1import base64
2from cryptography.hazmat.primitives.asymmetric import padding
3from cryptography.hazmat.primitives import serialization, hashes
4from cryptography.hazmat.backends import default_backend
5
6SOFIZ_PUBLIC_KEY_PEM = """-----BEGIN PUBLIC KEY-----
7MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv9toBr7vZ4XIkVzlzdGR
8vNVaKw7A9Z3/Vnq3bK8fLaaUTmoweL3CEKSbz1lxYUjzuRzY/nmDuCpPS/7t0i5c
9kWRifPaPgIoiUFr1fGLzjN+cttxtvbPQof2Zuxllbq5ox+XyZpc1eo8PjwhRobCB
10djDZ1iSV1VkhOWanrnNXeXFzUnRYHQUZmQ8FWOFQ8D9vUZanmq/ZJ6nJ4SZoj2lV
11dKrLBbh/MWtn9MmyrPrywoJYCnc7c+ylJIWnAhNv4jTafB5bqDTd6oSElV9lQqPf
12diO93j+Q/uBoAZQZ2EqWY0E4Ooz4Dd9dHl7EiNiAh19G9VTcBFN/QfXOdyCGajwC
13WwIDAQAB
14-----END PUBLIC KEY-----"""
15
16def encrypt_sofizpay_sk(secret_key: str, public_key_pem: str = SOFIZ_PUBLIC_KEY_PEM) -> str:
17    """Encrypts SofizPay Secret Key (S...) using RSA-OAEP SHA-256 for encrypted_sk"""
18    pub_key = serialization.load_pem_public_key(
19        public_key_pem.strip().encode('utf-8'),
20        backend=default_backend()
21    )
22    ciphertext = pub_key.encrypt(
23        secret_key.strip().encode('utf-8'),
24        padding.OAEP(
25            mgf=padding.MGF1(algorithm=hashes.SHA256()),
26            algorithm=hashes.SHA256(),
27            label=None
28        )
29    )
30    return base64.b64encode(ciphertext).decode('utf-8')
31
32# Example usage in API request body:
33# payload = {"encrypted_sk": encrypt_sofizpay_sk("S..."), "customer_num": "00000000000"}