Package: vcrpy-encrypt
Encrypt vcrpy cassettes so they can be safely kept under version control.RationaleSensitive data can easily end up in HTTP requests/responses during testing.Vcrpyhasa way to scrub that datafrom its cassettes, but sometimes the tests that logged them actually need that information to pass.This would normally result in a choice: either don't record those test cassettes or don't keep them under version
control so that they can remain local only.Enters vcrpy-encrypt: at its core it's a simplevcrpy persisterthat will
encrypt cassettes before writing them to disk and decrypt them before replaying them when needed by a test. This means
that tests can replay cassettes with sensitive data in them AND those cassettes can now be safely kept under version
control and shared with others.InstallSimply run:pipinstallvcrpy-encryptUsageProvide a secret keyA secret key is needed to encrypt cassettes. It must be a 128, a 192 or a 256 bits longbytesobject. vcrpy-encrypt
offers an easy way to generate a random key:python-c"from vcrpy_encrypt import generate_key; print(generate_key())"By default this will result in a 128 bits key, butgenerate_keycan take128or192or256as argument to
generate a longer key.If a specific key is preferred, it can be converted from an utf-8, 16/24/32 characters long string like this:key="sixteensecretkey".encode("UTF-8")# len(b'sixteensecretkey') == 16No matter the source, the key must be kept secret and separated from the code under version control!Register the persisterVcrpy's custom persister api needs a class reference. This class can be defined inheriting fromBaseEncryptedPersisterlike this:fromvcrpy_encryptimportBaseEncryptedPersisterkey=...# recover the secret key from somewhere safeclassMyEncryptedPersister(BaseEncryptedPersister):# the encryption_key field must be initialized here with the chosen keyencryption_key:bytes=keyThe encrypted persister can now be registered and used:importvcrimportrequests# create a custom vcr objectmy_vcr=vcr.VCR()# register the encrypted persister into the custom vcr objectmy_vcr.register_persister(MyEncryptedPersister)# use that custom vcr object with use_cassettewithmy_vcr.use_cassette("encoded-cassette"):# this request will produce an encrypted cassette and will replay it on following runsrequests.get("https://localhost/?key=super-secret")Keep in mind that multiple vcr objects can coexists, so it's possible to use the default vcr everywhere while
reserving the one with the encrypted persister only for requests resulting in cassettes with sensitive data.CustomizationSometimes it can be handy to inspect the content of a cassette. This can be done even when using encrypted cassettes:classMyEncryptedPersister(BaseEncryptedPersister):encryption_key:bytes=keyshould_output_clear_text_as_well=TrueThis persister will output a clear text cassette side by side with the encrypted one. Remember to blacklist all clear
text cassette in the version control system! For example this will cause git to ignore all.yamlfile inside a
cassettes' folder (at any depth):# file: .gitignore**/cassettes/**/*.yamlClear text cassettes are only useful for human inspection: the persister will still use only the encrypted ones to
replay network requests.If different cassettes file name suffix are desired, they can be customized:classMyEncryptedPersister(BaseEncryptedPersister):encryption_key:bytes=keyshould_output_clear_text_as_well=Trueclear_text_suffix=".custom_clear"encoded_suffix=".custom_enc"Encryption performanceCurrently this library is encrypting cassettes usingcryptographywithAES-GCM. This algorithm
implementation is striking a good balance between security and performance.Keep in mind that key length will have an impact on encrypt time: 128 bits keys should suffice for most use cases.DevelopmentInstallinvokeandpoetry:pipinstallinvokepoetryNow clone the git repo:gitclonegit@github.com:CarloDePieri/vcrpy-encrypt.gitcdvcrpy-encrypt
invinstallThis will try to create a virtualenv based onpython3.8and install there all
project's dependencies. If a different python version is preferred, it can be
selected by specifying  the--python(-p) flag like this:invinstall-ppython3.9The test suite can be run with commands:invtest# run the test suiteinvtest-spec# run the tests while showing the output as a spec documentinvtest-cov# run the tests suite and produce a coverage reportTo run the test suite against all supported python version (they must be in path!) run:invtest-all-python-versionTo test the github workflow withact:# First you need a .secrets file - do not version control this!echo"repo_token: your_coveralls_token">.secrets# Then you can run one of these:invact-prod# test the dev workflowinvact-prod-cshell# open a shell in the act container (the above must fail first!)invact-prod-cclean# stop and delete a failed act container