leblob 0.4.0.dev1__py3-none-any.whl

leblob/s3/xml_config.py

@@ -0,0 +1,431 @@
+"""Configuration documents: lifecycle rules, CORS, tags and ACLs. Pure.
+
+A lifecycle rule deletes data, so anything its parser doesn't understand is refused.
+Skipping an element could widen what a rule applies to.
+"""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime, time
+from itertools import starmap
+from typing import TYPE_CHECKING
+
+from leblob.model import (
+    CorsRule,
+    LifecycleRule,
+    RuleActions,
+    RuleScope,
+)
+from leblob.s3 import cors, errors, tagging, xml_base as base
+from leblob.s3.errors import S3Error
+from leblob.s3.xml import iso_date
+
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Mapping
+    from xml.etree.ElementTree import Element
+
+_ALL_USERS = "http://acs.amazonaws.com/groups/global/AllUsers"
+
+
+MAX_CORS_RULES = 100
+
+
+_CORS_PARTS = (
+    "AllowedHeader",
+    "AllowedMethod",
+    "AllowedOrigin",
+    "ExposeHeader",
+    "ID",
+    "MaxAgeSeconds",
+)
+
+
+MAX_LIFECYCLE_RULES = 1000
+
+
+MAX_RULE_ID = 255
+
+
+_RULE_PARTS = frozenset({
+    "AbortIncompleteMultipartUpload",
+    "Expiration",
+    "Filter",
+    "ID",
+    "NoncurrentVersionExpiration",
+    "Prefix",
+    "Status",
+})
+
+
+_FILTER_PARTS = frozenset({
+    "ObjectSizeGreaterThan",
+    "ObjectSizeLessThan",
+    "Prefix",
+    "Tag",
+})
+
+
+_TAG_PARTS = frozenset({"Key", "Value"})
+
+
+_REPEATABLE = frozenset({"Tag"})  # A filter can name several tags, and only those.
+
+
+_EXPIRATION_PARTS = frozenset({"Date", "Days", "ExpiredObjectDeleteMarker"})
+
+
+_NONCURRENT_PARTS = frozenset({"NewerNoncurrentVersions", "NoncurrentDays"})
+
+
+_ABORT_PARTS = frozenset({"DaysAfterInitiation"})
+
+
+_LIFECYCLE_NOT_BUILT = frozenset({"NoncurrentVersionTransition", "Transition"})
+
+
+def render_acl(*, public: bool) -> bytes:
+    everyone = (
+        '<Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" '
+        f'xsi:type="Group"><URI>{_ALL_USERS}</URI></Grantee>'
+        "<Permission>READ</Permission></Grant>"
+        if public
+        else ""
+    )
+    return base.document(
+        "AccessControlPolicy",
+        base.OWNER,
+        "<AccessControlList><Grant><Grantee "
+        'xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" '
+        'xsi:type="CanonicalUser"><ID>leblob</ID><DisplayName>leblob</DisplayName>'
+        f"</Grantee><Permission>FULL_CONTROL</Permission></Grant>{everyone}"
+        "</AccessControlList>",
+    )
+
+
+def parse_acl(body: bytes) -> bool:
+    """Return whether a policy makes something public, if it says no more than that.
+
+    One owner, and reading by everyone, is all there is. A grant to anyone else, or an
+    owner left out, is a promise that wouldn't be kept.
+    """
+    public = owner = False
+    for element in base.parse_document(body).iter():
+        if base.local_name(element.tag) != "Grant":
+            continue
+        grantee_uri = next(
+            (
+                item.text
+                for item in element.iter()
+                if base.local_name(item.tag) == "URI"
+            ),
+            None,
+        )
+        grantee_id = next(
+            (item.text for item in element.iter() if base.local_name(item.tag) == "ID"),
+            None,
+        )
+        permission = base.optional_child_text(element, "Permission")
+        if grantee_uri == _ALL_USERS and permission == "READ":
+            public = True
+        elif grantee_id == base.OWNER_ID and permission == "FULL_CONTROL":
+            owner = True
+        else:
+            raise S3Error(errors.NOT_IMPLEMENTED, "That grant is not implemented.")
+    if not owner:
+        raise S3Error(errors.NOT_IMPLEMENTED, "The owner keeps full control.")
+    return public
+
+
+def render_cors(rules: Iterable[CorsRule]) -> bytes:
+    return base.document("CORSConfiguration", *map(_render_cors_rule, rules))
+
+
+def _render_cors_rule(rule: CorsRule) -> str:
+    inner = (
+        base.optional("ID", rule.rule_id)
+        + "".join(base.element("AllowedOrigin", item) for item in rule.origins)
+        + "".join(base.element("AllowedMethod", item) for item in rule.methods)
+        + "".join(base.element("AllowedHeader", item) for item in rule.allowed_headers)
+        + "".join(base.element("ExposeHeader", item) for item in rule.expose)
+        + base.optional("MaxAgeSeconds", rule.max_age)
+    )
+    return f"<CORSRule>{inner}</CORSRule>"
+
+
+def parse_cors(body: bytes) -> tuple[CorsRule, ...]:
+    elements = list(base.parse_document(body))
+    if not elements or any(
+        base.local_name(item.tag) != "CORSRule" for item in elements
+    ):
+        raise S3Error(errors.MALFORMED_XML, "A configuration is a list of rules.")
+    if len(elements) > MAX_CORS_RULES:
+        raise S3Error(errors.INVALID_REQUEST, "Too many CORS rules.")
+    return tuple(map(_parse_cors_rule, elements))
+
+
+def _parse_cors_rule(element: Element) -> CorsRule:
+    values: dict[str, list[str]] = {name: [] for name in _CORS_PARTS}
+    for child in element:
+        name = base.local_name(child.tag)
+        if name not in values:
+            raise S3Error(errors.MALFORMED_XML, f"Unexpected element: {name}.")
+        values[name].append(child.text or "")
+    if not values["AllowedOrigin"] or not values["AllowedMethod"]:
+        raise S3Error(errors.MALFORMED_XML, "A rule needs an origin and a method.")
+    _check_cors_values(values)
+    return CorsRule(
+        tuple(values["AllowedOrigin"]),
+        tuple(values["AllowedMethod"]),
+        tuple(values["AllowedHeader"]),
+        tuple(values["ExposeHeader"]),
+        values["ID"][0] if values["ID"] else None,
+        int(values["MaxAgeSeconds"][0]) if values["MaxAgeSeconds"] else None,
+    )
+
+
+def _check_cors_values(values: Mapping[str, list[str]]) -> None:
+    if len(values["ID"]) > 1 or len(values["MaxAgeSeconds"]) > 1:
+        raise S3Error(errors.MALFORMED_XML, "Only one ID and MaxAgeSeconds in a rule.")
+    if any(len(rule_id) > MAX_RULE_ID for rule_id in values["ID"]):
+        raise S3Error(errors.INVALID_ARGUMENT, "That CORS rule ID is too long.")
+    if not all(text.isascii() and text.isdecimal() for text in values["MaxAgeSeconds"]):
+        raise S3Error(errors.MALFORMED_XML, "MaxAgeSeconds must be a whole number.")
+    if not cors.ALLOWED_METHODS.issuperset(values["AllowedMethod"]):
+        raise S3Error(errors.INVALID_REQUEST, "A rule names a method CORS can't allow.")
+    for pattern in (*values["AllowedOrigin"], *values["AllowedHeader"]):
+        if pattern.count("*") > 1:
+            raise S3Error(errors.INVALID_REQUEST, f"Two wildcards in {pattern!r}.")
+
+
+def render_tagging(tags: Mapping[str, str]) -> bytes:
+    inner = "".join(starmap(_render_tag, tags.items()))
+    return base.document("Tagging", f"<TagSet>{inner}</TagSet>")
+
+
+def _render_tag(key: str, value: str) -> str:
+    return f"<Tag>{base.element('Key', key)}{base.element('Value', value)}</Tag>"
+
+
+def parse_tagging(body: bytes) -> dict[str, str]:
+    parts = _known_children(base.parse_document(body), frozenset({"TagSet"}))
+    if "TagSet" not in parts:
+        raise S3Error(errors.MALFORMED_XML, "Missing element: TagSet.")
+    if any(base.local_name(child.tag) != "Tag" for child in parts["TagSet"]):
+        raise S3Error(errors.MALFORMED_XML, "A TagSet is a list of tags.")
+    return tagging.build_tags(map(_parse_tag, parts["TagSet"]))
+
+
+def _parse_tag(element: Element) -> tuple[str, str]:
+    parts = _known_children(element, _TAG_PARTS)
+    if parts.keys() != _TAG_PARTS:
+        raise S3Error(errors.MALFORMED_XML, "A tag needs a Key and a Value.")
+    return parts["Key"].text or "", parts["Value"].text or ""
+
+
+def render_lifecycle(rules: Iterable[LifecycleRule]) -> bytes:
+    return base.document("LifecycleConfiguration", *map(_render_rule, rules))
+
+
+def _render_rule(rule: LifecycleRule) -> str:
+    return (
+        f"<Rule>{base.element('ID', rule.rule_id)}{_render_scope(rule.scope)}"
+        f"{base.element('Status', 'Enabled' if rule.enabled else 'Disabled')}"
+        f"{_render_actions(rule.actions)}</Rule>"
+    )
+
+
+def _render_scope(scope: RuleScope) -> str:
+    if scope.legacy_prefix:
+        return base.element("Prefix", scope.prefix)
+    conditions = [
+        base.optional("Prefix", scope.prefix),
+        base.optional("ObjectSizeGreaterThan", scope.larger_than),
+        base.optional("ObjectSizeLessThan", scope.smaller_than),
+        *starmap(_render_tag, scope.tags),
+    ]
+    inner = "".join(conditions)
+    several = sum(bool(condition) for condition in conditions) > 1
+    return (
+        f"<Filter><And>{inner}</And></Filter>"
+        if several
+        else f"<Filter>{inner}</Filter>"
+    )
+
+
+def _render_actions(actions: RuleActions) -> str:
+    date = None if actions.expire_at is None else iso_date(actions.expire_at)
+    markers = "true" if actions.expire_lone_markers else None
+    expiration = (
+        base.optional("Days", actions.expire_days)
+        + base.optional("Date", date)
+        + base.optional("ExpiredObjectDeleteMarker", markers)
+    )
+    noncurrent = base.optional(
+        "NoncurrentDays", actions.noncurrent_days
+    ) + base.optional("NewerNoncurrentVersions", actions.keep_noncurrent or None)
+    abort = base.optional("DaysAfterInitiation", actions.abort_upload_days)
+    return (
+        _wrap_if_any("Expiration", expiration)
+        + _wrap_if_any("NoncurrentVersionExpiration", noncurrent)
+        + _wrap_if_any("AbortIncompleteMultipartUpload", abort)
+    )
+
+
+def _wrap_if_any(tag: str, inner: str) -> str:
+    return f"<{tag}>{inner}</{tag}>" if inner else ""
+
+
+def parse_lifecycle(body: bytes) -> tuple[LifecycleRule, ...]:
+    """Return the rules a configuration asks for.
+
+    A rule deletes data, so anything not understood is refused. Skipping an element
+    could widen what a rule applies to, as ignoring a <Tag> filter would.
+    """
+    elements = list(base.parse_document(body))
+    if not elements or any(base.local_name(item.tag) != "Rule" for item in elements):
+        raise S3Error(errors.MALFORMED_XML, "A configuration is a list of rules.")
+    if len(elements) > MAX_LIFECYCLE_RULES:
+        raise S3Error(errors.INVALID_ARGUMENT, "Too many lifecycle rules.")
+    rules = tuple(
+        _parse_rule(element, f"rule-{position}")
+        for position, element in enumerate(elements, 1)
+    )
+    if len({rule.rule_id for rule in rules}) < len(rules):
+        raise S3Error(errors.INVALID_ARGUMENT, "Lifecycle rule IDs must be unique.")
+    return rules
+
+
+def _parse_rule(element: Element, default_id: str) -> LifecycleRule:
+    parts = _known_children(element, _RULE_PARTS)
+    rule_id = _text_of(parts, "ID") or default_id
+    if len(rule_id) > MAX_RULE_ID:
+        raise S3Error(errors.INVALID_ARGUMENT, "That lifecycle rule ID is too long.")
+    status = _text_of(parts, "Status")
+    if status not in {"Enabled", "Disabled"}:
+        raise S3Error(errors.MALFORMED_XML, f"Bad status: {status!r}.")
+    scope = _parse_scope(parts)
+    actions = _parse_actions(parts)
+    if actions == RuleActions():
+        raise S3Error(errors.MALFORMED_XML, "A lifecycle rule needs an action.")
+    if actions.abort_upload_days is not None and scope.looks_inside_objects():
+        # An upload has no size or tags yet: the rule would apply to more than it says.
+        raise S3Error(
+            errors.INVALID_REQUEST,
+            "A rule that aborts uploads can only filter on a prefix.",
+        )
+    if actions.expire_lone_markers and scope.tags:
+        raise S3Error(
+            errors.INVALID_REQUEST, "A delete marker has no tags to filter on."
+        )
+    return LifecycleRule(rule_id, status == "Enabled", scope, actions)
+
+
+def _parse_scope(parts: Mapping[str, Element]) -> RuleScope:
+    """Require a scope: a rule over a whole bucket says so, with an empty filter."""
+    if ("Prefix" in parts) == ("Filter" in parts):
+        raise S3Error(errors.MALFORMED_XML, "A rule needs a Prefix or a Filter.")
+    if "Prefix" in parts:
+        return RuleScope(_text_of(parts, "Prefix") or "", legacy_prefix=True)
+    holder = parts["Filter"]
+    conditions = _known_children(holder, _FILTER_PARTS | {"And"}, _REPEATABLE)
+    if "And" in conditions:
+        if len(conditions) > 1:
+            raise S3Error(errors.MALFORMED_XML, "An And stands alone in a Filter.")
+        holder = conditions["And"]
+        conditions = _known_children(holder, _FILTER_PARTS, _REPEATABLE)
+    tags = tagging.build_tags(
+        _parse_tag(child) for child in holder if base.local_name(child.tag) == "Tag"
+    )
+    prefix = conditions.get("Prefix")
+    return RuleScope(
+        None if prefix is None else prefix.text or "",
+        larger_than=_whole_number(conditions, "ObjectSizeGreaterThan", minimum=0),
+        smaller_than=_whole_number(conditions, "ObjectSizeLessThan", minimum=1),
+        tags=tuple(tags.items()),
+    )
+
+
+def _parse_actions(parts: Mapping[str, Element]) -> RuleActions:
+    expiration = _known_children_of(parts, "Expiration", _EXPIRATION_PARTS)
+    if len(expiration) > 1:
+        raise S3Error(errors.MALFORMED_XML, "An expiration takes one condition.")
+    noncurrent = _known_children_of(
+        parts, "NoncurrentVersionExpiration", _NONCURRENT_PARTS
+    )
+    if noncurrent and "NoncurrentDays" not in noncurrent:
+        raise S3Error(errors.MALFORMED_XML, "Missing element: NoncurrentDays.")
+    abort = _known_children_of(parts, "AbortIncompleteMultipartUpload", _ABORT_PARTS)
+    return RuleActions(
+        expire_days=_whole_number(expiration, "Days", minimum=1),
+        expire_at=_parse_rule_date(expiration),
+        expire_lone_markers=_parse_marker_flag(expiration),
+        noncurrent_days=_whole_number(noncurrent, "NoncurrentDays", minimum=1),
+        keep_noncurrent=_whole_number(noncurrent, "NewerNoncurrentVersions", minimum=1)
+        or 0,
+        abort_upload_days=_whole_number(abort, "DaysAfterInitiation", minimum=1),
+    )
+
+
+def _parse_rule_date(expiration: Mapping[str, Element]) -> int | None:
+    if "Date" not in expiration:
+        return None
+    text = expiration["Date"].text or ""
+    try:
+        moment = datetime.fromisoformat(text)
+    except ValueError:
+        raise S3Error(errors.INVALID_ARGUMENT, f"Bad date: {text!r}.") from None
+    if moment.tzinfo is None:
+        moment = moment.replace(tzinfo=UTC)
+    if moment.astimezone(UTC).time() != time():
+        raise S3Error(errors.INVALID_ARGUMENT, "A date must be midnight UTC.")
+    return int(moment.timestamp()) * 1000
+
+
+def _parse_marker_flag(expiration: Mapping[str, Element]) -> bool:
+    text = _text_of(expiration, "ExpiredObjectDeleteMarker")
+    if text not in {None, "true", "false"}:
+        raise S3Error(errors.MALFORMED_XML, f"Bad boolean: {text!r}.")
+    return text == "true"
+
+
+def _whole_number(
+    parts: Mapping[str, Element], name: str, *, minimum: int
+) -> int | None:
+    if name not in parts:
+        return None
+    # Present but empty is refused: dropping a size condition would widen the rule.
+    text = parts[name].text or ""
+    if not (text.isascii() and text.isdecimal()):
+        raise S3Error(errors.MALFORMED_XML, f"{name} must be a whole number.")
+    value = int(text)
+    if value < minimum:
+        raise S3Error(errors.INVALID_ARGUMENT, f"{name} must be at least {minimum}.")
+    return value
+
+
+def _known_children_of(
+    parts: Mapping[str, Element], name: str, allowed: frozenset[str]
+) -> dict[str, Element]:
+    return _known_children(parts[name], allowed) if name in parts else {}
+
+
+def _known_children(
+    element: Element,
+    allowed: frozenset[str],
+    repeatable: frozenset[str] = frozenset(),
+) -> dict[str, Element]:
+    """An element's children by name, refusing surprises and repeats."""
+    found: dict[str, Element] = {}
+    for child in element:
+        name = base.local_name(child.tag)
+        if name in _LIFECYCLE_NOT_BUILT:
+            raise S3Error(errors.NOT_IMPLEMENTED, f"{name} is not implemented.")
+        repeated = name in found and name not in repeatable
+        if name not in allowed or repeated:
+            raise S3Error(errors.MALFORMED_XML, f"Unexpected element: {name}.")
+        found[name] = child
+    return found
+
+
+def _text_of(parts: Mapping[str, Element], name: str) -> str | None:
+    return parts[name].text if name in parts else None

leblob/streams.py

@@ -0,0 +1,179 @@
+"""An object's bytes on their way in and out: decoding, checking, encrypting, storing.
+
+Handlers deal in requests and answers, and leave the bytes to this.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from contextlib import aclosing
+from typing import TYPE_CHECKING
+
+from leblob import blobstore
+from leblob.model import BlobSlice
+from leblob.s3 import conditions, errors, payload, sse
+from leblob.s3.errors import S3Error
+
+if TYPE_CHECKING:
+    from collections.abc import AsyncGenerator, Callable, Mapping
+
+    from leblob.handlers import Context, Request
+    from leblob.model import Blob, ByteSpan, Checksum, ChecksumPlan, ObjectRecord
+
+MAX_OBJECT_BYTES = 5 * 1024**3
+
+
+class ClientDisconnectedError(Exception):
+    """The client went away during an upload; nothing was committed."""
+
+
+async def decoded_body(
+    request: Request, decoder: payload.PlainDecoder | payload.ChunkedDecoder
+) -> AsyncGenerator[bytes]:
+    while True:
+        message = await request.receive()
+        if message["type"] == "http.disconnect":
+            raise ClientDisconnectedError
+        data = message.get("body", b"")
+        if data:
+            yield decoder.feed(data)
+        if not message.get("more_body", False):
+            return
+
+
+async def receive_blob(
+    ctx: Context,
+    request: Request,
+    plan: ChecksumPlan | None = None,
+    key: sse.CustomerKey | None = None,
+) -> tuple[Blob, Checksum | None]:
+    """Store a request's body as a durable blob, if it keeps its promises."""
+    spec = payload.parse_spec(request.headers)
+    if plan is not None:
+        spec = payload.requiring(spec, plan.algorithm)
+    decoder = payload.new_decoder(spec, request.stream_seed)
+    return await _write_blob(
+        ctx, spec, decoded_body(request, decoder), key, decoder.finish
+    )
+
+
+async def copy_to_new_blob(
+    ctx: Context,
+    chunks: AsyncGenerator[bytes],
+    plan: ChecksumPlan | None = None,
+    key: sse.CustomerKey | None = None,
+) -> tuple[Blob, Checksum | None]:
+    """Store bytes already held again, as any new blob is written."""
+    spec = payload.parse_spec({})
+    if plan is not None:
+        spec = payload.requiring(spec, plan.algorithm)
+    async with aclosing(chunks) as plain:
+        return await _write_blob(ctx, spec, plain, key, dict)
+
+
+async def _write_blob(
+    ctx: Context,
+    spec: payload.PayloadSpec,
+    chunks: AsyncGenerator[bytes],
+    key: sse.CustomerKey | None,
+    trailers: Callable[[], Mapping[str, str]],
+) -> tuple[Blob, Checksum | None]:
+    """Make plain bytes a durable blob, once they have kept their promises.
+
+    Promises are about the plain bytes, and a blob's own MD5 about what is stored, which
+    with a key are different bytes, and so are hashed apart.
+    """
+    if key is None:
+        with ctx.blobs.writer(payload.new_hashers(spec)) as writer:
+            await blobstore.write_stream(writer, chunks, MAX_OBJECT_BYTES)
+            checksum = payload.verify(spec, writer.digests(), writer.size, trailers())
+            return await asyncio.to_thread(writer.commit), checksum
+
+    hashers = payload.new_hashers(spec)
+    encryptor = sse.Encryptor(key)
+    size = 0
+
+    async def sealed() -> AsyncGenerator[bytes]:
+        nonlocal size
+        async for chunk in chunks:
+            size += len(chunk)
+            for hasher in hashers.values():
+                hasher.update(chunk)
+            yield encryptor.feed(chunk)
+        yield encryptor.finish()
+
+    with ctx.blobs.writer(payload.new_hashers(payload.parse_spec({}))) as writer:
+        await blobstore.write_stream(
+            writer, sealed(), sse.stored_size(MAX_OBJECT_BYTES)
+        )
+        digests = {name: hasher.digest() for name, hasher in hashers.items()}
+        checksum = payload.verify(spec, digests, size, trailers())
+        return await asyncio.to_thread(writer.commit), checksum
+
+
+def plain_bytes(
+    ctx: Context,
+    record: ObjectRecord,
+    span: ByteSpan,
+    key: sse.CustomerKey | None,
+) -> AsyncGenerator[bytes]:
+    """Stream a range of an object as its client knows it, decrypting if it needs to."""
+    if key is None:
+        slices = conditions.slice_blobs(record.blobs, span.start, span.length)
+        return blobstore.read_slices(ctx.blobs, slices)
+    return _decrypted_object(ctx, record, span, key)
+
+
+async def _decrypted_object(
+    ctx: Context,
+    record: ObjectRecord,
+    span: ByteSpan,
+    key: sse.CustomerKey,
+) -> AsyncGenerator[bytes]:
+    start, length = span.start, span.length
+    position = 0
+    for blob in record.blobs:
+        size = sse.plain_size(blob.size)
+        first = max(start, position)
+        last = min(start + length, position + size)
+        if first < last:
+            salt = await _read_salt(ctx, blob)
+            plan = sse.plan_read(blob.size, first - position, last - first)
+            decryptor = sse.Decryptor(key, salt, blob.size, plan)
+            piece = BlobSlice(blob, plan.stored_offset, plan.stored_length)
+            stored = blobstore.read_slices(ctx.blobs, [piece])
+            try:
+                async for chunk in stored:
+                    yield decryptor.feed(chunk)
+            finally:
+                await stored.aclose()
+            yield decryptor.finish()
+        position += size
+
+
+async def _read_salt(ctx: Context, blob: Blob) -> bytes:
+    salt = bytearray()
+    head = [BlobSlice(blob, 0, sse.SALT_BYTES)]
+    async with aclosing(blobstore.read_slices(ctx.blobs, head)) as chunks:
+        async for chunk in chunks:
+            salt += chunk
+    return bytes(salt)
+
+
+def customer_key(
+    ctx: Context, request: Request, prefix: str = sse.HEADER_PREFIX
+) -> sse.CustomerKey | None:
+    """Read a key sent with a request, which over plain HTTP anyone could read too."""
+    key = sse.parse_key(request.headers, prefix)
+    if key is not None and not request.secure and not ctx.sse_over_http:
+        raise S3Error(errors.INVALID_REQUEST, "An encryption key needs HTTPS.")
+    return key
+
+
+def client_size(blob: Blob, key: sse.CustomerKey | None) -> int:
+    """How many bytes a client sent, which encrypting them takes more room to store."""
+    return blob.size if key is None else sse.plain_size(blob.size)
+
+
+def key_headers(key: sse.CustomerKey | None) -> tuple[tuple[str, str], ...]:
+    return () if key is None else key.response_headers()