Codex
44 lines
1.1 KiB
Python
44 lines
1.1 KiB
Python
#!/usr/bin/env python
|
|
# -*- coding: utf-8 -*-
|
|
"""敏感信息加解密（数据库连接密码等）"""
|
|
import base64
|
|
import hashlib
|
|
import logging
|
|
|
|
from app.config import settings
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
_fernet = None
|
|
|
|
|
|
def _get_fernet():
|
|
global _fernet
|
|
if _fernet is not None:
|
|
return _fernet
|
|
try:
|
|
from cryptography.fernet import Fernet
|
|
except ImportError as exc:
|
|
raise RuntimeError("cryptography package is required for secret encryption") from exc
|
|
|
|
secret = getattr(settings, "DB_CONN_SECRET_KEY", None) or settings.JWT_SECRET_KEY
|
|
key = base64.urlsafe_b64encode(hashlib.sha256(secret.encode("utf-8")).digest())
|
|
_fernet = Fernet(key)
|
|
return _fernet
|
|
|
|
|
|
def encrypt_secret(value: str) -> str:
|
|
if not value:
|
|
return ""
|
|
return _get_fernet().encrypt(value.encode("utf-8")).decode("utf-8")
|
|
|
|
|
|
def decrypt_secret(value: str) -> str:
|
|
if not value:
|
|
return ""
|
|
try:
|
|
return _get_fernet().decrypt(value.encode("utf-8")).decode("utf-8")
|
|
except Exception as exc:
|
|
logger.warning("Failed to decrypt secret: %s", exc)
|
|
return ""
|