R524809
dc6d38c128
- 删除 auth.py 与 deps.py，各路由去除 get_current_user 依赖 - collection.py 更名为 materials.py，冻结链路（ozon/publish/shops/categories）移入 legacy/ - 扩展默认生图服务端口并入 8800 并自动迁移旧配置，水印默认文案改为 Panda Store - 新增 docs/v2.1/backend-structure.md 后端结构盘点文档
38 lines
1.1 KiB
Python
38 lines
1.1 KiB
Python
"""店铺凭证 AES-GCM 加解密（shops/categories/publish 冻结链路使用）。
|
|
|
|
鉴权（JWT/APP_TOKEN）已按 V2.1 决策移除，后续加账户体系时再引入。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import hashlib
|
|
import os
|
|
|
|
from config import get_settings
|
|
|
|
|
|
def _derive_key() -> bytes:
|
|
settings = get_settings()
|
|
return hashlib.sha256(settings.secret_key.encode("utf-8")).digest()
|
|
|
|
|
|
def encrypt_secret(plaintext: str) -> str:
|
|
"""AES-GCM 加密，返回 base64(nonce + ciphertext + tag)。"""
|
|
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
|
|
|
|
key = _derive_key()
|
|
nonce = os.urandom(12)
|
|
aesgcm = AESGCM(key)
|
|
ct = aesgcm.encrypt(nonce, plaintext.encode("utf-8"), None)
|
|
return base64.b64encode(nonce + ct).decode("ascii")
|
|
|
|
|
|
def decrypt_secret(ciphertext: str) -> str:
|
|
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
|
|
|
|
key = _derive_key()
|
|
raw = base64.b64decode(ciphertext.encode("ascii"))
|
|
nonce, ct = raw[:12], raw[12:]
|
|
aesgcm = AESGCM(key)
|
|
return aesgcm.decrypt(nonce, ct, None).decode("utf-8")
|