aeat.adapters.persistence.storage.sql._secure_object_crypto module

Cryptographic hash helpers for SQL secure object revision metadata.

derive_revision_id(*, namespace, object_key, schema_version, written_at, payload_hash, ciphertext_hash, previous_revision_id, previous_payload_hash)[source]

Derive a deterministic secure-object revision id from row metadata.

Return type:

str

Parameters:

  • namespace (str)

  • object_key (bytes)

  • schema_version (int)

  • written_at (datetime)

  • payload_hash (str)

  • ciphertext_hash (str)

  • previous_revision_id (str | None)

  • previous_payload_hash (str | None)

verify_revision_self_consistency(*, namespace, object_key, schema_version, written_at, revision_id, previous_revision_id, payload_hash, ciphertext_hash, previous_payload_hash)[source]

Return whether a stored revision_id recomputes from its lineage columns.

The revision id is a content address over the whole revision-lineage metadata tuple (namespace, object-key digest, schema version, written_at, payload_hash, ciphertext_hash, and the previous revision/payload-hash links). Recomputing it from the stored columns and comparing to the stored revision_id is a read-time integrity gate: a tamper of any single lineage column — including payload_hash — that does not also recompute revision_id is detected and can be failed closed. The check is purely metadata-internal (it never touches the encrypted payload bytes), so it does not interfere with the AEAD payload authentication or with corruption probes that re-encrypt a mutated payload without restamping the metadata.

A row written without revision metadata (revision_id is None) carries nothing to verify and is reported consistent. A row whose revision_id is present but whose required hash inputs are absent is inconsistent.

Return type:

bool

Parameters:

  • namespace (str)

  • object_key (bytes)

  • schema_version (int)

  • written_at (datetime)

  • revision_id (str | None)

  • previous_revision_id (str | None)

  • payload_hash (str | None)

  • ciphertext_hash (str | None)

  • previous_payload_hash (str | None)