agentseed-mcp 0.3.0

package/server/engine/schema.py

@@ -0,0 +1,193 @@
+"""AgentSeed JSON Schema validator.
+
+Primary path: the industry-standard ``jsonschema`` library (Draft 2020-12
+and friends) — full keyword coverage. Fallback path: a zero-dependency
+subset validator so the plugin still runs in bare environments (the
+``verify-before-code`` skill only relies on subset keywords).
+"""
+
+from __future__ import annotations
+
+import re
+
+try:
+    from jsonschema import Draft202012Validator as _Validator
+    from jsonschema.exceptions import ValidationError as _ValidationError
+    from jsonschema.validators import validator_for as _validator_for
+
+    _HAS_JSONSCHEMA = True
+except ImportError:  # pragma: no cover - exercised via the bare CI job
+    _HAS_JSONSCHEMA = False
+
+
+# Defensive ReDoS bound: schema-supplied regexes are compiled by whichever
+# validator runs; cap their length before compilation anywhere in the tree.
+_MAX_PATTERN_LENGTH = 256
+
+
+def _oversized_pattern(schema: dict) -> str | None:
+    stack = [schema]
+    while stack:
+        node = stack.pop()
+        if isinstance(node, dict):
+            pattern = node.get("pattern")
+            if isinstance(pattern, str) and len(pattern) > _MAX_PATTERN_LENGTH:
+                return pattern
+            stack.extend(node.values())
+        elif isinstance(node, list):
+            stack.extend(node)
+    return None
+
+
+def schema_validate(instance, schema: dict) -> dict:
+    """Validate an instance against a JSON Schema.
+
+    Uses ``jsonschema`` when installed (all Draft 2020-12 keywords, boolean
+    schemas); otherwise falls back to the built-in subset validator
+    (type incl. type arrays / enum / const / minLength / maxLength /
+    pattern / minItems / maxItems / items / properties / required /
+    additionalProperties).
+
+    Returns:
+        {"valid": bool, "errors": [human-readable messages],
+         "validator": "jsonschema" | "builtin-subset"}
+    """
+    if not isinstance(schema, dict):
+        return {
+            "valid": False,
+            "errors": ["schema must be a JSON object"],
+            "validator": "builtin-subset" if not _HAS_JSONSCHEMA else "jsonschema",
+        }
+
+    bad_pattern = _oversized_pattern(schema)
+    if bad_pattern is not None:
+        return {
+            "valid": False,
+            "errors": [
+                f"schema pattern rejected: longer than {_MAX_PATTERN_LENGTH} "
+                "chars (defensive ReDoS bound)"
+            ],
+            "validator": "builtin-subset" if not _HAS_JSONSCHEMA else "jsonschema",
+        }
+
+    if _HAS_JSONSCHEMA:
+        try:
+            cls = _validator_for(schema, default=_Validator)
+            validator = cls(schema)
+            errors = sorted(validator.iter_errors(instance), key=lambda e: e.path)
+            return {
+                "valid": not errors,
+                "errors": [e.message for e in errors],
+                "validator": "jsonschema",
+            }
+        except _ValidationError as exc:
+            return {"valid": False, "errors": [exc.message], "validator": "jsonschema"}
+        except Exception:  # noqa: BLE001
+            # Draft 2020-12 rejects some valid draft-07 schemas (e.g. tuple
+            # "items" arrays) — sometimes as SchemaError, sometimes as raw
+            # AttributeErrors mid-walk depending on library version. Degrade
+            # to the builtin subset (which understands those keywords) instead
+            # of reporting an opaque crash.
+            pass
+
+    errors: list[str] = []
+    try:
+        _validate_subset(instance, schema, "$", errors)
+    except Exception as exc:  # noqa: BLE001
+        return {
+            "valid": False,
+            "errors": [f"validation crashed: {exc}"],
+            "validator": "builtin-subset",
+        }
+    return {"valid": len(errors) == 0, "errors": errors, "validator": "builtin-subset"}
+
+
+# ---------------------------------------------------------------------------
+# Zero-dependency fallback (subset)
+# ---------------------------------------------------------------------------
+
+
+def _json_equal(a, b) -> bool:
+    """JSON-Schema equality: booleans never equal numbers (True != 1)."""
+    if isinstance(a, bool) or isinstance(b, bool):
+        return isinstance(a, bool) and isinstance(b, bool) and a is b
+    return a == b
+
+
+def _schema_type_ok(value, expected: str) -> bool:
+    if expected == "object":
+        return isinstance(value, dict)
+    if expected == "array":
+        return isinstance(value, list)
+    if expected == "string":
+        return isinstance(value, str)
+    if expected == "integer":
+        return isinstance(value, int) and not isinstance(value, bool)
+    if expected == "number":
+        return isinstance(value, (int, float)) and not isinstance(value, bool)
+    if expected == "boolean":
+        return isinstance(value, bool)
+    if expected == "null":
+        return value is None
+    return True
+
+
+def _validate_subset(instance, schema: dict, path: str, errors: list[str]) -> None:
+    type_spec = schema.get("type")
+    if type_spec is not None:
+        if isinstance(type_spec, list):
+            if not any(_schema_type_ok(instance, t) for t in type_spec):
+                errors.append(
+                    f"{path}: expected type in {type_spec}, got {type(instance).__name__}"
+                )
+                return
+        elif not _schema_type_ok(instance, type_spec):
+            errors.append(f"{path}: expected type {type_spec}, got {type(instance).__name__}")
+            return
+    if "enum" in schema and not any(_json_equal(instance, v) for v in schema["enum"]):
+        errors.append(f"{path}: value not in enum {schema['enum']}")
+    if "const" in schema and not _json_equal(instance, schema["const"]):
+        errors.append(f"{path}: expected const {schema['const']!r}")
+    if isinstance(instance, str):
+        if "minLength" in schema and len(instance) < schema["minLength"]:
+            errors.append(f"{path}: shorter than minLength {schema['minLength']}")
+        if "maxLength" in schema and len(instance) > schema["maxLength"]:
+            errors.append(f"{path}: longer than maxLength {schema['maxLength']}")
+        if "pattern" in schema and not re.search(schema["pattern"], instance):
+            errors.append(f"{path}: does not match pattern {schema['pattern']}")
+    if isinstance(instance, list):
+        if "minItems" in schema and len(instance) < schema["minItems"]:
+            errors.append(f"{path}: fewer than minItems {schema['minItems']}")
+        if "maxItems" in schema and len(instance) > schema["maxItems"]:
+            errors.append(f"{path}: more than maxItems {schema['maxItems']}")
+        items = schema.get("items")
+        if isinstance(items, list):
+            # draft-07 tuple form: positional schemas; extras governed by
+            # additionalItems (default: allowed).
+            for idx, sub in enumerate(items):
+                if idx < len(instance):
+                    _validate_subset(instance[idx], sub, f"{path}[{idx}]", errors)
+            extra = len(instance) - len(items)
+            if extra > 0:
+                addl = schema.get("additionalItems")
+                if addl is False:
+                    errors.append(f"{path}: {extra} additional item(s) not allowed")
+                elif isinstance(addl, dict):
+                    for j in range(len(items), len(instance)):
+                        _validate_subset(instance[j], addl, f"{path}[{j}]", errors)
+        elif "items" in schema:
+            for idx, item in enumerate(instance):
+                _validate_subset(item, schema["items"], f"{path}[{idx}]", errors)
+    if isinstance(instance, dict):
+        if "properties" in schema:
+            for prop, subschema in schema["properties"].items():
+                if prop in instance:
+                    _validate_subset(instance[prop], subschema, f"{path}.{prop}", errors)
+        for req in schema.get("required", []):
+            if req not in instance:
+                errors.append(f"{path}: missing required property '{req}'")
+        if schema.get("additionalProperties") is False:
+            allowed = schema.get("properties", {})
+            for key in instance:
+                if key not in allowed:
+                    errors.append(f"{path}: unexpected property '{key}'")