aeat.application.user_profile._bundle_encryption module

Passphrase encryption for portable profile-bundle exports.

class EncryptedProfileBundleExport(**data)[source]

Bases: BaseModel

Encrypted transport envelope for a serialized profile-bundle payload.

The ciphertext wraps the exact UserProfilePortableExport JSON bytes. The envelope schema is transport metadata only; after decryption, callers still validate the original bundle model and its bundle_schema_version.

Parameters:

  • encrypted_bundle_schema_version (int)

  • payload_model (str)

  • payload_schema_version (int)

  • kdf (str)

  • kdf_version (int)

  • memory_cost (int)

  • time_cost (int)

  • parallelism (int)

  • salt_b64 (str)

  • ciphertext_b64 (str)

encrypted_bundle_schema_version: int
payload_model: str
payload_schema_version: int
kdf: str
kdf_version: int
memory_cost: int
time_cost: int
parallelism: int
salt_b64: str
ciphertext_b64: str
exception EncryptedProfileBundleError[source]

Bases: ValueError

Raised when an encrypted profile-bundle envelope cannot be opened.

encrypt_profile_bundle_for_passphrase(bundle, *, passphrase)[source]

Encrypt bundle under passphrase and return a transport envelope.

Return type:

EncryptedProfileBundleExport

Parameters:
decrypt_profile_bundle_with_passphrase(envelope, *, passphrase)[source]

Decrypt envelope and validate the wrapped UserProfilePortableExport.

Payload validation routes through validate_bundle_payload(), so an out-of-range or non-upgradeable bundle_schema_version propagates as UnsupportedBundleSchemaVersionError (naming the version) rather than being flattened into the generic envelope error.

Return type:

UserProfilePortableExport

Parameters: