Trustless, par construction

# AuditZK E2E Connection: binance
# ECIES (ECDH P-256 + HKDF-SHA256 + AES-256-GCM)
# Requires: pip install cryptography

import json, os, ssl, sys, urllib.request, urllib.error
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

# Configuration: replace the placeholder values
USER_UID = "YOUR_SERVICE_UID"
EXCHANGE = "binance"
API_KEY    = "YOUR_API_KEY"
API_SECRET = "YOUR_API_SECRET"
# Sign-in token for your account, valid 15 minutes from generation. Do not share this script.
TOKEN = "YOUR_SESSION_TOKEN"
ENCLAVE_URL = "https://enclave.auditzk.com"

print("Connecting to AuditZK enclave (E2E encrypted)...")
ctx = ssl.create_default_context()
try:
    # 1. Fetch the enclave's E2E public key from its attestation
    with urllib.request.urlopen(f"{ENCLAVE_URL}/api/v1/attestation", context=ctx) as r:
        att = json.loads(r.read())
    print(f"  Enclave E2E key fingerprint: {att['e2eEncryption']['publicKeyFingerprint'][:16]}...")

    # 2. Encrypt the credentials here, before anything leaves this machine
    pub = serialization.load_pem_public_key(att["e2eEncryption"]["publicKey"].encode())
    eph = ec.generate_private_key(ec.SECP256R1())
    shared = eph.exchange(ec.ECDH(), pub)
    aes_key = HKDF(algorithm=hashes.SHA256(), length=32, salt=None, info=b"enclave-e2e-encryption").derive(shared)
    iv = os.urandom(12)
    creds = json.dumps({"api_key": API_KEY, "api_secret": API_SECRET})
    ct = AESGCM(aes_key).encrypt(iv, creds.encode(), None)
    eph_pem = eph.public_key().public_bytes(serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo).decode()
    print("  Credentials encrypted (AES-256-GCM)")

    # 3. Send the ciphertext to the enclave
    payload = json.dumps({
        "user_uid": USER_UID, "exchange": EXCHANGE, "label": f"{EXCHANGE} account",
        "encrypted": { "ephemeralPublicKey": eph_pem, "iv": iv.hex(), "ciphertext": ct[:-16].hex(), "tag": ct[-16:].hex() }
    })
    req = urllib.request.Request(f"{ENCLAVE_URL}/api/v1/credentials/connect", data=payload.encode(),
        headers={"Content-Type": "application/json", "Authorization": f"Bearer {TOKEN}"})
    with urllib.request.urlopen(req, context=ctx) as r:
        res = json.loads(r.read())
    if res.get("success"):
        print("SUCCESS: " + res.get("message", "Connection established"))
        print("Back in your dashboard, sync your connections to see this account.")
    else:
        print("ERROR: " + res.get("error", "Unknown error")); sys.exit(1)
except urllib.error.HTTPError as he:
    if he.code == 401:
        print("\nERROR: the sign-in token has expired. Generate a new script from your dashboard."); sys.exit(1)
    print(f"\nERROR: HTTP {he.code}: {he.read().decode(errors='replace')}"); sys.exit(1)
except Exception as e:
    print(f"\nERROR: {e}"); sys.exit(1)