
    [i                         d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
Z
ddlmZ dZ e	e          j        dz  Ze G d	 d
                      ZdedefdZdedededefdZ G d d          ZdS )z
LuckySt Syndicate - Report Encryption & Key Management

AES-256-GCM encryption for trading session reports.
Redis-based key storage with 24-hour access grants for pledged syndicate members.
    N)	dataclass)Optional)Path)AESGCM   zregistry.yamlc                   p    e Zd ZU dZeed<   eed<   eed<   defdZededee	eef         fd            Z
d	S )
EncryptedReportz6An AES-256-GCM encrypted report with its key material.
ciphertextnoncekeyreturnc                 \    t                               dd          }|| j        z   | j        z   S )u   
        Serialize for on-chain storage.

        Format: [version:1][nonce:12][ciphertext:N]
        The AES key is NOT included — it's stored in Redis.
        r   big)REPORT_VERSIONto_bytesr   r
   )selfversion_bytes     '/app/agentic/syndicate/report_crypto.pyto_chain_byteszEncryptedReport.to_chain_bytes$   s-     &..q%88dj(4?::    datac                 D    | d         }| dd         }| dd         }|||fS )zk
        Parse on-chain bytes back into components.

        Returns: (version, nonce, ciphertext)
        r   r      N )r   versionr   r
   s       r   parse_chain_bytesz!EncryptedReport.parse_chain_bytes.   s4     q'QrT
"##Y
z))r   N)__name__
__module____qualname____doc__bytes__annotations__r   staticmethodtupleintr   r   r   r   r	   r	      s         @@LLL	JJJ; ; ; ; ; 	* 	*%UE0A*B 	* 	* 	* \	* 	* 	*r   r	   	plaintextr   c                     t          j        d          }t          j        d          }t          |          }|                    ||                     d          d          }t          |||          S )z
    Encrypt a report string with AES-256-GCM.

    Generates a random 256-bit key and 96-bit nonce.
    Returns EncryptedReport with ciphertext, nonce, and key.
           utf-8N)r
   r   r   )secretstoken_bytesr   encryptencoder	   )r&   r   r   aesgcmr
   s        r   encrypt_reportr0   ;   sg     
b
!
!C##EC[[Fy'7'7'@'@$GGJj3GGGGr   r
   r   r   c                 x    t          |          }|                    || d          }|                    d          S )z
    Decrypt an AES-256-GCM encrypted report.

    Args:
        ciphertext: The encrypted data
        nonce: 12-byte nonce used during encryption
        key: 32-byte AES key

    Returns:
        Decrypted plaintext string
    Nr*   )r   decryptdecode)r
   r   r   r/   r&   s        r   decrypt_reportr4   I   s8     C[[Fuj$77IG$$$r   c                       e Zd ZdZdZdZdZdZd Zde	de
d	e	d
edee	         de	fdZde	de	d	e	dee	         fdZd	e	dee         fdZde	dee         fdZde	defdZdS )ReportKeyManagerz
    Manages AES keys for encrypted reports via Redis.

    - Authors keep keys indefinitely (no expiry)
    - Other pledged syndicate members can request 24h access
    - Pledge verification checks registry.yaml
    zreport:key:zreport:grant:zreport:index:iQ c                     || _         d S )N)redis)r   redis_clients     r   __init__zReportKeyManager.__init__n   s    !


r   tx_hashaes_keyauthor_addressinstance_idmarkets	timestampc           	         |                                 |                                ||||d}| j                            | j         | t          j        |                     | j                            | j         |                                 |t          |
                                rt          |          nd          i           dS )u   
        Store the AES key for a report. Called by the report author.

        The key is stored with no expiry — the author always has access.
        Also indexes the report under the author's address for listing.
        )aes_key_hexauthorr>   r?   r@   r;   r   N)hexlowerr8   set
KEY_PREFIXjsondumpszaddINDEX_PREFIXfloatisdigitr%   )r   r;   r<   r=   r>   r?   r@   metadatas           r   store_report_keyz!ReportKeyManager.store_report_keyq   s      #;;==$**,,&"
 
 	
)))Jx  	
 	
 	
 	
 :."6"6"8"8::ei.?.?.A.AHC	NNNqIIJ	
 	
 	
 	
 	
r   requester_addressr   c                    |                                 |                                 k    r!|                     |          }|r|d         ndS |                     |          sdS |                     |          }|sdS |d         |                                 k    rdS |d         }| j         | d|                                  }| j                            || j        |           |S )z
        Grant 24-hour access to a report's AES key.

        Verifies the requester is a pledged syndicate member.
        Returns the AES key hex string, or None if denied.
        rB   NrC   :)rE   _get_metadata_is_pledgedGRANT_PREFIXr8   setex	GRANT_TTL)r   r;   rP   r=   metarB   	grant_keys          r   grant_accesszReportKeyManager.grant_access   s    ""$$(<(<(>(>>>%%g..D*.84&&D8  122 	4 !!'** 	4 >^1133334=) (O'OO4E4K4K4M4MOO	
DNK@@@r   c                 l   | j          |                                 }| j                            |dd          }g }|D ]u}t	          |t
                    r|                                }|                     |          }|r3d |                                D             }|	                    |           v|S )z5List all report tx hashes and metadata for an author.r   c                 &    i | ]\  }}|d k    ||S )rB   r   ).0kvs      r   
<dictcomp>z;ReportKeyManager.list_reports_by_author.<locals>.<dictcomp>   s(    QQQdaa=>P>PQ>P>P>Pr   )
rK   rE   r8   	zrevrange
isinstancer!   r3   rS   itemsappend)r   r=   	index_key	tx_hashesreportsr;   rX   	safe_metas           r   list_reports_by_authorz'ReportKeyManager.list_reports_by_author   s    (B.*>*>*@*@BB	J((Ar::	  	* 	*G'5)) +!..**%%g..D *QQdjjllQQQ	y)))r   c                     | j                             | j         |           }|sdS t          |t                    r|                                }t          j        |          S )zGet report metadata from Redis.N)r8   getrG   rc   r!   r3   rH   loads)r   r;   raws      r   rS   zReportKeyManager._get_metadata   s\    jnn:::;; 	4c5!! 	**,,Cz#r   addressc                    	 t          t          d          5 }t          j        |          }ddd           n# 1 swxY w Y   |                    d          pg }|D ]\}|                    dd                                          |                                k    r|                    d          dk    r dS ]d	S # t          $ r Y d	S w xY w)
z2Check if an address is a pledged syndicate member.rNagentsbase_address statusactiveTF)openREGISTRY_PATHyaml	safe_loadrl   rE   	Exception)r   ro   fregistryrr   agents         r   rT   zReportKeyManager._is_pledged   s   	mS)) -Q>!,,- - - - - - - - - - - - - - - \\(++1rF $ $99^R006688GMMOOKKyy**h66#tt5 	 	 	55	s4   B; 8B; <B; < A6B; 8B; ;
C	C	N)r   r   r   r    rG   rU   rK   rW   r:   strr!   r%   listrO   r   rZ   dictrj   rS   boolrT   r   r   r   r6   r6   ^   sC         J"L"LI" " ""
"
 "
 	"

 "
 c"
 "
 "
 "
 "
H$$ $ 	$
 
#$ $ $ $LS T$Z    "S Xd^    3 4      r   r6   )r    osrH   r+   dataclassesr   typingr   pathlibr   ry   +cryptography.hazmat.primitives.ciphers.aeadr   r   __file__parentrx   r	   r   r0   r!   r4   r6   r   r   r   <module>r      sa    
			   ! ! ! ! ! !              > > > > > > X%7 * * * * * * * *:Hc Ho H H H H%u %U % %3 % % % %*D D D D D D D D D Dr   