mip-wrapper 0.1.0__tar.gz

mip_wrapper-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mip-wrapper contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mip_wrapper-0.1.0/PKG-INFO

@@ -0,0 +1,103 @@
+Metadata-Version: 2.4
+Name: mip-wrapper
+Version: 0.1.0
+Summary: Unofficial Python wrapper for Microsoft Information Protection file decryption
+License-Expression: MIT
+Project-URL: Repository, https://github.com/firaun2020/mip-wrapper
+Project-URL: Documentation, https://github.com/firaun2020/mip-wrapper/tree/main/docs
+Project-URL: Issues, https://github.com/firaun2020/mip-wrapper/issues
+Keywords: mip,information-protection,azure-rights-management,decryption
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: packaging>=21.0
+Dynamic: license-file
+
+# mip-wrapper
+
+Unofficial Python wrapper for inspecting and decrypting files protected by Microsoft Purview Information Protection. The Python package starts a local JSON subprocess bridge to a separately built .NET helper, which calls the Microsoft Information Protection File SDK.
+
+## Scope
+
+- Windows x64 only
+- Python 3.11 or newer
+- `delegated_reader` is the only supported authorization mode
+- Unattended client-secret authentication via MSAL
+- Local file inspection and temporary decryption
+- No DRM bypass: the delegated user must have the required document usage right
+
+The package does not bundle the .NET helper or Microsoft MIP SDK binaries. Build and install the helper separately, and ensure its Microsoft SDK licensing and redistribution terms are satisfied for your environment.
+
+## Installation
+
+```powershell
+python -m pip install mip-wrapper
+dotnet publish native/MipWrapper.Helper/MipWrapper.Helper.csproj -c Release -o helper-bin
+$env:MIP_WRAPPER_HELPER_PATH = (Resolve-Path helper-bin/MipWrapper.Helper.exe)
+```
+
+The helper requires the .NET runtime targeted by the project and the native Microsoft MIP SDK runtime available to it. `MIP_WRAPPER_HELPER_PATH` may point to the published helper executable. The source repository's `helper-bin/` directory is a local build output and is not part of the Python distribution.
+
+## Usage
+
+```python
+import os
+from mip_wrapper import MipClient
+from mip_wrapper.auth import ClientSecretAuth
+
+auth = ClientSecretAuth(
+    tenant_id=os.environ["MIP_TENANT_ID"],
+    client_id=os.environ["MIP_CLIENT_ID"],
+    secret_provider=lambda: os.environ["MIP_CLIENT_SECRET"],
+)
+
+client = MipClient(
+    auth=auth,
+    authorization_mode="delegated_reader",
+    delegated_user="reader@contoso.com",
+)
+
+info = client.inspect("protected.xlsx")
+print(info.is_protected, info.usage_rights)
+
+with client.decrypted_file("protected.xlsx") as file:
+    process(file.path)
+```
+
+The context manager creates a temporary directory, returns the committed plaintext path, and removes the directory on normal exit and exceptions. A cleanup failure raises `CleanupError`. The original protected file is not used as the output path.
+
+## Entra and document authorization
+
+The app registration must be configured for the Microsoft Information Protection resource and granted the application permission required by the MIP SDK's delegated-reader flow, documented by Microsoft as `Content.DelegatedReader`, with tenant-admin consent. `delegated_reader` is package configuration terminology, not an Entra permission. The delegated user must independently have `Export` or `Owner` usage rights on the protected file; neither the package mode nor the app permission grants document access by itself.
+
+The helper acquires app-only tokens with `AcquireTokenForClient`, using the tenant supplied by the request and the MIP SDK challenge resource as `{resource}/.default`. It does not perform an interactive delegated-user sign-in.
+
+## Security and operational limits
+
+- Do not put client secrets in source code, command-line arguments, logs, or protocol diagnostics. Supply them through a secret provider such as an environment-backed secret store.
+- Protected file contents are written temporarily in plaintext while inside the context manager. Restrict host access and process only authorized content.
+- The helper protocol is local and line-delimited JSON; it is not an authenticated network service.
+- The package does not download, install, or update the helper or Microsoft SDK runtime.
+- Real tenant credentials and protected files are required for integration testing. Unit tests use fake helper processes and do not prove tenant authorization or MIP service connectivity.
+
+## Development
+
+```powershell
+python -m pip install -e .
+python -m pytest
+dotnet build native/MipWrapper.Helper/MipWrapper.Helper.csproj -c Release
+```
+
+See [`BUILD_LOCALLY.md`](BUILD_LOCALLY.md) for the local helper workflow. See [`docs/distribution-and-licensing.md`](docs/distribution-and-licensing.md) for the unresolved Microsoft SDK distribution and licensing questions. This project is not affiliated with or endorsed by Microsoft.
+
+## License
+
+The wrapper source is MIT licensed. The Microsoft Information Protection SDK and its native runtime are separately licensed by Microsoft; this repository does not grant rights to redistribute them.

mip_wrapper-0.1.0/README.md

@@ -0,0 +1,80 @@
+# mip-wrapper
+
+Unofficial Python wrapper for inspecting and decrypting files protected by Microsoft Purview Information Protection. The Python package starts a local JSON subprocess bridge to a separately built .NET helper, which calls the Microsoft Information Protection File SDK.
+
+## Scope
+
+- Windows x64 only
+- Python 3.11 or newer
+- `delegated_reader` is the only supported authorization mode
+- Unattended client-secret authentication via MSAL
+- Local file inspection and temporary decryption
+- No DRM bypass: the delegated user must have the required document usage right
+
+The package does not bundle the .NET helper or Microsoft MIP SDK binaries. Build and install the helper separately, and ensure its Microsoft SDK licensing and redistribution terms are satisfied for your environment.
+
+## Installation
+
+```powershell
+python -m pip install mip-wrapper
+dotnet publish native/MipWrapper.Helper/MipWrapper.Helper.csproj -c Release -o helper-bin
+$env:MIP_WRAPPER_HELPER_PATH = (Resolve-Path helper-bin/MipWrapper.Helper.exe)
+```
+
+The helper requires the .NET runtime targeted by the project and the native Microsoft MIP SDK runtime available to it. `MIP_WRAPPER_HELPER_PATH` may point to the published helper executable. The source repository's `helper-bin/` directory is a local build output and is not part of the Python distribution.
+
+## Usage
+
+```python
+import os
+from mip_wrapper import MipClient
+from mip_wrapper.auth import ClientSecretAuth
+
+auth = ClientSecretAuth(
+    tenant_id=os.environ["MIP_TENANT_ID"],
+    client_id=os.environ["MIP_CLIENT_ID"],
+    secret_provider=lambda: os.environ["MIP_CLIENT_SECRET"],
+)
+
+client = MipClient(
+    auth=auth,
+    authorization_mode="delegated_reader",
+    delegated_user="reader@contoso.com",
+)
+
+info = client.inspect("protected.xlsx")
+print(info.is_protected, info.usage_rights)
+
+with client.decrypted_file("protected.xlsx") as file:
+    process(file.path)
+```
+
+The context manager creates a temporary directory, returns the committed plaintext path, and removes the directory on normal exit and exceptions. A cleanup failure raises `CleanupError`. The original protected file is not used as the output path.
+
+## Entra and document authorization
+
+The app registration must be configured for the Microsoft Information Protection resource and granted the application permission required by the MIP SDK's delegated-reader flow, documented by Microsoft as `Content.DelegatedReader`, with tenant-admin consent. `delegated_reader` is package configuration terminology, not an Entra permission. The delegated user must independently have `Export` or `Owner` usage rights on the protected file; neither the package mode nor the app permission grants document access by itself.
+
+The helper acquires app-only tokens with `AcquireTokenForClient`, using the tenant supplied by the request and the MIP SDK challenge resource as `{resource}/.default`. It does not perform an interactive delegated-user sign-in.
+
+## Security and operational limits
+
+- Do not put client secrets in source code, command-line arguments, logs, or protocol diagnostics. Supply them through a secret provider such as an environment-backed secret store.
+- Protected file contents are written temporarily in plaintext while inside the context manager. Restrict host access and process only authorized content.
+- The helper protocol is local and line-delimited JSON; it is not an authenticated network service.
+- The package does not download, install, or update the helper or Microsoft SDK runtime.
+- Real tenant credentials and protected files are required for integration testing. Unit tests use fake helper processes and do not prove tenant authorization or MIP service connectivity.
+
+## Development
+
+```powershell
+python -m pip install -e .
+python -m pytest
+dotnet build native/MipWrapper.Helper/MipWrapper.Helper.csproj -c Release
+```
+
+See [`BUILD_LOCALLY.md`](BUILD_LOCALLY.md) for the local helper workflow. See [`docs/distribution-and-licensing.md`](docs/distribution-and-licensing.md) for the unresolved Microsoft SDK distribution and licensing questions. This project is not affiliated with or endorsed by Microsoft.
+
+## License
+
+The wrapper source is MIT licensed. The Microsoft Information Protection SDK and its native runtime are separately licensed by Microsoft; this repository does not grant rights to redistribute them.

mip_wrapper-0.1.0/pyproject.toml

@@ -0,0 +1,51 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "mip-wrapper"
+version = "0.1.0"
+description = "Unofficial Python wrapper for Microsoft Information Protection file decryption"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+keywords = ["mip", "information-protection", "azure-rights-management", "decryption"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Natural Language :: English",
+    "Operating System :: Microsoft :: Windows",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Software Development :: Libraries",
+]
+
+dependencies = [
+    "packaging>=21.0",
+]
+
+[project.urls]
+Repository = "https://github.com/firaun2020/mip-wrapper"
+Documentation = "https://github.com/firaun2020/mip-wrapper/tree/main/docs"
+Issues = "https://github.com/firaun2020/mip-wrapper/issues"
+
+[tool.setuptools]
+packages = ["mip_wrapper", "mip_wrapper.bridge"]
+package-dir = {"" = "src"}
+
+[tool.setuptools.package-data]
+mip_wrapper = ["py.typed"]
+
+[tool.mypy]
+python_version = "3.11"
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = true
+disallow_incomplete_defs = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = ["test_*.py"]
+python_classes = ["Test*"]
+python_functions = ["test_*"]

mip_wrapper-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

mip_wrapper-0.1.0/src/mip_wrapper/__init__.py

@@ -0,0 +1,47 @@
+"""MIP Wrapper: Python interface for Microsoft Information Protection decryption."""
+
+from mip_wrapper.client import MipClient
+from mip_wrapper.exceptions import (
+    AuthenticationError,
+    AuthorizationError,
+    CleanupError,
+    DecryptionError,
+    DestinationError,
+    InvalidConfigurationError,
+    MipError,
+    MissingRuntimeError,
+    NativeRuntimeError,
+    PermissionDeniedError,
+    ProtocolError,
+    UnsupportedFileTypeError,
+    UnsupportedProtectionError,
+)
+from mip_wrapper.auth import AuthBase, CertificateAuth, ClientSecretAuth
+from mip_wrapper.artifacts import DecryptedFile, FileInfo
+from mip_wrapper.version import PACKAGE_VERSION, PROTOCOL_VERSION
+
+__version__ = PACKAGE_VERSION
+
+__all__ = [
+    "MipClient",
+    "MipError",
+    "AuthenticationError",
+    "AuthorizationError",
+    "PermissionDeniedError",
+    "UnsupportedProtectionError",
+    "UnsupportedFileTypeError",
+    "InvalidConfigurationError",
+    "NativeRuntimeError",
+    "ProtocolError",
+    "DecryptionError",
+    "CleanupError",
+    "DestinationError",
+    "MissingRuntimeError",
+    "AuthBase",
+    "CertificateAuth",
+    "ClientSecretAuth",
+    "DecryptedFile",
+    "FileInfo",
+    "PACKAGE_VERSION",
+    "PROTOCOL_VERSION",
+]

mip_wrapper-0.1.0/src/mip_wrapper/artifacts.py

@@ -0,0 +1,82 @@
+"""Decrypted file artifacts."""
+
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+class DecryptedFile:
+    """Artifact representing a decrypted temporary file."""
+
+    def __init__(
+        self,
+        path: Path,
+        filename: str,
+        file_format: str,
+        size_bytes: int | None = None,
+        audit_metadata: dict[str, str] | None = None,
+    ) -> None:
+        """
+        Initialize decrypted file artifact.
+
+        Args:
+            path: Path to the decrypted file
+            filename: Original filename
+            file_format: File extension (.xlsx, .pdf, etc.)
+            size_bytes: Size of decrypted file (if known)
+            audit_metadata: Safe audit metadata
+        """
+        self.path = path
+        self.filename = filename
+        self.file_format = file_format
+        self.size_bytes = size_bytes
+        self.audit_metadata = audit_metadata or {}
+        self.decryption_timestamp = datetime.now(timezone.utc)
+
+    def __repr__(self) -> str:
+        return f"DecryptedFile(path={self.path}, filename={self.filename})"
+
+
+class FileInfo:
+    """Metadata about a protected file."""
+
+    def __init__(
+        self,
+        is_protected: bool,
+        label_id: str | None,
+        tenant_id: str | None,
+        file_format: str,
+        protection_type: str,
+        usage_rights: list[str],
+        can_decrypt: bool,
+        sdk_version: str,
+        helper_version: str,
+    ) -> None:
+        """
+        Initialize file info.
+
+        Args:
+            is_protected: Whether file is MIP-protected
+            label_id: Sensitivity label ID (if available)
+            tenant_id: Tenant ID where file is protected
+            file_format: File extension
+            protection_type: Type of protection (azure_rms, etc.)
+            usage_rights: Available rights for current user
+            can_decrypt: Whether current config can decrypt
+            sdk_version: MIP SDK version
+            helper_version: Helper version
+        """
+        self.is_protected = is_protected
+        self.label_id = label_id
+        self.tenant_id = tenant_id
+        self.file_format = file_format
+        self.protection_type = protection_type
+        self.usage_rights = usage_rights
+        self.can_decrypt = can_decrypt
+        self.sdk_version = sdk_version
+        self.helper_version = helper_version
+
+    def __repr__(self) -> str:
+        return (
+            f"FileInfo(protected={self.is_protected}, "
+            f"label={self.label_id}, rights={self.usage_rights})"
+        )

mip_wrapper-0.1.0/src/mip_wrapper/auth.py

@@ -0,0 +1,101 @@
+"""Authentication configuration."""
+
+from abc import ABC, abstractmethod
+from pathlib import Path
+
+from mip_wrapper.exceptions import InvalidConfigurationError
+
+
+class AuthBase(ABC):
+    """Base class for authentication methods."""
+
+    tenant_id: str
+    client_id: str
+
+    @abstractmethod
+    def validate(self) -> None:
+        """Validate configuration is complete."""
+        pass
+
+
+class CertificateAuth(AuthBase):
+    """Certificate-based authentication (recommended)."""
+
+    def __init__(
+        self,
+        tenant_id: str,
+        client_id: str,
+        certificate_path: str,
+        certificate_password_path: str | None = None,
+    ) -> None:
+        """
+        Configure certificate-based authentication.
+
+        Args:
+            tenant_id: Azure AD tenant ID (UUID or domain)
+            client_id: App registration client ID (UUID)
+            certificate_path: Path to .pfx certificate file
+            certificate_password_path: Path to file containing certificate password
+                                       (optional if cert has no password)
+        """
+        self.tenant_id = tenant_id
+        self.client_id = client_id
+        self.certificate_path = certificate_path
+        self.certificate_password_path = certificate_password_path
+
+    def validate(self) -> None:
+        """Validate certificate paths exist."""
+        if not self.tenant_id or not self.client_id:
+            raise InvalidConfigurationError(
+                "tenant_id and client_id are required",
+                error_code="MissingAuth",
+            )
+
+        cert_path = Path(self.certificate_path)
+        if not cert_path.exists():
+            raise InvalidConfigurationError(
+                f"Certificate file not found: {self.certificate_path}",
+                error_code="CertificateNotFound",
+            )
+
+        if self.certificate_password_path:
+            pwd_path = Path(self.certificate_password_path)
+            if not pwd_path.exists():
+                raise InvalidConfigurationError(
+                    f"Certificate password file not found: {self.certificate_password_path}",
+                    error_code="PasswordFileNotFound",
+                )
+
+
+class ClientSecretAuth(AuthBase):
+    """Client secret authentication (less secure, for development)."""
+
+    def __init__(
+        self,
+        tenant_id: str,
+        client_id: str,
+        secret_provider: callable,
+    ) -> None:
+        """
+        Configure client secret authentication.
+
+        Args:
+            tenant_id: Azure AD tenant ID
+            client_id: App registration client ID
+            secret_provider: Callable that returns the client secret
+
+        Note:
+            Client secrets should be stored securely (Key Vault, etc.)
+            This method is less secure than certificate authentication.
+        """
+        self.tenant_id = tenant_id
+        self.client_id = client_id
+        self.secret_provider = secret_provider
+
+    def validate(self) -> None:
+        """Validate configuration."""
+        if not self.tenant_id or not self.client_id:
+            raise InvalidConfigurationError(
+                "tenant_id and client_id are required",
+                error_code="MissingAuth",
+            )

mip_wrapper-0.1.0/src/mip_wrapper/bridge/__init__.py

@@ -0,0 +1,17 @@
+"""Bridge between Python and .NET helper."""
+
+from mip_wrapper.bridge.client import HelperClient
+from mip_wrapper.bridge.protocol import (
+    DecryptResult,
+    InspectResult,
+    ProtocolRequest,
+    ProtocolResponse,
+)
+
+__all__ = [
+    "HelperClient",
+    "ProtocolRequest",
+    "ProtocolResponse",
+    "InspectResult",
+    "DecryptResult",
+]