Initial commit: InviteMe production redesign

app/utils/secrets.py

@@ -0,0 +1,34 @@
+import base64
+import hashlib
+
+from cryptography.fernet import Fernet, InvalidToken
+from flask import current_app
+
+
+PREFIX = "fernet:"
+
+
+def _fernet():
+    configured_key = str(current_app.config["CREDENTIAL_ENCRYPTION_KEY"]).encode("utf-8")
+    derived_key = base64.urlsafe_b64encode(hashlib.sha256(configured_key).digest())
+    return Fernet(derived_key)
+
+
+def encrypt_secret(value):
+    if not value:
+        return ""
+    if value.startswith(PREFIX):
+        return value
+    token = _fernet().encrypt(value.encode("utf-8")).decode("ascii")
+    return f"{PREFIX}{token}"
+
+
+def decrypt_secret(value):
+    if not value:
+        return ""
+    if not value.startswith(PREFIX):
+        return value
+    try:
+        return _fernet().decrypt(value[len(PREFIX):].encode("ascii")).decode("utf-8")
+    except InvalidToken as exc:
+        raise RuntimeError("Не удалось расшифровать почтовые учётные данные") from exc