrypted_value"]}'
+        ),
+        'secret_string': (
+            f'{ENCRYPTED_JSON_VALUE_PREFIX}:schemahash:'
+            f'{encrypted_string["encrypted_password"]}:'
+            f'{encrypted_string["encrypted_value"]}'
+        ),
+        'secret_object': (
+            f'{ENCRYPTED_JSON_VALUE_PREFIX}:schemahash:'
+            f'{encrypted_object["encrypted_password"]}:'
+            f'{encrypted_object["encrypted_value"]}'
+        ),
+        'secret_array': (
+            f'{ENCRYPTED_JSON_VALUE_PREFIX}:schemahash:'
+            f'{encrypted_array["encrypted_password"]}:'
+            f'{encrypted_array["encrypted_value"]}'
+        ),
     }
 
     await memory_storage_client.key_value_stores().get_or_create(id='default')
@@ -91,4 +122,7 @@ async def test_get_input_with_encrypted_secrets(
     async with Actor as my_actor:
         input = await my_actor.get_input()  # noqa: A001
         assert input['foo'] == input_with_secret['foo']
-        assert input['secret'] == secret_string
+        assert input['secret_string_legacy'] == secret_string_legacy
+        assert input['secret_string'] == secret_string
+        assert input['secret_object'] == secret_object
+        assert input['secret_array'] == secret_array

apify-2.6.1b7/src/apify/_consts.py

@@ -1,10 +0,0 @@
-from __future__ import annotations
-
-import re
-from datetime import timedelta
-
-EVENT_LISTENERS_TIMEOUT = timedelta(seconds=5)
-
-BASE64_REGEXP = '[-A-Za-z0-9+/]*={0,3}'
-ENCRYPTED_INPUT_VALUE_PREFIX = 'ENCRYPTED_VALUE'
-ENCRYPTED_INPUT_VALUE_REGEXP = re.compile(f'^{ENCRYPTED_INPUT_VALUE_PREFIX}:({BASE64_REGEXP}):({BASE64_REGEXP})$')