58 lines
1.6 KiB
Python
58 lines
1.6 KiB
Python
"""Encrypted secret storage for sensitive Box data (app-level)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import json
|
|
from hashlib import pbkdf2_hmac
|
|
from pathlib import Path
|
|
from typing import Any
|
|
|
|
from cryptography.fernet import Fernet, InvalidToken
|
|
|
|
STATIC_SALT = b"klangkiste-static-salt-v1"
|
|
KDF_ITERATIONS = 200_000
|
|
|
|
|
|
class SecretStore:
|
|
def __init__(self, base_dir: Path, box_id: str) -> None:
|
|
self._path = base_dir / "secrets.enc"
|
|
self._box_id = box_id
|
|
|
|
def load_secrets(self) -> dict[str, Any]:
|
|
if not self._path.exists():
|
|
return {}
|
|
token = self._path.read_bytes()
|
|
fernet = Fernet(self._derive_key())
|
|
try:
|
|
payload = fernet.decrypt(token)
|
|
except InvalidToken:
|
|
return {}
|
|
return json.loads(payload.decode("utf-8"))
|
|
|
|
def save_secrets(self, data: dict[str, Any]) -> None:
|
|
fernet = Fernet(self._derive_key())
|
|
payload = json.dumps(data, indent=2).encode("utf-8")
|
|
token = fernet.encrypt(payload)
|
|
self._path.write_bytes(token)
|
|
|
|
def clear_wifi_secrets(self) -> None:
|
|
data = self.load_secrets()
|
|
if "wifi_profiles" in data:
|
|
data.pop("wifi_profiles")
|
|
self.save_secrets(data)
|
|
|
|
def clear_all(self) -> None:
|
|
if self._path.exists():
|
|
self._path.unlink()
|
|
|
|
def _derive_key(self) -> bytes:
|
|
raw = pbkdf2_hmac(
|
|
"sha256",
|
|
self._box_id.encode("utf-8"),
|
|
STATIC_SALT,
|
|
KDF_ITERATIONS,
|
|
dklen=32,
|
|
)
|
|
return base64.urlsafe_b64encode(raw)
|