Added CLI tools for encrypting and decrypting secrets.

Author: eriq-augustine

edq/cli/crypto/__init__.py

@@ -0,0 +1,3 @@
+"""
+The edq.cli.crypto package contains cryptographic tools.
+"""

edq/cli/crypto/__main__.py

@@ -0,0 +1,11 @@
+import sys
+
+import edq.clilib.list
+
+def main() -> int:
+    """ List this CLI dir. """
+
+    return edq.clilib.list.main()
+
+if (__name__ == '__main__'):
+    sys.exit(main())

edq/cli/crypto/decrypt-secret.py

@@ -0,0 +1,41 @@
+# pylint: disable=invalid-name
+
+"""
+Decrypt an edq.util.crypto.Secret into cleartext.
+
+The standard configuration encryption key will be used.
+"""
+
+import argparse
+import sys
+
+import edq.config.constants
+import edq.core.argparser
+import edq.util.crypto
+
+def run_cli(args: argparse.Namespace) -> int:
+    """ Run the CLI. """
+
+    secret = edq.util.crypto.Secret.parse(args.ciphertext, args._config_info.application_config.encryption_key)
+
+    print(secret.cleartext)
+
+    return 0
+
+def main() -> int:
+    """ Get a parser, parse the args, and call run. """
+    return run_cli(_get_parser().parse_args())
+
+def _get_parser() -> argparse.ArgumentParser:
+    """ Get the parser. """
+
+    parser = edq.core.argparser.get_default_parser(__doc__.strip())
+
+    parser.add_argument('ciphertext', metavar = 'TEXT',
+        action = 'store', type = str,
+        help = 'The ciphertext to decrypt.')
+
+    return parser
+
+if (__name__ == '__main__'):
+    sys.exit(main())

edq/cli/crypto/encrypt-secret.py

@@ -0,0 +1,61 @@
+# pylint: disable=invalid-name
+
+"""
+Encrypt a cleartext string as an edq.util.crypto.Secret.
+
+The standard configuration encryption key will be used.
+"""
+
+import argparse
+import sys
+
+import edq.config.constants
+import edq.core.argparser
+import edq.util.crypto
+
+def run_cli(args: argparse.Namespace) -> int:
+    """ Run the CLI. """
+
+    secret = edq.util.crypto.Secret(args.cleartext, iv_b64 = args.iv, salt_b64 = args.salt)
+    ciphertext = secret.encrypt(args._config_info.application_config.encryption_key)
+
+    print(ciphertext)
+
+    return 0
+
+def main() -> int:
+    """ Get a parser, parse the args, and call run. """
+    return run_cli(_get_parser().parse_args())
+
+def _get_parser() -> argparse.ArgumentParser:
+    """ Get the parser. """
+
+    parser = edq.core.argparser.get_default_parser(__doc__.strip())
+
+    parser.add_argument('cleartext', metavar = 'TEXT',
+        action = 'store', type = str,
+        help = 'The text to encrypt.')
+
+    parser.add_argument('--encryption-method', dest = 'encryption_method',
+        action = 'store', type = str, default = edq.util.crypto.EncryptionMethod.AES256v1.value,
+        choices = [choice.value for choice in edq.util.crypto.EncryptionMethod],
+        help = 'The encryption method to use (default: %(default)s).')
+
+    parser.add_argument('--salt', dest = 'salt',
+        action = 'store', type = str, default = None,
+        help = ('An optional salt to provide (as a base64 encoded string).'
+                + ' Providing a salt is not recommended.'
+                + ' If no salt is provided, one will be generated randomly.')
+    )
+
+    parser.add_argument('--iv', dest = 'iv',
+        action = 'store', type = str, default = None,
+        help = ('An optional initialization vector (IV) to provide (as a base64 encoded string).'
+                + ' Providing an IV is not recommended.'
+                + ' If no IV is provided, one will be generated randomly.')
+    )
+
+    return parser
+
+if (__name__ == '__main__'):
+    sys.exit(main())

edq/testing/testdata/cli/tests/crypto/decrypt-secret_base.txt

@@ -0,0 +1,8 @@
+{
+    "cli": "edq.cli.crypto.decrypt-secret",
+    "arguments": [
+        "__edq_secret__::AES256v1::nfhP9KYRTwQyGbwtkEj4FA==::bQTHv6sDqIRVbnyFHkwODA==::A4cLESzs0b3iyFKJBV7BHQ==",
+    ],
+}
+---
+It's a secret!

edq/testing/testdata/cli/tests/crypto/decrypt-secret_key.txt

@@ -0,0 +1,9 @@
+{
+    "cli": "edq.cli.crypto.decrypt-secret",
+    "arguments": [
+        "--encryption-key", "my-key",
+        "__edq_secret__::AES256v1::nfhP9KYRTwQyGbwtkEj4FA==::bQTHv6sDqIRVbnyFHkwODA==::K/QuuVZoh675qtysU/QG1Q==",
+    ],
+}
+---
+It's a secret!

edq/testing/testdata/cli/tests/crypto/encrypt-secret_base.txt

@@ -0,0 +1,10 @@
+{
+    "cli": "edq.cli.crypto.encrypt-secret",
+    "arguments": [
+        "It's a secret!",
+        "--iv", "nfhP9KYRTwQyGbwtkEj4FA==",
+        "--salt", "bQTHv6sDqIRVbnyFHkwODA==",
+    ],
+}
+---
+__edq_secret__::AES256v1::nfhP9KYRTwQyGbwtkEj4FA==::bQTHv6sDqIRVbnyFHkwODA==::A4cLESzs0b3iyFKJBV7BHQ==

edq/testing/testdata/cli/tests/crypto/encrypt-secret_key.txt

@@ -0,0 +1,11 @@
+{
+    "cli": "edq.cli.crypto.encrypt-secret",
+    "arguments": [
+        "It's a secret!",
+        "--iv", "nfhP9KYRTwQyGbwtkEj4FA==",
+        "--salt", "bQTHv6sDqIRVbnyFHkwODA==",
+        "--encryption-key", "my-key",
+    ],
+}
+---
+__edq_secret__::AES256v1::nfhP9KYRTwQyGbwtkEj4FA==::bQTHv6sDqIRVbnyFHkwODA==::K/QuuVZoh675qtysU/QG1Q==