How to Mock KMS Envelope Encryption in Python

import base64
import json
import os
import hashlib


class MockKMS:
    """Minimal mock of AWS KMS envelope encryption flow."""

    def generate_data_key(self):
        # Simulate KMS returning a plaintext and encrypted data key
        plaintext_key = os.urandom(32)
        encrypted_key = hashlib.sha256(plaintext_key).digest()
        return plaintext_key, base64.b64encode(encrypted_key).decode()

    def decrypt_data_key(self, encrypted_key_b64):
        # In a real system this would call KMS Decrypt; here we reverse the mock
        encrypted_key = base64.b64decode(encrypted_key_b64)
        plaintext_key = b""
        for i in range(32):
            plaintext_key += bytes([encrypted_key[i] ^ 0x5A])  # reversed mock
        return plaintext_key


def envelope_encrypt(data: bytes, kms: MockKMS) -> str:
    data_key, encrypted_key_b64 = kms.generate_data_key()

    # AES-GCM in pure Python (simplified - real code would use cryptography lib)
    iv = os.urandom(12)
    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
    ciphertext = AESGCM(data_key).encrypt(iv, data, None)

    envelope = {
        "encrypted_key": encrypted_key_b64,
        "iv": base64.b64encode(iv).decode(),
        "ciphertext": base64.b64encode(ciphertext).decode(),
        "algorithm": "AES-256-GCM"
    }
    return json.dumps(envelope)


def envelope_decrypt(envelope_json: str, kms: MockKMS) -> bytes:
    env = json.loads(envelope_json)
    data_key = kms.decrypt_data_key(env["encrypted_key"])
    iv = base64.b64decode(env["iv"])
    ciphertext = base64.b64decode(env["ciphertext"])
    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
    return AESGCM(data_key).decrypt(iv, ciphertext, None)


if __name__ == "__main__":
    kms = MockKMS()
    secret = b"Price: $42; details: top secret!"
    envelope = envelope_encrypt(secret, kms)
    print("Envelope:", envelope)
    plaintext = envelope_decrypt(envelope, kms)
    print("Decrypted:", plaintext.decode())