simplecrypter 0.1.0__tar.gz → 0.1.2__tar.gz

{simplecrypter-0.1.0 → simplecrypter-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simplecrypter
-Version: 0.1.0
+Version: 0.1.2
 Summary: Small, password-based authenticated encryption for Python strings.
 Author: Muck
 License: MIT
@@ -39,7 +39,9 @@ encrypted = simplecrypter.ez_e("phrase", "password")
 original = simplecrypter.ez_d(encrypted, "password")
 ```
 
-Each encryption uses a new random salt. The encrypted text includes that salt, so only the encrypted value and the password are needed to decrypt it. A wrong password or altered encrypted text raises `ValueError`.
+Each encryption uses a new random salt. The encrypted text includes that salt, so only the encrypted value and the password are needed to decrypt it. `easy_decrypt` returns `"incorrect passwordㅤ"` when the password does not decrypt a correctly formed value, or `"invalid encrypted stringㅤ"` when the value is malformed. Both messages end in the invisible U+3164 character so they can be distinguished from normal text.
+
+The marked error strings are reserved. Attempting to encrypt one returns `"invalid passwordㅤ"` instead.
 
 ## Notes
 

{simplecrypter-0.1.0 → simplecrypter-0.1.2}/README.md

@@ -24,7 +24,9 @@ encrypted = simplecrypter.ez_e("phrase", "password")
 original = simplecrypter.ez_d(encrypted, "password")
 ```
 
-Each encryption uses a new random salt. The encrypted text includes that salt, so only the encrypted value and the password are needed to decrypt it. A wrong password or altered encrypted text raises `ValueError`.
+Each encryption uses a new random salt. The encrypted text includes that salt, so only the encrypted value and the password are needed to decrypt it. `easy_decrypt` returns `"incorrect passwordㅤ"` when the password does not decrypt a correctly formed value, or `"invalid encrypted stringㅤ"` when the value is malformed. Both messages end in the invisible U+3164 character so they can be distinguished from normal text.
+
+The marked error strings are reserved. Attempting to encrypt one returns `"invalid passwordㅤ"` instead.
 
 ## Notes
 

{simplecrypter-0.1.0 → simplecrypter-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "simplecrypter"
-version = "0.1.0"
+version = "0.1.2"
 description = "Small, password-based authenticated encryption for Python strings."
 readme = "README.md"
 requires-python = ">=3.9"

{simplecrypter-0.1.0 → simplecrypter-0.1.2}/src/simplecrypter/core.py

@@ -9,6 +9,11 @@ from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
 
 _PREFIX = "simplecrypter:v1:"
 _SALT_BYTES = 16
+_ERROR_SUFFIX = "\u3164"
+_INCORRECT_PASSWORD = f"incorrect password{_ERROR_SUFFIX}"
+_INVALID_CIPHERTEXT = f"invalid encrypted string{_ERROR_SUFFIX}"
+_INVALID_PASSWORD = f"invalid password{_ERROR_SUFFIX}"
+_RESERVED_ERROR_VALUES = {_INCORRECT_PASSWORD, _INVALID_CIPHERTEXT, _INVALID_PASSWORD}
 
 
 def _require_text(value: str, name: str) -> None:
@@ -27,6 +32,8 @@ def _key_from_password(password: str, salt: bytes) -> bytes:
 def easy_encrypt(phrase: str, password: str) -> str:
     """Encrypt a text phrase with a password and return a self-contained string."""
     _require_text(phrase, "phrase")
+    if phrase in _RESERVED_ERROR_VALUES:
+        return _INVALID_PASSWORD
     salt = os.urandom(_SALT_BYTES)
     encrypted = Fernet(_key_from_password(password, salt)).encrypt(phrase.encode("utf-8"))
     encoded_salt = base64.urlsafe_b64encode(salt).decode("ascii")
@@ -34,19 +41,27 @@ def easy_encrypt(phrase: str, password: str) -> str:
 
 
 def easy_decrypt(ciphertext: str, password: str) -> str:
-    """Decrypt text returned by :func:`easy_encrypt` using its original password."""
-    _require_text(ciphertext, "ciphertext")
+    """Decrypt a value, returning a friendly message instead of crypto errors.
+
+    A malformed value returns ``"invalid encrypted stringㅤ"``. A wrong password
+    (or an altered encrypted payload, which cannot safely be distinguished from
+    a wrong password) returns ``"incorrect passwordㅤ"``.
+    """
+    if not isinstance(ciphertext, str) or not ciphertext:
+        return _INVALID_CIPHERTEXT
     _require_text(password, "password")
 
     try:
         if not ciphertext.startswith(_PREFIX):
-            raise ValueError
+            return _INVALID_CIPHERTEXT
         encoded_salt, encrypted = ciphertext.removeprefix(_PREFIX).split(":", 1)
         if not encrypted:
-            raise ValueError
+            return _INVALID_CIPHERTEXT
         salt = base64.urlsafe_b64decode(encoded_salt.encode("ascii"))
         if len(salt) != _SALT_BYTES:
-            raise ValueError
+            return _INVALID_CIPHERTEXT
         return Fernet(_key_from_password(password, salt)).decrypt(encrypted.encode("ascii")).decode("utf-8")
-    except (ValueError, UnicodeError, binascii.Error, InvalidToken) as error:
-        raise ValueError("ciphertext is invalid or the password is incorrect") from error
+    except InvalidToken:
+        return _INCORRECT_PASSWORD
+    except (ValueError, UnicodeError, binascii.Error):
+        return _INVALID_CIPHERTEXT

simplecrypter-0.1.2/tests/test_core.py

@@ -0,0 +1,31 @@
+import simplecrypter
+
+
+def test_encrypt_then_decrypt():
+    encrypted = simplecrypter.easy_encrypt("hello", "a secure password")
+
+    assert encrypted.startswith("simplecrypter:v1:")
+    assert simplecrypter.easy_decrypt(encrypted, "a secure password") == "hello"
+
+
+def test_short_aliases_match_main_api():
+    encrypted = simplecrypter.ez_e("hello", "a secure password")
+
+    assert simplecrypter.ez_d(encrypted, "a secure password") == "hello"
+
+
+def test_wrong_password_returns_a_friendly_message():
+    encrypted = simplecrypter.easy_encrypt("hello", "correct password")
+
+    assert simplecrypter.easy_decrypt(encrypted, "wrong password") == "incorrect passwordㅤ"
+
+
+def test_invalid_ciphertext_returns_a_friendly_message():
+    assert simplecrypter.easy_decrypt("not encrypted", "a secure password") == "invalid encrypted stringㅤ"
+
+
+def test_plain_error_text_can_be_encrypted_but_marked_error_text_is_reserved():
+    encrypted = simplecrypter.easy_encrypt("incorrect password", "a secure password")
+
+    assert simplecrypter.easy_decrypt(encrypted, "a secure password") == "incorrect password"
+    assert simplecrypter.easy_encrypt("incorrect passwordㅤ", "a secure password") == "invalid passwordㅤ"

simplecrypter-0.1.0/tests/test_core.py

@@ -1,23 +0,0 @@
-import pytest
-
-import simplecrypter
-
-
-def test_encrypt_then_decrypt():
-    encrypted = simplecrypter.easy_encrypt("hello", "a secure password")
-
-    assert encrypted.startswith("simplecrypter:v1:")
-    assert simplecrypter.easy_decrypt(encrypted, "a secure password") == "hello"
-
-
-def test_short_aliases_match_main_api():
-    encrypted = simplecrypter.ez_e("hello", "a secure password")
-
-    assert simplecrypter.ez_d(encrypted, "a secure password") == "hello"
-
-
-def test_wrong_password_is_rejected():
-    encrypted = simplecrypter.easy_encrypt("hello", "correct password")
-
-    with pytest.raises(ValueError, match="invalid or the password is incorrect"):
-        simplecrypter.easy_decrypt(encrypted, "wrong password")