admina-core 0.13.2__tar.gz → 0.14.1__tar.gz

{admina_core-0.13.2 → admina_core-0.14.1}/Cargo.lock

@@ -4,7 +4,7 @@ version = 4
 
 [[package]]
 name = "admina_core"
-version = "0.13.2"
+version = "0.14.1"
 dependencies = [
  "chrono",
  "hex",

{admina_core-0.13.2 → admina_core-0.14.1}/Cargo.toml

@@ -15,7 +15,7 @@
 
 [package]
 name = "admina_core"
-version = "0.13.2"
+version = "0.14.1"
 edition = "2021"
 description = "Admina governance engines — Rust core with Python bindings"
 license = "Apache-2.0"

{admina_core-0.13.2 → admina_core-0.14.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: admina-core
-Version: 0.13.2
+Version: 0.14.1
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: POSIX :: Linux
@@ -46,7 +46,7 @@ pip install admina-core
 
 The Python framework auto-detects the Rust engine at runtime and falls
 back to a pure-Python implementation if `admina-core` is not installed,
-so `admina-framework` always works on its own.
+so `admina` always works on its own.
 
 ## License
 

{admina_core-0.13.2 → admina_core-0.14.1}/README.md

@@ -17,7 +17,7 @@ pip install admina-core
 
 The Python framework auto-detects the Rust engine at runtime and falls
 back to a pure-Python implementation if `admina-core` is not installed,
-so `admina-framework` always works on its own.
+so `admina` always works on its own.
 
 ## License
 

{admina_core-0.13.2 → admina_core-0.14.1}/pyproject.toml

@@ -19,7 +19,7 @@ build-backend = "maturin"
 
 [project]
 name = "admina-core"
-version = "0.13.2"
+version = "0.14.1"
 description = "Admina governance engines — Rust core with Python bindings (firewall, PII, loop breaker, hash chain)"
 readme = "README.md"
 requires-python = ">=3.11"

{admina_core-0.13.2 → admina_core-0.14.1}/src/pii.rs

@@ -13,13 +13,84 @@
 // limitations under the License.
 
 use pyo3::prelude::*;
-use regex::Regex;
+use regex::{Captures, Regex};
 use std::sync::OnceLock;
 
 struct PiiPattern {
     name: &'static str,
     regex: Regex,
     mask: &'static str,
+    /// Whether a match is reported, given the scanned text: the checks the
+    /// regex cannot express (a checksum, the characters around the match).
+    accept: fn(&str, &Captures) -> bool,
+}
+
+fn any_match(_text: &str, _caps: &Captures) -> bool {
+    true
+}
+
+/// A card number is reported only when its digits pass the Luhn checksum,
+/// as in the Python PII redactor.
+fn luhn_valid(_text: &str, caps: &Captures) -> bool {
+    let digits: Vec<u32> = caps[0].chars().filter_map(|c| c.to_digit(10)).collect();
+    let sum: u32 = digits
+        .iter()
+        .rev()
+        .enumerate()
+        .map(|(i, &d)| {
+            if !i.is_multiple_of(2) {
+                let x = d * 2;
+                if x > 9 {
+                    x - 9
+                } else {
+                    x
+                }
+            } else {
+                d
+            }
+        })
+        .sum();
+    !digits.is_empty() && sum.is_multiple_of(10)
+}
+
+fn is_word(c: char) -> bool {
+    c.is_alphanumeric() || c == '_'
+}
+
+/// The boundaries of the phone patterns of the Python PII redactor, which
+/// the regex crate cannot express as lookarounds: a North American number
+/// is not preceded or followed by a digit; an Italian number is not
+/// preceded by a word character or "+", nor followed by a word character.
+fn phone_boundaries(text: &str, caps: &Captures) -> bool {
+    let whole = caps.get(0).unwrap();
+    let before = text[..whole.start()].chars().next_back();
+    let after = text[whole.end()..].chars().next();
+    if caps.name("us").is_some() {
+        !before.is_some_and(|c| c.is_ascii_digit()) && !after.is_some_and(|c| c.is_ascii_digit())
+    } else {
+        !before.is_some_and(|c| is_word(c) || c == '+') && !after.is_some_and(is_word)
+    }
+}
+
+// Phone numbers, as in the Python PII redactor: North American format
+// (3-3-4 digits, optional country code), and Italian numbers, with +39 or
+// 0039 or without: mobile numbers (3 and 8 or 9 more digits, compact or in
+// groups) and landline numbers (an area code 02, 06 or 0 followed by 2 or 3
+// digits, then 5 to 8 digits, or 2 or 3 groups of 2 to 4 digits separated
+// by spaces; without +39 a space, "/" or "-" follows the area code).
+const US_PHONE: &str = r"(?:\+\d{1,3}[\s.\-]?)?\(?\d{3}\)?[\s.\-]\d{3}[\s.\-]\d{4}";
+const IT_MOBILE: &str = r"3[1-9]\d(?:[ \-]?\d{6,7}|[ \-]\d{3}[ \-]\d{3,4})";
+const IT_AREA: &str = r"0(?:[26]|[1-9]\d{1,2})";
+const IT_SUBSCRIBER: &str = r"(?:\d{5,8}|\d{2,4} \d{2,4}(?: \d{2,4})?)";
+
+fn phone_regex() -> Regex {
+    let italian = format!(
+        "(?:(?:\\+|00)39[ .\\-]?(?:{m}|{a}[ ./\\-]?{s})|{m}|{a}[ /\\-]{s})",
+        m = IT_MOBILE,
+        a = IT_AREA,
+        s = IT_SUBSCRIBER
+    );
+    Regex::new(&format!("(?P<us>{US_PHONE})|(?P<it>{italian})")).unwrap()
 }
 
 static PII_PATTERNS: OnceLock<Vec<PiiPattern>> = OnceLock::new();
@@ -31,29 +102,31 @@ fn get_pii_patterns() -> &'static Vec<PiiPattern> {
                 name: "email",
                 regex: Regex::new(r"[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}").unwrap(),
                 mask: "[EMAIL_REDACTED]",
+                accept: any_match,
             },
             PiiPattern {
                 name: "credit_card",
                 regex: Regex::new(r"\b(?:\d{4}[\s\-]?){3}\d{4}\b").unwrap(),
                 mask: "[CC_REDACTED]",
+                accept: luhn_valid,
             },
             PiiPattern {
                 name: "ssn",
                 regex: Regex::new(r"\b\d{3}-\d{2}-\d{4}\b").unwrap(),
                 mask: "[SSN_REDACTED]",
+                accept: any_match,
             },
             PiiPattern {
                 name: "phone",
-                regex: Regex::new(
-                    r"(?:\+?\d{1,3}[\s\-.]?)?\(?\d{2,4}\)?[\s\-.]?\d{3,4}[\s\-.]?\d{3,4}\b",
-                )
-                .unwrap(),
+                regex: phone_regex(),
                 mask: "[PHONE_REDACTED]",
+                accept: phone_boundaries,
             },
             PiiPattern {
                 name: "iban",
                 regex: Regex::new(r"\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}([A-Z0-9]?){0,16}\b").unwrap(),
                 mask: "[IBAN_REDACTED]",
+                accept: any_match,
             },
             PiiPattern {
                 name: "ip_address",
@@ -62,6 +135,7 @@ fn get_pii_patterns() -> &'static Vec<PiiPattern> {
                 )
                 .unwrap(),
                 mask: "[IP_REDACTED]",
+                accept: any_match,
             },
         ]
     })
@@ -123,10 +197,18 @@ impl RustPiiScanner {
         let mut details: Vec<(String, usize)> = Vec::new();
 
         for pattern in patterns.iter() {
-            let matches: Vec<_> = pattern.regex.find_iter(&result).collect();
-            let match_count = matches.len();
+            let current = result.clone();
+            let mut match_count: usize = 0;
+            let replaced = pattern.regex.replace_all(&current, |caps: &Captures| {
+                if (pattern.accept)(&current, caps) {
+                    match_count += 1;
+                    pattern.mask.to_string()
+                } else {
+                    caps[0].to_string()
+                }
+            });
             if match_count > 0 {
-                result = pattern.regex.replace_all(&result, pattern.mask).to_string();
+                result = replaced.into_owned();
                 count += match_count;
                 categories.push(pattern.name.to_string());
                 details.push((pattern.name.to_string(), match_count));
@@ -151,7 +233,11 @@ impl RustPiiScanner {
         let mut details: Vec<(String, usize)> = Vec::new();
 
         for pattern in patterns.iter() {
-            let match_count = pattern.regex.find_iter(text).count();
+            let match_count = pattern
+                .regex
+                .captures_iter(text)
+                .filter(|caps| (pattern.accept)(text, caps))
+                .count();
             if match_count > 0 {
                 count += match_count;
                 categories.push(pattern.name.to_string());
@@ -203,8 +289,50 @@ mod tests {
     #[test]
     fn test_credit_card_redaction() {
         let mut s = RustPiiScanner::new();
-        let r = s.redact("Card: 4111-2222-3333-4444");
-        assert!(!r.redacted_text.contains("4111-2222-3333-4444"));
+        let r = s.redact("Card: 4111-1111-1111-1111");
+        assert!(!r.redacted_text.contains("4111-1111-1111-1111"));
+        assert!(r.categories.contains(&"credit_card".to_string()));
+    }
+
+    #[test]
+    fn test_card_number_failing_luhn_is_not_a_card() {
+        let mut s = RustPiiScanner::new();
+        let r = s.redact("order 4111 1111 1111 1112 was cancelled");
+        assert!(r.redacted_text.contains("4111 1111 1111 1112"));
+        assert_eq!(r.count, 0);
+        assert_eq!(s.scan("order 4111 1111 1111 1112").count, 0);
+    }
+
+    #[test]
+    fn test_phone_numbers_are_redacted() {
+        let mut s = RustPiiScanner::new();
+        for text in [
+            "call 555-123-4567 today",
+            "call +1 555-123-4567 today",
+            "chiama il 333 1234567",
+            "chiama +39 06 1234 5678",
+            "ufficio 02/12345678",
+        ] {
+            let r = s.redact(text);
+            assert!(
+                r.redacted_text.contains("[PHONE_REDACTED]"),
+                "{text}: {}",
+                r.redacted_text
+            );
+        }
+    }
+
+    #[test]
+    fn test_codes_that_are_not_phone_numbers() {
+        let s = RustPiiScanner::new();
+        for text in [
+            "ISBN 978-3-16-148410-0 is out of print",
+            "build 20261008.1 passed all 4554 checks",
+            "upgrade to version 2.14.3",
+            "id1234567890",
+        ] {
+            assert_eq!(s.scan(text).count, 0, "{text}");
+        }
     }
 
     #[test]

{admina_core-0.13.2 → admina_core-0.14.1}/uv.lock

@@ -4,5 +4,5 @@ requires-python = ">=3.11"
 
 [[package]]
 name = "admina-core"
-version = "0.13.2"
+version = "0.14.1"
 source = { editable = "." }