simplecrypter 0.1.1__tar.gz → 0.1.2__tar.gz

{simplecrypter-0.1.1 → simplecrypter-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simplecrypter
-Version: 0.1.1
+Version: 0.1.2
 Summary: Small, password-based authenticated encryption for Python strings.
 Author: Muck
 License: MIT
@@ -39,7 +39,9 @@ encrypted = simplecrypter.ez_e("phrase", "password")
 original = simplecrypter.ez_d(encrypted, "password")
 ```
 
-Each encryption uses a new random salt. The encrypted text includes that salt, so only the encrypted value and the password are needed to decrypt it. `easy_decrypt` returns `"incorrect password"` when the password does not decrypt a correctly formed value, or `"invalid encrypted string"` when the value is malformed.
+Each encryption uses a new random salt. The encrypted text includes that salt, so only the encrypted value and the password are needed to decrypt it. `easy_decrypt` returns `"incorrect passwordㅤ"` when the password does not decrypt a correctly formed value, or `"invalid encrypted stringㅤ"` when the value is malformed. Both messages end in the invisible U+3164 character so they can be distinguished from normal text.
+
+The marked error strings are reserved. Attempting to encrypt one returns `"invalid passwordㅤ"` instead.
 
 ## Notes
 

{simplecrypter-0.1.1 → simplecrypter-0.1.2}/README.md

@@ -24,7 +24,9 @@ encrypted = simplecrypter.ez_e("phrase", "password")
 original = simplecrypter.ez_d(encrypted, "password")
 ```
 
-Each encryption uses a new random salt. The encrypted text includes that salt, so only the encrypted value and the password are needed to decrypt it. `easy_decrypt` returns `"incorrect password"` when the password does not decrypt a correctly formed value, or `"invalid encrypted string"` when the value is malformed.
+Each encryption uses a new random salt. The encrypted text includes that salt, so only the encrypted value and the password are needed to decrypt it. `easy_decrypt` returns `"incorrect passwordㅤ"` when the password does not decrypt a correctly formed value, or `"invalid encrypted stringㅤ"` when the value is malformed. Both messages end in the invisible U+3164 character so they can be distinguished from normal text.
+
+The marked error strings are reserved. Attempting to encrypt one returns `"invalid passwordㅤ"` instead.
 
 ## Notes
 

{simplecrypter-0.1.1 → simplecrypter-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "simplecrypter"
-version = "0.1.1"
+version = "0.1.2"
 description = "Small, password-based authenticated encryption for Python strings."
 readme = "README.md"
 requires-python = ">=3.9"

{simplecrypter-0.1.1 → simplecrypter-0.1.2}/src/simplecrypter/core.py

@@ -9,6 +9,11 @@ from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
 
 _PREFIX = "simplecrypter:v1:"
 _SALT_BYTES = 16
+_ERROR_SUFFIX = "\u3164"
+_INCORRECT_PASSWORD = f"incorrect password{_ERROR_SUFFIX}"
+_INVALID_CIPHERTEXT = f"invalid encrypted string{_ERROR_SUFFIX}"
+_INVALID_PASSWORD = f"invalid password{_ERROR_SUFFIX}"
+_RESERVED_ERROR_VALUES = {_INCORRECT_PASSWORD, _INVALID_CIPHERTEXT, _INVALID_PASSWORD}
 
 
 def _require_text(value: str, name: str) -> None:
@@ -27,6 +32,8 @@ def _key_from_password(password: str, salt: bytes) -> bytes:
 def easy_encrypt(phrase: str, password: str) -> str:
     """Encrypt a text phrase with a password and return a self-contained string."""
     _require_text(phrase, "phrase")
+    if phrase in _RESERVED_ERROR_VALUES:
+        return _INVALID_PASSWORD
     salt = os.urandom(_SALT_BYTES)
     encrypted = Fernet(_key_from_password(password, salt)).encrypt(phrase.encode("utf-8"))
     encoded_salt = base64.urlsafe_b64encode(salt).decode("ascii")
@@ -36,25 +43,25 @@ def easy_encrypt(phrase: str, password: str) -> str:
 def easy_decrypt(ciphertext: str, password: str) -> str:
     """Decrypt a value, returning a friendly message instead of crypto errors.
 
-    A malformed value returns ``"invalid encrypted string"``. A wrong password
+    A malformed value returns ``"invalid encrypted stringㅤ"``. A wrong password
     (or an altered encrypted payload, which cannot safely be distinguished from
-    a wrong password) returns ``"incorrect password"``.
+    a wrong password) returns ``"incorrect passwordㅤ"``.
     """
     if not isinstance(ciphertext, str) or not ciphertext:
-        return "invalid encrypted string"
+        return _INVALID_CIPHERTEXT
     _require_text(password, "password")
 
     try:
         if not ciphertext.startswith(_PREFIX):
-            return "invalid encrypted string"
+            return _INVALID_CIPHERTEXT
         encoded_salt, encrypted = ciphertext.removeprefix(_PREFIX).split(":", 1)
         if not encrypted:
-            return "invalid encrypted string"
+            return _INVALID_CIPHERTEXT
         salt = base64.urlsafe_b64decode(encoded_salt.encode("ascii"))
         if len(salt) != _SALT_BYTES:
-            return "invalid encrypted string"
+            return _INVALID_CIPHERTEXT
         return Fernet(_key_from_password(password, salt)).decrypt(encrypted.encode("ascii")).decode("utf-8")
     except InvalidToken:
-        return "incorrect password"
+        return _INCORRECT_PASSWORD
     except (ValueError, UnicodeError, binascii.Error):
-        return "invalid encrypted string"
+        return _INVALID_CIPHERTEXT

{simplecrypter-0.1.1 → simplecrypter-0.1.2}/tests/test_core.py

@@ -17,8 +17,15 @@ def test_short_aliases_match_main_api():
 def test_wrong_password_returns_a_friendly_message():
     encrypted = simplecrypter.easy_encrypt("hello", "correct password")
 
-    assert simplecrypter.easy_decrypt(encrypted, "wrong password") == "incorrect password"
+    assert simplecrypter.easy_decrypt(encrypted, "wrong password") == "incorrect passwordㅤ"
 
 
 def test_invalid_ciphertext_returns_a_friendly_message():
-    assert simplecrypter.easy_decrypt("not encrypted", "a secure password") == "invalid encrypted string"
+    assert simplecrypter.easy_decrypt("not encrypted", "a secure password") == "invalid encrypted stringㅤ"
+
+
+def test_plain_error_text_can_be_encrypted_but_marked_error_text_is_reserved():
+    encrypted = simplecrypter.easy_encrypt("incorrect password", "a secure password")
+
+    assert simplecrypter.easy_decrypt(encrypted, "a secure password") == "incorrect password"
+    assert simplecrypter.easy_encrypt("incorrect passwordㅤ", "a secure password") == "invalid passwordㅤ"