fdc-shared-kernel 0.0.184__tar.gz → 0.0.185__tar.gz

{fdc_shared_kernel-0.0.184 → fdc_shared_kernel-0.0.185}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fdc_shared_kernel
-Version: 0.0.184
+Version: 0.0.185
 Summary: Shared library for microservice
 Author-email: Shikhil S <shikhil.s@dbizsolution.com>, Ahammed Akdham N <ahammedakdham.n@dbizsolution.com>
 Classifier: Programming Language :: Python :: 3

{fdc_shared_kernel-0.0.184 → fdc_shared_kernel-0.0.185}/fdc_shared_kernel.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fdc_shared_kernel
-Version: 0.0.184
+Version: 0.0.185
 Summary: Shared library for microservice
 Author-email: Shikhil S <shikhil.s@dbizsolution.com>, Ahammed Akdham N <ahammedakdham.n@dbizsolution.com>
 Classifier: Programming Language :: Python :: 3

{fdc_shared_kernel-0.0.184 → fdc_shared_kernel-0.0.185}/fdc_shared_kernel.egg-info/SOURCES.txt

@@ -113,6 +113,7 @@ shared_kernel/interfaces/__init__.py
 shared_kernel/interfaces/base_job_handler.py
 shared_kernel/interfaces/data_warehouse_handler.py
 shared_kernel/interfaces/databus.py
+shared_kernel/interfaces/encryption.py
 shared_kernel/interfaces/http.py
 shared_kernel/interfaces/keyvault.py
 shared_kernel/interfaces/query_executor.py
@@ -148,6 +149,9 @@ shared_kernel/schema_onboarding_tracker/task_manager.py
 shared_kernel/schema_onboarding_tracker/template_manager.py
 shared_kernel/schema_onboarding_tracker/utility_manager.py
 shared_kernel/security/__init__.py
+shared_kernel/security/encryption/__init__.py
+shared_kernel/security/encryption/manager.py
+shared_kernel/security/encryption/providers.py
 shared_kernel/security/key_vault/__init__.py
 shared_kernel/security/key_vault/aws_secret_manager.py
 shared_kernel/security/key_vault/azure_keyvault.py
@@ -165,6 +169,7 @@ shared_kernel/tests/messaging/__init__.py
 shared_kernel/tests/messaging/test_aws_databus.py
 shared_kernel/tests/messaging/test_event_executor.py
 shared_kernel/tests/messaging/test_nats_interface.py
+shared_kernel/tests/security/test_encryption.py
 shared_kernel/tests/utils/__init__.py
 shared_kernel/tests/utils/test_data_validators.py
 shared_kernel/tests/utils/test_date_format_utils.py

{fdc_shared_kernel-0.0.184 → fdc_shared_kernel-0.0.185}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fdc_shared_kernel"
-version = "0.0.184"
+version = "0.0.185"
 requires-python = ">=3.7"
 readme = "README_pypi.md"
 description = "Shared library for microservice"

{fdc_shared_kernel-0.0.184 → fdc_shared_kernel-0.0.185}/shared_kernel/interfaces/__init__.py

@@ -2,3 +2,4 @@ from shared_kernel.interfaces.databus import *
 from shared_kernel.interfaces.data_warehouse_handler import *
 from shared_kernel.interfaces.keyvault import *
 from shared_kernel.interfaces.http import *
+from shared_kernel.interfaces.encryption import *

fdc_shared_kernel-0.0.185/shared_kernel/interfaces/encryption.py

@@ -0,0 +1,33 @@
+from abc import ABC, abstractmethod
+
+
+class EncryptionProviderInterface(ABC):
+    """
+    Abstract interface for encryption/decryption providers.
+    """
+
+    @abstractmethod
+    def encrypt(self, plaintext: str) -> str:
+        """
+        Encrypts the plaintext string and returns the base64-encoded ciphertext.
+
+        Args:
+            plaintext (str): The plaintext string to encrypt.
+
+        Returns:
+            str: The base64-encoded ciphertext string.
+        """
+        pass
+
+    @abstractmethod
+    def decrypt(self, ciphertext: str) -> str:
+        """
+        Decrypts the base64-encoded ciphertext and returns the plaintext string.
+
+        Args:
+            ciphertext (str): The base64-encoded ciphertext string.
+
+        Returns:
+            str: The decrypted plaintext string.
+        """
+        pass

fdc_shared_kernel-0.0.185/shared_kernel/security/__init__.py

@@ -0,0 +1,2 @@
+from shared_kernel.security.key_vault import *
+from shared_kernel.security.encryption import *

fdc_shared_kernel-0.0.185/shared_kernel/security/encryption/__init__.py

@@ -0,0 +1,4 @@
+from shared_kernel.security.encryption.manager import EncryptionManager
+from shared_kernel.interfaces.encryption import EncryptionProviderInterface
+
+__all__ = ["EncryptionManager", "EncryptionProviderInterface"]

fdc_shared_kernel-0.0.185/shared_kernel/security/encryption/manager.py

@@ -0,0 +1,84 @@
+from typing import Dict, Any, Optional
+from shared_kernel.interfaces.encryption import EncryptionProviderInterface
+from shared_kernel.exceptions import EncryptionError
+from shared_kernel.security.encryption.providers import (
+    BasicEncryptionProvider,
+    AwsKmsProvider,
+    AzureKeyVaultCryptoProvider,
+)
+
+
+class EncryptionManager:
+    """
+    Factory manager for creating encryption providers and orchestrating
+    encryption and decryption operations.
+    """
+
+    def __init__(
+        self,
+        method: str,
+        key: Optional[str] = None,
+        config: Optional[Dict[str, Any]] = None,
+    ):
+        """
+        Initializes the EncryptionManager with the specified method, key, and config.
+
+        Args:
+            method (str): The encryption method (e.g., 'BASIC', 'AWS_KMS', 'AZURE_KEYVAULT').
+            key (str, optional): The encryption key or identifier.
+            config (dict, optional): Additional configuration for cloud provider clients.
+        """
+        self._provider = self._resolve_provider(method, key, config or {})
+
+    def _resolve_provider(
+        self, method: str, key: Optional[str], config: Dict[str, Any]
+    ) -> EncryptionProviderInterface:
+        """
+        Resolves and instantiates the proper encryption provider.
+        """
+        method_upper = method.upper()
+
+        if method_upper in ["BASIC", "SYMMETRIC", "FERNET"]:
+            return BasicEncryptionProvider(key, config)
+        # elif method_upper == "AWS_KMS":
+        #     return AwsKmsProvider(key, config)
+        # elif method_upper in ["AZURE_KEYVAULT", "AZURE_KMS"]:
+        #     return AzureKeyVaultCryptoProvider(key, config)
+        else:
+            raise ValueError(f"Unsupported encryption method: {method}")
+
+    def encrypt(self, plaintext: str) -> str:
+        """
+        Encrypts the plaintext string using the configured provider.
+
+        Args:
+            plaintext (str): The string to encrypt.
+
+        Returns:
+            str: Base64-encoded encrypted ciphertext.
+        """
+        if not isinstance(plaintext, str):
+            raise TypeError("Plaintext must be a string")
+
+        try:
+            return self._provider.encrypt(plaintext)
+        except Exception as e:
+            raise EncryptionError("Encryption failed", detail=str(e))
+
+    def decrypt(self, ciphertext: str) -> str:
+        """
+        Decrypts the ciphertext string using the configured provider.
+
+        Args:
+            ciphertext (str): The base64-encoded ciphertext to decrypt.
+
+        Returns:
+            str: Decrypted plaintext string.
+        """
+        if not isinstance(ciphertext, str):
+            raise TypeError("Ciphertext must be a string")
+
+        try:
+            return self._provider.decrypt(ciphertext)
+        except Exception as e:
+            raise EncryptionError("Decryption failed", detail=str(e))

fdc_shared_kernel-0.0.185/shared_kernel/security/encryption/providers.py

@@ -0,0 +1,96 @@
+import base64
+import hashlib
+import os
+from typing import Dict, Any, Optional
+from cryptography.fernet import Fernet
+from shared_kernel.interfaces.encryption import EncryptionProviderInterface
+
+
+class BasicEncryptionProvider(EncryptionProviderInterface):
+    """
+    Symmetric encryption provider using cryptography Fernet.
+    """
+
+    def __init__(self, key: Optional[str] = None, config: Optional[Dict[str, Any]] = None):
+        """
+        Initializes the BasicEncryptionProvider with a symmetric key.
+
+        Args:
+            key (str, optional): The encryption key. If not provided,
+                                 it will attempt to read config or environment.
+            config (dict, optional): Configuration dictionary.
+        """
+        cfg = config or {}
+        raw_key = key or cfg.get("encryption_key") or os.getenv("FDC_ENCRYPTION_KEY")
+
+        if not raw_key:
+            raise ValueError("Encryption key must be provided for basic encryption.")
+
+        self._fernet = self._setup_fernet(raw_key)
+
+    def _setup_fernet(self, raw_key: str) -> Fernet:
+        """
+        Sets up the Fernet instance, deriving a key if the raw key is not valid.
+        """
+        try:
+            key_bytes = raw_key.encode("utf-8")
+            decoded = base64.urlsafe_b64decode(key_bytes)
+            if len(decoded) == 32:
+                return Fernet(key_bytes)
+        except Exception:
+            pass
+
+        # Derive a 32-byte key using SHA-256 for non-Fernet formatted keys
+        derived = hashlib.sha256(raw_key.encode("utf-8")).digest()
+        fernet_key = base64.urlsafe_b64encode(derived)
+        return Fernet(fernet_key)
+
+    def encrypt(self, plaintext: str) -> str:
+        """
+        Encrypts the plaintext string.
+        """
+        if not plaintext:
+            return ""
+        data_bytes = plaintext.encode("utf-8")
+        token = self._fernet.encrypt(data_bytes)
+        return token.decode("utf-8")
+
+    def decrypt(self, ciphertext: str) -> str:
+        """
+        Decrypts the ciphertext string.
+        """
+        if not ciphertext:
+            return ""
+        token_bytes = ciphertext.encode("utf-8")
+        decrypted = self._fernet.decrypt(token_bytes)
+        return decrypted.decode("utf-8")
+
+
+class AwsKmsProvider(EncryptionProviderInterface):
+    """
+    AWS KMS encryption provider stub.
+    """
+
+    def __init__(self, key: Optional[str] = None, config: Optional[Dict[str, Any]] = None):
+        raise NotImplementedError("AwsKmsProvider is not implemented yet.")
+
+    def encrypt(self, plaintext: str) -> str:
+        raise NotImplementedError("AwsKmsProvider is not implemented yet.")
+
+    def decrypt(self, ciphertext: str) -> str:
+        raise NotImplementedError("AwsKmsProvider is not implemented yet.")
+
+
+class AzureKeyVaultCryptoProvider(EncryptionProviderInterface):
+    """
+    Azure Key Vault Keys Cryptography provider stub.
+    """
+
+    def __init__(self, key: Optional[str] = None, config: Optional[Dict[str, Any]] = None):
+        raise NotImplementedError("AzureKeyVaultCryptoProvider is not implemented yet.")
+
+    def encrypt(self, plaintext: str) -> str:
+        raise NotImplementedError("AzureKeyVaultCryptoProvider is not implemented yet.")
+
+    def decrypt(self, ciphertext: str) -> str:
+        raise NotImplementedError("AzureKeyVaultCryptoProvider is not implemented yet.")

fdc_shared_kernel-0.0.185/shared_kernel/tests/security/test_encryption.py

@@ -0,0 +1,105 @@
+import pytest
+from shared_kernel.exceptions import EncryptionError
+from shared_kernel.security.encryption import EncryptionManager
+from shared_kernel.security.encryption.providers import BasicEncryptionProvider
+
+
+def test_basic_provider_roundtrip():
+    """
+    Test that encrypting and decrypting with BasicEncryptionProvider works.
+    """
+    key = "my_super_secret_raw_key"
+    provider = BasicEncryptionProvider(key=key)
+    plaintext = "Hello, FactWeavers!"
+
+    ciphertext = provider.encrypt(plaintext)
+    assert ciphertext != plaintext
+
+    decrypted = provider.decrypt(ciphertext)
+    assert decrypted == plaintext
+
+
+def test_basic_provider_empty_and_none():
+    """
+    Test that empty input strings yield empty output in BasicEncryptionProvider.
+    """
+    provider = BasicEncryptionProvider(key="some_key")
+    assert provider.encrypt("") == ""
+    assert provider.decrypt("") == ""
+
+
+def test_encryption_manager_basic_selection():
+    """
+    Test that EncryptionManager properly routes BASIC method.
+    """
+    manager = EncryptionManager(method="BASIC", key="another_secret_key")
+    plaintext = "Sensitive data here"
+
+    ciphertext = manager.encrypt(plaintext)
+    decrypted = manager.decrypt(ciphertext)
+    assert decrypted == plaintext
+
+
+def test_encryption_manager_unsupported_method():
+    """
+    Test that unsupported encryption methods raise ValueError.
+    """
+    with pytest.raises(ValueError) as excinfo:
+        EncryptionManager(method="SUPER_CRYPT", key="key")
+    assert "Unsupported encryption method" in str(excinfo.value)
+
+
+def test_encryption_manager_type_checks():
+    """
+    Test that EncryptionManager raises TypeError for non-string inputs.
+    """
+    manager = EncryptionManager(method="fernet", key="key")
+
+    with pytest.raises(TypeError):
+        manager.encrypt(12345)  # type: ignore
+
+    with pytest.raises(TypeError):
+        manager.decrypt(dict())  # type: ignore
+
+
+def test_encryption_manager_not_implemented_stubs():
+    """
+    Test that unimplemented methods raise NotImplementedError on instantiation.
+    """
+    with pytest.raises(NotImplementedError) as excinfo:
+        EncryptionManager(method="AWS_KMS", key="key")
+    assert "AwsKmsProvider is not implemented yet" in str(excinfo.value)
+
+    with pytest.raises(NotImplementedError) as excinfo2:
+        EncryptionManager(method="AZURE_KEYVAULT", key="key")
+    assert "AzureKeyVaultCryptoProvider is not implemented yet" in str(excinfo2.value)
+
+
+def test_encrypted_json_field_direct():
+    """
+    Test the EncryptedJSONField's preparation and DB value load methods directly
+    without needing a database backend setup.
+    """
+    from llm.models import EncryptedJSONField
+
+    field = EncryptedJSONField()
+    payload = {"api_key": "my_val", "other": 123}
+
+    # 1. get_prep_value should serialize and encrypt the dictionary
+    prep_value = field.get_prep_value(payload)
+    assert isinstance(prep_value, str)
+    assert "my_val" not in prep_value
+
+    # 2. from_db_value should decrypt and deserialize the value
+    loaded_value = field.from_db_value(prep_value, None, None)
+    assert loaded_value == payload
+
+    # 3. None inputs should be handled gracefully
+    assert field.get_prep_value(None) is None
+    assert field.from_db_value(None, None, None) is None
+
+    # 4. If value is not a string, from_db_value returns it as is (backward compatibility)
+    assert field.from_db_value(payload, None, None) == payload
+
+    # 5. Already encrypted strings passed to get_prep_value are returned unchanged
+    assert field.get_prep_value(prep_value) == prep_value

fdc_shared_kernel-0.0.184/shared_kernel/security/__init__.py

@@ -1 +0,0 @@
-from shared_kernel.security.key_vault import *