Initial commit

site/social/crypto.py

@@ -0,0 +1,67 @@
+"""Token encryption helpers for SocialAccount / SocialAppCredentials."""
+
+from cryptography.fernet import Fernet, InvalidToken
+from django.conf import settings
+
+# Copied from .env.prod.example / deploy templates — not valid Fernet material.
+_PLACEHOLDER_KEYS = frozenset(
+    {
+        "replace-with-fernet-key",
+        "changeme",
+        "change-me",
+        "todo",
+    }
+)
+
+
+class SocialCryptoError(ValueError):
+    """Raised when SOCIAL_TOKEN_ENCRYPTION_KEY is missing or not a Fernet key."""
+
+
+def _normalize_key(raw: str | bytes | None) -> bytes | None:
+    if raw is None:
+        return None
+    if isinstance(raw, bytes):
+        text = raw.decode("utf-8", errors="ignore").strip()
+    else:
+        text = str(raw).strip()
+    if not text or text.lower() in _PLACEHOLDER_KEYS:
+        return None
+    return text.encode()
+
+
+def _fernet() -> Fernet:
+    key = _normalize_key(settings.SOCIAL_TOKEN_ENCRYPTION_KEY)
+    if key is None:
+        if settings.DEBUG:
+            # Dev-only unstable fallback — set SOCIAL_TOKEN_ENCRYPTION_KEY for real use.
+            return Fernet(Fernet.generate_key())
+        raise SocialCryptoError(
+            "SOCIAL_TOKEN_ENCRYPTION_KEY is not set. Generate one with: "
+            'python -c "from cryptography.fernet import Fernet; '
+            'print(Fernet.generate_key().decode())" '
+            "and add it to the beta/prod app env, then redeploy/restart."
+        )
+    try:
+        return Fernet(key)
+    except (ValueError, TypeError) as exc:
+        raise SocialCryptoError(
+            "SOCIAL_TOKEN_ENCRYPTION_KEY is invalid (must be 32 url-safe "
+            "base64-encoded bytes from Fernet.generate_key()). "
+            "Replace the placeholder in the beta/prod env and restart."
+        ) from exc
+
+
+def encrypt_tokens(plaintext: str) -> str:
+    return _fernet().encrypt(plaintext.encode()).decode()
+
+
+def decrypt_tokens(ciphertext: str) -> str:
+    if not ciphertext:
+        return ""
+    try:
+        return _fernet().decrypt(ciphertext.encode()).decode()
+    except InvalidToken as exc:
+        raise ValueError("Unable to decrypt social tokens") from exc
+    except SocialCryptoError:
+        raise