diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..d4a2c44 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,21 @@ +# http://editorconfig.org + +root = true + +[*] +indent_style = space +indent_size = 4 +trim_trailing_whitespace = true +insert_final_newline = true +charset = utf-8 +end_of_line = lf + +[*.bat] +indent_style = tab +end_of_line = crlf + +[LICENSE] +insert_final_newline = false + +[Makefile] +indent_style = tab diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md new file mode 100644 index 0000000..f484eb2 --- /dev/null +++ b/.github/ISSUE_TEMPLATE.md @@ -0,0 +1,15 @@ +* cryptio version: +* Python version: +* Operating System: + +### Description + +Describe what you were trying to get done. +Tell us what happened, what went wrong, and what you expected to happen. + +### What I Did + +``` +Paste the command(s) you ran and the output. +If there was a crash, please include the traceback here. +``` diff --git a/.github/workflows/build-pipeline.yml b/.github/workflows/build-pipeline.yml new file mode 100644 index 0000000..43a5a19 --- /dev/null +++ b/.github/workflows/build-pipeline.yml @@ -0,0 +1,33 @@ +name: CI build + +on: + pull_request: + branches: + - master + - main +jobs: + build: + runs-on: ${{ matrix.os }} + env: + PYTHONIOENCODING: "utf8" + strategy: + matrix: + os: [ubuntu-latest] + python-version: ["3.12"] + + steps: + - uses: actions/checkout@v4 + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: ${{ matrix.python-version }} + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install .[dev] + - name: Run Linting + run: | + ruff check . + - name: Run Tests + run: | + pytest tests/ diff --git a/.github/workflows/publish_node.yml b/.github/workflows/publish_node.yml new file mode 100644 index 0000000..0118542 --- /dev/null +++ b/.github/workflows/publish_node.yml @@ -0,0 +1,21 @@ +name: 📦 Publish to Comfy registry +on: + workflow_dispatch: + push: + tags: + - '*' + +permissions: + issues: write + +jobs: + publish-node: + name: Publish Custom Node to registry + runs-on: ubuntu-latest + steps: + - name: ♻️ Check out code + uses: actions/checkout@v4 + - name: 📦 Publish Custom Node + uses: Comfy-Org/publish-node-action@main + with: + personal_access_token: ${{ secrets.REGISTRY_ACCESS_TOKEN }} diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml new file mode 100644 index 0000000..8d3b5d4 --- /dev/null +++ b/.github/workflows/validate.yml @@ -0,0 +1,13 @@ +name: Validate backwards compatibility + +on: + pull_request: + branches: + - master + - main + +jobs: + validate: + runs-on: ubuntu-latest + steps: + - uses: comfy-org/node-diff@main diff --git a/.gitignore b/.gitignore index 0fedfe7..f1dedd9 100644 --- a/.gitignore +++ b/.gitignore @@ -2,12 +2,14 @@ __pycache__/ *.py[cod] *$py.class - +/js # OSX useful to ignore *.DS_Store .AppleDouble .LSOverride - +/keys +*.pem +*.key # Thumbnails ._* diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..2539924 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,10 @@ +repos: + - repo: https://github.com/astral-sh/ruff-pre-commit + # Ruff version. + rev: v0.4.9 + hooks: + # Run the linter. + - id: ruff + args: [ --fix ] + # Run the formatter. + - id: ruff-format diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..d634ba0 --- /dev/null +++ b/LICENSE @@ -0,0 +1,675 @@ +GNU GENERAL PUBLIC LICENSE +Version 3, 29 June 2007 + +Copyright (C) 2007 Free Software Foundation, Inc. +Everyone is permitted to copy and distribute verbatim copies +of this license document, but changing it is not allowed. + + Preamble + +The GNU General Public License is a free, copyleft license for +software and other kinds of works. + +The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + +When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + +To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + +For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + +Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + +For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + +Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + +Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + +The precise terms and conditions for copying, distribution and +modification follow. + +TERMS AND CONDITIONS + +0. Definitions. + +"This License" refers to version 3 of the GNU General Public License. + +"Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + +"The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + +To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + +A "covered work" means either the unmodified Program or a work based +on the Program. + +To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + +To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + +An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + +1. Source Code. + +The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + +A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + +The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + +The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + +The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + +The Corresponding Source for a work in source code form is that +same work. + +2. Basic Permissions. + +All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + +You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + +Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + +3. Protecting Users' Legal Rights From Anti-Circumvention Law. + +No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + +When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + +4. Conveying Verbatim Copies. + +You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + +You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + +5. Conveying Modified Source Versions. + +You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + +a) The work must carry prominent notices stating that you modified +it, and giving a relevant date. + +b) The work must carry prominent notices stating that it is +released under this License and any conditions added under section +7. This requirement modifies the requirement in section 4 to +"keep intact all notices". + +c) You must license the entire work, as a whole, under this +License to anyone who comes into possession of a copy. This +License will therefore apply, along with any applicable section 7 +additional terms, to the whole of the work, and all its parts, +regardless of how they are packaged. This License gives no +permission to license the work in any other way, but it does not +invalidate such permission if you have separately received it. + +d) If the work has interactive user interfaces, each must display +Appropriate Legal Notices; however, if the Program has interactive +interfaces that do not display Appropriate Legal Notices, your +work need not make them do so. + +A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + +6. Conveying Non-Source Forms. + +You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + +a) Convey the object code in, or embodied in, a physical product +(including a physical distribution medium), accompanied by the +Corresponding Source fixed on a durable physical medium +customarily used for software interchange. + +b) Convey the object code in, or embodied in, a physical product +(including a physical distribution medium), accompanied by a +written offer, valid for at least three years and valid for as +long as you offer spare parts or customer support for that product +model, to give anyone who possesses the object code either (1) a +copy of the Corresponding Source for all the software in the +product that is covered by this License, on a durable physical +medium customarily used for software interchange, for a price no +more than your reasonable cost of physically performing this +conveying of source, or (2) access to copy the +Corresponding Source from a network server at no charge. + +c) Convey individual copies of the object code with a copy of the +written offer to provide the Corresponding Source. This +alternative is allowed only occasionally and noncommercially, and +only if you received the object code with such an offer, in accord +with subsection 6b. + +d) Convey the object code by offering access from a designated +place (gratis or for a charge), and offer equivalent access to the +Corresponding Source in the same way through the same place at no +further charge. You need not require recipients to copy the +Corresponding Source along with the object code. If the place to +copy the object code is a network server, the Corresponding Source +may be on a different server (operated by you or a third party) +that supports equivalent copying facilities, provided you maintain +clear directions next to the object code saying where to find the +Corresponding Source. Regardless of what server hosts the +Corresponding Source, you remain obligated to ensure that it is +available for as long as needed to satisfy these requirements. + +e) Convey the object code using peer-to-peer transmission, provided +you inform other peers where the object code and Corresponding +Source of the work are being offered to the general public at no +charge under subsection 6d. + +A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + +A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + +"Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + +If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + +The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + +Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + +7. Additional Terms. + +"Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + +When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + +Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + +a) Disclaiming warranty or limiting liability differently from the +terms of sections 15 and 16 of this License; or + +b) Requiring preservation of specified reasonable legal notices or +author attributions in that material or in the Appropriate Legal +Notices displayed by works containing it; or + +c) Prohibiting misrepresentation of the origin of that material, or +requiring that modified versions of such material be marked in +reasonable ways as different from the original version; or + +d) Limiting the use for publicity purposes of names of licensors or +authors of the material; or + +e) Declining to grant rights under trademark law for use of some +trade names, trademarks, or service marks; or + +f) Requiring indemnification of licensors and authors of that +material by anyone who conveys the material (or modified versions of +it) with contractual assumptions of liability to the recipient, for +any liability that these contractual assumptions directly impose on +those licensors and authors. + +All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + +If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + +Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + +8. Termination. + +You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + +However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + +Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + +Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + +9. Acceptance Not Required for Having Copies. + +You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + +10. Automatic Licensing of Downstream Recipients. + +Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + +An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + +You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + +11. Patents. + +A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + +A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + +Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + +In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + +If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + +If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + +A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + +Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + +12. No Surrender of Others' Freedom. + +If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + +13. Use with the GNU Affero General Public License. + +Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + +14. Revised Versions of this License. + +The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + +If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + +Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + +15. Disclaimer of Warranty. + +THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + +16. Limitation of Liability. + +IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + +17. Interpretation of Sections 15 and 16. + +If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + +END OF TERMS AND CONDITIONS + +How to Apply These Terms to Your New Programs + +If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + +To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + +Copyright (C) + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU General Public License as published by +the Free Software Foundation, either version 3 of the License, or +(at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + +If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) +This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. +This is free software, and you are welcome to redistribute it +under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + +You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + +The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. + diff --git a/MANIFEST.in b/MANIFEST.in new file mode 100644 index 0000000..6514960 --- /dev/null +++ b/MANIFEST.in @@ -0,0 +1,9 @@ +include LICENSE +include README.md + +recursive-exclude * __pycache__ +recursive-exclude * *.py[co] + +recursive-include docs *.rst conf.py Makefile make.bat *.jpg *.png *.gif + + diff --git a/README.md b/README.md new file mode 100644 index 0000000..a8874b2 --- /dev/null +++ b/README.md @@ -0,0 +1,71 @@ +# CryptIO + +A collection of custom nodes for ComfyUI that provides secure encryption for data transmission between browser and server. + +> [!NOTE] +> This projected was created with a [cookiecutter](https://github.com/Comfy-Org/cookiecutter-comfy-extension) template. It helps you start writing custom nodes without worrying about the Python setup. + +## Quickstart + +1. Install [ComfyUI](https://docs.comfy.org/get_started). +1. Install [ComfyUI-Manager](https://github.com/ltdrdata/ComfyUI-Manager) +1. Look up this extension in ComfyUI-Manager. If you are installing manually, clone this repository under `ComfyUI/custom_nodes`. +1. Restart ComfyUI. + +# Features + +- Uses asymmetric encryption (RSA) to protect data transmission +- Automatic key pair generation on the server side +- Client automatically retrieves and stores public key +- Browser-side encryption, server-side decryption +- No manual key management required by users + +## Develop + +To install the dev dependencies and pre-commit (will run the ruff hook), do: + +```bash +cd cryptio +pip install -e .[dev] +pre-commit install +``` + +The `-e` flag above will result in a "live" install, in the sense that any changes you make to your node extension will automatically be picked up the next time you run ComfyUI. + +## Publish to Github + +Install Github Desktop or follow these [instructions](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) for ssh. + +1. Create a Github repository that matches the directory name. +2. Push the files to Git +``` +git add . +git commit -m "project scaffolding" +git push +``` + +## Writing custom nodes + +An example custom node is located in [node.py](src/cryptio/nodes.py). To learn more, read the [docs](https://docs.comfy.org/essentials/custom_node_overview). + + +## Tests + +This repo contains unit tests written in Pytest in the `tests/` directory. It is recommended to unit test your custom node. + +- [build-pipeline.yml](.github/workflows/build-pipeline.yml) will run pytest and linter on any open PRs +- [validate.yml](.github/workflows/validate.yml) will run [node-diff](https://github.com/Comfy-Org/node-diff) to check for breaking changes + +## Publishing to Registry + +If you wish to share this custom node with others in the community, you can publish it to the registry. We've already auto-populated some fields in `pyproject.toml` under `tool.comfy`, but please double-check that they are correct. + +You need to make an account on https://registry.comfy.org and create an API key token. + +- [ ] Go to the [registry](https://registry.comfy.org). Login and create a publisher id (everything after the `@` sign on your registry profile). +- [ ] Add the publisher id into the pyproject.toml file. +- [ ] Create an api key on the Registry for publishing from Github. [Instructions](https://docs.comfy.org/registry/publishing#create-an-api-key-for-publishing). +- [ ] Add it to your Github Repository Secrets as `REGISTRY_ACCESS_TOKEN`. + +A Github action will run on every git push. You can also run the Github action manually. Full instructions [here](https://docs.comfy.org/registry/publishing). Join our [discord](https://discord.com/invite/comfyorg) if you have any questions! + diff --git a/TODO.md b/TODO.md new file mode 100644 index 0000000..edecbed --- /dev/null +++ b/TODO.md @@ -0,0 +1,14 @@ +# DONE 🎉 +- 图片上传 +- 图片 paste上传，drop上传 +- 图片预览，保存 +- 图片预览，保存 自动下载按钮 +- 重构文本加解密节点 +- 视频上传，预览，保存解密 + +# TODO 🚧 + +# PLAN 📝 +- fetch hook，/view fetch encrypted文件时自动转换 +- service worker 加解密 +- 设置界面，配置、查看密钥对 exchange密钥对按钮 \ No newline at end of file diff --git a/__init__.py b/__init__.py new file mode 100644 index 0000000..74b9b7c --- /dev/null +++ b/__init__.py @@ -0,0 +1,14 @@ +"""Top-level package for cryptio.""" + +WEB_DIRECTORY = "./js" +__all__ = ["NODE_CLASS_MAPPINGS", "NODE_DISPLAY_NAME_MAPPINGS", "WEB_DIRECTORY"] + + +__author__ = """ComfyUI-CryptoIO""" +__email__ = "thesoup@foxmail.com" +__version__ = "0.0.1" + +from .src.cryptio.nodes import NODE_CLASS_MAPPINGS +from .src.cryptio.nodes import NODE_DISPLAY_NAME_MAPPINGS + + diff --git a/pyproject.toml b/pyproject.toml new file mode 100644 index 0000000..a474d0b --- /dev/null +++ b/pyproject.toml @@ -0,0 +1,80 @@ +[build-system] +requires = ["setuptools>=70.0"] +build-backend = "setuptools.build_meta" + +[project] +name = "cryptio" +version = "0.0.2" +description = "A collection of custom nodes for ComfyUI" +authors = [{ name = "ComfyUI-CryptoIO", email = "thesoup@foxmail.com" }] +readme = "README.md" +license = { text = "GNU General Public License v3" } +requires-python = ">=3.10" +classifiers = [] +dependencies = [] + + +[project.optional-dependencies] +dev = [ + "bump-my-version", + "coverage", # testing + "mypy", # linting + "pre-commit", # runs linting on commit + "pytest", # testing + "ruff", # linting +] + +[project.urls] +Repository = "https://github.com/Suzu008/cryptio" +BugTracker = "https://github.com/Suzu008/cryptio/issues" +Documentation = "https://github.com/Suzu008/cryptio/wiki" + + +[tool.comfy] +PublisherId = "Suzu008" +DisplayName = "CryptIO" +Icon = "" +Tags = [] +Repository = "https://github.com/Suzu008/cryptio" + +includes = [] + +[tool.setuptools.package-data] +"*" = ["*.*"] + +[tool.pytest.ini_options] +minversion = "8.0" +testpaths = ["tests"] + +[tool.mypy] +files = "." + +# Use strict defaults +strict = true +warn_unreachable = true +warn_no_return = true + +[[tool.mypy.overrides]] +# Don't require test functions to include types +module = "tests.*" +allow_untyped_defs = true +disable_error_code = "attr-defined" + +[tool.ruff] +# extend-exclude = ["static", "ci/templates"] +line-length = 140 +src = ["src", "tests"] +target-version = "py39" + +# Add rules to ban exec/eval +[tool.ruff.lint] +select = [ + "S102", # exec-builtin + "S307", # eval-used + "W293", + "F", # The "F" series in Ruff stands for "Pyflakes" rules, which catch various Python syntax errors and undefined names. + # See all rules here: https://docs.astral.sh/ruff/rules/#pyflakes-f +] + +[tool.ruff.lint.flake8-quotes] +inline-quotes = "double" diff --git a/src/cryptio/__init__.py b/src/cryptio/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/src/cryptio/api.py b/src/cryptio/api.py new file mode 100644 index 0000000..751e22a --- /dev/null +++ b/src/cryptio/api.py @@ -0,0 +1,176 @@ +import os +import string +import secrets +import json +import base64 +from aiohttp import web +from server import PromptServer # pyright: ignore[reportMissingImports] +import folder_paths # pyright: ignore[reportMissingImports] +from .utils import _key_manager +from .utils.crypto_utils import ( + encrypt_data_with_public_key, + generate_aes_key_and_iv, + encrypt_with_aes_cbc, +) +from cryptography.hazmat.primitives import serialization +from cryptography.hazmat.backends import default_backend + + +@PromptServer.instance.routes.post("/cryptio/exchange_keys") +async def exchange_keys(request): + """ + 密钥交换端点： + 1. 接收客户端公钥 + 2. 保存客户端公钥到服务器 + 3. 使用客户端公钥加密服务端密钥对 + 4. 返回加密后的服务端密钥 + """ + try: + data = await request.json() + client_public_key_pem = data.get("client_public_key") + + if not client_public_key_pem: + return web.json_response({"error": "client_public_key is required"}, status=400) + + # 保存客户端公钥 + client_public_key_bytes = client_public_key_pem.encode("utf-8") + _key_manager.update_client_key(client_public_key_bytes) + + # 获取服务端密钥 PEM 格式 + server_public_key_pem = _key_manager.server_public_key_pem + server_private_key_pem = _key_manager.server_private_key_pem + + if not server_public_key_pem or not server_private_key_pem: + return web.json_response({"error": "Server keys not found"}, status=500) + + # 使用客户端公钥加密服务端密钥 + client_public_key = serialization.load_pem_public_key( + client_public_key_bytes, backend=default_backend() + ) + + # 准备要加密的数据（服务端公钥和私钥） + keys_data = json.dumps( + { + "server_public_key": server_public_key_pem.decode("utf-8"), + "server_private_key": server_private_key_pem.decode("utf-8"), + } + ) + + # 由于RSA加密有大小限制，使用混合加密方案（AES-CBC + RSA-OAEP） + # 1. 生成随机AES密钥和IV + aes_key, iv = generate_aes_key_and_iv() + + # 2. 使用AES加密数据 + encrypted_data = encrypt_with_aes_cbc(keys_data.encode("utf-8"), aes_key, iv) + + # 3. 使用RSA加密AES密钥 + encrypted_aes_key = encrypt_data_with_public_key(aes_key, client_public_key) + + # 4. 返回加密后的数据 + return web.json_response( + { + "encrypted_aes_key": base64.b64encode(encrypted_aes_key).decode("ascii"), + "iv": base64.b64encode(iv).decode("ascii"), + "encrypted_data": base64.b64encode(encrypted_data).decode("ascii"), + } + ) + + except Exception as e: + print(f"Error in key exchange: {e}") + import traceback + + traceback.print_exc() + return web.json_response({"error": str(e)}, status=500) + + +@PromptServer.instance.routes.get("/cryptio/public_key") +async def get_public_key(request): + """兼容旧的公钥获取接口（不加密传输）""" + pub_pem = _key_manager.server_public_key_pem + if pub_pem: + return web.json_response({"public_key": pub_pem.decode("utf-8")}) + else: + return web.json_response({"error": "Public key not found"}, status=404) + + +@PromptServer.instance.routes.post("/cryptio/upload_encrypted") +async def upload_encrypted_image(request): + """接收加密的图片数据并保存到文件""" + try: + # 读取 multipart 表单数据 + reader = await request.multipart() + + encrypted_data = None + original_filename = None + + async for field in reader: + if field.name == "image": + # 读取加密的文件数据 + encrypted_data = await field.read() + original_filename = field.filename + + if not encrypted_data: + return web.json_response({"error": "No image data received"}, status=400) + + # 生成唯一的加密文件名，保留原始文件名并追加随机字符串 + input_dir = folder_paths.get_input_directory() + + safe_original = os.path.basename(original_filename) if original_filename else "cryptio" + if safe_original.lower().endswith(".encrypted"): + safe_original = safe_original[:-len(".encrypted")] + + base_name, file_ext = os.path.splitext(safe_original) + + base_name = base_name.strip().replace(" ", "_") or "cryptio" + file_ext = file_ext or ".enc" + + charset = string.ascii_lowercase + string.digits + + def build_filename() -> str: + random_suffix = ''.join(secrets.choice(charset) for _ in range(6)) + return f"{base_name}_{random_suffix}{file_ext}.encrypted" + + unique_filename = build_filename() + while os.path.exists(os.path.join(input_dir, unique_filename)): + unique_filename = build_filename() + + # 保存到 input 目录 + file_path = os.path.join(input_dir, unique_filename) + + # 写入加密数据 + with open(file_path, "wb") as f: + f.write(encrypted_data) + + return web.json_response({"name": unique_filename, "subfolder": "", "type": "input"}) + + except Exception as e: + print(f"Error uploading encrypted image: {e}") + return web.json_response({"error": str(e)}, status=500) + + +@PromptServer.instance.routes.get("/cryptio/view_encrypted") +async def view_encrypted_image(request): + """获取加密图片用于前端预览（返回二进制加密数据，由前端解密）""" + try: + filename = request.query.get("filename") + if not filename: + return web.json_response({"error": "filename parameter is required"}, status=400) + + # 获取文件路径 + image_path = folder_paths.get_annotated_filepath(filename) + + if not os.path.exists(image_path): + return web.json_response({"error": "File not found"}, status=404) + + # 读取加密文件 + with open(image_path, "rb") as f: + encrypted_data = f.read() + + # 返回二进制数据，使用 Content-Disposition header 传递文件名 + return web.Response( + body=encrypted_data, content_type="application/octet-stream", headers={"Content-Disposition": f'filename="{filename}"'} + ) + + except Exception as e: + print(f"Error viewing encrypted image: {e}") + return web.json_response({"error": str(e)}, status=500) diff --git a/src/cryptio/nodes.py b/src/cryptio/nodes.py new file mode 100644 index 0000000..cb60865 --- /dev/null +++ b/src/cryptio/nodes.py @@ -0,0 +1,40 @@ +from .text_crypt import TextDecrypt, TextEncrypt +from .upload_image import UploadImageCryptIO +from .save_image import SaveImageCryptIO, PreviewImageCryptIO +from .upload_video import UploadVideoCryptIO +from .save_video import SaveVideoCryptIO, PreviewVideoCryptIO +from . import api as _api # noqa: F401 + +# 节点映射 - 按功能分组组织 +NODE_CLASS_MAPPINGS = { + # 文本加解密 + "TextEncrypt": TextEncrypt, + "TextDecrypt": TextDecrypt, + + # 图片处理 + "UploadImageCryptIO": UploadImageCryptIO, + "SaveImageCryptIO": SaveImageCryptIO, + "PreviewImageCryptIO": PreviewImageCryptIO, + + # 视频处理 + "UploadVideoCryptIO": UploadVideoCryptIO, + "SaveVideoCryptIO": SaveVideoCryptIO, + "PreviewVideoCryptIO": PreviewVideoCryptIO, +} + +# 节点显示名称映射 +NODE_DISPLAY_NAME_MAPPINGS = { + # 文本加解密 + "TextEncrypt": "Text Encrypt 🔒", + "TextDecrypt": "Text Decrypt 🔒", + + # 图片处理 + "UploadImageCryptIO": "Upload Image 🔒", + "SaveImageCryptIO": "Save Image 🔒", + "PreviewImageCryptIO": "Preview Image 🔒", + + # 视频处理 deprecated, now defined in node schema + # "UploadVideoCryptIO": "Upload Video 🔒", + # "SaveVideoCryptIO": "Save Video 🔒", + # "PreviewVideoCryptIO": "Preview Video 🔒", +} diff --git a/src/cryptio/save_image.py b/src/cryptio/save_image.py new file mode 100644 index 0000000..7de888f --- /dev/null +++ b/src/cryptio/save_image.py @@ -0,0 +1,200 @@ +import os +import json +import random +import numpy as np +import torch +from PIL import Image +from PIL.PngImagePlugin import PngInfo + +import folder_paths # pyright: ignore[reportMissingImports] +from .utils import _key_manager +from .utils.crypto_utils import encrypt_data_hybrid + + +class SaveImageCryptIO: + """ + 加密图片保存节点，将图片保存为加密的 .png.encrypted 文件 + """ + + def __init__(self): + self.output_dir = folder_paths.get_output_directory() + self.type = "output" + self.prefix_append = "" + self.compress_level = 4 + + @classmethod + def INPUT_TYPES(s): + return { + "required": { + "images": ("IMAGE",), + "filename_prefix": ("STRING", {"default": "ComfyUI"}), + "format": (["PNG", "JPG", "WEBP", "AVIF"],), + "quality": ("INT", {"default": 95, "min": 1, "max": 100, "step": 1}), + "auto_download": ("BOOLEAN", {"default": False}), + }, + "hidden": {"prompt": "PROMPT", "extra_pnginfo": "EXTRA_PNGINFO"}, + } + + RETURN_TYPES = () + FUNCTION = "save_images" + OUTPUT_NODE = True + CATEGORY = "CryptIO🔒" + + def save_images(self, images, filename_prefix="ComfyUI", format="PNG", quality=95, auto_download=False, prompt=None, extra_pnginfo=None): + """ + 保存并加密图片 + """ + filename_prefix += self.prefix_append + full_output_folder, filename, counter, subfolder, filename_prefix = folder_paths.get_save_image_path( + filename_prefix, self.output_dir, images[0].shape[1], images[0].shape[0] + ) + results = list() + + for batch_number, image in enumerate(images): + i = 255.0 * image.cpu().numpy() + img = Image.fromarray(np.clip(i, 0, 255).astype(np.uint8)) + + # 添加元数据 (仅PNG支持) + metadata = None + if format == "PNG" and (prompt is not None or extra_pnginfo is not None): + metadata = PngInfo() + if prompt is not None: + metadata.add_text("prompt", json.dumps(prompt)) + if extra_pnginfo is not None: + for x in extra_pnginfo: + metadata.add_text(x, json.dumps(extra_pnginfo[x])) + + # 保存为指定格式到内存 + from io import BytesIO + + file_ext = format.lower() + if format == "JPG": + file_ext = "jpg" + format_key = "JPEG" + else: + format_key = format + + buffer = BytesIO() + if format == "PNG": + img.save(buffer, format="PNG", pnginfo=metadata, compress_level=self.compress_level) + else: + # JPG/WEBP/AVIF ignore metadata for now + img.save(buffer, format=format_key, quality=quality) + + image_data = buffer.getvalue() + + # 加密数据 + encrypted_data = encrypt_data(image_data) + + # 保存加密数据到文件 + filename_with_batch_num = filename.replace("%batch_num%", str(batch_number)) + file = f"{filename_with_batch_num}_{counter:05}_.{file_ext}.encrypted" + encrypted_path = os.path.join(full_output_folder, file) + + with open(encrypted_path, "wb") as f: + f.write(encrypted_data) + + results.append( + {"filename": file, "subfolder": subfolder, "type": self.type} + ) + counter += 1 + + return {"ui": {"cryptio_images": results}} + +class PreviewImageCryptIO: + """ + 加密图片预览节点，类似SaveImage但用于临时预览 + """ + + def __init__(self): + self.output_dir = folder_paths.get_temp_directory() + self.type = "temp" + self.prefix_append = "_temp_" + ''.join(random.choice("abcdefghijklmnopqrstupvxyz") for x in range(5)) + self.compress_level = 1 + + @classmethod + def INPUT_TYPES(s): + return { + "required": { + "images": ("IMAGE",), + "format": (["PNG", "JPG", "WEBP", "AVIF"],), + "quality": ("INT", {"default": 95, "min": 1, "max": 100, "step": 1}), + "auto_download": ("BOOLEAN", {"default": False}), + }, + "hidden": {"prompt": "PROMPT", "extra_pnginfo": "EXTRA_PNGINFO"}, + } + + RETURN_TYPES = () + FUNCTION = "save_images" + OUTPUT_NODE = True + CATEGORY = "CryptIO🔒" + + def save_images(self, images, auto_download=False, filename_prefix="ComfyUI", format="PNG", quality=95, prompt=None, extra_pnginfo=None): + """ + 保存并加密图片用于预览 + """ + filename_prefix += self.prefix_append + full_output_folder, filename, counter, subfolder, filename_prefix = folder_paths.get_save_image_path( + filename_prefix, self.output_dir, images[0].shape[1], images[0].shape[0] + ) + results = list() + + for batch_number, image in enumerate(images): + i = 255.0 * image.cpu().numpy() + img = Image.fromarray(np.clip(i, 0, 255).astype(np.uint8)) + + # 添加元数据 (仅PNG支持) + metadata = None + if format == "PNG" and (prompt is not None or extra_pnginfo is not None): + metadata = PngInfo() + if prompt is not None: + metadata.add_text("prompt", json.dumps(prompt)) + if extra_pnginfo is not None: + for x in extra_pnginfo: + metadata.add_text(x, json.dumps(extra_pnginfo[x])) + + # 保存为指定格式到内存 + from io import BytesIO + + file_ext = format.lower() + if format == "JPG": + file_ext = "jpg" + format_key = "JPEG" + else: + format_key = format + + buffer = BytesIO() + if format == "PNG": + img.save(buffer, format="PNG", pnginfo=metadata, compress_level=self.compress_level) + else: + img.save(buffer, format=format_key, quality=quality) + + image_data = buffer.getvalue() + + # 加密数据 + encrypted_data = encrypt_data(image_data) + + # 保存加密数据到文件 + filename_with_batch_num = filename.replace("%batch_num%", str(batch_number)) + file = f"{filename_with_batch_num}_{counter:05}_.{file_ext}.encrypted" + encrypted_path = os.path.join(full_output_folder, file) + + with open(encrypted_path, "wb") as f: + f.write(encrypted_data) + + results.append( + {"filename": file, "subfolder": subfolder, "type": self.type} + ) + counter += 1 + + return {"ui": {"cryptio_images": results}} + +def encrypt_data(data: bytes) -> bytes: + """ + 使用混合加密方案加密数据（使用客户端公钥加密） + """ + # 使用客户端公钥加密（这样只有客户端能解密） + if not _key_manager.client_public_key: + raise ValueError("Client public key not found. Please upload an image first to exchange keys.") + + return encrypt_data_hybrid(data, _key_manager.client_public_key) diff --git a/src/cryptio/save_video.py b/src/cryptio/save_video.py new file mode 100644 index 0000000..82d306b --- /dev/null +++ b/src/cryptio/save_video.py @@ -0,0 +1,290 @@ +import os +import random +from io import BytesIO +import folder_paths # pyright: ignore[reportMissingImports] +from .utils import _key_manager +import av +import torch +import numpy as np +import math +import json +from fractions import Fraction +from .utils import _key_manager +from .utils.crypto_utils import encrypt_data_hybrid +from comfy_api.input import VideoInput +from comfy_api.latest import io, ui + + + +def _save_to_bytesio_impl(video, buffer, metadata=None): + """ + Unified method to save video (file or components) to a BytesIO buffer. + Handles remuxing for files (if compatible) and re-encoding for components. + """ + # 1. Try Remuxing (if input is a file) + if hasattr(video, "get_stream_source"): + try: + source = video.get_stream_source() + if isinstance(source, BytesIO): + source.seek(0) + + with av.open(source, mode='r') as input_container: + # We strictly want MP4 for encryption node compatibility + # writing to buffer requires explicit format + with av.open(buffer, mode='w', format='mp4', options={'movflags': 'use_metadata_tags'}) as output_container: + # Merge metadata + if metadata is None: + metadata = {} + + # Copy input metadata first + for key, value in input_container.metadata.items(): + if key not in metadata: + output_container.metadata[key] = value + + # Apply new metadata + for key, value in metadata.items(): + output_container.metadata[key] = json.dumps(value) if not isinstance(value, str) else value + + # Map streams + stream_map = {} + for stream in input_container.streams: + # Copy video and audio streams + if isinstance(stream, (av.VideoStream, av.AudioStream)): + out_stream = output_container.add_stream_from_template(template=stream, opaque=True) + stream_map[stream] = out_stream + + if not stream_map: + raise ValueError("No compatible streams found for remuxing") + + # Copy packets + for packet in input_container.demux(): + if packet.stream in stream_map and packet.dts is not None: + packet.stream = stream_map[packet.stream] + output_container.mux(packet) + + return # Success + except Exception as e: + # Fallback to re-encoding + # print(f"CryptIO: Remux failed ({e}), falling back to re-encoding.") + buffer.seek(0) + buffer.truncate() + pass + + # 2. Re-encoding (VideoFromComponents or fallback) + components = video.get_components() + + with av.open(buffer, mode='w', format='mp4', options={'movflags': 'use_metadata_tags'}) as output: + if metadata: + for key, value in metadata.items(): + output.metadata[key] = json.dumps(value) if not isinstance(value, str) else value + + # Video Stream + frame_rate = components.frame_rate + if isinstance(frame_rate, (int, float)): + frame_rate = Fraction(round(frame_rate * 1000), 1000) + + if components.images is None or len(components.images) == 0: + raise ValueError("No video frames to save") + + height, width = components.images.shape[1], components.images.shape[2] + + stream = output.add_stream('h264', rate=frame_rate) + stream.width = width + stream.height = height + stream.pix_fmt = 'yuv420p' + + # Audio Stream + audio_stream = None + audio_sample_rate = 44100 + if components.audio: + audio_sample_rate = int(components.audio.get('sample_rate', 44100)) + audio_stream = output.add_stream('aac', rate=audio_sample_rate) + + # Encode Video + for i, img_tensor in enumerate(components.images): + img_np = (img_tensor * 255).clamp(0, 255).byte().cpu().numpy() + frame = av.VideoFrame.from_ndarray(img_np, format='rgb24') + frame = frame.reformat(format='yuv420p') + for packet in stream.encode(frame): + output.mux(packet) + + # Flush Video + for packet in stream.encode(None): + output.mux(packet) + + # Encode Audio + if audio_stream and components.audio: + waveform = components.audio['waveform'] + required_samples = math.ceil((audio_sample_rate / frame_rate) * len(components.images)) + if waveform.shape[-1] > required_samples: + waveform = waveform[..., :required_samples] + + flat_audio = waveform.movedim(2, 1).reshape(1, -1).float().cpu().numpy() + + frame = av.AudioFrame.from_ndarray( + flat_audio, + format='flt', + layout='mono' if waveform.shape[1] == 1 else 'stereo' + ) + frame.sample_rate = audio_sample_rate + frame.pts = 0 + + for packet in audio_stream.encode(frame): + output.mux(packet) + + for packet in audio_stream.encode(None): + output.mux(packet) + + +class SaveVideoCryptIO(io.ComfyNode): + """ + Encrypt and save video files using client public key + """ + + @classmethod + def define_schema(cls): + return io.Schema( + node_id="SaveVideoCryptIO", + display_name="Save Video 🔒", + category="CryptIO🔒", + description="Encrypt and save videos to the output directory", + inputs=[ + io.Video.Input("video", tooltip="The video to encrypt and save"), + io.String.Input("filename_prefix", default="ComfyUI", tooltip="Prefix for the saved encrypted file"), + io.Boolean.Input("auto_download", default=False, tooltip="Automatically download decrypted video in browser"), + ], + outputs=[], + hidden=[io.Hidden.prompt, io.Hidden.extra_pnginfo], + is_output_node=True, + ) + + @classmethod + def execute(cls, video: VideoInput, filename_prefix: str = "ComfyUI", auto_download: bool = False) -> io.NodeOutput: + """ + Encrypt and save video file + """ + try: + # Get video dimensions for path generation + width, height = video.get_dimensions() + + # Generate save path + full_output_folder, filename, counter, subfolder, filename_prefix = folder_paths.get_save_image_path( + filename_prefix, folder_paths.get_output_directory(), width, height + ) + + # Prepare workflow metadata + metadata = None + if cls.hidden.extra_pnginfo is not None or cls.hidden.prompt is not None: + metadata = {} + if cls.hidden.extra_pnginfo is not None: + metadata.update(cls.hidden.extra_pnginfo) + if cls.hidden.prompt is not None: + metadata["prompt"] = cls.hidden.prompt + + # Save video to in-memory buffer to avoid writing plaintext to disk + buffer = BytesIO() + # Save video to in-memory buffer using unified helper + buffer = BytesIO() + _save_to_bytesio_impl(video, buffer, metadata=metadata) + video_data = buffer.getvalue() + buffer.close() + + # Encrypt video data using client public key + if not _key_manager.client_public_key: + raise ValueError("Client public key not found. Please upload an image first to exchange keys.") + + encrypted_data = encrypt_data_hybrid(video_data, _key_manager.client_public_key) + + # Save encrypted file + file = f"{filename}_{counter:05}_.mp4.encrypted" + encrypted_path = os.path.join(full_output_folder, file) + + with open(encrypted_path, "wb") as f: + f.write(encrypted_data) + + # Return UI with encrypted video info + results = [{"filename": file, "subfolder": subfolder, "type": "output", "format": "video/mp4"}] + + return io.NodeOutput(ui={"cryptio_images": results, "animated": [True] * len(results)}) + + except Exception as e: + print(f"Error saving/encrypting video: {e}") + raise ValueError(f"Failed to save/encrypt video: {e}") + + +class PreviewVideoCryptIO(io.ComfyNode): + """ + Encrypt and preview video files using client public key (saved to temp directory) + """ + + @classmethod + def define_schema(cls): + return io.Schema( + node_id="PreviewVideoCryptIO", + display_name="Preview Video 🔒", + category="CryptIO🔒", + description="Encrypt and preview videos (saved to temp directory)", + inputs=[ + io.Video.Input("video", tooltip="The video to encrypt and preview"), + io.Boolean.Input("auto_download", default=False, tooltip="Automatically download decrypted video in browser"), + ], + outputs=[], + hidden=[io.Hidden.prompt, io.Hidden.extra_pnginfo], + is_output_node=True, + ) + + @classmethod + def execute(cls, video: VideoInput, auto_download: bool = False) -> io.NodeOutput: + """ + Encrypt and save video file for preview + """ + try: + # Get video dimensions for path generation + width, height = video.get_dimensions() + + # Generate unique prefix for temp files + random_suffix = "".join(random.choice("abcdefghijklmnopqrstuvwxyz") for _ in range(5)) + filename_prefix = f"ComfyUI_temp_{random_suffix}" + + # Generate save path in temp directory + full_output_folder, filename, counter, subfolder, filename_prefix = folder_paths.get_save_image_path( + filename_prefix, folder_paths.get_temp_directory(), width, height + ) + + # Prepare workflow metadata + metadata = None + if cls.hidden.extra_pnginfo is not None or cls.hidden.prompt is not None: + metadata = {} + if cls.hidden.extra_pnginfo is not None: + metadata.update(cls.hidden.extra_pnginfo) + if cls.hidden.prompt is not None: + metadata["prompt"] = cls.hidden.prompt + + # Save video to in-memory buffer using unified helper + buffer = BytesIO() + # Preview forces mp4/h264 in save_to usually, but our helper does that by default for buffer + _save_to_bytesio_impl(video, buffer, metadata=metadata) + video_data = buffer.getvalue() + buffer.close() + + # Encrypt video data using client public key + if not _key_manager.client_public_key: + raise ValueError("Client public key not found. Please upload an image first to exchange keys.") + + encrypted_data = encrypt_data_hybrid(video_data, _key_manager.client_public_key) + + # Save encrypted file + file = f"{filename}_{counter:05}_.mp4.encrypted" + encrypted_path = os.path.join(full_output_folder, file) + + with open(encrypted_path, "wb") as f: + f.write(encrypted_data) + + # Return UI with encrypted video info + results = [{"filename": file, "subfolder": subfolder, "type": "temp", "format": "video/mp4"}] + + return io.NodeOutput(ui={"cryptio_images": results, "animated": [True] * len(results)}) + + except Exception as e: + print(f"Error previewing/encrypting video: {e}") + raise ValueError(f"Failed to preview/encrypt video: {e}") diff --git a/src/cryptio/text_crypt.py b/src/cryptio/text_crypt.py new file mode 100644 index 0000000..92f8db6 --- /dev/null +++ b/src/cryptio/text_crypt.py @@ -0,0 +1,83 @@ +import base64 +from .utils import _key_manager +from .utils.crypto_utils import decrypt_data_hybrid + + +class TextEncrypt: + """ + 客户端加密节点，使用公钥加密文本 + """ + + def __init__(self): + pass + + @classmethod + def INPUT_TYPES(cls): + return { + "required": { + "text": ("STRING", {"multiline": True, "default": "要加密的文本"}), + "encrypted": ("BOOLEAN", {"default": False}), + }, + } + + RETURN_TYPES = ("STRING", "STRING") + RETURN_NAMES = ("text", "encrypted_text") + FUNCTION = "crypt" + CATEGORY = "CryptIO🔒" + + def crypt(self, text: str, encrypted): + """使用公钥加密文本 + 在客户端JavaScript中实现，这里只是占位符 + 实际加密在前端JavaScript中完成 + """ + try: + if text.startswith("ENCRYPTED:"): + encrypted_bytes = base64.b64decode(text[10:]) + + # 使用混合解密 + decrypted_data = decrypt_data_hybrid(encrypted_bytes, _key_manager.server_private_key) + decrypted_text = decrypted_data.decode("utf-8") + return (decrypted_text, text) + else: + raise ValueError("文本不是加密格式") + except Exception as e: + print(f"解密错误: {e}") + return (f"解密错误: {str(e)}",) + + +class TextDecrypt: + """ + 服务端解密节点，使用私钥解密文本 + """ + + def __init__(self): + pass + + @classmethod + def INPUT_TYPES(cls): + return { + "required": { + "encrypted_text": ("STRING", {"multiline": True, "default": "ENCRYPTED:加密的文本"}), + }, + } + + RETURN_TYPES = ("STRING",) + RETURN_NAMES = ("decrypted_text",) + FUNCTION = "decrypt" + CATEGORY = "CryptIO🔒" + + def decrypt(self, encrypted_text): + """使用私钥解密文本（支持混合加密格式）""" + try: + if encrypted_text.startswith("ENCRYPTED:"): + encrypted_bytes = base64.b64decode(encrypted_text[10:]) + + # 使用混合解密 + decrypted_data = decrypt_data_hybrid(encrypted_bytes, _key_manager.server_private_key) + decrypted_text = decrypted_data.decode("utf-8") + return (decrypted_text,) + else: + return (encrypted_text,) + except Exception as e: + print(f"解密错误: {e}") + return (f"解密错误: {str(e)}",) diff --git a/src/cryptio/upload_image.py b/src/cryptio/upload_image.py new file mode 100644 index 0000000..8520b77 --- /dev/null +++ b/src/cryptio/upload_image.py @@ -0,0 +1,134 @@ +import os +import hashlib +import numpy as np +import torch +from PIL import Image, ImageSequence, ImageOps +from .utils import _key_manager +from .utils.crypto_utils import decrypt_data_hybrid +import folder_paths # pyright: ignore[reportMissingImports] +import node_helpers # pyright: ignore[reportMissingImports] + + +class UploadImageCryptIO: + """ + 加密图片上传节点，使用公钥在客户端加密图片数据，服务端使用私钥解密 + """ + + def __init__(self): + self.input_dir = folder_paths.get_input_directory() + self.type = "input" + + @classmethod + def INPUT_TYPES(s): + input_dir = folder_paths.get_input_directory() + files = [f for f in os.listdir(input_dir) if os.path.isfile(os.path.join(input_dir, f))] + encrypted_files = [f for f in files if f.endswith(".encrypted")] + all_files = sorted(set(encrypted_files)) + + return { + "required": {"image": (all_files, {"file_upload": True})}, + } + + RETURN_TYPES = ("IMAGE", "MASK") + RETURN_NAMES = ("image", "mask") + FUNCTION = "load_image" + CATEGORY = "CryptIO🔒" + + def load_image(self, image): + """ + 加载并解密图片 + """ + try: + # 检查是否是加密文件（文件名以 .encrypted 结尾） + if isinstance(image, str) and image.endswith(".encrypted"): + # 从加密文件读取 + image_path = folder_paths.get_annotated_filepath(image) + + with open(image_path, "rb") as f: + encrypted_combined = f.read() + + # 使用服务端私钥解密（混合加密） + decrypted_data = decrypt_data_hybrid(encrypted_combined, _key_manager.server_private_key) + + # 从字节数据创建图片 + from io import BytesIO + + img = Image.open(BytesIO(decrypted_data)) + + else: + return (None, None) + + # 处理图片（与LoadImage节点相同的处理逻辑） + output_images = [] + output_masks = [] + w, h = None, None + + for i in ImageSequence.Iterator(img): + i = node_helpers.pillow(ImageOps.exif_transpose, i) + + if i.mode == "I": + i = i.point(lambda i: i * (1 / 255)) + image_rgb = i.convert("RGB") + + if len(output_images) == 0: + w = image_rgb.size[0] + h = image_rgb.size[1] + + if image_rgb.size[0] != w or image_rgb.size[1] != h: + continue + + image_array = np.array(image_rgb).astype(np.float32) / 255.0 + image_tensor = torch.from_numpy(image_array)[None,] + + # 处理遮罩 + if "A" in i.getbands(): + mask = np.array(i.getchannel("A")).astype(np.float32) / 255.0 + mask = 1.0 - torch.from_numpy(mask) + elif i.mode == "P" and "transparency" in i.info: + mask = np.array(i.convert("RGBA").getchannel("A")).astype(np.float32) / 255.0 + mask = 1.0 - torch.from_numpy(mask) + else: + mask = torch.zeros((64, 64), dtype=torch.float32, device="cpu") + + output_images.append(image_tensor) + output_masks.append(mask.unsqueeze(0)) + + if len(output_images) > 1 and img.format not in ["MPO"]: + output_image = torch.cat(output_images, dim=0) + output_mask = torch.cat(output_masks, dim=0) + else: + output_image = output_images[0] + output_mask = output_masks[0] + + return (output_image, output_mask) + + except Exception as e: + print(f"加载/解密图片错误: {e}") + raise ValueError(f"Failed to decrypt image: {e}") + + @classmethod + def IS_CHANGED(s, image): + """检查图片是否已更改""" + if isinstance(image, str) and not image.startswith("ENCRYPTED:"): + image_path = folder_paths.get_annotated_filepath(image) + m = hashlib.sha256() + with open(image_path, "rb") as f: + m.update(f.read()) + return m.digest().hex() + return float("NaN") # 对于加密数据，总是重新处理 + + @classmethod + def VALIDATE_INPUTS(s, image): + """验证输入""" + if isinstance(image, str) and image.endswith(".encrypted"): + # 加密数据由解密逻辑处理 + # 检查加密文件是否存在 + if image.endswith(".encrypted"): + if not folder_paths.exists_annotated_filepath(image): + return f"Invalid encrypted image file: {image}" + return True + + if not folder_paths.exists_annotated_filepath(image): + return f"Invalid image file: {image}" + + return True diff --git a/src/cryptio/upload_video.py b/src/cryptio/upload_video.py new file mode 100644 index 0000000..2edbc3f --- /dev/null +++ b/src/cryptio/upload_video.py @@ -0,0 +1,105 @@ +import os +import hashlib +import tempfile +import folder_paths # pyright: ignore[reportMissingImports] +from .utils import _key_manager +from .utils.crypto_utils import decrypt_data_hybrid +from comfy_api.input import VideoInput +from comfy_api.input_impl import VideoFromFile +from comfy_api.latest import io + + +class UploadVideoCryptIO(io.ComfyNode): + """ + Upload and decrypt encrypted video files using server private key + """ + + @classmethod + def define_schema(cls): + input_dir = folder_paths.get_input_directory() + files = [f for f in os.listdir(input_dir) if os.path.isfile(os.path.join(input_dir, f))] + # Support encrypted video files + encrypted_video_files = [ + f for f in files if f.endswith(( + ".mp4.encrypted", ".avi.encrypted", ".mov.encrypted", + ".mkv.encrypted", ".webm.encrypted" + )) + ] + all_files = sorted(set(encrypted_video_files)) + + return io.Schema( + node_id="UploadVideoCryptIO", + display_name="Upload Video 🔒", + category="CryptIO🔒", + description="Upload and decrypt video files encrypted with server public key", + inputs=[ + io.Combo.Input("video", options=all_files, tooltip="Select an encrypted video file to upload and decrypt"), + ], + outputs=[ + io.Video.Output(tooltip="Decrypted video"), + ], + ) + + @classmethod + def execute(cls, video: str) -> io.NodeOutput: + """ + Decrypt and load the uploaded video file + """ + if not isinstance(video, str) or not video.endswith(".encrypted"): + raise ValueError("Invalid video input, expected encrypted video file") + + # Read encrypted file + video_path = folder_paths.get_annotated_filepath(video) + + with open(video_path, "rb") as f: + encrypted_data = f.read() + + # Decrypt using server private key + if not _key_manager.server_private_key: + raise ValueError("Server private key not initialized") + + decrypted_data = decrypt_data_hybrid(encrypted_data, _key_manager.server_private_key) + + # Save decrypted data to temporary file + # Note: We don't delete the temp file because VideoInput may need it later + # ComfyUI will clean up temp directory automatically + temp_file = tempfile.NamedTemporaryFile( + delete=False, + suffix=".mp4", + dir=folder_paths.get_temp_directory() + ) + temp_file.write(decrypted_data) + temp_file.close() + + # Create VideoInput from decrypted file + video_input = VideoFromFile(temp_file.name) + + return io.NodeOutput(video_input) + + @classmethod + def fingerprint_inputs(cls, video: str): + """ + Return unique fingerprint for caching + """ + if isinstance(video, str) and video.endswith(".encrypted"): + video_path = folder_paths.get_annotated_filepath(video) + m = hashlib.sha256() + with open(video_path, "rb") as f: + m.update(f.read()) + return m.digest().hex() + return float("NaN") + + @classmethod + def validate_inputs(cls, video: str): + """ + Validate input video file exists + """ + if isinstance(video, str) and video.endswith(".encrypted"): + if not folder_paths.exists_annotated_filepath(video): + return f"Invalid encrypted video file: {video}" + return True + + if not folder_paths.exists_annotated_filepath(video): + return f"Invalid video file: {video}" + + return True diff --git a/src/cryptio/utils/__init__.py b/src/cryptio/utils/__init__.py new file mode 100644 index 0000000..98028eb --- /dev/null +++ b/src/cryptio/utils/__init__.py @@ -0,0 +1,30 @@ +""" +CryptIO Utils Module +提供加密、解密、密钥管理等通用功能 +""" + +from .crypto_utils import ( + encrypt_data_with_public_key, + decrypt_data_with_private_key, + encrypt_data_hybrid, + decrypt_data_hybrid, + generate_aes_key_and_iv, + encrypt_with_aes_cbc, + decrypt_with_aes_cbc, +) + +from .key_utils import KeyManager, _key_manager + +__all__ = [ + # 加密/解密 + "encrypt_data_with_public_key", + "decrypt_data_with_private_key", + "encrypt_data_hybrid", + "decrypt_data_hybrid", + "generate_aes_key_and_iv", + "encrypt_with_aes_cbc", + "decrypt_with_aes_cbc", + # 密钥管理 + "KeyManager", + "_key_manager", +] diff --git a/src/cryptio/utils/crypto_utils.py b/src/cryptio/utils/crypto_utils.py new file mode 100644 index 0000000..3782985 --- /dev/null +++ b/src/cryptio/utils/crypto_utils.py @@ -0,0 +1,216 @@ +""" +加密/解密工具模块 +提供数据加密和解密的核心功能 +""" + +import os +import secrets +from typing import Tuple +from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes +from cryptography.hazmat.primitives.asymmetric import padding +from cryptography.hazmat.primitives import hashes +from cryptography.hazmat.backends import default_backend + + +def encrypt_data_with_public_key(data: bytes, public_key) -> bytes: + """ + 使用RSA公钥直接加密数据（适用于小数据，最大约190字节） + + Args: + data: 要加密的数据 + public_key: RSA公钥对象 + + Returns: + 加密后的数据 + """ + encrypted = public_key.encrypt( + data, + padding.OAEP( + mgf=padding.MGF1(algorithm=hashes.SHA256()), + algorithm=hashes.SHA256(), + label=None, + ), + ) + return encrypted + + +def decrypt_data_with_private_key(encrypted_data: bytes, private_key) -> bytes: + """ + 使用RSA私钥直接解密数据 + + Args: + encrypted_data: 加密的数据 + private_key: RSA私钥对象 + + Returns: + 解密后的数据 + """ + decrypted = private_key.decrypt( + encrypted_data, + padding.OAEP( + mgf=padding.MGF1(algorithm=hashes.SHA256()), + algorithm=hashes.SHA256(), + label=None, + ), + ) + return decrypted + + +def encrypt_data_hybrid(data: bytes, public_key) -> bytes: + """ + 使用混合加密方案加密数据（AES-GCM + RSA-OAEP） + 适用于任意大小的数据 + + 数据格式： + [加密的AES密钥长度(4字节)] + [加密的AES密钥] + [IV长度(4字节)] + [IV] + [加密的数据] + + Args: + data: 要加密的数据 + public_key: RSA公钥对象（用于加密AES密钥） + + Returns: + 组合的加密数据 + """ + # 1. 生成随机 AES 密钥和 IV + aes_key = os.urandom(32) # 256-bit key + iv = os.urandom(12) # 96-bit IV for GCM + + # 2. 使用 AES-GCM 加密数据 + cipher = Cipher(algorithms.AES(aes_key), modes.GCM(iv), backend=default_backend()) + encryptor = cipher.encryptor() + encrypted_data = encryptor.update(data) + encryptor.finalize() + tag = encryptor.tag # 获取认证标签 + + # 3. 使用RSA公钥加密 AES 密钥 + encrypted_aes_key = encrypt_data_with_public_key(aes_key, public_key) + + # 4. 组合数据 + encrypted_aes_key_length = len(encrypted_aes_key).to_bytes(4, byteorder="big") + iv_length = len(iv).to_bytes(4, byteorder="big") + + combined = ( + encrypted_aes_key_length + + encrypted_aes_key + + iv_length + + iv + + encrypted_data + + tag # GCM认证标签附加在末尾 + ) + + return combined + + +def decrypt_data_hybrid(encrypted_combined: bytes, private_key) -> bytes: + """ + 解密混合加密的数据（AES-GCM + RSA-OAEP） + + Args: + encrypted_combined: 组合的加密数据 + private_key: RSA私钥对象（用于解密AES密钥） + + Returns: + 解密后的原始数据 + """ + offset = 0 + + # 1. 读取加密的AES密钥长度 + encrypted_aes_key_length = int.from_bytes( + encrypted_combined[offset : offset + 4], byteorder="big" + ) + offset += 4 + + # 2. 读取加密的AES密钥 + encrypted_aes_key = encrypted_combined[offset : offset + encrypted_aes_key_length] + offset += encrypted_aes_key_length + + # 3. 读取IV长度 + iv_length = int.from_bytes(encrypted_combined[offset : offset + 4], byteorder="big") + offset += 4 + + # 4. 读取IV + iv = encrypted_combined[offset : offset + iv_length] + offset += iv_length + + # 5. 读取加密的数据（包含认证标签） + encrypted_data_with_tag = encrypted_combined[offset:] + + # 6. 使用RSA私钥解密AES密钥 + aes_key = decrypt_data_with_private_key(encrypted_aes_key, private_key) + + # 7. 使用AES密钥解密数据 + # GCM模式：认证标签附加在密文末尾 + tag_length = 16 + encrypted_data = encrypted_data_with_tag[:-tag_length] + tag = encrypted_data_with_tag[-tag_length:] + + cipher = Cipher( + algorithms.AES(aes_key), modes.GCM(iv, tag), backend=default_backend() + ) + decryptor = cipher.decryptor() + decrypted_data = decryptor.update(encrypted_data) + decryptor.finalize() + + return decrypted_data + + +def generate_aes_key_and_iv() -> Tuple[bytes, bytes]: + """ + 生成随机的AES密钥和IV + + Returns: + (aes_key, iv) 元组 + """ + aes_key = secrets.token_bytes(32) # 256-bit key + iv = secrets.token_bytes(16) # 128-bit IV for CBC + return aes_key, iv + + +def encrypt_with_aes_cbc(data: bytes, aes_key: bytes, iv: bytes) -> bytes: + """ + 使用AES-CBC模式加密数据（带PKCS7填充） + + Args: + data: 要加密的数据 + aes_key: AES密钥 + iv: 初始化向量 + + Returns: + 加密后的数据 + """ + from cryptography.hazmat.primitives import padding as sym_padding + + # PKCS7 padding + padder = sym_padding.PKCS7(128).padder() + padded_data = padder.update(data) + padder.finalize() + + # AES-CBC 加密 + cipher = Cipher(algorithms.AES(aes_key), modes.CBC(iv), backend=default_backend()) + encryptor = cipher.encryptor() + encrypted_data = encryptor.update(padded_data) + encryptor.finalize() + + return encrypted_data + + +def decrypt_with_aes_cbc(encrypted_data: bytes, aes_key: bytes, iv: bytes) -> bytes: + """ + 使用AES-CBC模式解密数据（带PKCS7填充） + + Args: + encrypted_data: 加密的数据 + aes_key: AES密钥 + iv: 初始化向量 + + Returns: + 解密后的数据 + """ + from cryptography.hazmat.primitives import padding as sym_padding + + # AES-CBC 解密 + cipher = Cipher(algorithms.AES(aes_key), modes.CBC(iv), backend=default_backend()) + decryptor = cipher.decryptor() + padded_data = decryptor.update(encrypted_data) + decryptor.finalize() + + # 移除 PKCS7 padding + unpadder = sym_padding.PKCS7(128).unpadder() + data = unpadder.update(padded_data) + unpadder.finalize() + + return data diff --git a/src/cryptio/utils/key_utils.py b/src/cryptio/utils/key_utils.py new file mode 100644 index 0000000..e15bf2f --- /dev/null +++ b/src/cryptio/utils/key_utils.py @@ -0,0 +1,189 @@ +""" +密钥工具模块 +提供密钥导入、导出、加载、存储管理等功能 +""" + +import os +import json +import base64 +from typing import Optional, cast +from cryptography.hazmat.primitives.asymmetric import rsa +from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey, RSAPrivateKey +from cryptography.hazmat.primitives import serialization +from cryptography.hazmat.backends import default_backend + + +class KeyManager: + """ + 密钥管理器单例类 + 负责密钥的加载、缓存、更新和持久化 + """ + + _instance: Optional["KeyManager"] = None + + def __new__(cls): + if cls._instance is None: + cls._instance = super().__new__(cls) + cls._instance._initialized = False + return cls._instance + + def __init__(self): + """初始化密钥管理器（仅首次调用时执行）""" + if self._initialized: + return + + # 密钥存储路径 + try: + import folder_paths # pyright: ignore[reportMissingImports] + base_dir = folder_paths.base_path + self._key_dir = os.path.join(folder_paths.get_system_user_directory(), "cryptio", "keys") + except ImportError: + # Fallback if folder_paths is not available (e.g. running standalone) + base_dir = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))) + self._key_dir = os.path.join(base_dir, "keys") + self._key_file = os.path.join(self._key_dir, "keys.json") + os.makedirs(self._key_dir, exist_ok=True) + + # 缓存状态 + self._cache_mtime: Optional[float] = None + self._server_public_key: Optional[RSAPublicKey] = None + self._server_private_key: Optional[RSAPrivateKey] = None + self._client_public_key: Optional[RSAPublicKey] = None + self._server_public_key_pem: Optional[bytes] = None + self._server_private_key_pem: Optional[bytes] = None + self._client_public_key_pem: Optional[bytes] = None + + # 初始化加载 + self._load() + self._initialized = True + + def _load(self): + """加载密钥到缓存""" + # 检查文件修改时间 + try: + current_mtime = os.path.getmtime(self._key_file) if os.path.exists(self._key_file) else None + except Exception: + current_mtime = None + + # 缓存命中 + if self._cache_mtime == current_mtime and self._server_private_key is not None: + return + + # 确保密钥文件存在 + if not os.path.exists(self._key_file): + self._generate_server_keys() + + # 从文件加载 + with open(self._key_file, "r", encoding="utf-8") as f: + data = json.load(f) + + # 解码 PEM 数据 + self._server_public_key_pem = base64.b64decode(data["server_public_key"]) + self._server_private_key_pem = base64.b64decode(data["server_private_key"]) + + if "client_public_key" in data: + self._client_public_key_pem = base64.b64decode(data["client_public_key"]) + + # 加载密钥对象 + self._server_public_key = cast( + RSAPublicKey, serialization.load_pem_public_key(self._server_public_key_pem, backend=default_backend()) + ) + self._server_private_key = cast( + RSAPrivateKey, serialization.load_pem_private_key(self._server_private_key_pem, password=None, backend=default_backend()) + ) + + if self._client_public_key_pem: + self._client_public_key = cast( + RSAPublicKey, serialization.load_pem_public_key(self._client_public_key_pem, backend=default_backend()) + ) + + # 更新缓存时间 + self._cache_mtime = current_mtime + + def _generate_server_keys(self): + """生成服务端密钥对""" + private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048, backend=default_backend()) + public_key = private_key.public_key() + + self._server_private_key_pem = private_key.private_bytes( + encoding=serialization.Encoding.PEM, + format=serialization.PrivateFormat.PKCS8, + encryption_algorithm=serialization.NoEncryption(), + ) + self._server_public_key_pem = public_key.public_bytes( + encoding=serialization.Encoding.PEM, + format=serialization.PublicFormat.SubjectPublicKeyInfo, + ) + + self._save() + + def _save(self): + """保存密钥到文件""" + data: dict[str, str] = {} + if self._server_public_key_pem and self._server_private_key_pem: + data["server_public_key"] = base64.b64encode(self._server_public_key_pem).decode("ascii") + data["server_private_key"] = base64.b64encode(self._server_private_key_pem).decode("ascii") + + if self._client_public_key_pem: + data["client_public_key"] = base64.b64encode(self._client_public_key_pem).decode("ascii") + + with open(self._key_file, "w", encoding="utf-8") as f: + json.dump(data, f, ensure_ascii=False, indent=2) + + def reload(self): + """重新加载密钥（当外部修改文件时调用）""" + self._cache_mtime = None + self._load() + + def update_client_key(self, client_public_pem: bytes): + """ + 更新客户端公钥 + + Args: + client_public_pem: 客户端公钥（PEM格式） + """ + self._client_public_key_pem = client_public_pem + self._save() + self.reload() + + # ===== 属性访问器 ===== + + @property + def server_public_key(self) -> Optional[RSAPublicKey]: + """服务端公钥对象""" + self._load() + return self._server_public_key + + @property + def server_private_key(self) -> Optional[RSAPrivateKey]: + """服务端私钥对象""" + self._load() + return self._server_private_key + + @property + def client_public_key(self) -> Optional[RSAPublicKey]: + """客户端公钥对象""" + self._load() + return self._client_public_key + + @property + def server_public_key_pem(self) -> Optional[bytes]: + """服务端公钥（PEM格式）""" + self._load() + return self._server_public_key_pem + + @property + def server_private_key_pem(self) -> Optional[bytes]: + """服务端私钥（PEM格式）""" + self._load() + return self._server_private_key_pem + + @property + def client_public_key_pem(self) -> Optional[bytes]: + """客户端公钥（PEM格式）""" + self._load() + return self._client_public_key_pem + + +# ===== 全局单例实例 ===== +_key_manager = KeyManager() diff --git a/ts/cryptioSaveImage.ts b/ts/cryptioSaveImage.ts new file mode 100644 index 0000000..1dde129 --- /dev/null +++ b/ts/cryptioSaveImage.ts @@ -0,0 +1,94 @@ +//@ts-ignore +import { app as rawApp } from "../../scripts/app.js"; +//@ts-ignore +import { api as rawApi } from "../../scripts/api.js"; +import type { + ComfyApp, + ComfyApi, + ComfyNodeDef, +} from "@comfyorg/comfyui-frontend-types"; + +import { loadEncryptedImageFromParams, downloadDecryptedImage } from "./utils/imageLoader.js"; + +const app: ComfyApp = rawApp; +const api: ComfyApi = rawApi; + +// 注册扩展 +app.registerExtension({ + name: "cryptio.SaveImageCryptIO", + async beforeRegisterNodeDef( + nodeType: any, + nodeData: ComfyNodeDef, + app: ComfyApp + ) { + if (nodeType.comfyClass === "SaveImageCryptIO" || nodeType.comfyClass === "PreviewImageCryptIO") { + // 覆盖默认的图片处理 + const onExecuted = nodeType.prototype.onExecuted; + nodeType.prototype.onExecuted = function (message: any) { + // 调用原始处理 + if (onExecuted) { + onExecuted.apply(this, arguments); + } + + // 处理加密图片 + if (message?.cryptio_images) { + const autoDownload = this.widgets.find((n: any) => n.name === "auto_download")?.value; + + for (let i = 0; i < message.cryptio_images.length; i++) { + const imageInfo = message.cryptio_images[i]; + if (imageInfo.filename && imageInfo.filename.endsWith(".encrypted")) { + // 异步加载并解密图片 + loadEncryptedImageFromParams(api, imageInfo) + .then((imageUrl) => { + // 更新节点的图片显示 + const img = new Image(); + img.onload = () => { + if (!this.imgs) { + this.imgs = []; + } + this.imgs[i] = img; + app.rootGraph?.setDirtyCanvas(true, false); + + // 如果开启了自动下载 + if (autoDownload) { + downloadDecryptedImage(imageUrl, imageInfo.filename); + console.log(`Auto-downloaded decrypted image: ${imageInfo.filename.replace(/\.encrypted$/, "")}`); + } + }; + img.src = imageUrl; + }) + .catch((error) => { + console.error("Failed to decrypt image for preview:", error); + }); + } + } + } + }; + + // 添加右键菜单支持查看/下载图片 + const getExtraMenuOptions = nodeType.prototype.getExtraMenuOptions; + nodeType.prototype.getExtraMenuOptions = function (canvas: any, options: any[]) { + if (getExtraMenuOptions) { + getExtraMenuOptions.apply(this, arguments); + } + + // 如果节点有图片 + if (this.imgs && this.imgs.length > 0) { + options.push({ + content: "下载解密图片", + callback: async () => { + for (let i = 0; i < this.imgs.length; i++) { + const img = this.imgs[i]; + if (img && img.src) { + // 获取原始文件名 + const filename = this.images?.[i]?.filename || `image_${i}.png.encrypted`; + downloadDecryptedImage(img.src, filename); + } + } + }, + }); + } + }; + } + }, +}); diff --git a/ts/cryptioSaveVideo.ts b/ts/cryptioSaveVideo.ts new file mode 100644 index 0000000..770aae1 --- /dev/null +++ b/ts/cryptioSaveVideo.ts @@ -0,0 +1,253 @@ +//@ts-ignore +import { app as rawApp } from "../../scripts/app.js"; +//@ts-ignore +import { api as rawApi } from "../../scripts/api.js"; +import type { + ComfyApp, + ComfyApi, + ComfyNodeDef, +} from "@comfyorg/comfyui-frontend-types"; + +import { + loadEncryptedVideoFromParams, + downloadDecryptedVideo +} from "./utils/videoLoader.js"; + +const app: ComfyApp = rawApp; +const api: ComfyApi = rawApi; + +const DEFAULT_VIDEO_SIZE = 256; +const MIN_WIDGET_HEIGHT = 64; + +function fitDimensionsToNodeWidth( + width: number, + height: number, + nodeWidth: number +) { + const aspectRatio = width / height; + if (!aspectRatio || Number.isNaN(aspectRatio)) { + return { + minHeight: DEFAULT_VIDEO_SIZE, + minWidth: nodeWidth || DEFAULT_VIDEO_SIZE, + }; + } + + const minWidth = nodeWidth || DEFAULT_VIDEO_SIZE; + const minHeight = Math.max(minWidth / aspectRatio, MIN_WIDGET_HEIGHT); + + return { minHeight, minWidth }; +} + +/** + * Create video preview widget + */ +function createVideoWidget(node: any, videoName: string, videoInfo: any) { + let minHeight = DEFAULT_VIDEO_SIZE; + let minWidth = node.size?.[0] || DEFAULT_VIDEO_SIZE; + + const container = document.createElement("div"); + container.classList.add("comfy-img-preview"); + + const widget = node.addDOMWidget( + videoName, + "video-preview", + container, + { + serialize: false, + hideOnZoom: false, + } + ); + + widget.computeLayoutSize = () => ({ + minHeight, + minWidth, + }); + + widget.updateLayout = (videoWidth: number, videoHeight: number) => { + const nodeWidth = node.size?.[0] || DEFAULT_VIDEO_SIZE; + const dimensions = fitDimensionsToNodeWidth( + videoWidth, + videoHeight, + nodeWidth + ); + minHeight = dimensions.minHeight; + minWidth = dimensions.minWidth; + }; + + widget.element.addEventListener('pointermove', (event: PointerEvent) => { + if ((event.buttons & 4) === 4) { + app.canvas.processMouseMove(event) + } + }) + widget.element.addEventListener('pointerdown', (event: PointerEvent) => { + if ((event.buttons & 4) === 4) { + app.canvas.processMouseDown(event) + } + }) + + + widget.element.addEventListener('wheel', (event: WheelEvent) => { + + if (event.ctrlKey) { + event.preventDefault() + event.stopPropagation() + return + } + + event.preventDefault() + app.canvas.processMouseWheel(event) + }) + + widget.videoInfo = videoInfo; + widget.value = { hidden: false, videoInfo }; + + return widget; +} + +/** + * Update video preview widget with decrypted video + */ +async function updateVideoWidget(widget: any, videoInfo: any) { + try { + const videoUrl = await loadEncryptedVideoFromParams(api, videoInfo); + + // Create video element + const video = document.createElement("video"); + video.controls = true; + video.loop = true; + video.muted = true; + video.autoplay = false; + video.playsInline = true; + + video.onloadedmetadata = () => { + widget.updateLayout?.(video.videoWidth, video.videoHeight); + widget.element.hidden = false; + widget.element.style.overflow = "hidden"; + + // Clear previous content + while (widget.element.firstChild) { + widget.element.removeChild(widget.element.firstChild); + } + + // Add new video + widget.element.appendChild(video); + widget.videoElement = video; + widget.videoUrl = videoUrl; + + app.rootGraph?.setDirtyCanvas(true, false); + }; + + video.src = videoUrl; + + return videoUrl; + } catch (error) { + console.error("Failed to decrypt video for preview:", error); + throw error; + } +} + +// Register extension +app.registerExtension({ + name: "cryptio.SaveVideoCryptIO", + async beforeRegisterNodeDef( + nodeType: any, + nodeData: ComfyNodeDef, + app: ComfyApp + ) { + if (nodeType.comfyClass !== "SaveVideoCryptIO" && nodeType.comfyClass !== "PreviewVideoCryptIO") { + return; + } + + // Override default video handling + const onExecuted = nodeType.prototype.onExecuted; + nodeType.prototype.onExecuted = async function (message: any) { + // Call original handler + if (onExecuted) { + onExecuted.apply(this, arguments); + } + + // Handle encrypted videos (backend returns cryptio_images field with animated flag) + if (message?.cryptio_images) { + const autoDownload = this.widgets.find((n: any) => n.name === "auto_download")?.value; + + // Remove existing video preview widgets + const existingWidgets = this.widgets.filter((w: any) => + w.type === "video-preview" + ); + for (const widget of existingWidgets) { + this.removeWidget(widget); + } + + // Create new widgets for each video + for (let i = 0; i < message.cryptio_images.length; i++) { + const videoInfo = message.cryptio_images[i]; + if (videoInfo.filename && videoInfo.filename.endsWith(".encrypted")) { + const videoName = `video_${i}`; + const widget = createVideoWidget(this, videoName, videoInfo); + + try { + const videoUrl = await updateVideoWidget(widget, videoInfo); + + // If auto-download is enabled + if (autoDownload) { + downloadDecryptedVideo(videoUrl, videoInfo.filename); + console.log(`Auto-downloaded decrypted video: ${videoInfo.filename.replace(/\.encrypted$/, "")}`); + } + } catch (error) { + console.error("Failed to load video:", error); + } + } + } + } + }; + + // Add context menu support for view/download videos + const getExtraMenuOptions = nodeType.prototype.getExtraMenuOptions; + nodeType.prototype.getExtraMenuOptions = function (canvas: any, options: any[]) { + if (getExtraMenuOptions) { + getExtraMenuOptions.apply(this, arguments); + } + + // Find video widgets + const videoWidgets = this.widgets?.filter((w: any) => + w.type === "video-preview" && w.videoElement + ) || []; + + if (videoWidgets.length > 0) { + options.push({ + content: "Download Decrypted Videos", + callback: async () => { + for (const widget of videoWidgets) { + if (widget.videoUrl && widget.videoInfo) { + downloadDecryptedVideo(widget.videoUrl, widget.videoInfo.filename); + } + } + }, + }); + } + }; + + // Cleanup on node removal + const onRemoved = nodeType.prototype.onRemoved; + nodeType.prototype.onRemoved = function () { + // Clean up video widgets + const videoWidgets = this.widgets?.filter((w: any) => + w.type === "video-preview" + ) || []; + + for (const widget of videoWidgets) { + if (widget.videoElement) { + widget.videoElement.pause(); + widget.videoElement.src = ""; + } + if (widget.videoUrl) { + URL.revokeObjectURL(widget.videoUrl); + } + } + + if (onRemoved) { + onRemoved.apply(this, arguments); + } + }; + }, +}); diff --git a/ts/cryptioSettings.ts b/ts/cryptioSettings.ts new file mode 100644 index 0000000..3c86713 --- /dev/null +++ b/ts/cryptioSettings.ts @@ -0,0 +1,315 @@ +/** + * CryptIO Settings - ComfyUI Settings Integration + * Integrates CryptIO key management into ComfyUI's native settings panel + */ + +//@ts-ignore +import { app as rawApp } from "../../scripts/app.js"; +import type { + ComfyApp, +} from "@comfyorg/comfyui-frontend-types"; + +import { + CLIENT_KEYPAIR_STORAGE_KEY, + SERVER_KEYS_STORAGE_KEY, + KeyPair, + ServerKeys +} from "./utils/cryptoKeys.js"; + +const app: ComfyApp = rawApp; + +/** + * Download JSON file + */ +function downloadJSON(data: any, filename: string): void { + const blob = new Blob([JSON.stringify(data, null, 2)], { type: "application/json" }); + const url = URL.createObjectURL(blob); + const a = document.createElement("a"); + a.href = url; + a.download = filename; + document.body.appendChild(a); + a.click(); + document.body.removeChild(a); + URL.revokeObjectURL(url); +} + +/** + * Read file content as JSON + */ +function readJSONFile(file: File): Promise { + return new Promise((resolve, reject) => { + const reader = new FileReader(); + reader.onload = (e) => { + try { + const data = JSON.parse(e.target?.result as string); + resolve(data); + } catch (error) { + reject(new Error("Invalid JSON file")); + } + }; + reader.onerror = () => reject(new Error("Failed to read file")); + reader.readAsText(file); + }); +} + +/** + * Show temporary message + */ +function showMessage(message: string, type: "success" | "error" | "info" = "info"): void { + const colors = { + success: "#4CAF50", + error: "#f44336", + info: "#2196F3" + }; + + const messageEl = document.createElement("div"); + messageEl.textContent = message; + messageEl.style.cssText = ` + position: fixed; + top: 20px; + right: 20px; + padding: 12px 20px; + border-radius: 4px; + color: white; + background-color: ${colors[type]}; + z-index: 10001; + font-family: Arial, sans-serif; + font-size: 14px; + box-shadow: 0 2px 10px rgba(0,0,0,0.3); + `; + document.body.appendChild(messageEl); + setTimeout(() => { + messageEl.remove(); + }, 3000); +} + +/** + * Generate new client key pair + */ +async function generateNewClientKeys(): Promise { + if (confirm("Are you sure you want to generate new client keys? This will overwrite your existing client keypair and cannot be undone.")) { + try { + const { generateClientKeyPair } = await import("./utils/cryptoKeys.js"); + const keyPair = await generateClientKeyPair(); + localStorage.setItem(CLIENT_KEYPAIR_STORAGE_KEY, JSON.stringify(keyPair)); + showMessage("New client keys generated successfully!", "success"); + } catch (error) { + showMessage(`Failed to generate keys: ${error}`, "error"); + } + } +} + +/** + * Clear all CryptIO keys + */ +function clearAllKeys(): void { + if (confirm("Are you sure you want to clear all CryptIO keys? This action cannot be undone.")) { + localStorage.removeItem(CLIENT_KEYPAIR_STORAGE_KEY); + localStorage.removeItem(SERVER_KEYS_STORAGE_KEY); + showMessage("All keys cleared successfully!", "success"); + } +} + +/** + * Download client keys + */ +function downloadClientKeys(): void { + const clientKeys = localStorage.getItem(CLIENT_KEYPAIR_STORAGE_KEY); + if (clientKeys) { + downloadJSON(JSON.parse(clientKeys), "cryptio-client-keypair.json"); + showMessage("Client keys downloaded successfully!", "success"); + } else { + showMessage("No client keys found", "error"); + } +} + +/** + * Download server keys + */ +function downloadServerKeys(): void { + const serverKeys = localStorage.getItem(SERVER_KEYS_STORAGE_KEY); + if (serverKeys) { + downloadJSON(JSON.parse(serverKeys), "cryptio-server-keys.json"); + showMessage("Server keys downloaded successfully!", "success"); + } else { + showMessage("No server keys found", "error"); + } +} + +/** + * Handle client key file upload + */ +async function handleClientKeyUpload(event: Event): Promise { + const file = (event.target as HTMLInputElement).files?.[0]; + if (!file) return; + + try { + const data = await readJSONFile(file); + if (data.publicKey && data.privateKey) { + localStorage.setItem(CLIENT_KEYPAIR_STORAGE_KEY, JSON.stringify(data)); + showMessage("Client keys uploaded successfully!", "success"); + } else { + showMessage("Invalid key format. Must contain publicKey and privateKey", "error"); + } + } catch (error) { + showMessage(`Failed to upload client keys: ${error}`, "error"); + } +} + +/** + * Handle server key file upload + */ +async function handleServerKeyUpload(event: Event): Promise { + const file = (event.target as HTMLInputElement).files?.[0]; + if (!file) return; + + try { + const data = await readJSONFile(file); + if (data.publicKey && data.privateKey) { + localStorage.setItem(SERVER_KEYS_STORAGE_KEY, JSON.stringify(data)); + showMessage("Server keys uploaded successfully!", "success"); + } else { + showMessage("Invalid key format. Must contain publicKey and privateKey", "error"); + } + } catch (error) { + showMessage(`Failed to upload server keys: ${error}`, "error"); + } +} + +/** + * Create hidden file input for uploads + */ +function createFileInput(id: string, onChange: (event: Event) => void): HTMLInputElement { + const input = document.createElement("input"); + input.type = "file"; + input.id = id; + input.accept = ".json"; + input.style.display = "none"; + input.addEventListener("change", onChange); + document.body.appendChild(input); + return input; +} + +// Register extension with ComfyUI settings +app.registerExtension({ + name: "cryptio.Settings", + settings: [ + { + id: "cryptio.category", + name: "CryptIO Settings", + type: "hidden", + defaultValue: "", + category: ["CryptIO🔒"] + }, + { + id: "cryptio.download_client_keys", + name: "Download Client Keys", + type: "boolean", + defaultValue: false, + category: ["CryptIO🔒", "Client Keys", "Download"], + tooltip: "Click to download your client keypair as a JSON file", + onChange: (newVal: boolean, oldVal: boolean) => { + if (newVal === true) { + downloadClientKeys(); + // Reset the toggle + setTimeout(() => { + app.extensionManager.setting.set("cryptio.download_client_keys", false); + }, 100); + } + } + }, + { + id: "cryptio.upload_client_keys", + name: "Upload Client Keys", + type: "boolean", + category: ["CryptIO🔒", "Client Keys", "Upload"], + defaultValue: false, + + tooltip: "Click to upload a client keypair JSON file", + onChange: (newVal: boolean, oldVal: boolean) => { + if (newVal === true) { + // Create file input and trigger it + const input = createFileInput("cryptio-client-upload", handleClientKeyUpload); + input.click(); + // Reset the toggle + setTimeout(() => { + app.extensionManager.setting.set("cryptio.upload_client_keys", false); + }, 100); + } + } + }, + { + id: "cryptio.download_server_keys", + name: "Download Server Keys", + type: "boolean", + defaultValue: false, + category: ["CryptIO🔒", "Server Keys", "Download"], + tooltip: "Click to download server keys as a JSON file", + onChange: (newVal: boolean, oldVal: boolean) => { + if (newVal === true) { + downloadServerKeys(); + // Reset the toggle + setTimeout(() => { + app.extensionManager.setting.set("cryptio.download_server_keys", false); + }, 100); + } + } + }, + { + id: "cryptio.upload_server_keys", + name: "Upload Server Keys", + type: "boolean", + defaultValue: false, + category: ["CryptIO🔒", "Server Keys", "Upload"], + tooltip: "Click to upload a server keys JSON file", + onChange: (newVal: boolean, oldVal: boolean) => { + if (newVal === true) { + // Create file input and trigger it + const input = createFileInput("cryptio-server-upload", handleServerKeyUpload); + input.click(); + // Reset the toggle + setTimeout(() => { + app.extensionManager.setting.set("cryptio.upload_server_keys", false); + }, 100); + } + } + }, + { + id: "cryptio.generate_new_keys", + name: "Generate New Client Keys", + type: "boolean", + defaultValue: false, + category: ["CryptIO🔒", "Key Management", "Generate"], + tooltip: "Generate a new client keypair (this will overwrite existing keys)", + onChange: (newVal: boolean, oldVal: boolean) => { + if (newVal === true) { + generateNewClientKeys(); + // Reset the toggle + setTimeout(() => { + app.extensionManager.setting.set("cryptio.generate_new_keys", false); + }, 100); + } + } + }, + { + id: "cryptio.clear_all_keys", + name: "Clear All Keys", + type: "boolean", + defaultValue: false, + category: ["CryptIO🔒", "Key Management", "Actions"], + tooltip: "Remove all CryptIO keys from localStorage (cannot be undone)", + onChange: (newVal: boolean, oldVal: boolean) => { + if (newVal === true) { + clearAllKeys(); + // Reset the toggle + setTimeout(() => { + app.extensionManager.setting.set("cryptio.clear_all_keys", false); + }, 100); + } + } + } + ], + async setup() { + console.log("CryptIO Settings extension loaded - all settings registered"); + }, +}); \ No newline at end of file diff --git a/ts/cryptioUploadImage.ts b/ts/cryptioUploadImage.ts new file mode 100644 index 0000000..e3c0fe3 --- /dev/null +++ b/ts/cryptioUploadImage.ts @@ -0,0 +1,141 @@ +//@ts-ignore +import { app as rawApp } from "../../scripts/app.js"; +//@ts-ignore +import { api as rawApi } from "../../scripts/api.js"; +import type { + ComfyApp, + ComfyApi, + ComfyNodeDef, +} from "@comfyorg/comfyui-frontend-types"; + +import { exchangeKeys } from "./utils/cryptoKeys.js"; +import { handleFileUpload, createPreviewUpdateFunction } from "./utils/uploadUtils.js"; + +const app: ComfyApp = rawApp; +const api: ComfyApi = rawApi; + +// 注册扩展 +app.registerExtension({ + name: "cryptio.UploadImageCryptIO", + async setup() { + // 初始化时交换密钥 + try { + await exchangeKeys(); + console.log("CryptIO: Keys exchanged successfully"); + } catch (error) { + console.error("CryptIO: Failed to exchange keys:", error); + } + }, + async beforeRegisterNodeDef( + nodeType: any, + nodeData: ComfyNodeDef, + app: ComfyApp + ) { + if (nodeType.comfyClass === "UploadImageCryptIO") { + // 添加自定义的upload widget + const onNodeCreated = nodeType.prototype.onNodeCreated; + nodeType.prototype.onNodeCreated = function (this: any) { + const r = onNodeCreated?.apply(this, arguments); + + // 移除默认的upload widget + this.removeWidgetByName("upload") + // 添加上传button widget + const uploadWidget = this.addWidget( + "button", + "cryptio-upload", + "image", + () => { + const fileInput = document.createElement("input"); + fileInput.type = "file"; + fileInput.accept = "image/*,.encrypted"; + fileInput.style.display = "none"; + document.body.appendChild(fileInput); + + fileInput.onchange = async () => { + if (fileInput.files && fileInput.files.length > 0) { + const file = fileInput.files[0]; + await handleFileUpload(this, file, app); + } + document.body.removeChild(fileInput); + }; + + fileInput.click(); + } + ); + uploadWidget.label = "choose file to upload"; + + // 添加预览更新方法 + this.updatePreview = createPreviewUpdateFunction(app); + + // 当image值改变时更新预览 + const imageWidget = this.widgets.find((w: any) => w.name === "image"); + if (imageWidget) { + const originalCallback = imageWidget.callback; + this.updatePreview(imageWidget.value); + imageWidget.callback = async function (this: any, value: any) { + if (originalCallback) { + originalCallback.call(this, value); + } + if (value && value.endsWith(".encrypted")) { + await this.node.updatePreview(value); + } + }; + } + + // 添加Drag and Drop支持 + this.onDragOver = function (e: DragEvent) { + // 检查是否有文件 + if (e.dataTransfer && e.dataTransfer.types.includes('Files')) { + // 阻止默认行为以允许drop + e.preventDefault(); + e.stopPropagation(); + // 设置拖放效果 + e.dataTransfer.dropEffect = 'copy'; + return true; + } + return false; + }; + + this.onDragDrop = async function (e: DragEvent) { + // 检查是否有文件 + if (!e.dataTransfer || !e.dataTransfer.files || e.dataTransfer.files.length === 0) { + return false; + } + + e.preventDefault(); + e.stopPropagation(); + + // 获取拖放的文件 + const file = e.dataTransfer.files[0]; + + // 检查是否为图片文件 + if (!file.type.startsWith('image/')) { + alert('Please drop an image file'); + return false; + } + + // 上传文件 + await handleFileUpload(this, file, app); + + return true; + }; + + // 添加Paste支持 + this.pasteFiles = async function (files: File[]) { + for (const file of files) { + // 查找图片类型 + if (!file.type.startsWith('image/')) { + continue + } + // 上传文件 + await handleFileUpload(this, file, app); + return true; + + } + } + + return r; + }; + } + }, +}); diff --git a/ts/cryptioUploadVideo.ts b/ts/cryptioUploadVideo.ts new file mode 100644 index 0000000..8b7bc80 --- /dev/null +++ b/ts/cryptioUploadVideo.ts @@ -0,0 +1,376 @@ +//@ts-ignore +import { app as rawApp } from "../../scripts/app.js"; +//@ts-ignore +import { api as rawApi } from "../../scripts/api.js"; +import type { + ComfyApp, + ComfyApi, + ComfyNodeDef, +} from "@comfyorg/comfyui-frontend-types"; + +import { exchangeKeys } from "./utils/cryptoKeys.js"; +import { encryptFileWithServerKey } from "./utils/cryptoUtils.js"; +import { loadEncryptedVideoFromFilename } from "./utils/videoLoader.js"; + +const app: ComfyApp = rawApp; +const api: ComfyApi = rawApi; + +const DEFAULT_VIDEO_SIZE = 256; +const MIN_WIDGET_HEIGHT = 64; + +function fitDimensionsToNodeWidth( + width: number, + height: number, + nodeWidth: number +) { + const aspectRatio = width / height; + if (!aspectRatio || Number.isNaN(aspectRatio)) { + return { + minHeight: DEFAULT_VIDEO_SIZE, + minWidth: nodeWidth || DEFAULT_VIDEO_SIZE, + }; + } + + const minWidth = nodeWidth || DEFAULT_VIDEO_SIZE; + const minHeight = Math.max(minWidth / aspectRatio, MIN_WIDGET_HEIGHT); + + return { minHeight, minWidth }; +} + +/** + * Create video preview widget + */ +function createVideoWidget(node: any) { + let minHeight = DEFAULT_VIDEO_SIZE; + let minWidth = node.size?.[0] || DEFAULT_VIDEO_SIZE; + + const container = document.createElement("div"); + container.classList.add("comfy-img-preview"); + + const widget = node.addDOMWidget( + "video_preview", + "video-preview", + container, + { + serialize: false, + hideOnZoom: false, + } + ); + + widget.computeLayoutSize = () => ({ + minHeight, + minWidth, + }); + + widget.element.addEventListener('pointermove', (event: PointerEvent) => { + if ((event.buttons & 4) === 4) { + app.canvas.processMouseMove(event) + } + }) + widget.element.addEventListener('pointerdown', (event: PointerEvent) => { + if ((event.buttons & 4) === 4) { + app.canvas.processMouseDown(event) + } + }) + + + widget.element.addEventListener('wheel', (event: WheelEvent) => { + + if (event.ctrlKey) { + event.preventDefault() + event.stopPropagation() + return + } + + event.preventDefault() + app.canvas.processMouseWheel(event) + }) + + widget.updateLayout = (videoWidth: number, videoHeight: number) => { + const nodeWidth = node.size?.[0] || DEFAULT_VIDEO_SIZE; + const dimensions = fitDimensionsToNodeWidth( + videoWidth, + videoHeight, + nodeWidth + ); + minHeight = dimensions.minHeight; + minWidth = dimensions.minWidth; + }; + + widget.value = { hidden: true }; + widget.element.hidden = true; + + return widget; +} + +/** + * Update video preview widget with decrypted video + */ +async function updateVideoWidget(widget: any, filename: string) { + try { + const videoUrl = await loadEncryptedVideoFromFilename(filename); + + // Create video element + const video = document.createElement("video"); + video.controls = true; + video.loop = true; + video.muted = true; + video.autoplay = false; + video.style.width = "100%"; + video.style.height = "auto"; + + video.onloadedmetadata = () => { + widget.updateLayout?.(video.videoWidth, video.videoHeight); + widget.element.hidden = false; + widget.element.style.overflow = "hidden"; + + // Clear previous content + while (widget.element.firstChild) { + widget.element.removeChild(widget.element.firstChild); + } + + // Add new video + widget.element.appendChild(video); + widget.videoElement = video; + widget.videoUrl = videoUrl; + widget.value = { hidden: false }; + + app.rootGraph?.setDirtyCanvas(true, false); + }; + + video.src = videoUrl; + } catch (error) { + console.error("Failed to decrypt video for preview:", error); + throw error; + } +} + +/** + * Clear video preview widget + */ +function clearVideoWidget(widget: any) { + if (widget.videoElement) { + widget.videoElement.pause(); + widget.videoElement.src = ""; + } + if (widget.videoUrl) { + URL.revokeObjectURL(widget.videoUrl); + } + widget.element.hidden = true; + widget.value = { hidden: true }; + + while (widget.element.firstChild) { + widget.element.removeChild(widget.element.firstChild); + } + + app.rootGraph?.setDirtyCanvas(true, false); +} + +/** + * Upload encrypted video to server (encrypted with server public key) + * @param file File to upload + * @returns Server response + */ +async function uploadEncryptedVideo(file: File): Promise { + console.log("Encrypting and uploading video:", file.name); + + // Encrypt file (use server public key, or directly read if already encrypted with server public key) + const encryptedData = file?.name?.endsWith(".encrypted") + ? new Uint8Array(await file.arrayBuffer()) + : await encryptFileWithServerKey(file); + + // Create FormData + const formData = new FormData(); + const encryptedBlob = new Blob([new Uint8Array(encryptedData)], { + type: "application/octet-stream", + }); + formData.append("image", encryptedBlob, file.name); + + // Upload to server + const response = await fetch("/cryptio/upload_encrypted", { + method: "POST", + body: formData, + }); + + if (!response.ok) { + throw new Error(`Upload failed: ${response.statusText}`); + } + + return await response.json(); +} + +/** + * Handle video file upload to node + * @param node Node instance + * @param file File to upload + * @param app ComfyUI App instance + */ +async function handleVideoUpload(node: any, file: File, app: ComfyApp) { + try { + // Upload encrypted video + const result = await uploadEncryptedVideo(file); + + // Update video widget value + const videoWidget = node.widgets.find( + (w: any) => w.name === "video" + ); + if (videoWidget) { + videoWidget.value = result.name; + } + + // Update preview + const previewWidget = node.widgets.find( + (w: any) => w.type === "video-preview" + ); + if (previewWidget) { + await updateVideoWidget(previewWidget, result.name); + } + + app.rootGraph?.setDirtyCanvas(true, false); + } catch (error) { + console.error("Upload error:", error); + alert("Failed to upload encrypted video: " + error); + } +} + +// Register extension +app.registerExtension({ + name: "cryptio.UploadVideoCryptIO", + async setup() { + // Exchange keys on initialization (if not already done) + try { + await exchangeKeys(); + console.log("CryptIO: Keys exchanged successfully for video upload"); + } catch (error) { + console.error("CryptIO: Failed to exchange keys:", error); + } + }, + async beforeRegisterNodeDef( + nodeType: any, + nodeData: ComfyNodeDef, + app: ComfyApp + ) { + if (nodeType.comfyClass === "UploadVideoCryptIO") { + // Add custom upload widget + const onNodeCreated = nodeType.prototype.onNodeCreated; + nodeType.prototype.onNodeCreated = function (this: any) { + const r = onNodeCreated?.apply(this, arguments); + + // Remove default upload widget + this.removeWidgetByName("upload"); + + // Add upload button widget + const uploadWidget = this.addWidget( + "button", + "cryptio-upload-video", + "video", + () => { + const fileInput = document.createElement("input"); + fileInput.type = "file"; + fileInput.accept = "video/*,.encrypted"; + fileInput.style.display = "none"; + document.body.appendChild(fileInput); + + fileInput.onchange = async () => { + if (fileInput.files && fileInput.files.length > 0) { + const file = fileInput.files[0]; + await handleVideoUpload(this, file, app); + } + document.body.removeChild(fileInput); + }; + + fileInput.click(); + } + ); + uploadWidget.label = "choose video to upload"; + + // Create video preview widget + const previewWidget = createVideoWidget(this); + + // Update preview when video value changes + const videoWidget = this.widgets.find((w: any) => w.name === "video"); + if (videoWidget) { + const originalCallback = videoWidget.callback; + + // Initial preview update + if (videoWidget.value && videoWidget.value.endsWith(".encrypted")) { + updateVideoWidget(previewWidget, videoWidget.value).catch(console.error); + } + + videoWidget.callback = async function (this: any, value: any) { + if (originalCallback) { + originalCallback.call(this, value); + } + + if (value && value.endsWith(".encrypted")) { + await updateVideoWidget(previewWidget, value); + } else { + clearVideoWidget(previewWidget); + } + }; + } + + // Add Drag and Drop support + this.onDragOver = function (e: DragEvent) { + if (e.dataTransfer && e.dataTransfer.types.includes('Files')) { + e.preventDefault(); + e.stopPropagation(); + e.dataTransfer.dropEffect = 'copy'; + return true; + } + return false; + }; + + this.onDragDrop = async function (e: DragEvent) { + if (!e.dataTransfer || !e.dataTransfer.files || e.dataTransfer.files.length === 0) { + return false; + } + + e.preventDefault(); + e.stopPropagation(); + + const file = e.dataTransfer.files[0]; + + // Check if it's a video file + if (!file.type.startsWith('video/') && !file.name.endsWith('.encrypted')) { + alert('Please drop a video file'); + return false; + } + + await handleVideoUpload(this, file, app); + return true; + }; + + // Add Paste support + this.pasteFiles = async function (files: File[]) { + for (const file of files) { + if (!file.type.startsWith('video/')) { + continue; + } + await handleVideoUpload(this, file, app); + return true; + } + }; + + return r; + }; + + // Cleanup on node removal + const onRemoved = nodeType.prototype.onRemoved; + nodeType.prototype.onRemoved = function () { + // Clean up video widget + const videoWidget = this.widgets?.find((w: any) => + w.type === "video-preview" + ); + + if (videoWidget) { + clearVideoWidget(videoWidget); + } + + if (onRemoved) { + onRemoved.apply(this, arguments); + } + }; + } + }, +}); diff --git a/ts/package.json b/ts/package.json new file mode 100644 index 0000000..56d31eb --- /dev/null +++ b/ts/package.json @@ -0,0 +1,20 @@ +{ + "name": "cryptio-js", + "version": "1.0.0", + "description": "", + "main": "crypto.js", + "scripts": { + "build": "tsc", + "check": "tsc --noEmit", + "clean": "rm -rf dist", + "dev": "tsc --watch", + "test": "echo \"Error: no test specified\" && exit 1" + }, + "keywords": [], + "author": "", + "license": "ISC", + "devDependencies": { + "@comfyorg/comfyui-frontend-types": "^1.29.0", + "typescript": "^5.9.3" + } +} \ No newline at end of file diff --git a/ts/pnpm-lock.yaml b/ts/pnpm-lock.yaml new file mode 100644 index 0000000..086c43e --- /dev/null +++ b/ts/pnpm-lock.yaml @@ -0,0 +1,230 @@ +lockfileVersion: '9.0' + +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + +importers: + + .: + devDependencies: + '@comfyorg/comfyui-frontend-types': + specifier: ^1.29.0 + version: 1.29.0(vue@3.5.22(typescript@5.9.3))(zod@3.25.76) + typescript: + specifier: ^5.9.3 + version: 5.9.3 + +packages: + + '@babel/helper-string-parser@7.27.1': + resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==} + engines: {node: '>=6.9.0'} + + '@babel/helper-validator-identifier@7.27.1': + resolution: {integrity: sha512-D2hP9eA+Sqx1kBZgzxZh0y1trbuU+JoDkiEwqhQ36nodYqJwyEIhPSdMNd7lOm/4io72luTPWH20Yda0xOuUow==} + engines: {node: '>=6.9.0'} + + '@babel/parser@7.28.4': + resolution: {integrity: sha512-yZbBqeM6TkpP9du/I2pUZnJsRMGGvOuIrhjzC1AwHwW+6he4mni6Bp/m8ijn0iOuZuPI2BfkCoSRunpyjnrQKg==} + engines: {node: '>=6.0.0'} + hasBin: true + + '@babel/types@7.28.4': + resolution: {integrity: sha512-bkFqkLhh3pMBUQQkpVgWDWq/lqzc2678eUyDlTBhRqhCHFguYYGM0Efga7tYk4TogG/3x0EEl66/OQ+WGbWB/Q==} + engines: {node: '>=6.9.0'} + + '@comfyorg/comfyui-frontend-types@1.29.0': + resolution: {integrity: sha512-Gf56EsxLQWe6u24WdqG4WRET4FRVLMhApJj98YmuEGxCMpWuHOqn4meFcpV5t7XoonXf07YFs7dWzVPlkkufRA==} + peerDependencies: + vue: ^3.5.13 + zod: ^3.23.8 + + '@jridgewell/sourcemap-codec@1.5.5': + resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==} + + '@vue/compiler-core@3.5.22': + resolution: {integrity: sha512-jQ0pFPmZwTEiRNSb+i9Ow/I/cHv2tXYqsnHKKyCQ08irI2kdF5qmYedmF8si8mA7zepUFmJ2hqzS8CQmNOWOkQ==} + + '@vue/compiler-dom@3.5.22': + resolution: {integrity: sha512-W8RknzUM1BLkypvdz10OVsGxnMAuSIZs9Wdx1vzA3mL5fNMN15rhrSCLiTm6blWeACwUwizzPVqGJgOGBEN/hA==} + + '@vue/compiler-sfc@3.5.22': + resolution: {integrity: sha512-tbTR1zKGce4Lj+JLzFXDq36K4vcSZbJ1RBu8FxcDv1IGRz//Dh2EBqksyGVypz3kXpshIfWKGOCcqpSbyGWRJQ==} + + '@vue/compiler-ssr@3.5.22': + resolution: {integrity: sha512-GdgyLvg4R+7T8Nk2Mlighx7XGxq/fJf9jaVofc3IL0EPesTE86cP/8DD1lT3h1JeZr2ySBvyqKQJgbS54IX1Ww==} + + '@vue/reactivity@3.5.22': + resolution: {integrity: sha512-f2Wux4v/Z2pqc9+4SmgZC1p73Z53fyD90NFWXiX9AKVnVBEvLFOWCEgJD3GdGnlxPZt01PSlfmLqbLYzY/Fw4A==} + + '@vue/runtime-core@3.5.22': + resolution: {integrity: sha512-EHo4W/eiYeAzRTN5PCextDUZ0dMs9I8mQ2Fy+OkzvRPUYQEyK9yAjbasrMCXbLNhF7P0OUyivLjIy0yc6VrLJQ==} + + '@vue/runtime-dom@3.5.22': + resolution: {integrity: sha512-Av60jsryAkI023PlN7LsqrfPvwfxOd2yAwtReCjeuugTJTkgrksYJJstg1e12qle0NarkfhfFu1ox2D+cQotww==} + + '@vue/server-renderer@3.5.22': + resolution: {integrity: sha512-gXjo+ao0oHYTSswF+a3KRHZ1WszxIqO7u6XwNHqcqb9JfyIL/pbWrrh/xLv7jeDqla9u+LK7yfZKHih1e1RKAQ==} + peerDependencies: + vue: 3.5.22 + + '@vue/shared@3.5.22': + resolution: {integrity: sha512-F4yc6palwq3TT0u+FYf0Ns4Tfl9GRFURDN2gWG7L1ecIaS/4fCIuFOjMTnCyjsu/OK6vaDKLCrGAa+KvvH+h4w==} + + csstype@3.1.3: + resolution: {integrity: sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==} + + entities@4.5.0: + resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==} + engines: {node: '>=0.12'} + + estree-walker@2.0.2: + resolution: {integrity: sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==} + + magic-string@0.30.19: + resolution: {integrity: sha512-2N21sPY9Ws53PZvsEpVtNuSW+ScYbQdp4b9qUaL+9QkHUrGFKo56Lg9Emg5s9V/qrtNBmiR01sYhUOwu3H+VOw==} + + nanoid@3.3.11: + resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==} + engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} + hasBin: true + + picocolors@1.1.1: + resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==} + + postcss@8.5.6: + resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==} + engines: {node: ^10 || ^12 || >=14} + + source-map-js@1.2.1: + resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + engines: {node: '>=0.10.0'} + + typescript@5.9.3: + resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==} + engines: {node: '>=14.17'} + hasBin: true + + vue@3.5.22: + resolution: {integrity: sha512-toaZjQ3a/G/mYaLSbV+QsQhIdMo9x5rrqIpYRObsJ6T/J+RyCSFwN2LHNVH9v8uIcljDNa3QzPVdv3Y6b9hAJQ==} + peerDependencies: + typescript: '*' + peerDependenciesMeta: + typescript: + optional: true + + zod@3.25.76: + resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==} + +snapshots: + + '@babel/helper-string-parser@7.27.1': {} + + '@babel/helper-validator-identifier@7.27.1': {} + + '@babel/parser@7.28.4': + dependencies: + '@babel/types': 7.28.4 + + '@babel/types@7.28.4': + dependencies: + '@babel/helper-string-parser': 7.27.1 + '@babel/helper-validator-identifier': 7.27.1 + + '@comfyorg/comfyui-frontend-types@1.29.0(vue@3.5.22(typescript@5.9.3))(zod@3.25.76)': + dependencies: + vue: 3.5.22(typescript@5.9.3) + zod: 3.25.76 + + '@jridgewell/sourcemap-codec@1.5.5': {} + + '@vue/compiler-core@3.5.22': + dependencies: + '@babel/parser': 7.28.4 + '@vue/shared': 3.5.22 + entities: 4.5.0 + estree-walker: 2.0.2 + source-map-js: 1.2.1 + + '@vue/compiler-dom@3.5.22': + dependencies: + '@vue/compiler-core': 3.5.22 + '@vue/shared': 3.5.22 + + '@vue/compiler-sfc@3.5.22': + dependencies: + '@babel/parser': 7.28.4 + '@vue/compiler-core': 3.5.22 + '@vue/compiler-dom': 3.5.22 + '@vue/compiler-ssr': 3.5.22 + '@vue/shared': 3.5.22 + estree-walker: 2.0.2 + magic-string: 0.30.19 + postcss: 8.5.6 + source-map-js: 1.2.1 + + '@vue/compiler-ssr@3.5.22': + dependencies: + '@vue/compiler-dom': 3.5.22 + '@vue/shared': 3.5.22 + + '@vue/reactivity@3.5.22': + dependencies: + '@vue/shared': 3.5.22 + + '@vue/runtime-core@3.5.22': + dependencies: + '@vue/reactivity': 3.5.22 + '@vue/shared': 3.5.22 + + '@vue/runtime-dom@3.5.22': + dependencies: + '@vue/reactivity': 3.5.22 + '@vue/runtime-core': 3.5.22 + '@vue/shared': 3.5.22 + csstype: 3.1.3 + + '@vue/server-renderer@3.5.22(vue@3.5.22(typescript@5.9.3))': + dependencies: + '@vue/compiler-ssr': 3.5.22 + '@vue/shared': 3.5.22 + vue: 3.5.22(typescript@5.9.3) + + '@vue/shared@3.5.22': {} + + csstype@3.1.3: {} + + entities@4.5.0: {} + + estree-walker@2.0.2: {} + + magic-string@0.30.19: + dependencies: + '@jridgewell/sourcemap-codec': 1.5.5 + + nanoid@3.3.11: {} + + picocolors@1.1.1: {} + + postcss@8.5.6: + dependencies: + nanoid: 3.3.11 + picocolors: 1.1.1 + source-map-js: 1.2.1 + + source-map-js@1.2.1: {} + + typescript@5.9.3: {} + + vue@3.5.22(typescript@5.9.3): + dependencies: + '@vue/compiler-dom': 3.5.22 + '@vue/compiler-sfc': 3.5.22 + '@vue/runtime-dom': 3.5.22 + '@vue/server-renderer': 3.5.22(vue@3.5.22(typescript@5.9.3)) + '@vue/shared': 3.5.22 + optionalDependencies: + typescript: 5.9.3 + + zod@3.25.76: {} diff --git a/ts/textEncrypt.ts b/ts/textEncrypt.ts new file mode 100644 index 0000000..13fa059 --- /dev/null +++ b/ts/textEncrypt.ts @@ -0,0 +1,155 @@ +//@ts-ignore +import { app as rawApp } from "../../scripts/app.js"; +//@ts-ignore +import { api as rawApi } from "../../scripts/api.js"; +import type { + ComfyApp, + ComfyApi, + ComfyNodeDef, +} from "@comfyorg/comfyui-frontend-types"; +import { decryptDataWithServerKey, encryptDataWithServerKey, encryptFileWithServerKey } from "./utils/cryptoUtils.js"; +import { base64ToBytes, bytesToBase64 } from "./utils/base64Utils.js"; +const app: ComfyApp = rawApp; +const api: ComfyApi = rawApi; + +// 密钥存储键名 +const PUBLIC_KEY_STORAGE_KEY = "cryptio_public_key"; + +// 获取公钥 +async function getPublicKey(): Promise { + // 先从localStorage获取 + let publicKey = localStorage.getItem(PUBLIC_KEY_STORAGE_KEY); + + // 如果本地没有，则从服务器获取 + if (!publicKey) { + try { + const response = await fetch("/cryptio/public_key"); + const data = await response.json(); + + if (data.public_key) { + publicKey = data.public_key; + if (publicKey == null) { + throw new Error("publicKey is null"); + } + // 保存到localStorage + localStorage.setItem(PUBLIC_KEY_STORAGE_KEY, publicKey); + } else { + console.error("Failed to get public key:", data.error); + return null; + } + } catch (error) { + console.error("Error fetching public key:", error); + return null; + } + } + + return publicKey; +} + +// 使用服务端公钥加密文本 +async function encryptText( + text: string +): Promise { + try { + const encrypted = await encryptDataWithServerKey( + new TextEncoder().encode(text) + ); + + // 转换为Base64 + const encryptedBase64 = bytesToBase64(encrypted); + + // 添加前缀标识这是加密数据 + return "ENCRYPTED:" + encryptedBase64; + } catch (error) { + console.error("Encryption error:", error); + throw error; + } +} +// 使用服务端私钥解密文本 +async function decryptText( + text: string +): Promise { + try { + // 移除前缀 + text = text.replace("ENCRYPTED:", ""); + const decrypted = await decryptDataWithServerKey( + base64ToBytes(text) + ); + + // 转换为Base64 + const decryptedText = new TextDecoder().decode(decrypted); + + // 添加前缀标识这是加密数据 + return decryptedText; + } catch (error) { + console.error("Decryption error:", error); + throw error; + } +} + +// 注册客户端加密节点 +app.registerExtension({ + name: "cryptio.TextEncrypt", + async beforeRegisterNodeDef( + nodeType: any, + nodeData: ComfyNodeDef, + app: ComfyApp + ) { + if (nodeType.comfyClass == "TextEncrypt") { + const originalOnNodeCreated = nodeType.prototype.onNodeCreated; + nodeType.prototype.onNodeCreated = async function ( + this: any + ) { + const me = originalOnNodeCreated?.apply(this); + if (this?.widgets) { + const widgets = this.widgets; + + const textWidget = widgets[0]; + const rawWidget = widgets[1]; + + // Override the serialization of the value to resolve dynamic prompts for all widgets supporting it in this node + textWidget.serializeValue = async ( + workflowNode: any, + widgetIndex: number + ) => { + if (rawWidget.value) return textWidget.value; + + let prompt = ""; + + const encryptedText = await encryptText( + textWidget.value + ); + prompt = encryptedText; + + + return prompt; + }; + } + return me; + }; + } + }, + async loadedGraphNode(node, app) { + if (node.type === "TextEncrypt" && node?.widgets?.[0]) { + const textWidget = node.widgets[0]; + const text = textWidget.value; + if (typeof (text) === "string" && text?.startsWith("ENCRYPTED:")) { + textWidget.value = await decryptText(text); + } + } + }, + async init() { + console.log("CryptIO client-side encryption initialized"); + const graphToPrompt = app.graphToPrompt; + app.graphToPrompt = async function (...args) { + const res = await graphToPrompt.apply(this, args); + for (const nodeId in res.workflow?.nodes) { + const node = res.workflow.nodes[nodeId]; + if (node.type === "TextEncrypt") { + node.widgets_values[0] = await encryptText(node.widgets_values[0]); + } + } + return res; + }; + }, +}); \ No newline at end of file diff --git a/ts/tsconfig.json b/ts/tsconfig.json new file mode 100644 index 0000000..1f68146 --- /dev/null +++ b/ts/tsconfig.json @@ -0,0 +1,20 @@ +{ + "compilerOptions": { + "target": "ESNext", + "module": "ESNext", + "moduleResolution": "node", + "resolveJsonModule": true, + "isolatedModules": true, + "noEmit": false, + "strict": true, + "esModuleInterop": true, + "skipLibCheck": true, + "outDir": "../js", + "forceConsistentCasingInFileNames": true, + "typeRoots": [ + "./node_modules/@comfyorg/comfyui-frontend-types/dist", + "./node_modules/@types" + ] + }, + "include": ["**/*.ts"] +} diff --git a/ts/utils/base64Utils.ts b/ts/utils/base64Utils.ts new file mode 100644 index 0000000..70db0f6 --- /dev/null +++ b/ts/utils/base64Utils.ts @@ -0,0 +1,7 @@ +export function base64ToBytes(base64: string) { + return new Uint8Array(atob(base64).split("").map(n => n.charCodeAt(0))) +} + +export function bytesToBase64(bytes: Uint8Array): string { + return btoa([...bytes].map((n) => String.fromCharCode(n)).join("")); +} diff --git a/ts/utils/cryptoKeys.ts b/ts/utils/cryptoKeys.ts new file mode 100644 index 0000000..dca19cd --- /dev/null +++ b/ts/utils/cryptoKeys.ts @@ -0,0 +1,272 @@ +/** + * 密钥管理模块 + * 负责客户端和服务端密钥的生成、导入、交换和存储 + */ + +// 密钥存储键名 +export const CLIENT_KEYPAIR_STORAGE_KEY = "cryptio_client_keypair"; +export const SERVER_KEYS_STORAGE_KEY = "cryptio_server_keys"; + +// 密钥接口 +export interface KeyPair { + publicKey: string; + privateKey: string; +} + +export interface ServerKeys { + publicKey: string; + privateKey: string; +} + +/** + * 生成客户端RSA密钥对 + */ +export async function generateClientKeyPair(): Promise { + // 生成RSA密钥对 + const keyPair = await window.crypto.subtle.generateKey( + { + name: "RSA-OAEP", + modulusLength: 2048, + publicExponent: new Uint8Array([1, 0, 1]), + hash: "SHA-256", + }, + true, + ["encrypt", "decrypt"] + ); + + // 导出公钥为PEM格式 + const publicKeyBuffer = await window.crypto.subtle.exportKey( + "spki", + keyPair.publicKey + ); + const publicKeyBase64 = btoa( + String.fromCharCode(...new Uint8Array(publicKeyBuffer)) + ); + const publicKeyPem = + "-----BEGIN PUBLIC KEY-----\n" + + publicKeyBase64.match(/.{1,64}/g)!.join("\n") + + "\n-----END PUBLIC KEY-----"; + + // 导出私钥为PEM格式 + const privateKeyBuffer = await window.crypto.subtle.exportKey( + "pkcs8", + keyPair.privateKey + ); + const privateKeyBase64 = btoa( + String.fromCharCode(...new Uint8Array(privateKeyBuffer)) + ); + const privateKeyPem = + "-----BEGIN PRIVATE KEY-----\n" + + privateKeyBase64.match(/.{1,64}/g)!.join("\n") + + "\n-----END PRIVATE KEY-----"; + + return { + publicKey: publicKeyPem, + privateKey: privateKeyPem, + }; +} + +/** + * 获取或生成客户端密钥对 + */ +export async function getClientKeyPair(): Promise { + // 从localStorage获取 + const stored = localStorage.getItem(CLIENT_KEYPAIR_STORAGE_KEY); + if (stored) { + try { + return JSON.parse(stored); + } catch (e) { + console.error("Failed to parse stored client keypair:", e); + } + } + + // 生成新的密钥对 + console.log("Generating new client keypair..."); + const keyPair = await generateClientKeyPair(); + + // 保存到localStorage + localStorage.setItem(CLIENT_KEYPAIR_STORAGE_KEY, JSON.stringify(keyPair)); + + return keyPair; +} + +/** + * 从PEM格式导入公钥 + */ +export async function importPublicKeyFromPem(pem: string): Promise { + const pemHeader = "-----BEGIN PUBLIC KEY-----"; + const pemFooter = "-----END PUBLIC KEY-----"; + const pemContents = pem + .substring( + pem.indexOf(pemHeader) + pemHeader.length, + pem.indexOf(pemFooter) + ) + .replace(/\s/g, ""); + + const binaryDer = window.atob(pemContents); + const binaryDerArray = new Uint8Array(binaryDer.length); + for (let i = 0; i < binaryDer.length; i++) { + binaryDerArray[i] = binaryDer.charCodeAt(i); + } + + return await window.crypto.subtle.importKey( + "spki", + binaryDerArray, + { + name: "RSA-OAEP", + hash: "SHA-256", + }, + false, + ["encrypt"] + ); +} + +/** + * 从PEM格式导入私钥 + */ +export async function importPrivateKeyFromPem(pem: string): Promise { + const pemHeader = "-----BEGIN PRIVATE KEY-----"; + const pemFooter = "-----END PRIVATE KEY-----"; + const pemContents = pem + .substring( + pem.indexOf(pemHeader) + pemHeader.length, + pem.indexOf(pemFooter) + ) + .replace(/\s/g, ""); + + const binaryDer = window.atob(pemContents); + const binaryDerArray = new Uint8Array(binaryDer.length); + for (let i = 0; i < binaryDer.length; i++) { + binaryDerArray[i] = binaryDer.charCodeAt(i); + } + + return await window.crypto.subtle.importKey( + "pkcs8", + binaryDerArray, + { + name: "RSA-OAEP", + hash: "SHA-256", + }, + false, + ["decrypt"] + ); +} + +/** + * 与服务器交换密钥，使用客户端公钥加密 AES 密钥 + */ +export async function exchangeKeys(): Promise { + // 检查缓存 + const cached = localStorage.getItem(SERVER_KEYS_STORAGE_KEY); + if (cached) { + try { + return JSON.parse(cached); + } catch (e) { + console.error("Failed to parse stored server keys:", e); + } + } + + // 获取客户端密钥对 + const clientKeyPair = await getClientKeyPair(); + + // 发送客户端公钥到服务器 + const response = await fetch("/cryptio/exchange_keys", { + method: "POST", + headers: { + "Content-Type": "application/json", + }, + body: JSON.stringify({ + client_public_key: clientKeyPair.publicKey, + }), + }); + + if (!response.ok) { + throw new Error(`Key exchange failed: ${response.statusText}`); + } + + const data = await response.json(); + + // 使用客户端私钥解密服务端密钥 + const clientPrivateKey = await importPrivateKeyFromPem( + clientKeyPair.privateKey + ); + + // 1. 解密AES密钥 + const encryptedAesKey = Uint8Array.from( + atob(data.encrypted_aes_key), + (c) => c.charCodeAt(0) + ); + const aesKeyBuffer = await window.crypto.subtle.decrypt( + { + name: "RSA-OAEP", + }, + clientPrivateKey, + encryptedAesKey + ); + + // 2. 导入AES密钥 + const aesKey = await window.crypto.subtle.importKey( + "raw", + aesKeyBuffer, + { + name: "AES-CBC", + length: 256, + }, + false, + ["decrypt"] + ); + + // 3. 解密服务端密钥数据 + const iv = Uint8Array.from(atob(data.iv), (c) => c.charCodeAt(0)); + const encryptedData = Uint8Array.from(atob(data.encrypted_data), (c) => + c.charCodeAt(0) + ); + + const decryptedBuffer = await window.crypto.subtle.decrypt( + { + name: "AES-CBC", + iv: iv, + }, + aesKey, + encryptedData + ); + + // 4. 解析JSON + const decryptedText = new TextDecoder().decode(decryptedBuffer); + const rawServerKeys = JSON.parse(decryptedText); + const serverKeys = { + publicKey: rawServerKeys.server_public_key, + privateKey: rawServerKeys.server_private_key, + }; + + // 5. 保存到localStorage + localStorage.setItem(SERVER_KEYS_STORAGE_KEY, JSON.stringify(serverKeys)); + + return serverKeys; +} + +/** + * 获取服务端密钥 + */ +export async function getServerKeys(): Promise { + // 先尝试从缓存获取 + const cached = localStorage.getItem(SERVER_KEYS_STORAGE_KEY); + if (cached) { + try { + return JSON.parse(cached); + } catch (e) { + console.error("Failed to parse stored server keys:", e); + } + } + + // 如果缓存不存在，抛出错误（SaveImage场景） + // 或者尝试交换密钥（UploadImage场景） + throw new Error("Server keys not found. Please upload an image first to exchange keys."); +} + +/** + * 获取服务端密钥（带自动交换） + */ +export async function getServerKeysWithExchange(): Promise { + return await exchangeKeys(); +} diff --git a/ts/utils/cryptoUtils.ts b/ts/utils/cryptoUtils.ts new file mode 100644 index 0000000..9b3a2ec --- /dev/null +++ b/ts/utils/cryptoUtils.ts @@ -0,0 +1,196 @@ +/** + * 加密/解密工具模块 + * 提供文件和数据的加密解密功能 + */ + +import { getServerKeysWithExchange, getClientKeyPair, importPublicKeyFromPem, importPrivateKeyFromPem, type KeyPair } from "./cryptoKeys.js"; + +/** + * 使用混合加密方案加密数据 + * @param data 要加密的数据 + * @param publicKeyPem 用于加密AES密钥的公钥（PEM格式） + * @returns 加密后的数据 + */ +async function encryptData(data: Uint8Array, publicKeyPem: string): Promise { + // 1. 生成随机 AES 密钥 + const aesKey = await window.crypto.subtle.generateKey( + { + name: "AES-GCM", + length: 256, + }, + true, + ["encrypt"] + ); + + // 2. 生成随机 IV + const iv = window.crypto.getRandomValues(new Uint8Array(12)); + + // 3. 使用 AES 加密文件数据 + const encryptedData = await window.crypto.subtle.encrypt( + { + name: "AES-GCM", + iv: iv, + }, + aesKey, + // @ts-ignore + data + ); + + // 4. 导出 AES 密钥 + const rawAesKey = await window.crypto.subtle.exportKey("raw", aesKey); + + // 5. 使用指定的公钥加密 AES 密钥 + const publicKey = await importPublicKeyFromPem(publicKeyPem); + const encryptedAesKey = await window.crypto.subtle.encrypt( + { + name: "RSA-OAEP", + }, + publicKey, + rawAesKey + ); + + // 6. 组合数据 + const encryptedAesKeyArray = new Uint8Array(encryptedAesKey); + const encryptedDataArray = new Uint8Array(encryptedData); + const combined = new Uint8Array( + 4 + encryptedAesKeyArray.length + 4 + iv.length + encryptedDataArray.length + ); + + const view = new DataView(combined.buffer); + view.setUint32(0, encryptedAesKeyArray.length, false); + combined.set(encryptedAesKeyArray, 4); + view.setUint32(4 + encryptedAesKeyArray.length, iv.length, false); + combined.set(iv, 4 + encryptedAesKeyArray.length + 4); + combined.set(encryptedDataArray, 4 + encryptedAesKeyArray.length + 4 + iv.length); + + return combined; +} + +/** + * 使用混合加密方案加密文件（UploadImage场景，使用服务端公钥） + * @param file 要加密的文件 + * @returns 加密后的数据 + */ +export async function encryptFileWithServerKey(file: File): Promise { + // 读取文件内容 + const arrayBuffer = await file.arrayBuffer(); + const data = new Uint8Array(arrayBuffer); + return await encryptDataWithServerKey(data); +} + +export async function encryptDataWithServerKey(data: Uint8Array): Promise { + const serverKeys = await getServerKeysWithExchange(); + return await encryptData(data, serverKeys.publicKey); +} + +/** + * 使用混合加密方案加密文件（支持自定义密钥对） + * @param file 要加密的文件 + * @param keyPair 密钥对（使用其中的公钥加密） + * @returns 加密后的数据 + */ +export async function encryptFileWithKeyPair(file: File, keyPair: KeyPair): Promise { + // 读取文件内容 + const arrayBuffer = await file.arrayBuffer(); + const data = new Uint8Array(arrayBuffer); + + return await encryptData(data, keyPair.publicKey); +} + +/** + * 解密文件数据（使用指定的私钥） + * @param encryptedData 加密的数据 + * @param privateKeyPem 用于解密AES密钥的私钥（PEM格式） + * @returns 解密后的数据 + */ +async function decryptData(encryptedData: Uint8Array, privateKeyPem: string): Promise { + // 解析组合数据 + let offset = 0; + + // 1. 读取加密的AES密钥长度 + const view = new DataView(encryptedData.buffer); + const encryptedAesKeyLength = view.getUint32(offset, false); + offset += 4; + + // 2. 读取加密的AES密钥 + const encryptedAesKey = encryptedData.slice( + offset, + offset + encryptedAesKeyLength + ); + offset += encryptedAesKeyLength; + + // 3. 读取IV长度 + const ivLength = view.getUint32(offset, false); + offset += 4; + + // 4. 读取IV + const iv = encryptedData.slice(offset, offset + ivLength); + offset += ivLength; + + // 5. 读取加密的数据 + const encrypted = encryptedData.slice(offset); + + // 6. 使用指定的私钥解密AES密钥 + const privateKey = await importPrivateKeyFromPem(privateKeyPem); + const aesKeyBuffer = await window.crypto.subtle.decrypt( + { + name: "RSA-OAEP", + }, + privateKey, + encryptedAesKey + ); + + // 7. 导入AES密钥 + const aesKey = await window.crypto.subtle.importKey( + "raw", + aesKeyBuffer, + { + name: "AES-GCM", + length: 256, + }, + false, + ["decrypt"] + ); + + // 8. 使用AES密钥解密数据 + const decryptedBuffer = await window.crypto.subtle.decrypt( + { + name: "AES-GCM", + iv: iv, + }, + aesKey, + encrypted + ); + + return new Uint8Array(decryptedBuffer); +} + +/** + * 解密文件数据（UploadImage预览场景，使用服务端私钥） + * @param encryptedData 加密的数据 + * @returns 解密后的数据 + */ +export async function decryptDataWithServerKey(encryptedData: Uint8Array): Promise { + const serverKeys = await getServerKeysWithExchange(); + return await decryptData(encryptedData, serverKeys.privateKey); +} + +/** + * 解密文件数据（SaveImage/PreviewImage场景，使用客户端私钥） + * @param encryptedData 加密的数据 + * @returns 解密后的数据 + */ +export async function decryptFileWithClientKey(encryptedData: Uint8Array): Promise { + const clientKeyPair = await getClientKeyPair(); + return await decryptData(encryptedData, clientKeyPair.privateKey); +} + +/** + * 解密文件数据（支持自定义密钥对） + * @param encryptedData 加密的数据 + * @param keyPair 密钥对（使用其中的私钥解密） + * @returns 解密后的数据 + */ +export async function decryptFileWithKeyPair(encryptedData: Uint8Array, keyPair: KeyPair): Promise { + return await decryptData(encryptedData, keyPair.privateKey); +} diff --git a/ts/utils/fileUtils.ts b/ts/utils/fileUtils.ts new file mode 100644 index 0000000..e47206c --- /dev/null +++ b/ts/utils/fileUtils.ts @@ -0,0 +1,48 @@ +/** + * 文件工具模块 + * 提供文件相关的实用函数 + */ + +/** + * 从文件名中提取MIME类型 + * @param filename 文件名 + * @returns MIME类型字符串 + */ +export function getMimeTypeFromFilename(filename: string): string { + const baseFilename = filename.replace(/\.encrypted$/, ''); + // 提取原始扩展名 + const lastDotIndex = baseFilename.lastIndexOf('.'); + if (lastDotIndex === -1) { + // 如果没有扩展名，默认返回image/png + return 'image/png'; + } + + const extension = baseFilename.substring(lastDotIndex + 1).toLowerCase(); + + // 扩展名到MIME类型的映射 + const mimeTypes: { [key: string]: string } = { + // 图片格式 + 'jpg': 'image/jpeg', + 'jpeg': 'image/jpeg', + 'png': 'image/png', + 'gif': 'image/gif', + 'webp': 'image/webp', + 'bmp': 'image/bmp', + 'svg': 'image/svg+xml', + 'ico': 'image/x-icon', + 'tiff': 'image/tiff', + 'tif': 'image/tiff', + 'avif': 'image/avif', + // 视频格式 + 'mp4': 'video/mp4', + 'webm': 'video/webm', + 'mkv': 'video/x-matroska', + 'avi': 'video/x-msvideo', + 'mov': 'video/quicktime', + 'flv': 'video/x-flv', + 'wmv': 'video/x-ms-wmv', + 'm4v': 'video/x-m4v' + }; + + return mimeTypes[extension] || 'image/png'; // 默认返回image/png +} diff --git a/ts/utils/imageLoader.ts b/ts/utils/imageLoader.ts new file mode 100644 index 0000000..643d25a --- /dev/null +++ b/ts/utils/imageLoader.ts @@ -0,0 +1,94 @@ +/** + * 图片加载模块 + * 负责从服务器加载并解密图片用于预览 + */ + +import type { ComfyApi } from "@comfyorg/comfyui-frontend-types"; +import { decryptDataWithServerKey, decryptFileWithClientKey } from "./cryptoUtils.js"; +import { getMimeTypeFromFilename } from "./fileUtils.js"; + +export interface ImageLoadParams { + filename: string; + subfolder?: string; + type: string; +} + +/** + * 从简单文件名加载加密图片（用于UploadImage场景，使用服务端私钥解密） + * @param filename 文件名 + * @returns Blob URL + */ +export async function loadEncryptedImageFromFilename(filename: string): Promise { + // 从服务器获取加密数据（二进制格式） + const response = await fetch( + `/cryptio/view_encrypted?filename=${encodeURIComponent(filename)}` + ); + + if (!response.ok) { + throw new Error(`Failed to load encrypted image: ${response.statusText}`); + } + + // 直接读取二进制数据 + const encryptedArrayBuffer = await response.arrayBuffer(); + const encryptedData = new Uint8Array(encryptedArrayBuffer); + + // 使用服务端私钥解密（UploadImage场景） + const decryptedData = await decryptDataWithServerKey(encryptedData); + + // 转换为Blob URL + const blob = new Blob([new Uint8Array(decryptedData)], { + type: getMimeTypeFromFilename(filename), + }); + return URL.createObjectURL(blob); +} + +/** + * 从参数加载加密图片（用于SaveImage/PreviewImage场景，使用客户端私钥解密） + * @param api ComfyUI API实例 + * @param params 图片参数（包含filename, subfolder, type） + * @returns Blob URL + */ +export async function loadEncryptedImageFromParams(api: ComfyApi, params: ImageLoadParams): Promise { + // 构建URL + const url = api.apiURL( + `/view?filename=${encodeURIComponent(params.filename)}&type=${params.type}${ + params.subfolder ? `&subfolder=${encodeURIComponent(params.subfolder)}` : "" + }` + ); + + // 从服务器获取加密数据（二进制格式） + const response = await fetch(url); + + if (!response.ok) { + throw new Error(`Failed to load encrypted image: ${response.statusText}`); + } + + // 直接读取二进制数据 + const encryptedArrayBuffer = await response.arrayBuffer(); + const encryptedData = new Uint8Array(encryptedArrayBuffer); + + // 使用客户端私钥解密（SaveImage/PreviewImage场景） + const decryptedData = await decryptFileWithClientKey(encryptedData); + + // 转换为Blob URL + const blob = new Blob([new Uint8Array(decryptedData)], { + type: getMimeTypeFromFilename(params.filename), + }); + return URL.createObjectURL(blob); +} + +/** + * 下载解密后的图片 + * @param blobUrl Blob URL + * @param filename 原始文件名（带 .encrypted 后缀） + */ +export function downloadDecryptedImage(blobUrl: string, filename: string): void { + const a = document.createElement("a"); + a.href = blobUrl; + // 移除 .encrypted 后缀 + const originalFilename = filename.replace(/\.encrypted$/, ""); + a.download = originalFilename; + document.body.appendChild(a); + a.click(); + document.body.removeChild(a); +} diff --git a/ts/utils/uploadUtils.ts b/ts/utils/uploadUtils.ts new file mode 100644 index 0000000..43a71b7 --- /dev/null +++ b/ts/utils/uploadUtils.ts @@ -0,0 +1,97 @@ +/** + * 上传工具模块 + * 提供文件上传相关功能 + */ + +import type { ComfyApp } from "@comfyorg/comfyui-frontend-types"; +import { encryptFileWithServerKey } from "./cryptoUtils.js"; +import { loadEncryptedImageFromFilename } from "./imageLoader.js"; + +/** + * 上传加密图片到服务器（使用服务端公钥加密） + * @param file 要上传的文件 + * @returns 服务器响应 + */ +export async function uploadEncryptedImage(file: File): Promise { + console.log("Encrypting and uploading image:", file.name); + + // 加密文件（使用服务端公钥，如果文件已经使用服务端公钥加密则直接读取） + const encryptedData = file?.name?.endsWith(".encrypted") + ? new Uint8Array(await file.arrayBuffer()) + : await encryptFileWithServerKey(file); + + // 创建FormData + const formData = new FormData(); + const encryptedBlob = new Blob([new Uint8Array(encryptedData)], { + type: "application/octet-stream", + }); + formData.append("image", encryptedBlob, file.name); + + // 上传到服务器 + const response = await fetch("/cryptio/upload_encrypted", { + method: "POST", + body: formData, + }); + + if (!response.ok) { + throw new Error(`Upload failed: ${response.statusText}`); + } + + return await response.json(); +} + +/** + * 处理文件上传到节点的通用方法 + * @param node 节点实例 + * @param file 要上传的文件 + * @param app ComfyUI App实例 + */ +export async function handleFileUpload(node: any, file: File, app: ComfyApp) { + try { + // 上传加密图片 + const result = await uploadEncryptedImage(file); + + // 更新image widget的值 + const imageWidget = node.widgets.find( + (w: any) => w.name === "image" + ); + if (imageWidget) { + imageWidget.value = result.name; + } + + // 更新预览 + await node.updatePreview(result.name); + + app.rootGraph?.setDirtyCanvas(true, false); + } catch (error) { + console.error("Upload error:", error); + alert("Failed to upload encrypted image: " + error); + } +} + +/** + * 创建节点预览更新函数 + * @param app ComfyUI App实例 + * @returns 预览更新函数 + */ +export function createPreviewUpdateFunction(app: ComfyApp) { + return async function (this: any, filename: string) { + if (!filename || !filename.endsWith(".encrypted")) { + return; + } + + try { + const imageUrl = await loadEncryptedImageFromFilename(filename); + + // 更新节点的图片显示 + const img = new Image(); + img.onload = () => { + this.imgs = [img]; + app.rootGraph?.setDirtyCanvas(true, false); + }; + img.src = imageUrl; + } catch (error) { + console.error("Preview error:", error); + } + }; +} diff --git a/ts/utils/videoLoader.ts b/ts/utils/videoLoader.ts new file mode 100644 index 0000000..7bdc0e4 --- /dev/null +++ b/ts/utils/videoLoader.ts @@ -0,0 +1,127 @@ +/** + * 视频加载模块 + * 负责从服务器加载并解密视频用于预览 + */ + +import type { ComfyApi } from "@comfyorg/comfyui-frontend-types"; +import { decryptDataWithServerKey, decryptFileWithClientKey } from "./cryptoUtils.js"; +import { getMimeTypeFromFilename } from "./fileUtils.js"; + +export interface VideoLoadParams { + filename: string; + subfolder?: string; + type: string; +} + +/** + * 从简单文件名加载加密视频（用于UploadVideo场景，使用服务端私钥解密） + * @param filename 文件名 + * @returns Blob URL + */ +export async function loadEncryptedVideoFromFilename(filename: string): Promise { + // 从服务器获取加密数据（二进制格式） + const response = await fetch( + `/cryptio/view_encrypted?filename=${encodeURIComponent(filename)}` + ); + + if (!response.ok) { + throw new Error(`Failed to load encrypted video: ${response.statusText}`); + } + + // 直接读取二进制数据 + const encryptedArrayBuffer = await response.arrayBuffer(); + const encryptedData = new Uint8Array(encryptedArrayBuffer); + + // 使用服务端私钥解密（UploadVideo场景） + const decryptedData = await decryptDataWithServerKey(encryptedData); + + // 转换为Blob URL + const blob = new Blob([new Uint8Array(decryptedData)], { + type: getMimeTypeFromFilename(filename), + }); + return URL.createObjectURL(blob); +} + +/** + * 从参数加载加密视频（用于SaveVideo/PreviewVideo场景，使用客户端私钥解密） + * @param api ComfyUI API实例 + * @param params 视频参数（包含filename, subfolder, type） + * @returns Blob URL + */ +export async function loadEncryptedVideoFromParams(api: ComfyApi, params: VideoLoadParams): Promise { + // 构建URL + const url = api.apiURL( + `/view?filename=${encodeURIComponent(params.filename)}&type=${params.type}${ + params.subfolder ? `&subfolder=${encodeURIComponent(params.subfolder)}` : "" + }` + ); + + // 从服务器获取加密数据（二进制格式） + const response = await fetch(url); + + if (!response.ok) { + throw new Error(`Failed to load encrypted video: ${response.statusText}`); + } + + // 直接读取二进制数据 + const encryptedArrayBuffer = await response.arrayBuffer(); + const encryptedData = new Uint8Array(encryptedArrayBuffer); + + // 使用客户端私钥解密（SaveVideo/PreviewVideo场景） + const decryptedData = await decryptFileWithClientKey(encryptedData); + + // 转换为Blob URL + const blob = new Blob([new Uint8Array(decryptedData)], { + type: getMimeTypeFromFilename(params.filename), + }); + return URL.createObjectURL(blob); +} + +/** + * 下载解密后的视频 + * @param blobUrl Blob URL + * @param filename 原始文件名（带 .encrypted 后缀） + */ +export function downloadDecryptedVideo(blobUrl: string, filename: string): void { + const a = document.createElement("a"); + a.href = blobUrl; + // 移除 .encrypted 后缀 + const originalFilename = filename.replace(/\.encrypted$/, ""); + a.download = originalFilename; + document.body.appendChild(a); + a.click(); + document.body.removeChild(a); +} + +/** + * 创建视频预览元素 + * @param videoUrl 视频URL + * @param width 预览宽度（可选） + * @param height 预览高度（可选） + * @returns HTMLVideoElement + */ +export function createVideoPreviewElement( + videoUrl: string, + width?: number, + height?: number +): HTMLVideoElement { + const video = document.createElement("video"); + video.src = videoUrl; + video.controls = true; + video.loop = true; + video.muted = true; // 默认静音，避免自动播放时声音打扰 + video.style.maxWidth = "100%"; + video.style.maxHeight = "100%"; + + if (width) { + video.width = width; + } + if (height) { + video.height = height; + } + + // 尝试加载视频元数据 + video.load(); + + return video; +}