Compact JWE Envelope

Build a small utility that turns arbitrary bytes into compact JWE strings and back again, allowing callers to pick key management and content encryption algorithms and optionally compress payloads. The module must surface protected header values (alg, enc, zip, kid, cty) to callers.

Capabilities

Encrypts with chosen algorithms

• Encrypting the payload b"hi" with a symmetric 256-bit key, key management "dir", and content encryption "A256GCM" returns a compact JWE string whose protected header contains alg="dir" and enc="A256GCM". @test

Optional compression

• When use_compression=True, encrypting b"{\"msg\":\"zip me\"}" produces a JWE that includes zip="DEF" in its protected header and decrypts back to the original payload. @test

Decrypts and exposes headers

• Decrypting a previously produced JWE using the matching key yields the original plaintext bytes and a header mapping that includes alg, enc, any kid provided at encryption time, and optional cty. @test

Rejects mismatched keys

• Attempting to decrypt a JWE with an incorrect key or when the selected algorithms do not match the token metadata raises an exception. @test

Implementation

@generates

API

from typing import Callable, Dict, Optional, Tuple


def encrypt_payload(
    payload: bytes,
    key: bytes,
    alg: str,
    enc: str,
    use_compression: bool = False,
    content_type: Optional[str] = None,
    key_id: Optional[str] = None,
) -> str:
    """
    Produce a compact JWE string for the payload using the requested
    key management (alg) and content encryption (enc) values. When
    use_compression is True, compress the payload before encryption
    and mark the header accordingly. Include kid/cty headers when
    provided.
    """


def decrypt_payload(
    token: str,
    key_provider: Callable[[Optional[str]], bytes],
) -> Tuple[bytes, Dict[str, str]]:
    """
    Decrypt a compact JWE string using the key resolved from the kid
    header (if present). Return the plaintext bytes and the protected
    header values. Raise an exception on decryption failure or when
    algorithms/keys do not match.
    """

Dependencies { .dependencies }

python-jose { .dependency }

Provides JOSE JWE encryption/decryption with configurable algorithms and optional compression.