aeat.adapters.persistence.storage.blob_store package

Blob-store substrate for classification-gated encrypted blobs.

Public surface for the content-addressed EncryptedBlobStore and its typed BlobReference / BlobManifest handles. Blob layout is classification-driven: only SensitivityClass.CORPUS payloads are stored as plaintext corpus blobs; every other class is ciphertext with a per-blob wrapped data-encryption key.

This package also exposes the path-shaped secret bridge used by SDKs that cannot consume in-memory bytes. materialise_secret() and export_to_temp_path() read encrypted records through adapters.persistence.storage.secret_store.SecretStore, write a short-lived private tempfile, and leave cleanup ownership explicit. Domain repositories and calculation sources should depend on higher-level secure-object or repository APIs, not on blob paths directly.

Submodules

• aeat.adapters.persistence.storage.blob_store._blob_store module
  • BlobManifest
    • BlobManifest.sha256_plaintext_hex
    • BlobManifest.sha256_ciphertext_hex
    • BlobManifest.size_plaintext
    • BlobManifest.content_type
    • BlobManifest.classification
    • BlobManifest.wrapped_dek
    • BlobManifest.payload_metadata
  • BlobReference
    • BlobReference.sha256_plaintext_hex
    • BlobReference.classification
  • EncryptedBlobStore
    • EncryptedBlobStore.root_dir
    • EncryptedBlobStore.put()
    • EncryptedBlobStore.get()
    • EncryptedBlobStore.delete()
    • EncryptedBlobStore.iter_manifests()
    • EncryptedBlobStore.rotate_master_key()
• aeat.adapters.persistence.storage.blob_store._materialisation module
  • get_secret_store()
  • override_secret_store()
  • materialise_secret()
  • export_to_temp_path()