secure-credentials-kit 0.1.0__tar.gz → 0.2.0__tar.gz

{secure_credentials_kit-0.1.0/secure_credentials_kit.egg-info → secure_credentials_kit-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-credentials-kit
-Version: 0.1.0
+Version: 0.2.0
 Summary: A secure encrypted credentials system for Django and FastAPI, inspired by Rails credentials
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/lexpank/django-secure-credentials-kit
@@ -36,6 +36,7 @@ A secure, encrypted credentials system for Django and FastAPI, inspired by Rails
 - Environment-specific encrypted credentials
 - Framework-neutral CLI for generating and editing encrypted credentials
 - Master keys for editing credentials and read-only keys for application runtime access
+- Signed encrypted credential files backed by an asymmetric signing/verification key pair
 - Django management commands
 - FastAPI helpers for loading credentials into application state
 
@@ -103,16 +104,21 @@ Add secret keys to `.gitignore`:
 echo "secrets/*.key" >> .gitignore
 ```
 
-Generate a new key:
+Generate a new key pair:
 
 ```sh
 secure-credentials-kit generate-key <environment>
 ```
 
-This creates two keys:
+This creates two role-specific keys:
 
-- `secrets/<environment>.master.key` can decrypt, edit, encrypt, and sign credentials.
-- `secrets/<environment>.readonly.key` can decrypt and verify credentials, but cannot produce accepted credential updates.
+- `secrets/<environment>.master.key` can decrypt, edit, encrypt, and sign credentials with the private signing key.
+- `secrets/<environment>.readonly.key` can decrypt and verify credentials with the public verification key, but cannot produce accepted credential updates.
+
+Key files are stored as one-line base64url payloads. The decoded payload contains
+the key material and format version; the package detects the key role
+automatically from the key material, so there is no visible `master:` or
+`readonly:` prefix in the file contents.
 
 You can regenerate a read-only key from an existing master key:
 

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0}/README.md

@@ -6,6 +6,7 @@ A secure, encrypted credentials system for Django and FastAPI, inspired by Rails
 - Environment-specific encrypted credentials
 - Framework-neutral CLI for generating and editing encrypted credentials
 - Master keys for editing credentials and read-only keys for application runtime access
+- Signed encrypted credential files backed by an asymmetric signing/verification key pair
 - Django management commands
 - FastAPI helpers for loading credentials into application state
 
@@ -73,16 +74,21 @@ Add secret keys to `.gitignore`:
 echo "secrets/*.key" >> .gitignore
 ```
 
-Generate a new key:
+Generate a new key pair:
 
 ```sh
 secure-credentials-kit generate-key <environment>
 ```
 
-This creates two keys:
+This creates two role-specific keys:
 
-- `secrets/<environment>.master.key` can decrypt, edit, encrypt, and sign credentials.
-- `secrets/<environment>.readonly.key` can decrypt and verify credentials, but cannot produce accepted credential updates.
+- `secrets/<environment>.master.key` can decrypt, edit, encrypt, and sign credentials with the private signing key.
+- `secrets/<environment>.readonly.key` can decrypt and verify credentials with the public verification key, but cannot produce accepted credential updates.
+
+Key files are stored as one-line base64url payloads. The decoded payload contains
+the key material and format version; the package detects the key role
+automatically from the key material, so there is no visible `master:` or
+`readonly:` prefix in the file contents.
 
 You can regenerate a read-only key from an existing master key:
 

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secure-credentials-kit"
-version = "0.1.0"
+version = "0.2.0"
 description = "A secure encrypted credentials system for Django and FastAPI, inspired by Rails credentials"
 readme = "README.md"
 requires-python = ">=3.10,<3.15"

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0}/secure_credentials_kit/cli.py

@@ -10,7 +10,7 @@ def print_key_paths(env: str, key_paths: dict) -> None:
 
 def generate_key_main(argv=None) -> int:
     parser = argparse.ArgumentParser(
-        description="Generate an encryption key for secure credentials."
+        description="Generate secure credentials keys for an environment."
     )
     parser.add_argument("env", help="Environment name")
     parser.add_argument("--secrets-dir", default="secrets", help="Credentials directory")
@@ -55,7 +55,7 @@ def main(argv=None) -> int:
 
     generate_parser = subparsers.add_parser(
         "generate-key",
-        help="Generate an encryption key for an environment.",
+        help="Generate secure credentials keys for an environment.",
     )
     generate_parser.add_argument("env", help="Environment name")
     generate_parser.add_argument(
@@ -80,7 +80,11 @@ def main(argv=None) -> int:
         default="secrets",
         help="Credentials directory",
     )
-    edit_parser.add_argument("--editor", help="Editor command to use")
+    edit_parser.add_argument(
+        "--editor",
+        default="nano",
+        help="Editor command to use"
+    )
 
     args = parser.parse_args(argv)
 

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0}/secure_credentials_kit/management/commands/credentials_generate_key.py

@@ -4,7 +4,7 @@ from secure_credentials_kit.credentials import generate_credentials_key
 
 
 class Command(BaseCommand):
-    help = "Generate a new encryption key"
+    help = "Generate secure credentials keys"
 
     def add_arguments(self, parser):
         parser.add_argument("env", type=str, help="Environment name")

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0}/secure_credentials_kit/utils.py

@@ -1,4 +1,5 @@
 import base64
+import binascii
 import json
 from typing import Tuple
 
@@ -12,7 +13,8 @@ def _base64_encode(data: bytes) -> str:
 
 
 def _base64_decode(data: str) -> bytes:
-    return base64.urlsafe_b64decode(data.encode("utf-8"))
+    padded_data = data + "=" * (-len(data) % 4)
+    return base64.urlsafe_b64decode(padded_data.encode("utf-8"))
 
 
 def _generate_signing_key_pair():
@@ -50,7 +52,11 @@ def _verify_signature(verification_key: str, data: str, signature: str) -> None:
 
 
 def serialize_key(key_data: dict) -> str:
-    return json.dumps(key_data, sort_keys=True)
+    payload = key_data.copy()
+    payload.pop("role", None)
+    return _base64_encode(
+        json.dumps(payload, separators=(",", ":"), sort_keys=True).encode("utf-8")
+    )
 
 
 def parse_key(key: str) -> dict:
@@ -59,7 +65,11 @@ def parse_key(key: str) -> dict:
     try:
         key_data = json.loads(stripped_key)
     except json.JSONDecodeError:
-        raise ValueError("Unsupported credentials key format")
+        try:
+            decoded_key = _base64_decode(stripped_key).decode("utf-8")
+            key_data = json.loads(decoded_key)
+        except (binascii.Error, json.JSONDecodeError, UnicodeDecodeError):
+            raise ValueError("Unsupported credentials key format")
 
     if not isinstance(key_data, dict):
         raise ValueError("Unsupported credentials key format")
@@ -68,8 +78,13 @@ def parse_key(key: str) -> dict:
         raise ValueError("Unsupported credentials key format")
 
     role = key_data.get("role")
-    if role not in {MASTER_KEY_ROLE, READONLY_KEY_ROLE}:
+    inferred_role = MASTER_KEY_ROLE if key_data.get("signing_key") else READONLY_KEY_ROLE
+    if role is None:
+        role = inferred_role
+    elif role not in {MASTER_KEY_ROLE, READONLY_KEY_ROLE}:
         raise ValueError("Unsupported credentials key role")
+    elif role != inferred_role:
+        raise ValueError("Credentials key role does not match key material")
 
     if not key_data.get("encryption_key"):
         raise ValueError("Credentials key is missing encryption_key")
@@ -80,6 +95,8 @@ def parse_key(key: str) -> dict:
     if role == MASTER_KEY_ROLE and not key_data.get("signing_key"):
         raise ValueError("Master credentials key is missing signing_key")
 
+    key_data = key_data.copy()
+    key_data["role"] = role
     return key_data
 
 

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0/secure_credentials_kit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-credentials-kit
-Version: 0.1.0
+Version: 0.2.0
 Summary: A secure encrypted credentials system for Django and FastAPI, inspired by Rails credentials
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/lexpank/django-secure-credentials-kit
@@ -36,6 +36,7 @@ A secure, encrypted credentials system for Django and FastAPI, inspired by Rails
 - Environment-specific encrypted credentials
 - Framework-neutral CLI for generating and editing encrypted credentials
 - Master keys for editing credentials and read-only keys for application runtime access
+- Signed encrypted credential files backed by an asymmetric signing/verification key pair
 - Django management commands
 - FastAPI helpers for loading credentials into application state
 
@@ -103,16 +104,21 @@ Add secret keys to `.gitignore`:
 echo "secrets/*.key" >> .gitignore
 ```
 
-Generate a new key:
+Generate a new key pair:
 
 ```sh
 secure-credentials-kit generate-key <environment>
 ```
 
-This creates two keys:
+This creates two role-specific keys:
 
-- `secrets/<environment>.master.key` can decrypt, edit, encrypt, and sign credentials.
-- `secrets/<environment>.readonly.key` can decrypt and verify credentials, but cannot produce accepted credential updates.
+- `secrets/<environment>.master.key` can decrypt, edit, encrypt, and sign credentials with the private signing key.
+- `secrets/<environment>.readonly.key` can decrypt and verify credentials with the public verification key, but cannot produce accepted credential updates.
+
+Key files are stored as one-line base64url payloads. The decoded payload contains
+the key material and format version; the package detects the key role
+automatically from the key material, so there is no visible `master:` or
+`readonly:` prefix in the file contents.
 
 You can regenerate a read-only key from an existing master key:
 

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0}/secure_credentials_kit.egg-info/top_level.txt

@@ -1,2 +1,3 @@
 dist
+secrets
 secure_credentials_kit

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0}/tests/test_key_roles.py

@@ -1,3 +1,4 @@
+import base64
 import json
 import tempfile
 import unittest
@@ -17,6 +18,7 @@ from secure_credentials_kit.utils import (
     encrypt_credentials_data,
     is_master_key,
     is_readonly_key,
+    parse_key,
     serialize_key,
 )
 
@@ -45,6 +47,29 @@ def make_readonly_key() -> str:
 
 
 class KeyRoleTests(unittest.TestCase):
+    def test_serialized_keys_are_base64_payloads_with_inferred_roles(self):
+        key = make_master_key()
+
+        with self.assertRaises(json.JSONDecodeError):
+            json.loads(key)
+
+        payload = json.loads(base64.urlsafe_b64decode(key).decode("utf-8"))
+        self.assertNotIn("role", payload)
+        self.assertEqual(payload["version"], KEY_FORMAT_VERSION)
+        self.assertEqual(parse_key(key)["role"], MASTER_KEY_ROLE)
+
+    def test_legacy_json_keys_are_still_supported(self):
+        legacy_key = json.dumps(
+            {
+                "version": KEY_FORMAT_VERSION,
+                "role": READONLY_KEY_ROLE,
+                "encryption_key": "encryption",
+                "verification_key": "verification",
+            }
+        )
+
+        self.assertTrue(is_readonly_key(legacy_key))
+
     def test_generated_key_roles_are_identified(self):
         self.assertTrue(is_master_key(make_master_key()))
         self.assertTrue(is_readonly_key(make_readonly_key()))
@@ -104,6 +129,27 @@ class KeyRoleTests(unittest.TestCase):
             self.assertEqual(master_path.read_text(), "master-key")
             self.assertEqual(readonly_path.read_text(), "readonly-key")
 
+    def test_generated_master_and_readonly_keys_roundtrip_credentials(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            generated = generate_credentials_key("production", tmpdir)
+
+            master_key = Path(generated["master"]).read_text()
+            readonly_key = Path(generated["readonly"]).read_text()
+
+            self.assertTrue(is_master_key(master_key))
+            self.assertTrue(is_readonly_key(readonly_key))
+
+            encrypted = encrypt_credentials_data(master_key, "api_key: secret")
+
+            self.assertEqual(
+                decrypt_credentials_data(master_key, encrypted),
+                "api_key: secret",
+            )
+            self.assertEqual(
+                decrypt_credentials_data(readonly_key, encrypted),
+                "api_key: secret",
+            )
+
     def test_read_key_prefers_readonly_and_master_key_rejects_readonly_only(self):
         with tempfile.TemporaryDirectory() as tmpdir:
             readonly_path = Path(tmpdir) / "production.readonly.key"
@@ -113,6 +159,13 @@ class KeyRoleTests(unittest.TestCase):
             with self.assertRaises(PermissionError):
                 resolve_master_key_path("production", tmpdir)
 
+    def test_read_key_uses_master_when_readonly_is_absent(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            master_path = Path(tmpdir) / "production.master.key"
+            master_path.write_text(make_master_key())
+
+            self.assertEqual(resolve_read_key_path("production", tmpdir), str(master_path))
+
 
 if __name__ == "__main__":
     unittest.main()

{secure_credentials_kit-0.1.0 → secure_credentials_kit-0.2.0}/tests/test_packaging.py

@@ -13,11 +13,11 @@ class SetupMetadataTests(unittest.TestCase):
         with pyproject_path.open("rb") as f:
             return tomllib.load(f)
 
-    def test_package_uses_secure_credentials_kit_name_and_initial_version(self):
+    def test_package_uses_secure_credentials_kit_name_and_current_version(self):
         metadata = self.load_project_metadata()["project"]
 
         self.assertEqual(metadata["name"], "secure-credentials-kit")
-        self.assertEqual(metadata["version"], "0.1.0")
+        self.assertEqual(metadata["version"], "0.2.0")
         self.assertEqual(metadata["requires-python"], ">=3.10,<3.15")
 
     def test_django_and_fastapi_are_optional_extras(self):