aeat.adapters.persistence.storage.attachment module¶

Encrypted SQL-backed content-addressed attachment store implementation.

Concrete adapter-layer implementation of the AttachmentStoreProtocol. The domain declares the protocol; this module provides the implementation that reads/writes encrypted attachment blobs and manifests through the SecureObjectRepository persistence substrate. Blob rows are framed byte payloads governed by adapters.persistence.storage.ATTACHMENT_BLOB_NAMESPACE; manifest rows wrap Attachment payloads in Envelope records governed by adapters.persistence.storage.ATTACHMENT_MANIFEST_NAMESPACE.

Sensitivity rationale: attachment blobs and manifests are content-addressed byte objects (invoice PDFs, bank statements, supporting documents) that are FINANCIAL regardless of the modelo that triggered the upload. Attachments are not modelo-scoped - a single blob may be referenced from multiple modelos and filing revisions. The ModeloDefinition.output_sensitivity field governs model output artefacts; attachment storage is an independent content- addressed substrate and its sensitivity class is irreducibly FINANCIAL.

class AttachmentStore(**data)[source]¶

Bases: BaseModel

Encrypted SQL-backed content-addressed attachment store.

Implements AttachmentStoreProtocol by storing raw document bytes under their SHA-256 digest in adapters.persistence.storage.ATTACHMENT_BLOB_NAMESPACE and encrypted Attachment manifests in adapters.persistence.storage.ATTACHMENT_MANIFEST_NAMESPACE. Both namespaces are profile-local FINANCIAL custody surfaces; the SecureObjectRepository encrypts the stored rows and HMAC-digests the object keys.

Parameters:: objects (SecureObjectRepository | None)

objects: SecureObjectRepository | None¶

property blobs_dir: Path¶: Return the logical marker for the attachment blob namespace.

property manifests_dir: Path¶: Return the logical marker for the attachment manifest namespace.

manifest_path(attachment_id)[source]¶

Return a logical object marker for attachment_id.

Return type:: Path
Parameters:: attachment_id (str)

put_bytes(data)[source]¶

Write data under its SHA-256 digest in the blob namespace.

Return type:: str
Parameters:: data (bytes)

put_file(source)[source]¶

Read source into the encrypted object backend.

Return type:: tuple[str, int]
Parameters:: source (Path)

read_bytes(sha256)[source]¶

Return the raw bytes for sha256.

Return type:: bytes
Parameters:: sha256 (str)

open_bytes(sha256)[source]¶

Open the blob for sha256 as a streaming binary handle.

Return type:: BinaryIO
Parameters:: sha256 (str)

verify_blob(attachment_id)[source]¶

Re-hash the stored blob and verify it matches attachment_id.

Return type:: None
Parameters:: attachment_id (str)

write_manifest(attachment)[source]¶

Persist attachment as an encrypted manifest envelope.

Return type:: None
Parameters:: attachment (Attachment)

load_manifest(attachment_id)[source]¶

Load and validate the Attachment manifest envelope.

Return type:: Attachment
Parameters:: attachment_id (str)

iter_manifests()[source]¶

Iterate over every Attachment manifest in sorted attachment-id order.

Return type:: Iterator[Attachment]