security: encrypt synchronized Saved Searches (Closes #1126)

src/saved_search_store.py

@@ -1,11 +1,11 @@
 """Durable, account-scoped saved Search views."""
 
-import json
 import re
 import sqlite3
 from pathlib import Path
 
 from src.private_state import connect_private_sqlite
+from src.state_encryption import PrivateStateCipher, PrivateStateEncryptionError, private_state_encryption_key
 
 
 _REPOSITORY = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
@@ -21,10 +21,21 @@ class SavedSearchConflict(ValueError):
 
 
 class SavedSearchStore:
-    def __init__(self, path: str | Path, *, limit: int = 20, timeout: float = 1.0):
+    def __init__(
+        self,
+        path: str | Path,
+        *,
+        limit: int = 20,
+        timeout: float = 1.0,
+        encryption_key: bytes | None = None,
+    ):
         self.path = Path(path)
         self.limit = limit
         self.timeout = timeout
+        self._cipher = PrivateStateCipher(
+            encryption_key if encryption_key is not None else private_state_encryption_key(),
+            store="saved-searches",
+        )
         self._initialize()
 
     def _initialize(self) -> None:
@@ -50,19 +61,31 @@ class SavedSearchStore:
             raise ValueError("login is required")
         return normalized
 
-    @staticmethod
-    def _snapshot(row) -> dict:
-        return {"revision": 0, "views": []} if row is None else {
-            "revision": int(row[0]), "views": json.loads(row[1])
-        }
+    def _snapshot(self, row, login: str) -> tuple[dict, bool]:
+        if row is None:
+            return {"revision": 0, "views": []}, False
+        views, legacy = self._cipher.open(row[1], binding=f"views:{login}")
+        if not isinstance(views, list):
+            raise PrivateStateEncryptionError("private state could not be decrypted")
+        return {"revision": int(row[0]), "views": views}, legacy
+
+    def _sealed_views(self, login: str, views: list[dict]) -> str:
+        return self._cipher.seal(views, binding=f"views:{login}")
 
     def get(self, login: str) -> dict:
+        login = self._login(login)
         with self._connect() as connection:
             row = connection.execute(
                 "SELECT revision, views FROM saved_searches WHERE login = ?",
-                (self._login(login),),
+                (login,),
             ).fetchone()
-        return self._snapshot(row)
+            snapshot, legacy = self._snapshot(row, login)
+            if row is not None and legacy:
+                connection.execute(
+                    "UPDATE saved_searches SET views = ? WHERE login = ? AND views = ?",
+                    (self._sealed_views(login, snapshot["views"]), login, row[1]),
+                )
+        return snapshot
 
     def _normalize(self, views: list[dict]) -> list[dict]:
         if not isinstance(views, list):
@@ -113,13 +136,13 @@ class SavedSearchStore:
         if not isinstance(expected_revision, int) or isinstance(expected_revision, bool) or expected_revision < 0:
             raise ValueError("revision is invalid")
         normalized = self._normalize(views)
-        serialized = json.dumps(normalized, separators=(",", ":"))
+        serialized = self._sealed_views(login, normalized)
         with self._connect() as connection:
             connection.execute("BEGIN IMMEDIATE")
             row = connection.execute(
                 "SELECT revision, views FROM saved_searches WHERE login = ?", (login,)
             ).fetchone()
-            current = self._snapshot(row)
+            current, _legacy = self._snapshot(row, login)
             if current["revision"] != expected_revision:
                 raise SavedSearchConflict(current)
             revision = expected_revision + 1