+ JV-jb^RIt^RIHuHt^RIHt^RIt!RR]P4t RRlt Rt !RR ]P4t R t R tR#) N)FileSystemKeyMaterialStorec6a]tRt^toRtRtRtRtRtVt R#)InMemoryKmsClientzJThis is a mock class implementation of KmsClient, built for testing only. c f\PPV4VPVnR#)z%Create an InMemoryKmsClient instance.N)pe KmsClient__init__custom_kms_confmaster_keys_map)selfconfigs&&q/Volumes/fast/ai/experiments/ui-tars-smoke/.venv/lib/python3.14/site-packages/pyarrow/tests/parquet/encryption.pyr InMemoryKmsClient.__init__s" d#%55c VPV,PR4pRPW1.4p\P!V4pV#)zXNot a secure cipher - the wrapped key is just the master key concatenated with key bytesutf-8r)r encodejoinbase64 b64encode)r key_bytesmaster_key_identifiermaster_key_bytes wrapped_keyresults&&& rwrap_keyInMemoryKmsClient.wrap_key!sK //0EFMM hh 0<= !!+. rc W P9d \RV4hVPV,p\P!V4pVR,pVR,pW5P R48XdV#\RWV4h)z?Not a secure cipher - just extract the key from the wrapped keyzUnknown master key:NN:rNNrzIncorrect master key used)r ValueErrorr b64decodedecode)r rrexpected_master_keydecoded_wrapped_keyr decrypted_keys&&& r unwrap_keyInMemoryKmsClient.unwrap_key*s !(<(< <13HI I"223HI$..{;.s3+C0 #:#:7#C C 4): :r)r N) __name__ __module__ __qualname____firstlineno____doc__r rr&__static_attributes____classdictcell__ __classdict__s@rrrs6  : :rrc\V^8dQhR\R\\\\3,/#)rreturn)strtupleintbytes)formats"r __annotate__r99s) B B3 B5c5+A Brc\P!R4pVPV4;p'd9VP4wr4p\ V4p\ P !V4pW4V3#\RV4h)zParses a wrapped key string into a tuple: (key id, version, key) given input in the form: :v:z(.+?):v([0-9]+?):(.+)zCannot parse wrapped key)recompile fullmatchgroupsr6rr!r )rptnmidversionb64keykeys& rparse_wrapped_keyrE9si **, -C MM+ &&q&hhjVg,v&S!!3[AArmaster_key_versioncva]tRt^ItoRtV3RlRlt]V3RlRl4tV3RlRltV3RlR lt R t Vt R #) MockVersioningKmsClientaAThis is a mock class implementation of KmsClient, built for testing only. During tests that involve CryptoFactory.rotate_master_keys, separate instances of this client will be created when writing, rotating keys, and reading back parquet data. To help unit tests verify that external key material was stored correctly at each step, this client wraps keys with a master_key_identifier and a version number. To ensure each client wraps with the correct version, the current version is persisted in the key_access_token attribute of the KmsConnectionConfig shared by all clients c<V^8dQhRR/#)r2r3N)r8r0s"rr9$MockVersioningKmsClient.__annotate__Vs33T3rcP\PPV4WnR#N)rrr connection_config)r rNs&&rr MockVersioningKmsClient.__init__Vs d#!2rc <V^8dQhRS[/#)r2r3)r6)r8r0s"rr9rK[s< 33<<NNrrHc\VR4;_uu_4pVP^4pVR8XgQhRRR4R# +'giR#;i)zVerify that the file is encrypted by looking at its first 4 bytes. If it's the magic string PARE then this is a parquet with encrypted footer.rbsPAREN)openread)pathfile magic_strs& rverify_file_encryptedrems= dD  TIIaL G###    s ; A c\P!V4p\4pVP4F"pVP V4pWBVP &K$ V#)z~Reads an external key material store given a parquet file path and returns a dict mapping master_key_id to KeyMaterial objects)rfor_filedictget_key_id_setget_key_material master_key_id)rbstorekeysrA key_materials& rread_external_keys_to_dictrowsS ' / / 5E 6D""$--b1 +7\ ' '(% Kr)rpyarrow.parquet.encryptionparquet encryptionrpyarrow._parquet_encryptionrr;rrrEMASTER_KEY_VERSIONrHrerorJrrrusP"''B : :D B*!bll!H$r