trust_api.utils.encryption
==========================

.. py:module:: trust_api.utils.encryption

.. autoapi-nested-parse::

   AES-CBC decryption for task payloads received from the central hub.



Attributes
----------

.. autoapisummary::

   trust_api.utils.encryption._aes_key_cache


Functions
---------

.. autoapisummary::

   trust_api.utils.encryption.get_aes_key
   trust_api.utils.encryption.decrypt


Module Contents
---------------

.. py:data:: _aes_key_cache
   :type:  bytes | None
   :value: None


.. py:function:: get_aes_key() -> bytes

   Retrieve the AES key from the environment and return it as bytes.

   Cached after first call — the key does not change during the lifetime of a process.

   :returns: The decoded AES key.
   :rtype: bytes


.. py:function:: decrypt(encoded_payload: str, key: bytes | None = None) -> str

   Decrypt Base64-encoded ciphertext using AES-CBC with PKCS7 padding.

   :param encoded_payload: Base64-encoded payload where the first 16 bytes are the IV and the
                           remaining bytes are the ciphertext.
   :type encoded_payload: str
   :param key: The AES key to use. If None, the shared AES key is retrieved via
               :func:`get_aes_key`.
   :type key: bytes | None

   :returns: The decrypted plaintext.
   :rtype: str