Agent Zero
a1d5e56009
Check Cross-Plugin Imports / check (push) Has been cancelled
Die 3 pure-function Bloecke aus services.py in eigene Sub-Module extrahiert: crypto.py (AES-256 Fernet mit Legacy-Salt + MAIL_ENCRYPTION_KEY-Guard), sanitize.py (nh3 HTML-Sanitizer), pgp.py (pgpy-basiert). Rueckwaertskompatibilitaet via Re-Export-Imports in services.py — alle 4 Consumer unveraendert. Beweis: mail+sig_label_routes 51/51 passed in 105.52s; ruff clean.
49 lines
1.8 KiB
Python
49 lines
1.8 KiB
Python
"""PGP encryption/decryption for the Mail plugin using pgpy.
|
|
|
|
Extracted from services.py as part of the God-object split (BUG-018 pilot).
|
|
Re-exported by ``app.plugins.builtins.mail.services``.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pgpy
|
|
|
|
|
|
def import_pgp_private_key(private_key_armored: str, passphrase: str = "") -> tuple[str, str]:
|
|
"""Import a PGP private key. Returns (key_id, public_key_armored)."""
|
|
key, _ = pgpy.PGPKey.from_blob(private_key_armored)
|
|
if key.is_protected:
|
|
with key.unlock(passphrase):
|
|
pub_key = key.pubkey
|
|
key_id = str(key.fingerprint).upper()[-16:]
|
|
return key_id, str(pub_key)
|
|
pub_key = key.pubkey
|
|
key_id = str(key.fingerprint).upper()[-16:]
|
|
return key_id, str(pub_key)
|
|
|
|
|
|
def import_pgp_public_key(public_key_armored: str) -> str:
|
|
"""Import a PGP public key. Returns key_id."""
|
|
key, _ = pgpy.PGPKey.from_blob(public_key_armored)
|
|
return str(key.fingerprint).upper()[-16:]
|
|
|
|
|
|
def pgp_encrypt_message(plaintext: str, recipient_public_key_armored: str) -> str:
|
|
"""Encrypt a message with recipient's public PGP key."""
|
|
pub_key, _ = pgpy.PGPKey.from_blob(recipient_public_key_armored)
|
|
msg = pgpy.PGPMessage.new(plaintext)
|
|
encrypted = pub_key.encrypt(msg)
|
|
return str(encrypted)
|
|
|
|
|
|
def pgp_decrypt_message(ciphertext: str, private_key_armored: str, passphrase: str = "") -> str:
|
|
"""Decrypt a PGP-encrypted message."""
|
|
key, _ = pgpy.PGPKey.from_blob(private_key_armored)
|
|
enc_msg = pgpy.PGPMessage.from_blob(ciphertext)
|
|
if key.is_protected:
|
|
with key.unlock(passphrase):
|
|
decrypted = key.decrypt(enc_msg)
|
|
return decrypted.message.decode("utf-8")
|
|
decrypted = key.decrypt(enc_msg)
|
|
return decrypted.message.decode("utf-8")
|