derivepassphrase.git

@@ -13,16 +13,14 @@ from typing import TYPE_CHECKING

 import hypothesis

 import pytest

 from hypothesis import strategies

-from typing_extensions import TypeAlias, TypeVar

+from typing_extensions import TypeVar

-import derivepassphrase

 import tests

+from derivepassphrase import vault

 if TYPE_CHECKING:

     from collections.abc import Iterator

-Vault: TypeAlias = derivepassphrase.vault.Vault

-

 BLOCK_SIZE = hashlib.sha1().block_size

 DIGEST_SIZE = hashlib.sha1().digest_size

@@ -32,7 +30,7 @@ def phrases_are_interchangable(

     phrase2: bytes | bytearray | str,

     /,

 ) -> bool:

-    """Work-alike of [`Vault.phrases_are_interchangable`][].

+    """Work-alike of [`vault.Vault.phrases_are_interchangable`][].

     This version is not resistant to timing attacks, but faster, and

     supports strings directly.

@@ -44,7 +42,7 @@ def phrases_are_interchangable(

             A passphrase to compare.

     Returns:

-        True if the phrases behave identically under [`Vault`][],

+        True if the phrases behave identically under [`vault.Vault`][],

         false otherwise.

     """

@@ -56,8 +54,8 @@ def phrases_are_interchangable(

             else bs.rstrip(b'\x00')

         )

-    phrase1 = canon(Vault._get_binary_string(phrase1))

-    phrase2 = canon(Vault._get_binary_string(phrase2))

+    phrase1 = canon(vault.Vault._get_binary_string(phrase1))

+    phrase2 = canon(vault.Vault._get_binary_string(phrase2))

     return phrase1 == phrase2

@@ -83,9 +81,7 @@ class TestVault:

             min_size=2,

             max_size=2,

             unique=True,

-        ).filter(

-            lambda tup: not phrases_are_interchangable(*tup)

-        ),

+        ).filter(lambda tup: not phrases_are_interchangable(*tup)),

         service=strategies.text(

             strategies.characters(min_codepoint=32, max_codepoint=126),

             min_size=1,

@@ -102,9 +98,9 @@ class TestVault:

         We filter out interchangable passphrases during generation.

         """

-        assert Vault.create_hash(

+        assert vault.Vault.create_hash(

             phrase=phrases[0], service=service

-        ) != Vault.create_hash(phrase=phrases[1], service=service)

+        ) != vault.Vault.create_hash(phrase=phrases[1], service=service)

     @hypothesis.given(

         phrases=strategies.lists(

@@ -112,9 +108,7 @@ class TestVault:

             min_size=2,

             max_size=2,

             unique=True,

-        ).filter(

-            lambda tup: not phrases_are_interchangable(*tup)

-        ),

+        ).filter(lambda tup: not phrases_are_interchangable(*tup)),

         service=strategies.text(

             strategies.characters(min_codepoint=32, max_codepoint=126),

             min_size=1,

@@ -131,9 +125,9 @@ class TestVault:

         We filter out interchangable passphrases during generation.

         """

-        assert Vault.create_hash(

+        assert vault.Vault.create_hash(

             phrase=phrases[0], service=service

-        ) != Vault.create_hash(phrase=phrases[1], service=service)

+        ) != vault.Vault.create_hash(phrase=phrases[1], service=service)

     @hypothesis.given(

         phrases=strategies.lists(

@@ -143,9 +137,7 @@ class TestVault:

             min_size=2,

             max_size=2,

             unique=True,

-        ).filter(

-            lambda tup: not phrases_are_interchangable(*tup)

-        ),

+        ).filter(lambda tup: not phrases_are_interchangable(*tup)),

         service=strategies.text(

             strategies.characters(min_codepoint=32, max_codepoint=126),

             min_size=1,

@@ -162,9 +154,9 @@ class TestVault:

         We filter out interchangable passphrases during generation.

         """

-        assert Vault.create_hash(

+        assert vault.Vault.create_hash(

             phrase=phrases[0], service=service

-        ) != Vault.create_hash(phrase=phrases[1], service=service)

+        ) != vault.Vault.create_hash(phrase=phrases[1], service=service)

     @hypothesis.given(

         phrases=strategies.lists(

@@ -178,9 +170,7 @@ class TestVault:

             min_size=2,

             max_size=2,

             unique=True,

-        ).filter(

-            lambda tup: not phrases_are_interchangable(*tup)

-        ),

+        ).filter(lambda tup: not phrases_are_interchangable(*tup)),

         service=strategies.text(

             strategies.characters(min_codepoint=32, max_codepoint=126),

             min_size=1,

@@ -197,9 +187,9 @@ class TestVault:

         We filter out interchangable passphrases during generation.

         """

-        assert Vault.create_hash(

+        assert vault.Vault.create_hash(

             phrase=phrases[0], service=service

-        ) != Vault.create_hash(phrase=phrases[1], service=service)

+        ) != vault.Vault.create_hash(phrase=phrases[1], service=service)

     @hypothesis.given(

         phrase=strategies.text(

@@ -220,9 +210,9 @@ class TestVault:

         services: list[bytes],

     ) -> None:

         """The internal hash is dependent on the service name."""

-        assert Vault.create_hash(

+        assert vault.Vault.create_hash(

             phrase=phrase, service=services[0]

-        ) != Vault.create_hash(phrase=phrase, service=services[1])

+        ) != vault.Vault.create_hash(phrase=phrase, service=services[1])

     @tests.hypothesis_settings_coverage_compatible

     @hypothesis.given(

@@ -232,7 +222,7 @@ class TestVault:

                 strategies.integers(

                     min_value=1,

                     max_value=BLOCK_SIZE - len(bs),

-                ).map(lambda num: bs + b'\x00' * num)

+                ).map(lambda num: bs + b'\x00' * num),

             )

         ),

         service=strategies.text(

@@ -247,10 +237,10 @@ class TestVault:

         service: str,

     ) -> None:

         """Claimed interchangable passphrases are actually interchangable."""

-        assert Vault.phrases_are_interchangable(*phrases)

-        assert Vault.create_hash(

+        assert vault.Vault.phrases_are_interchangable(*phrases)

+        assert vault.Vault.create_hash(

             phrase=phrases[0], service=service

-        ) == Vault.create_hash(phrase=phrases[1], service=service)

+        ) == vault.Vault.create_hash(phrase=phrases[1], service=service)

     @tests.hypothesis_settings_coverage_compatible

     @hypothesis.given(

@@ -279,10 +269,10 @@ class TestVault:

         service: str,

     ) -> None:

         """Claimed interchangable passphrases are actually interchangable."""

-        assert Vault.phrases_are_interchangable(*phrases)

-        assert Vault.create_hash(

+        assert vault.Vault.phrases_are_interchangable(*phrases)

+        assert vault.Vault.create_hash(

             phrase=phrases[0], service=service

-        ) == Vault.create_hash(phrase=phrases[1], service=service)

+        ) == vault.Vault.create_hash(phrase=phrases[1], service=service)

     @pytest.mark.parametrize(

         ['service', 'expected'],

@@ -295,12 +285,12 @@ class TestVault:

         self, service: bytes | str, expected: bytes

     ) -> None:

         """Deriving a passphrase principally works."""

-        assert Vault(phrase=self.phrase).generate(service) == expected

+        assert vault.Vault(phrase=self.phrase).generate(service) == expected

     def test_201_phrase_dependence(self) -> None:

         """The derived passphrase is dependent on the master passphrase."""

         assert (

-            Vault(phrase=(self.phrase + b'X')).generate('google')

+            vault.Vault(phrase=(self.phrase + b'X')).generate('google')

             == b'n+oIz6sL>K*lTEWYRO%7'

         )

@@ -310,9 +300,7 @@ class TestVault:

             min_size=2,

             max_size=2,

             unique=True,

-        ).filter(

-            lambda tup: not phrases_are_interchangable(*tup)

-        ),

+        ).filter(lambda tup: not phrases_are_interchangable(*tup)),

         service=strategies.text(

             strategies.characters(min_codepoint=32, max_codepoint=126),

             min_size=1,

@@ -348,27 +336,27 @@ class TestVault:

         """The derived passphrase is dependent on the master passphrase.

         Certain pairs of master passphrases are known to be

-        interchangable; see [`Vault.phrases_are_interchangable`][].

+        interchangable; see [`vault.Vault.phrases_are_interchangable`][].

         These are excluded from consideration by the hypothesis

         strategy.

         """

         # See test_100_create_hash_phrase_dependence for context.

-        assert Vault(phrase=phrases[0]).generate(

-            service

-        ) != Vault(phrase=phrases[1]).generate(service)

+        assert vault.Vault(phrase=phrases[0]).generate(service) != vault.Vault(

+            phrase=phrases[1]

+        ).generate(service)

     def test_202a_reproducibility_and_bytes_service_name(self) -> None:

         """Deriving a passphrase works equally for byte strings."""

-        assert Vault(phrase=self.phrase).generate(b'google') == Vault(

-            phrase=self.phrase

-        ).generate('google')

+        assert vault.Vault(phrase=self.phrase).generate(

+            b'google'

+        ) == vault.Vault(phrase=self.phrase).generate('google')

     def test_202b_reproducibility_and_bytearray_service_name(self) -> None:

         """Deriving a passphrase works equally for byte arrays."""

-        assert Vault(phrase=self.phrase).generate(b'google') == Vault(

-            phrase=self.phrase

-        ).generate(bytearray(b'google'))

+        assert vault.Vault(phrase=self.phrase).generate(

+            b'google'

+        ) == vault.Vault(phrase=self.phrase).generate(bytearray(b'google'))

     @hypothesis.given(

         phrase=strategies.text(

@@ -388,10 +376,10 @@ class TestVault:

         service: str,

     ) -> None:

         """Deriving a passphrase works equally for byte arrays/strings."""

-        assert Vault(phrase=phrase).generate(service) == Vault(

+        assert vault.Vault(phrase=phrase).generate(service) == vault.Vault(

             phrase=phrase

         ).generate(service.encode('utf-8'))

-        assert Vault(phrase=phrase).generate(service) == Vault(

+        assert vault.Vault(phrase=phrase).generate(service) == vault.Vault(

             phrase=phrase

         ).generate(bytearray(service.encode('utf-8')))

@@ -414,9 +402,9 @@ class TestVault:

         services: list[bytes],

     ) -> None:

         """The derived passphrase is dependent on the service name."""

-        assert Vault(phrase=phrase).generate(

-            services[0]

-        ) != Vault(phrase=phrase).generate(services[1])

+        assert vault.Vault(phrase=phrase).generate(services[0]) != vault.Vault(

+            phrase=phrase

+        ).generate(services[1])

     @tests.hypothesis_settings_coverage_compatible

     @hypothesis.given(

@@ -441,9 +429,9 @@ class TestVault:

     ) -> None:

         """The derived passphrase is dependent on the service name."""

         try:

-            assert Vault(phrase=phrase, **config).generate(

+            assert vault.Vault(phrase=phrase, **config).generate(

                 services[0]

-            ) != Vault(phrase=phrase, **config).generate(services[1])

+            ) != vault.Vault(phrase=phrase, **config).generate(services[1])

         except ValueError as exc:

             # The service configuration strategy attempts to only

             # generate satisfiable configurations.  It is possible,

@@ -458,7 +446,8 @@ class TestVault:

     def test_210_nonstandard_length(self) -> None:

         """Deriving a passphrase adheres to imposed length limits."""

         assert (

-            Vault(phrase=self.phrase, length=4).generate('google') == b'xDFu'

+            vault.Vault(phrase=self.phrase, length=4).generate('google')

+            == b'xDFu'

         )

     @tests.hypothesis_settings_coverage_compatible

@@ -481,13 +470,13 @@ class TestVault:

         service: str,

     ) -> None:

         """Derived passphrases have the requested length."""

-        password = Vault(phrase=phrase, length=length).generate(service)

+        password = vault.Vault(phrase=phrase, length=length).generate(service)

         assert len(password) == length

     def test_211_repetition_limit(self) -> None:

         """Deriving a passphrase adheres to imposed repetition limits."""

         assert (

-            Vault(

+            vault.Vault(

                 phrase=b'', length=24, symbol=0, number=0, repeat=1

             ).generate('asd')

             == b'IVTDzACftqopUXqDHPkuCIhV'

@@ -496,14 +485,14 @@ class TestVault:

     def test_212_without_symbols(self) -> None:

         """Deriving a passphrase adheres to imposed limits on symbols."""

         assert (

-            Vault(phrase=self.phrase, symbol=0).generate('google')

+            vault.Vault(phrase=self.phrase, symbol=0).generate('google')

             == b'XZ4wRe0bZCazbljCaMqR'

         )

     def test_213_no_numbers(self) -> None:

         """Deriving a passphrase adheres to imposed limits on numbers."""

         assert (

-            Vault(phrase=self.phrase, number=0).generate('google')

+            vault.Vault(phrase=self.phrase, number=0).generate('google')

             == b'_*$TVH.%^aZl(LUeOT?>'

         )

@@ -512,28 +501,30 @@ class TestVault:

         Deriving a passphrase adheres to imposed limits on lowercase letters.

         """

         assert (

-            Vault(phrase=self.phrase, lower=0).generate('google')

+            vault.Vault(phrase=self.phrase, lower=0).generate('google')

             == b':{?)+7~@OA:L]!0E$)(+'

         )

     def test_215_at_least_5_digits(self) -> None:

         """Deriving a passphrase adheres to imposed counts of numbers."""

         assert (

-            Vault(phrase=self.phrase, length=8, number=5).generate('songkick')

+            vault.Vault(phrase=self.phrase, length=8, number=5).generate(

+                'songkick'

+            )

             == b'i0908.7['

         )

     def test_216_lots_of_spaces(self) -> None:

         """Deriving a passphrase adheres to imposed counts of spaces."""

         assert (

-            Vault(phrase=self.phrase, space=12).generate('songkick')

+            vault.Vault(phrase=self.phrase, space=12).generate('songkick')

             == b' c   6 Bq  % 5fR    '

         )

     def test_217_all_character_classes(self) -> None:

         """Deriving a passphrase adheres to imposed counts of all types."""

         assert (

-            Vault(

+            vault.Vault(

                 phrase=self.phrase,

                 lower=2,

                 upper=2,

@@ -603,7 +594,7 @@ class TestVault:

     ) -> None:

         """Derived passphrases obey character and occurrence restraints."""

         try:

-            password = Vault(phrase=phrase, **config).generate(service)

+            password = vault.Vault(phrase=phrase, **config).generate(service)

         except ValueError as exc:

             # The service configuration strategy attempts to only

             # generate satisfiable configurations.  It is possible,

@@ -619,7 +610,7 @@ class TestVault:

         for key in ('lower', 'upper', 'number', 'space', 'dash', 'symbol'):

             if config[key] > 0:

                 assert (

-                    sum(c in Vault._CHARSETS[key] for c in password)

+                    sum(c in vault.Vault._CHARSETS[key] for c in password)

                     >= config[key]

                 ), (

                     'Password does not satisfy '

@@ -630,9 +621,9 @@ class TestVault:

                 # appear via the other character class.

                 assert True

             else:

-                assert sum(c in Vault._CHARSETS[key] for c in password) == 0, (

-                    'Password does not satisfy character ban constraints.'

-                )

+                assert (

+                    sum(c in vault.Vault._CHARSETS[key] for c in password) == 0

+                ), 'Password does not satisfy character ban constraints.'

         T = TypeVar('T', str, bytes)

@@ -653,7 +644,7 @@ class TestVault:

         This example is checked explicitly against forbidden substrings.

         """

-        generated = Vault(

+        generated = vault.Vault(

             phrase=b'',

             length=40,

             lower=0,

@@ -702,22 +693,22 @@ class TestVault:

         service: str,

     ) -> None:

         """Derived passphrases obey the given occurrence constraint."""

-        password = Vault(phrase=phrase, length=length, repeat=repeat).generate(

-            service

-        )

+        password = vault.Vault(

+            phrase=phrase, length=length, repeat=repeat

+        ).generate(service)

         for i in range((length + 1) - (repeat + 1)):

             assert len(set(password[i : i + repeat + 1])) > 1

     def test_219_very_limited_character_set(self) -> None:

         """Deriving a passphrase works even with limited character sets."""

-        generated = Vault(

+        generated = vault.Vault(

             phrase=b'', length=24, lower=0, upper=0, space=0, symbol=0

         ).generate('testing')

         assert generated == b'763252593304946694588866'

     def test_220_character_set_subtraction(self) -> None:

         """Removing allowed characters internally works."""

-        assert Vault._subtract(b'be', b'abcdef') == bytearray(b'acdf')

+        assert vault.Vault._subtract(b'be', b'abcdef') == bytearray(b'acdf')

     @pytest.mark.parametrize(

         ['length', 'settings', 'entropy'],

@@ -742,7 +733,7 @@ class TestVault:

         self, length: int, settings: dict[str, int], entropy: int

     ) -> None:

         """Estimating the entropy and sufficient hash length works."""

-        v = Vault(length=length, **settings)  # type: ignore[arg-type]

+        v = vault.Vault(length=length, **settings)  # type: ignore[arg-type]

         assert math.isclose(v._entropy(), entropy)

         assert v._estimate_sufficient_hash_length() > 0

         if math.isfinite(entropy) and entropy:

@@ -755,7 +746,7 @@ class TestVault:

         """

         Estimating the entropy and hash length for degenerate cases works.

         """

-        v = Vault(

+        v = vault.Vault(

             phrase=self.phrase,

             lower=0,

             upper=0,

@@ -783,7 +774,7 @@ class TestVault:

         """

         Estimating the entropy and hash length for the degenerate case works.

         """

-        v = Vault(phrase=self.phrase)

+        v = vault.Vault(phrase=self.phrase)

         monkeypatch.setattr(

             v,

             '_estimate_sufficient_hash_length',

@@ -805,7 +796,7 @@ class TestVault:

     )

     def test_224_binary_strings(self, s: str | bytes | bytearray) -> None:

         """Byte string conversion is idempotent."""

-        binstr = Vault._get_binary_string

+        binstr = vault.Vault._get_binary_string

         if isinstance(s, str):

             assert binstr(s) == s.encode('UTF-8')

             assert binstr(binstr(s)) == s.encode('UTF-8')

@@ -818,12 +809,12 @@ class TestVault:

         with pytest.raises(

             ValueError, match='requested passphrase length too short'

         ):

-            Vault(phrase=self.phrase, symbol=100)

+            vault.Vault(phrase=self.phrase, symbol=100)

     def test_311_no_viable_characters(self) -> None:

         """Deriving passphrases without allowed characters fails."""

         with pytest.raises(ValueError, match='no allowed characters left'):

-            Vault(

+            vault.Vault(

                 phrase=self.phrase,

                 lower=0,

                 upper=0,

@@ -836,13 +827,13 @@ class TestVault:

     def test_320_character_set_subtraction_duplicate(self) -> None:

         """Character sets do not contain duplicate characters."""

         with pytest.raises(ValueError, match='duplicate characters'):

-            Vault._subtract(b'abcdef', b'aabbccddeeff')

+            vault.Vault._subtract(b'abcdef', b'aabbccddeeff')

         with pytest.raises(ValueError, match='duplicate characters'):

-            Vault._subtract(b'aabbccddeeff', b'abcdef')

+            vault.Vault._subtract(b'aabbccddeeff', b'abcdef')

     def test_322_hash_length_estimation(self) -> None:

         """Hash length estimation rejects invalid safety factors."""

-        v = Vault(phrase=self.phrase)

+        v = vault.Vault(phrase=self.phrase)

         with pytest.raises(ValueError, match='invalid safety factor'):

             assert v._estimate_sufficient_hash_length(-1.0)

         with pytest.raises(