@follenfang/fupload 0.0.0-bootstrap.0 → 0.0.2

package/fupload/scripts/fupload_cli/errors.py

@@ -0,0 +1,94 @@
+"""Stable, redacted CLI errors."""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Dict, Optional
+
+
+_BEARER = re.compile(r"(?i)Bearer\s+[A-Za-z0-9._~+/=-]+")
+_JWT = re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\b")
+_WA_VALUE = re.compile(r"!WA:\d+![^\s\"']+")
+_SIGNED = re.compile(r"(?i)(X-Amz-(?:Credential|Signature)=)[^&\s]+")
+_SIGNED_TOKEN = re.compile(r"(?i)(X-Amz-(?:Security-Token|Date|Expires)=)[^&\s]+")
+_URL_TOKEN = re.compile(r"(?i)([?&](?:token|jwt|clientNo|client_no|signature|credential)=)[^&\s]+")
+_COOKIE = re.compile(r"(?i)(Cookie|Set-Cookie|Authentication|Authorization)(\s*[:=]\s*)[^\s;]+")
+_SECRET_NAME = (
+    r"(?:access[_-]?token|refresh[_-]?token|resource[_-]?token|token|clientNo|client_no|"
+    r"clientId|client_id|client[_-]?secret|device[_-]?(?:id|proof)|login[_-]?code|jwt|"
+    r"credential|signature|api[_-]?key|auth[_-]?key|password|secret|cookie|set[_-]?cookie|"
+    r"authorization|authentication|signed[_-]?url|upload[_-]?url|presigned[_-]?(?:uri|url))"
+)
+_TOKEN_PAIR = re.compile(
+    r'''(?i)((?:["']?''' + _SECRET_NAME + r'''["']?)\s*[:=]\s*["']?)[^"',}&\s]+'''
+)
+
+
+def redact(value: str) -> str:
+    value = _BEARER.sub("Bearer [REDACTED]", str(value))
+    value = _JWT.sub("[REDACTED_JWT]", value)
+    value = _WA_VALUE.sub("[REDACTED_WA]", value)
+    value = _SIGNED.sub(r"\1[REDACTED]", value)
+    value = _SIGNED_TOKEN.sub(r"\1[REDACTED]", value)
+    value = _URL_TOKEN.sub(r"\1[REDACTED]", value)
+    value = _COOKIE.sub(r"\1\2[REDACTED]", value)
+    return _TOKEN_PAIR.sub(r"\1[REDACTED]", value)[:1000]
+
+
+class FuploadError(Exception):
+    def __init__(
+        self,
+        message: str,
+        *,
+        kind: str = "operation_failed",
+        stage: Optional[str] = None,
+        endpoint: Optional[str] = None,
+        http_status: Optional[int] = None,
+        business_code: Optional[Any] = None,
+        verification_required: bool = False,
+        details: Optional[Dict[str, Any]] = None,
+    ) -> None:
+        super().__init__(redact(message))
+        self.kind = kind
+        self.stage = stage
+        self.endpoint = endpoint
+        self.http_status = http_status
+        self.business_code = business_code
+        self.verification_required = verification_required
+        self.details = details or {}
+
+    def as_dict(self) -> Dict[str, Any]:
+        result: Dict[str, Any] = {
+            "kind": self.kind,
+            "message": redact(str(self)),
+            "verification_required": bool(self.verification_required),
+        }
+        if self.stage:
+            result["stage"] = self.stage
+        if self.endpoint:
+            result["endpoint"] = self.endpoint
+        if self.http_status is not None:
+            result["http_status"] = self.http_status
+        if self.business_code is not None:
+            result["business_code"] = self.business_code
+        if self.details:
+            result["details"] = self.details
+        return result
+
+    @classmethod
+    def from_dict(cls, value: Dict[str, Any]) -> "FuploadError":
+        return cls(
+            str(value.get("message") or "operation failed"),
+            kind=str(value.get("kind") or "operation_failed"),
+            stage=str(value.get("stage")) if value.get("stage") else None,
+            endpoint=str(value.get("endpoint")) if value.get("endpoint") else None,
+            http_status=value.get("http_status"),
+            business_code=value.get("business_code"),
+            verification_required=bool(value.get("verification_required")),
+            details=value.get("details") if isinstance(value.get("details"), dict) else None,
+        )
+
+
+class ValidationError(FuploadError):
+    def __init__(self, message: str, *, path: str = "$") -> None:
+        super().__init__(message, kind="validation_error", stage="dependency_get", details={"path": path})

package/fupload/scripts/fupload_cli/io.py

@@ -0,0 +1,125 @@
+"""Input and stable output helpers."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+from pathlib import Path
+from typing import Any, Dict
+
+from .errors import FuploadError, ValidationError, redact
+
+
+OUTPUT_SCHEMA = "fupload.output.v1"
+_SENSITIVE_KEYS = {
+    "token", "access_token", "refresh_token", "resource_token", "jwt", "jwttoken",
+    "cookie", "set_cookie", "authorization", "authentication", "clientno", "client_no",
+    "clientid", "client_id", "client_secret", "device_id", "device_proof", "cred",
+    "credential", "signature", "x_amz_credential", "x_amz_signature",
+    "x_amz_security_token", "signed_url", "upload_url", "presigneduri", "presigned_uri",
+    "api_key", "auth_key", "password", "secret",
+}
+_RAW_CONTENT_KEYS = {
+    "content", "wa_str", "t_wa_str", "raw_wtf", "wtf_zip", "download_url",
+    "import_string",
+}
+
+
+class _DuplicateKey(ValueError):
+    pass
+
+
+def _strict_object(pairs: Any) -> Dict[str, Any]:
+    result: Dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise _DuplicateKey(str(key))
+        result[key] = value
+    return result
+
+
+def _reject_constant(value: str) -> Any:
+    raise ValueError(value)
+
+
+def read_json(path: str) -> Dict[str, Any]:
+    if not path:
+        raise ValidationError("--input is required", path="--input")
+    try:
+        text = sys.stdin.read() if path == "-" else Path(path).read_text(encoding="utf-8-sig")
+        text = text.lstrip("\ufeff")
+    except OSError as exc:
+        raise ValidationError("cannot read input: %s" % exc, path="--input") from exc
+    try:
+        value = json.loads(
+            text,
+            object_pairs_hook=_strict_object,
+            parse_constant=_reject_constant,
+        )
+    except _DuplicateKey as exc:
+        raise ValidationError("input contains duplicate key: %s" % exc, path="--input") from exc
+    except json.JSONDecodeError as exc:
+        raise ValidationError(
+            "input must be valid JSON: line %d column %d" % (exc.lineno, exc.colno),
+            path="--input",
+        ) from exc
+    except ValueError as exc:
+        raise ValidationError("input contains a non-standard numeric value", path="--input") from exc
+    if not isinstance(value, dict):
+        raise ValidationError("input document must be a JSON object")
+    return value
+
+
+def write_output(platform: str, operation: str, data: Any, *, dry_run: bool = False) -> None:
+    payload = {
+        "schema": OUTPUT_SCHEMA,
+        "platform": platform,
+        "operation": operation,
+        "success": True,
+        "dry_run": bool(dry_run),
+        "data": sanitize_output(data),
+    }
+    # Stable ASCII JSON avoids inheriting a Windows console code-page contract.
+    print(json.dumps(payload, ensure_ascii=True, sort_keys=True, separators=(",", ":"), allow_nan=False))
+
+
+def sanitize_output(value: Any) -> Any:
+    if isinstance(value, dict):
+        result: Dict[str, Any] = {}
+        for key, item in value.items():
+            normalized = str(key).replace("-", "_").lower()
+            if normalized in _SENSITIVE_KEYS or any(
+                marker in normalized
+                for marker in ("token", "cookie", "credential", "signature", "password", "secret")
+            ):
+                result[key] = "[REDACTED]"
+            elif normalized in _RAW_CONTENT_KEYS:
+                text = str(item or "").encode("utf-8")
+                result[str(key) + "_summary"] = {
+                    "bytes": len(text),
+                    "sha256": hashlib.sha256(text).hexdigest(),
+                }
+            else:
+                result[key] = sanitize_output(item)
+        return result
+    if isinstance(value, list):
+        return [sanitize_output(item) for item in value]
+    if isinstance(value, str):
+        return redact(value)
+    return value
+
+
+def write_error(platform: str, operation: str, error: BaseException) -> None:
+    if isinstance(error, FuploadError):
+        detail = sanitize_output(error.as_dict())
+    else:
+        detail = sanitize_output(FuploadError(str(error)).as_dict())
+    payload = {
+        "schema": OUTPUT_SCHEMA,
+        "platform": platform,
+        "operation": operation,
+        "success": False,
+        "error": detail,
+    }
+    print(json.dumps(payload, ensure_ascii=True, sort_keys=True, separators=(",", ":"), allow_nan=False))