cadrumo.adapters.persistence.profile.review_package_recipient_encryption module¶

Persistence and cryptographic adapter for recipient-encrypted packages.

This module is the outward implementation of the application-owned recipient-encryption capability. It owns the X25519, HKDF, and AEAD details and translates their wire values and failures at the application boundary.

Core types: SecureObjectRepository.

class RecipientEncryptionAdapter(*, repository=None, bucket_id=None)[source]¶

Bases: object

Concrete recipient-encryption capability backed by secure objects.

Parameters:

repository (SecureObjectRepository | None)
bucket_id (str | None)

ensure_keypair(*, bucket_id, generated_at=None)[source]¶

Load or atomically mint one bucket-scoped X25519 keypair.

Return type:

RecipientEncryptionKeypair

Parameters:

bucket_id (str)
generated_at (datetime | None)

encrypt(package_bytes, *, recipient_public_key_hex, review_only=False, valid_for=None, issued_at=None)[source]¶

Seal bytes for a recipient using X25519 ECIES over project AEAD.

Return type:

RecipientEncryptedPackage

Parameters:

package_bytes (bytes)
recipient_public_key_hex (str)
review_only (bool)
valid_for (timedelta | None)
issued_at (datetime | None)

decrypt(envelope, *, recipient_private_key_hex, now=None)[source]¶

Open one recipient envelope and return its application DTO.

Return type:

RecipientDecryptedPackage

Parameters:

envelope (RecipientEncryptedPackage)
recipient_private_key_hex (str)
now (datetime | None)

build_recipient_encryption_capability(*, bucket_id)[source]¶

Bind the concrete capability to the secure repository for bucket_id.

Return type:: RecipientEncryptionCapability
Parameters:: bucket_id (str)