Class swarmauri_mre_crypto_pgp.pgp_mre.PGPMreCrypto

swarmauri_mre_crypto_pgp.pgp_mre.PGPMreCrypto

Bases: MreCryptoBase

OpenPGP-backed multi-recipient encryption provider.

type class-attribute instance-attribute

type = 'PGPMreCrypto'

default_payload_alg class-attribute instance-attribute

default_payload_alg = 'AES-256-GCM'

default_recipient_alg class-attribute instance-attribute

default_recipient_alg = 'OpenPGP'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Source code in swarmauri_mre_crypto_pgp/pgp_mre.py

def supports(
    self,
) -> Dict[str, Iterable[str | MreMode]]:  # pragma: no cover - trivial
    modes: Tuple[str | MreMode, ...] = (
        MreMode.ENC_ONCE_HEADERS,
        MreMode.SEALED_PER_RECIPIENT,
    )
    return {
        "payload": (self.default_payload_alg,),
        "recipient": ("OpenPGP", "OpenPGP-SEAL"),
        "modes": modes,
        "features": ("aad", "rewrap_without_reencrypt"),
    }

encrypt_for_many async

encrypt_for_many(
    recipients,
    pt,
    *,
    payload_alg=None,
    recipient_alg=None,
    mode=None,
    aad=None,
    shared=None,
    opts=None,
)

Source code in swarmauri_mre_crypto_pgp/pgp_mre.py

async def encrypt_for_many(
    self,
    recipients: Sequence[KeyRef],
    pt: bytes,
    *,
    payload_alg: Optional[Alg] = None,
    recipient_alg: Optional[Alg] = None,
    mode: Optional[MreMode | str] = None,
    aad: Optional[bytes] = None,
    shared: Optional[Mapping[str, bytes]] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> MultiRecipientEnvelope:
    _ensure_pgpy()

    m = (
        MreMode(mode)
        if isinstance(mode, str)
        else (mode or MreMode.ENC_ONCE_HEADERS)
    )
    payload_alg = payload_alg or self.default_payload_alg
    recipient_alg = recipient_alg or self.default_recipient_alg

    pubs = [_load_pubkey(r) for r in recipients]
    rids = [_fingerprint_pub(pk) for pk in pubs]

    if m == MreMode.ENC_ONCE_HEADERS:
        if payload_alg != "AES-256-GCM":
            raise ValueError(
                "PGPMreCrypto currently supports only AES-256-GCM for shared payload."
            )
        cek = os.urandom(32)
        nonce, ct, tag = _aead_encrypt_gcm(cek, pt, aad=aad)
        headers = [
            _make_recipient_header(rid, _pgp_encrypt_bytes_for(pk, cek))
            for rid, pk in zip(rids, pubs)
        ]
        env: MultiRecipientEnvelope = {
            "mode": MreMode.ENC_ONCE_HEADERS.value,
            "payload_alg": payload_alg,
            "recipient_alg": "OpenPGP",
            "payload": _make_aead_payload(payload_alg, nonce, ct, tag, aad),
            "recipients": headers,
        }
        if shared:
            env["shared"] = dict(shared)
        return env

    if m == MreMode.SEALED_PER_RECIPIENT:
        sealed_entries = [
            _make_sealed_recipient(rid, _pgp_encrypt_bytes_for(pk, pt))
            for rid, pk in zip(rids, pubs)
        ]
        env = {
            "mode": MreMode.SEALED_PER_RECIPIENT.value,
            "recipient_alg": "OpenPGP-SEAL",
            "payload": {"kind": "sealed_per_recipient"},
            "recipients": sealed_entries,
        }
        if shared:
            env["shared"] = dict(shared)
        return env

    raise ValueError(f"Unsupported mode: {mode}")

open_for async

open_for(my_identity, env, *, aad=None, opts=None)

Source code in swarmauri_mre_crypto_pgp/pgp_mre.py

async def open_for(
    self,
    my_identity: KeyRef,
    env: MultiRecipientEnvelope,
    *,
    aad: Optional[bytes] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> bytes:
    _ensure_pgpy()
    mode_str = env.get("mode")
    m = MreMode(mode_str) if isinstance(mode_str, str) else mode_str
    priv = _load_privkey(my_identity, (opts or {}).get("passphrase"))

    if m == MreMode.ENC_ONCE_HEADERS:
        my_id = str(priv.fingerprint)
        headers: List[Dict[str, Any]] = env.get("recipients", [])
        target = next((h for h in headers if h.get("id") == my_id), None)

        cek: Optional[bytes] = None
        if target:
            cek = _pgp_decrypt_bytes_with(priv, target["header"])
        else:
            for h in headers:
                try:
                    cek = _pgp_decrypt_bytes_with(priv, h["header"])
                    break
                except Exception:
                    continue
        if cek is None:
            raise PermissionError("This identity cannot open the envelope.")

        payload = env["payload"]
        if payload.get("alg") != "AES-256-GCM":
            raise ValueError("Unsupported payload_alg for PGPMreCrypto open.")
        nonce, ct, tag = payload["nonce"], payload["ct"], payload["tag"]
        bound_aad = payload.get("aad", None)
        if aad is not None and bound_aad is not None and aad != bound_aad:
            raise ValueError("AAD mismatch.")
        return _aead_decrypt_gcm(cek, nonce, ct, tag, aad=bound_aad)

    if m == MreMode.SEALED_PER_RECIPIENT:
        my_id = str(priv.fingerprint)
        entries: List[Dict[str, Any]] = env.get("recipients", [])
        target = next((e for e in entries if e.get("id") == my_id), None)
        if not target:
            for e in entries:
                try:
                    return _pgp_decrypt_bytes_with(priv, e["sealed"])
                except Exception:
                    continue
            raise PermissionError("This identity cannot open the sealed envelope.")
        return _pgp_decrypt_bytes_with(priv, target["sealed"])

    raise ValueError(f"Unsupported mode: {mode_str}")

open_for_many async

open_for_many(my_identities, env, *, aad=None, opts=None)

Source code in swarmauri_mre_crypto_pgp/pgp_mre.py

async def open_for_many(
    self,
    my_identities: Sequence[KeyRef],
    env: MultiRecipientEnvelope,
    *,
    aad: Optional[bytes] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> bytes:
    last_err: Optional[Exception] = None
    for ident in my_identities:
        try:
            return await self.open_for(ident, env, aad=aad, opts=opts)
        except Exception as e:  # pragma: no cover
            last_err = e
            continue
    raise last_err or PermissionError(
        "None of the provided identities could open the envelope."
    )

rewrap async

rewrap(
    env,
    *,
    add=None,
    remove=None,
    recipient_alg=None,
    opts=None,
)

Source code in swarmauri_mre_crypto_pgp/pgp_mre.py

async def rewrap(
    self,
    env: MultiRecipientEnvelope,
    *,
    add: Optional[Sequence[KeyRef]] = None,
    remove: Optional[Sequence[RecipientId]] = None,
    recipient_alg: Optional[Alg] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> MultiRecipientEnvelope:
    _ensure_pgpy()
    mode_str = env.get("mode")
    m = MreMode(mode_str) if isinstance(mode_str, str) else mode_str

    add = add or ()
    remove_ids = set(remove or ())

    new_env: MultiRecipientEnvelope = {k: v for k, v in env.items()}

    if m == MreMode.ENC_ONCE_HEADERS:
        current_headers: List[Dict[str, Any]] = list(new_env.get("recipients", []))
        if remove_ids:
            current_headers = [
                h for h in current_headers if h.get("id") not in remove_ids
            ]

        cek: Optional[bytes] = None
        if add:
            if opts and isinstance(opts.get("cek"), (bytes, bytearray)):
                cek = bytes(opts["cek"])
            elif opts and opts.get("manage_key"):
                manage_key = _load_privkey(
                    opts["manage_key"], (opts or {}).get("passphrase")
                )
                candidate_headers = current_headers or list(
                    env.get("recipients", [])
                )
                for h in candidate_headers:
                    try:
                        cek = _pgp_decrypt_bytes_with(manage_key, h["header"])
                        break
                    except Exception:
                        continue
            else:
                raise RuntimeError(
                    "Rewrap(add=...) requires opts['cek'] or opts['manage_key']."
                )

        if add and cek is not None:
            pubs = [_load_pubkey(r) for r in add]
            rids = [_fingerprint_pub(pk) for pk in pubs]
            new_headers = [
                _make_recipient_header(rid, _pgp_encrypt_bytes_for(pk, cek))
                for rid, pk in zip(rids, pubs)
            ]
            merged: List[Dict[str, Any]] = []
            for h in current_headers:
                if h["id"] not in {rid for rid in rids}:
                    merged.append(h)
            merged.extend(new_headers)
            current_headers = merged

        rotate = bool(opts.get("rotate_payload_on_revoke")) if opts else False
        if remove_ids and rotate:
            if not cek:
                if opts and opts.get("manage_key"):
                    manage_key = _load_privkey(
                        opts["manage_key"], (opts or {}).get("passphrase")
                    )
                    for h in env.get("recipients", []):
                        try:
                            cek = _pgp_decrypt_bytes_with(manage_key, h["header"])
                            break
                        except Exception:
                            continue
                if not cek:
                    raise RuntimeError(
                        "rotate_payload_on_revoke requires CEK via opts['manage_key'] or opts['cek']."
                    )

            new_cek = os.urandom(32)
            payload = env["payload"]
            old_pt = _aead_decrypt_gcm(
                cek,
                payload["nonce"],
                payload["ct"],
                payload["tag"],
                aad=payload.get("aad"),
            )
            nonce, ct, tag = _aead_encrypt_gcm(
                new_cek, old_pt, aad=payload.get("aad")
            )
            new_env["payload"] = _make_aead_payload(
                env.get("payload_alg", self.default_payload_alg),
                nonce,
                ct,
                tag,
                payload.get("aad"),
            )

            add_pubkeys = (opts or {}).get("add_pubkeys")
            if not isinstance(add_pubkeys, (list, tuple)) or not add_pubkeys:
                raise RuntimeError(
                    "After rotation, provide opts['add_pubkeys'] = [KeyRef(pub=...), ...] for remaining recipients."
                )
            pubs = [_load_pubkey(r) for r in add_pubkeys]
            rids = [_fingerprint_pub(pk) for pk in pubs]
            new_headers = [
                _make_recipient_header(rid, _pgp_encrypt_bytes_for(pk, new_cek))
                for rid, pk in zip(rids, pubs)
            ]
            current_headers = new_headers

        new_env["recipients"] = current_headers
        return new_env

    if m == MreMode.SEALED_PER_RECIPIENT:
        current_entries: List[Dict[str, Any]] = list(new_env.get("recipients", []))
        if remove_ids:
            current_entries = [
                e for e in current_entries if e.get("id") not in remove_ids
            ]
        if add:
            pt_bytes = (opts or {}).get("plaintext")
            if not isinstance(pt_bytes, (bytes, bytearray)):
                raise RuntimeError(
                    "Rewrap(add=...) in sealed_per_recipient mode requires opts['plaintext']."
                )
            pubs = [_load_pubkey(r) for r in add]
            rids = [_fingerprint_pub(pk) for pk in pubs]
            new_entries = [
                _make_sealed_recipient(rid, _pgp_encrypt_bytes_for(pk, pt_bytes))
                for rid, pk in zip(rids, pubs)
            ]
            remaining = [
                e for e in current_entries if e["id"] not in {rid for rid in rids}
            ]
            current_entries = remaining + new_entries

        new_env["recipients"] = current_entries
        return new_env

    raise ValueError(f"Unsupported mode for rewrap: {mode_str}")

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger