aeat.adapters.persistence.storage.master_key._master_key_bucket_dek module

Bucket-DEK activation helpers for master-key providers.

master_key_unavailable_error(message)

Build and return a MasterKeyUnavailableError for this substrate.

Return type:

MasterKeyUnavailableError

Parameters:

message (str)

bucket_dek_path(*, storage_root, bucket_id)

Return the separated keystore path for one bucket’s wrapped DEK.

Return type:

Path

Parameters:

• storage_root (Path)

• bucket_id (str)

bucket_key_schedule(*, storage_root, bucket_id)

Return the bucket’s key schedule, or None when no manifest exists.

Parameters:

• storage_root (Path)

• bucket_id (str)

idle_minutes_for_bucket(*, storage_root, bucket_id, default_minutes)

Resolve the idle window from the bucket manifest, falling back to settings.

Return type:

int

Parameters:

• storage_root (Path)

• bucket_id (str)

• default_minutes (int)

load_or_mint_bucket_dek(*, kek, storage_root, bucket_id, allow_bootstrap_mint)

Unwrap the per-bucket DEK, or mint it for a not-yet-registered bucket.

Return type:

bytes

Parameters:

• kek (bytes)

• storage_root (Path)

• bucket_id (str)

• allow_bootstrap_mint (bool)

wrapped_dek_from_document(document)

Return a strict wrapped-DEK object from a persisted JSON document.

Parameters:

document (_WrappedBucketDekDocument)

document_from_wrapped_dek(wrapped)

Return the JSON document shape for a wrapped bucket DEK.

Return type:

_WrappedBucketDekDocument

read_wrapped_bucket_dek(path)

Read and validate a wrapped bucket-DEK document from disk.

Parameters:

path (Path)

write_wrapped_bucket_dek(path, wrapped)

Persist a wrapped bucket-DEK document through the secure atomic writer.

Return type:

None

Parameters:

path (Path)