(params, team_uids)
| 362 | |
| 363 | |
| 364 | def load_team_keys(params, team_uids): # type: (KeeperParams, List[str]) -> None |
| 365 | s = set(team_uids) |
| 366 | s.difference_update(params.key_cache.keys()) |
| 367 | if not s: |
| 368 | return |
| 369 | |
| 370 | if params.enterprise: |
| 371 | logging.debug('Resolve team keys shared with enterprise') |
| 372 | tree_key = params.enterprise['unencrypted_tree_key'] |
| 373 | for t in params.enterprise.get('teams', []): |
| 374 | team_uid = t.get('team_uid') |
| 375 | if team_uid in s: |
| 376 | try: |
| 377 | encrypted_team_key = t.get('encrypted_team_key') |
| 378 | if encrypted_team_key: |
| 379 | team_key = crypto.decrypt_aes_v2(utils.base64_url_decode(encrypted_team_key), tree_key) |
| 380 | existing = params.key_cache.get(team_uid) |
| 381 | params.key_cache[team_uid] = PublicKeys( |
| 382 | aes=team_key, |
| 383 | rsa=getattr(existing, 'rsa', b'') or b'', |
| 384 | ec=getattr(existing, 'ec', b'') or b'') |
| 385 | # Still fetch asymmetric public keys via team_get_keys below. |
| 386 | except Exception as e: |
| 387 | logging.debug('Team UID \"%s\": Decrypt key error: %s', team_uid, str(e)) |
| 388 | |
| 389 | if not s: |
| 390 | return |
| 391 | |
| 392 | logging.debug('Loading %d team keys', len(s)) |
| 393 | uids_to_load = list(s) |
| 394 | |
| 395 | while len(uids_to_load) > 0: |
| 396 | uids = uids_to_load[:90] |
| 397 | uids_to_load = uids_to_load[90:] |
| 398 | rq = { |
| 399 | 'command': 'team_get_keys', |
| 400 | 'teams': uids |
| 401 | } |
| 402 | rs = communicate(params, rq) |
| 403 | if 'keys' in rs: |
| 404 | merged = {} # team_uid -> PublicKeys fields |
| 405 | for tk in rs['keys']: |
| 406 | team_uid = tk.get('team_uid') |
| 407 | if not team_uid: |
| 408 | continue |
| 409 | if team_uid not in merged: |
| 410 | existing = params.key_cache.get(team_uid) |
| 411 | merged[team_uid] = { |
| 412 | 'aes': getattr(existing, 'aes', b'') or b'', |
| 413 | 'rsa': getattr(existing, 'rsa', b'') or b'', |
| 414 | 'ec': getattr(existing, 'ec', b'') or b'', |
| 415 | } |
| 416 | # Read the symmetric/wrapped team key from the 'key' field |
| 417 | if 'key' in tk: |
| 418 | try: |
| 419 | encrypted_key = utils.base64_url_decode(tk['key']) |
| 420 | key_type = tk.get('type') |
| 421 | if key_type == 1: |
nothing calls this directly
no test coverage detected