librus-python-api 1.0.0rc1__py3-none-any.whl

librus_python_api/_storage.py

@@ -0,0 +1,367 @@
+"""Private bounded SQLite ownership shared by explicit optional stores."""
+
+import asyncio
+import contextvars
+import hashlib
+import hmac
+import os
+import secrets
+import sqlite3
+import stat
+from collections.abc import Callable, Coroutine, Iterator
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Any, Self
+
+from pydantic import Field
+
+from librus_python_api.config import _ValidatedConfig
+from librus_python_api.exceptions import ErrorKind, LibrusError
+from librus_python_api.lifecycle import join_owned
+
+
+class _StorageLimits(_ValidatedConfig):
+    operations: int = Field(default=8, ge=1, le=64)
+    busy_timeout_seconds: float = Field(default=0.1, gt=0, le=5, allow_inf_nan=False)
+    # Final saves follow upstream side effects (a dispatched send or a consumed
+    # read-once page), so they wait longer for other contexts' write locks.
+    final_busy_timeout_seconds: float = Field(
+        default=5, gt=0, le=60, allow_inf_nan=False
+    )
+
+
+# Worker threads inherit the calling task's context through asyncio.to_thread.
+_busy_timeout_seconds: contextvars.ContextVar[float | None] = contextvars.ContextVar(
+    "_busy_timeout_seconds", default=None
+)
+
+_STORE_META_SCHEMA = """CREATE TABLE store_metadata (
+    name TEXT PRIMARY KEY CHECK(name='context_salt'),
+    value BLOB NOT NULL CHECK(length(value)=32)
+)"""
+
+
+class _SQLiteStore:
+    _filename = "state.sqlite3"
+    _database_bytes = 8 * 1024 * 1024
+    _schema: tuple[str, ...] = ()
+
+    def __init__(self, directory: Path, *, limits: _StorageLimits) -> None:
+        if not isinstance(directory, Path) or not directory.is_absolute():
+            raise LibrusError(ErrorKind.INVALID_INPUT)
+        self._directory = directory
+        self._path = directory / self._filename
+        self._storage_limits = limits
+        self._opened = self._opening = self._closing = self._closed = False
+        self._operations = 0
+        self._lock = asyncio.Lock()
+        self._tasks: set[asyncio.Task[Any]] = set()
+        self._workflows: set[asyncio.Task[Any]] = set()
+        self._close_task: asyncio.Task[None] | None = None
+        self._file_identity: tuple[int, int] | None = None
+        self._context_salt: bytes | None = None
+
+    def context_identifier(self, context: str) -> str:
+        """Store-local context pseudonym; requires an explicitly opened store."""
+        if not self._opened or self._closed:
+            raise LibrusError(ErrorKind.CLOSED)
+        return self._context_key(context)
+
+    def _context_key(self, context: str) -> str:
+        if type(context) is not str or len(context) != 64:
+            raise LibrusError(ErrorKind.INVALID_INPUT)
+        try:
+            decoded = bytes.fromhex(context)
+        except ValueError:
+            raise LibrusError(ErrorKind.INVALID_INPUT) from None
+        if len(decoded) != 32 or context != decoded.hex():
+            raise LibrusError(ErrorKind.INVALID_INPUT)
+        assert self._context_salt is not None
+        return hmac.new(self._context_salt, decoded, hashlib.sha256).hexdigest()
+
+    async def __aenter__(self) -> Self:
+        await self.open()
+        return self
+
+    async def __aexit__(self, *args: object) -> None:
+        await self.aclose()
+
+    async def open(self) -> None:
+        if os.name != "posix":
+            raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+        if self._opened or self._opening or self._closing or self._closed:
+            raise LibrusError(ErrorKind.INVALID_INPUT)
+        self._opening = True
+        try:
+            await self._io(self._initialise, opening=True)
+            self._opened = True
+        finally:
+            self._opening = False
+
+    async def aclose(self) -> None:
+        if (
+            asyncio.current_task() in self._tasks
+            or asyncio.current_task() in self._workflows
+        ):
+            raise LibrusError(ErrorKind.INVALID_INPUT)
+        if self._close_task is None:
+            self._closing = True
+            self._close_task = asyncio.create_task(self._close())
+        interrupted = await join_owned(self._close_task)
+        self._close_task.result()
+        if interrupted:
+            raise asyncio.CancelledError
+
+    async def _close(self) -> None:
+        # Join workflow-owned final saves before cancelling ordinary workers.
+        for task in tuple(self._workflows):
+            task.cancel()
+        for task in tuple(self._workflows):
+            await join_owned(task)
+        tasks = tuple(self._tasks)
+        for task in tasks:
+            task.cancel()
+        for task in tasks:
+            await join_owned(task)
+        self._closed = True
+        self._opened = False
+
+    async def _owned[T](self, operation: Callable[[], Coroutine[Any, Any, T]]) -> T:
+        if not self._opened or self._closing or self._closed:
+            raise LibrusError(ErrorKind.CLOSED)
+        if len(self._workflows) >= self._storage_limits.operations:
+            raise LibrusError(ErrorKind.LIMIT)
+        task = asyncio.create_task(operation())
+        self._workflows.add(task)
+        cancelled = False
+        try:
+            await asyncio.wait((task,))
+            return task.result()
+        except asyncio.CancelledError:
+            cancelled = True
+            task.cancel()
+            raise
+        finally:
+            interrupted = await join_owned(task)
+            self._workflows.discard(task)
+            if cancelled or interrupted:
+                raise asyncio.CancelledError
+
+    async def _io[T](
+        self,
+        operation: Callable[[], T],
+        *,
+        opening: bool = False,
+        finishing: bool = False,
+    ) -> T:
+        if (
+            self._closed
+            or (not self._opened and not opening)
+            or (self._closing and not finishing)
+        ):
+            raise LibrusError(ErrorKind.CLOSED)
+        if self._operations >= self._storage_limits.operations:
+            raise LibrusError(ErrorKind.LIMIT)
+        self._operations += 1
+        task = asyncio.create_task(
+            self._worker(
+                operation,
+                self._storage_limits.final_busy_timeout_seconds
+                if finishing
+                else self._storage_limits.busy_timeout_seconds,
+            )
+        )
+        self._tasks.add(task)
+        cancelled = False
+        try:
+            await asyncio.wait((task,))
+            return task.result()
+        except asyncio.CancelledError:
+            cancelled = True
+            # Final saves remain owned even while waiting for another worker.
+            if not finishing:
+                task.cancel()
+            raise
+        finally:
+            interrupted = await join_owned(task)
+            self._tasks.discard(task)
+            self._operations -= 1
+            if cancelled or interrupted:
+                raise asyncio.CancelledError
+
+    async def _worker[T](self, operation: Callable[[], T], busy_seconds: float) -> T:
+        async with self._lock:
+            _busy_timeout_seconds.set(busy_seconds)
+            task = asyncio.create_task(asyncio.to_thread(operation))
+            interrupted = await join_owned(task)
+            if interrupted:
+                raise asyncio.CancelledError
+            try:
+                return task.result()
+            except LibrusError:
+                raise
+            except Exception:
+                pass
+        raise LibrusError(ErrorKind.STORAGE)
+
+    def _check_directory(self) -> None:
+        # A private immediate parent is the trust boundary. Malicious same-user
+        # filesystem writers and unsuitable network filesystems are not isolated.
+        if self._directory.is_symlink():
+            raise LibrusError(ErrorKind.STORAGE)
+        self._directory.mkdir(mode=0o700, exist_ok=True)
+        status = self._directory.stat()
+        if not stat.S_ISDIR(status.st_mode):
+            raise LibrusError(ErrorKind.STORAGE)
+        if os.name == "posix" and (
+            status.st_uid != os.geteuid() or stat.S_IMODE(status.st_mode) & 0o077
+        ):
+            raise LibrusError(ErrorKind.STORAGE)
+
+    def _check_file(self, *, create: bool = False) -> None:
+        if self._path.is_symlink():
+            raise LibrusError(ErrorKind.STORAGE)
+        flags = os.O_RDWR | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+        if create:
+            flags |= os.O_CREAT
+        descriptor = os.open(self._path, flags, 0o600)
+        try:
+            status = os.fstat(descriptor)
+            if (
+                not stat.S_ISREG(status.st_mode)
+                or status.st_nlink != 1
+                or status.st_size > self._database_bytes
+            ):
+                raise LibrusError(ErrorKind.STORAGE)
+            if os.name == "posix" and (
+                status.st_uid != os.geteuid() or stat.S_IMODE(status.st_mode) & 0o077
+            ):
+                raise LibrusError(ErrorKind.STORAGE)
+            identity = (status.st_dev, status.st_ino)
+            if self._file_identity is not None and self._file_identity != identity:
+                raise LibrusError(ErrorKind.STORAGE)
+            self._file_identity = identity
+        finally:
+            os.close(descriptor)
+
+    def _check_sidecars(self) -> None:
+        for suffix in ("-journal", "-wal", "-shm"):
+            path = self._path.with_name(self._path.name + suffix)
+            try:
+                status = path.lstat()
+            except FileNotFoundError:
+                continue
+            if (
+                not stat.S_ISREG(status.st_mode)
+                or status.st_nlink != 1
+                or status.st_size > self._database_bytes + 1024 * 1024
+                or (
+                    os.name == "posix"
+                    and (
+                        status.st_uid != os.geteuid()
+                        or stat.S_IMODE(status.st_mode) & 0o077
+                    )
+                )
+            ):
+                raise LibrusError(ErrorKind.STORAGE)
+
+    @contextmanager
+    def _connection(self, *, initialise: bool = False) -> Iterator[sqlite3.Connection]:
+        connection = None
+        kind: ErrorKind | None = None
+        try:
+            self._check_directory()
+            self._check_file(create=initialise)
+            self._check_sidecars()
+            busy_seconds = _busy_timeout_seconds.get()
+            connection = sqlite3.connect(
+                self._path,
+                timeout=self._storage_limits.busy_timeout_seconds
+                if busy_seconds is None
+                else busy_seconds,
+            )
+            connection.execute("PRAGMA trusted_schema=OFF")
+            connection.execute("PRAGMA foreign_keys=ON")
+            connection.execute("PRAGMA synchronous=FULL")
+            connection.execute(f"PRAGMA max_page_count={self._database_bytes // 4096}")
+            connection.execute("BEGIN IMMEDIATE")
+            if not initialise:
+                self._validate_schema(connection)
+            yield connection
+            connection.commit()
+        except LibrusError:
+            raise
+        except sqlite3.Error as error:
+            kind = (
+                ErrorKind.LIMIT
+                if getattr(error, "sqlite_errorcode", None)
+                in (sqlite3.SQLITE_BUSY, sqlite3.SQLITE_LOCKED)
+                else ErrorKind.STORAGE
+            )
+        except OSError:
+            kind = ErrorKind.STORAGE
+        finally:
+            if connection is not None:
+                connection.close()
+        if kind is not None:
+            raise LibrusError(kind)
+
+    def _initialise(self) -> None:
+        with self._connection(initialise=True) as connection:
+            version = connection.execute("PRAGMA user_version").fetchone()[0]
+            if version == 0:
+                if connection.execute("SELECT 1 FROM sqlite_master LIMIT 1").fetchone():
+                    raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+                for sql in (_STORE_META_SCHEMA, *self._schema):
+                    connection.execute(sql)
+                connection.execute(
+                    "INSERT INTO store_metadata VALUES (?,?)",
+                    ("context_salt", secrets.token_bytes(32)),
+                )
+                connection.execute("PRAGMA user_version=3")
+            self._validate_schema(connection)
+            self._validate_contents(connection)
+        if os.name == "posix":
+            descriptor = os.open(
+                self._directory,
+                os.O_RDONLY
+                | getattr(os, "O_DIRECTORY", 0)
+                | getattr(os, "O_NOFOLLOW", 0),
+            )
+            try:
+                os.fsync(descriptor)
+            finally:
+                os.close(descriptor)
+
+    def _validate_schema(self, connection: sqlite3.Connection) -> None:
+        expected = []
+        for sql in (_STORE_META_SCHEMA, *self._schema):
+            name = sql.split()[2]
+            expected.extend(
+                [("table", name, sql), ("index", f"sqlite_autoindex_{name}_1", None)]
+            )
+        actual = connection.execute(
+            "SELECT type, name, sql FROM sqlite_master ORDER BY name LIMIT 32"
+        ).fetchall()
+        if (
+            connection.execute("PRAGMA user_version").fetchone()[0] != 3
+            or connection.execute("PRAGMA page_size").fetchone()[0] != 4096
+            or connection.execute("PRAGMA journal_mode").fetchone()[0] != "delete"
+            or actual != sorted(expected, key=lambda row: row[1])
+        ):
+            raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+        rows = connection.execute(
+            "SELECT name,value FROM store_metadata LIMIT 2"
+        ).fetchall()
+        if (
+            len(rows) != 1
+            or rows[0][0] != "context_salt"
+            or type(rows[0][1]) is not bytes
+            or len(rows[0][1]) != 32
+            or (self._context_salt is not None and self._context_salt != rows[0][1])
+        ):
+            raise LibrusError(ErrorKind.STORAGE)
+        self._context_salt = rows[0][1]
+
+    def _validate_contents(self, connection: sqlite3.Connection) -> None:
+        raise NotImplementedError

librus_python_api/announcements.py

@@ -0,0 +1,159 @@
+"""Bounded semantic school announcements, independently authored from requirements."""
+
+import hashlib
+import re
+from datetime import date
+
+from lxml import html
+
+from librus_python_api import markup
+from librus_python_api.config import (
+    ANNOUNCEMENT_EMPTY_CLASSES,
+    ANNOUNCEMENT_EMPTY_MARKERS,
+    ANNOUNCEMENT_LABELS,
+    ANNOUNCEMENT_MAX_CONTENT_LENGTH,
+    ANNOUNCEMENT_MAX_FIELD_LENGTH,
+    ANNOUNCEMENT_MAX_ITEMS,
+    ANNOUNCEMENT_MAX_TOTAL_TEXT_LENGTH,
+    ANNOUNCEMENT_TABLE_CLASSES,
+)
+from librus_python_api.exceptions import ErrorKind, LibrusError
+from librus_python_api.models import Announcement
+from librus_python_api.parsers import parse_page
+
+
+def _label(cell: html.HtmlElement) -> str | None:
+    return ANNOUNCEMENT_LABELS.get(
+        markup.text(cell, ANNOUNCEMENT_MAX_FIELD_LENGTH).rstrip(":").casefold()
+    )
+
+
+def _empty(document: html.HtmlElement) -> bool:
+    markers: list[html.HtmlElement] = []
+    for node in document.iter("div"):
+        if ANNOUNCEMENT_EMPTY_CLASSES <= set(node.get("class", "").split()):
+            for child in node:
+                if child.tag == "div":
+                    markers.extend(p for p in child if p.tag == "p")
+    if len(markers) > 1:
+        raise LibrusError(ErrorKind.PARSE)
+    return bool(markers) and (
+        markup.text(markers[0], ANNOUNCEMENT_MAX_FIELD_LENGTH).rstrip(".").casefold()
+        in ANNOUNCEMENT_EMPTY_MARKERS
+    )
+
+
+def _tables(document: html.HtmlElement) -> list[html.HtmlElement]:
+    tables = []
+    for table in document.iter("table"):
+        classes = set(table.get("class", "").split())
+        labels = {
+            _label(cell)
+            for row in markup.rows(table)
+            for cell in markup.cells(row)
+            if cell.tag == "th"
+        } - {None}
+        known = ANNOUNCEMENT_TABLE_CLASSES <= classes
+        if not known and len(labels) >= 2:
+            raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+        if known:
+            if next(table.iterancestors("table"), None) is not None:
+                raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+            tables.append(table)
+            if len(tables) > ANNOUNCEMENT_MAX_ITEMS:
+                raise LibrusError(ErrorKind.LIMIT)
+    return tables
+
+
+def _fields(table: html.HtmlElement) -> dict[str, str]:
+    if len(list(table.iter("table"))) != 1:
+        raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+    fields: dict[str, str] = {}
+    for row in markup.rows(table):
+        key: str | None
+        cells = markup.cells(row)
+        if next(row.iterancestors("thead"), None) is not None:
+            if len(cells) != 1 or cells[0].tag != "td" or "title" in fields:
+                raise LibrusError(ErrorKind.PARSE)
+            key, cell = "title", cells[0]
+            if cell.get("colspan", "1") not in {"1", "2"}:
+                raise LibrusError(ErrorKind.PARSE)
+        elif {"line0", "line1"}.intersection(row.get("class", "").split()):
+            if len(cells) != 2 or [cell.tag for cell in cells] != ["th", "td"]:
+                raise LibrusError(ErrorKind.PARSE)
+            key, cell = _label(cells[0]), cells[1]
+            if key is None:
+                raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+            if any(
+                c.get("colspan", "1") != "1" or c.get("rowspan", "1") != "1"
+                for c in cells
+            ):
+                raise LibrusError(ErrorKind.PARSE)
+        elif markup.text(row, ANNOUNCEMENT_MAX_FIELD_LENGTH):
+            raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+        else:
+            continue
+        if key in fields or cell.get("rowspan", "1") != "1":
+            raise LibrusError(ErrorKind.PARSE)
+        limit = (
+            ANNOUNCEMENT_MAX_CONTENT_LENGTH
+            if key == "content"
+            else ANNOUNCEMENT_MAX_FIELD_LENGTH
+        )
+        fields[key] = markup.text(cell, limit, multiline=key == "content")
+    if fields.keys() != {"title", "author", "date_text", "content"}:
+        raise LibrusError(ErrorKind.PARSE)
+    if any(not fields[key] for key in ("title", "author", "date_text")):
+        raise LibrusError(ErrorKind.PARSE)
+    return fields
+
+
+def _day(value: str) -> date:
+    if not re.fullmatch(r"[0-9]{4}-[0-9]{2}-[0-9]{2}", value):
+        raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+    try:
+        return date.fromisoformat(value)
+    except ValueError:
+        pass
+    raise LibrusError(ErrorKind.PARSE)
+
+
+def _reference(account: str, fields: dict[str, str]) -> str:
+    digest = hashlib.sha256(b"librus-announcements-v1\x00")
+    for value in (
+        account,
+        *(fields[key] for key in ("title", "author", "date_text", "content")),
+    ):
+        encoded = value.encode("utf-8")
+        digest.update(len(encoded).to_bytes(4, "big"))
+        digest.update(encoded)
+    return "content-sha256:" + digest.hexdigest()
+
+
+def parse_announcements(body: bytes, account: str) -> tuple[Announcement, ...]:
+    if not isinstance(account, str) or not account or len(account) > 80:
+        raise LibrusError(ErrorKind.INVALID_INPUT)
+    document = parse_page(body)
+    tables, empty = _tables(document), _empty(document)
+    if empty and tables:
+        raise LibrusError(ErrorKind.PARSE)
+    if not tables and not empty:
+        raise LibrusError(ErrorKind.PARSE)
+    items = []
+    total = 0
+    for table in tables:
+        fields = _fields(table)
+        total += sum(len(value) for value in fields.values())
+        if total > ANNOUNCEMENT_MAX_TOTAL_TEXT_LENGTH:
+            raise LibrusError(ErrorKind.LIMIT)
+        items.append(
+            Announcement(
+                reference=_reference(account, fields),
+                published_on=_day(fields["date_text"]),
+                title=fields["title"],
+                author=fields["author"],
+                date_text=fields["date_text"],
+                content=fields["content"],
+            )
+        )
+    return tuple(items)

librus_python_api/attachment_routes.py

@@ -0,0 +1,114 @@
+"""Fail-closed reference and signed-destination validation, never network I/O."""
+
+import re
+from urllib.parse import urlsplit
+
+from librus_python_api.config import (
+    ATTACHMENT_KEY_PATTERN,
+    ATTACHMENT_MAX_BYTES,
+    ATTACHMENT_MAX_LOCATION_LENGTH,
+    ATTACHMENT_REDIRECT_PATH,
+    ConnectionSettings,
+)
+from librus_python_api.exceptions import ErrorKind, LibrusError
+from librus_python_api.message_content import validate_reference
+from librus_python_api.models import (
+    MessageAttachmentReference,
+    ModernMessageAttachmentReference,
+)
+from librus_python_api.modern_mailbox import (
+    validate_reference as validate_modern_reference,
+)
+from librus_python_api.parsers import decode_json
+
+
+def validate_attachment_reference(
+    reference: MessageAttachmentReference, account: str
+) -> None:
+    if not isinstance(reference, MessageAttachmentReference):
+        raise LibrusError(ErrorKind.INVALID_INPUT)
+    validate_reference(reference.message, account)
+    if (
+        type(reference.identifier) is not str
+        or re.fullmatch(r"[0-9]{1,64}", reference.identifier) is None
+    ):
+        raise LibrusError(ErrorKind.INVALID_INPUT)
+
+
+def validate_key(key: str) -> None:
+    if (
+        type(key) is not str
+        or ATTACHMENT_KEY_PATTERN.fullmatch(key) is None
+        or key in {".", ".."}
+    ):
+        raise LibrusError(ErrorKind.ACCESS_DENIED)
+
+
+def validate_modern_attachment_reference(
+    reference: ModernMessageAttachmentReference,
+    account: str,
+) -> None:
+    if not isinstance(reference, ModernMessageAttachmentReference):
+        raise LibrusError(ErrorKind.INVALID_INPUT)
+    validate_modern_reference(reference.message, account)
+    if (
+        type(reference.archived) is not bool
+        or type(reference.identifier) is not str
+        or re.fullmatch(r"[0-9]{1,64}", reference.identifier) is None
+    ):
+        raise LibrusError(ErrorKind.INVALID_INPUT)
+
+
+def modern_attachment_key(body: bytes, connection: ConnectionSettings) -> str:
+    data = decode_json(body)
+    if not isinstance(data, dict) or not isinstance(data.get("data"), dict):
+        raise LibrusError(ErrorKind.PARSE)
+    return signed_attachment_key(data["data"].get("downloadLink"), connection)
+
+
+def validate_max_bytes(max_bytes: int) -> None:
+    if type(max_bytes) is not int or not 1 <= max_bytes <= ATTACHMENT_MAX_BYTES:
+        raise LibrusError(ErrorKind.INVALID_INPUT)
+
+
+def signed_attachment_key(location: str, connection: ConnectionSettings) -> str:
+    """Only an exact absolute official destination or explicitly configured loopback."""
+    # Controls make parsing ambiguous; other encoding characters are judged only
+    # after origin/scheme/userinfo, so a foreign destination is always a denial.
+    if (
+        type(location) is not str
+        or not 1 <= len(location) <= ATTACHMENT_MAX_LOCATION_LENGTH
+        or any(ord(c) <= 32 or ord(c) >= 127 for c in location)
+    ):
+        raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+    invalid = False
+    key = ""
+    try:
+        target = urlsplit(location)
+        expected = urlsplit(connection.download_origin)
+        authorities = {expected.netloc}
+        if expected.hostname == "sandbox.librus.pl":
+            authorities = {"sandbox.librus.pl", "sandbox.librus.pl:443"}
+        prefix, _, suffix = ATTACHMENT_REDIRECT_PATH.partition("{key}")
+        if (
+            target.scheme != expected.scheme
+            or target.netloc not in authorities
+            or target.username is not None
+            or target.password is not None
+        ):
+            invalid = True
+        elif (
+            any(c in location for c in ("%", "\\", "?", "#"))
+            or not target.path.startswith(prefix)
+            or suffix
+        ):
+            raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+        else:
+            key = target.path[len(prefix) :]
+    except ValueError:
+        invalid = True
+    if invalid:
+        raise LibrusError(ErrorKind.ACCESS_DENIED)
+    if ATTACHMENT_KEY_PATTERN.fullmatch(key) is None or key in {".", ".."}:
+        raise LibrusError(ErrorKind.UNSUPPORTED_CAPABILITY)
+    return key