apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/core/repo.py

@@ -0,0 +1,280 @@
+"""Git repository info detection for registration."""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import re
+import subprocess
+from pathlib import Path
+from typing import Any
+from urllib.parse import unquote, urlparse
+
+logger = logging.getLogger(__name__)
+
+
+def _run_git(project_root: Path, *args: str) -> str | None:
+    """Run a git command and return stdout, or None on failure."""
+    try:
+        result = subprocess.run(
+            ["git", *args],
+            cwd=project_root,
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        if result.returncode == 0 and result.stdout:
+            return result.stdout.strip()
+        return None
+    except (subprocess.TimeoutExpired, FileNotFoundError, subprocess.SubprocessError):
+        return None
+
+
+def _infer_scm_provider(repo_url: str) -> str:
+    """Infer SCM provider from URL."""
+    url_lower = repo_url.lower()
+    if "github.com" in url_lower:
+        return "github"
+    if "gitlab.com" in url_lower or "gitlab." in url_lower:
+        return "gitlab"
+    if "bitbucket.org" in url_lower or "bitbucket." in url_lower:
+        return "bitbucket"
+    if "azure" in url_lower or "dev.azure.com" in url_lower or "visualstudio.com" in url_lower:
+        return "azure"
+    return "git"
+
+
+def _sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+_GIT_AT_HOST_PATH = re.compile(
+    r"^git@(?P<host>[^:/]+)[:/](?P<path>.+)$",
+    re.IGNORECASE,
+)
+
+
+def _strip_git_suffix(segment: str) -> str:
+    s = segment.strip().rstrip("/")
+    if s.lower().endswith(".git"):
+        return s[:-4]
+    return s
+
+
+def _parse_github_host_path(host: str, path: str) -> str | None:
+    if "github.com" not in host.lower():
+        return None
+    segments = [p for p in path.split("/") if p]
+    if len(segments) < 2:
+        return None
+    org, repo = segments[0], _strip_git_suffix(segments[1])
+    if not org or not repo:
+        return None
+    return f"github:{org.lower()}/{repo.lower()}"
+
+
+def _parse_gitlab_host_path(host: str, path: str) -> str | None:
+    if "gitlab" not in host.lower():
+        return None
+    segments = [p for p in path.split("/") if p]
+    if len(segments) < 2:
+        return None
+    slug = "/".join(_strip_git_suffix(s).lower() for s in segments)
+    return f"gitlab:{slug}"
+
+
+def _parse_bitbucket_host_path(host: str, path: str) -> str | None:
+    if "bitbucket" not in host.lower():
+        return None
+    segments = [p for p in path.split("/") if p]
+    if len(segments) < 2:
+        return None
+    ws, repo = segments[0], _strip_git_suffix(segments[1])
+    if not ws or not repo:
+        return None
+    return f"bitbucket:{ws.lower()}/{repo.lower()}"
+
+
+def _parse_azure_https(host: str, path: str) -> str | None:
+    path = path.strip("/")
+    if not path:
+        return None
+    parts = [p for p in path.split("/") if p]
+    hl = host.lower()
+    if "dev.azure.com" in hl:
+        # dev.azure.com/Org/Project/_git/Repo
+        try:
+            idx = parts.index("_git")
+        except ValueError:
+            return None
+        if idx < 2 or idx + 1 >= len(parts):
+            return None
+        org, project = parts[0], parts[1]
+        repo = _strip_git_suffix(parts[idx + 1])
+        return f"azure:{org.lower()}/{project.lower()}/{repo.lower()}"
+    if "visualstudio.com" in hl:
+        try:
+            idx = parts.index("_git")
+        except ValueError:
+            return None
+        if idx < 1 or idx + 1 >= len(parts):
+            return None
+        namespace = "/".join(parts[:idx]).lower()
+        repo = _strip_git_suffix(parts[idx + 1])
+        return f"azure:{namespace}/{repo.lower()}"
+    return None
+
+
+def _parse_azure_ssh(remote: str) -> str | None:
+    m = re.match(
+        r"^git@ssh\.dev\.azure\.com:v3/(?P<org>[^/]+)/(?P<project>[^/]+)/(?P<repo>.+)$",
+        remote.strip(),
+        re.IGNORECASE,
+    )
+    if not m:
+        return None
+    org, project, repo = m.group("org"), m.group("project"), _strip_git_suffix(m.group("repo"))
+    return f"azure:{org.lower()}/{project.lower()}/{repo.lower()}"
+
+
+def _parse_scp_style(remote: str) -> str | None:
+    m = _GIT_AT_HOST_PATH.match(remote.strip())
+    if not m:
+        return None
+    host = m.group("host").lower()
+    raw_path = m.group("path").strip()
+    path = raw_path.replace("\\", "/")
+    if path.startswith("/"):
+        path = path.lstrip("/")
+    path = unquote(path)
+    segments = [p for p in path.split("/") if p]
+    if not segments:
+        return None
+
+    if "github.com" in host:
+        if len(segments) < 2:
+            return None
+        org, repo = segments[0], _strip_git_suffix(segments[1])
+        return f"github:{org.lower()}/{repo.lower()}"
+
+    if "gitlab" in host:
+        slug = "/".join(_strip_git_suffix(s).lower() for s in segments)
+        return f"gitlab:{slug}"
+
+    if "bitbucket" in host:
+        if len(segments) < 2:
+            return None
+        ws, repo = segments[0], _strip_git_suffix(segments[1])
+        return f"bitbucket:{ws.lower()}/{repo.lower()}"
+
+    if (
+        ("ssh.dev.azure.com" in host or "vs-ssh.visualstudio.com" in host)
+        and len(segments) >= 4
+        and segments[0].lower() == "v3"
+    ):
+        org, project, repo = segments[1], segments[2], _strip_git_suffix(segments[3])
+        return f"azure:{org.lower()}/{project.lower()}/{repo.lower()}"
+
+    return None
+
+
+def _parse_remote_to_canonical(remote_url: str) -> str | None:
+    u = remote_url.strip()
+    if not u:
+        return None
+
+    azure_ssh = _parse_azure_ssh(u)
+    if azure_ssh:
+        return azure_ssh
+
+    scp = _parse_scp_style(u)
+    if scp:
+        return scp
+
+    parsed = urlparse(u)
+    scheme = (parsed.scheme or "").lower()
+    if scheme not in {"http", "https", "ssh"}:
+        return None
+    host = (parsed.hostname or "").lower()
+    path = unquote((parsed.path or "").strip("/"))
+    if not host or not path:
+        return None
+
+    for fn in (
+        _parse_github_host_path,
+        _parse_gitlab_host_path,
+        _parse_bitbucket_host_path,
+        _parse_azure_https,
+    ):
+        hit = fn(host, path)
+        if hit:
+            return hit
+    return None
+
+
+def derive_canonical_repo_id(remote_url: str, project_root: Path) -> str:
+    """
+    Stable repository id for applicationsservice surface idempotency.
+
+    Preferred: ``{provider}:{namespace/repo}`` (lowercase, no ``.git`` suffix), e.g. ``github:apisec/api``.
+    If the remote cannot be parsed but ``remote_url`` is non-empty: ``git:url-<sha256(normalized_url)>``.
+    If there is no remote URL: ``local:<sha256(absolute_project_root)>``.
+    """
+    root = project_root.resolve()
+    ru = (remote_url or "").strip()
+    parsed = _parse_remote_to_canonical(ru) if ru else None
+    if parsed:
+        return parsed
+    if ru:
+        norm = ru.lower().rstrip("/")
+        if norm.endswith(".git"):
+            norm = norm[:-4]
+        digest = _sha256_hex(norm.encode("utf-8"))
+        return f"git:url-{digest}"
+    return f"local:{_sha256_hex(str(root).encode('utf-8'))}"
+
+
+def detect_repo_info(project_root: Path) -> dict[str, Any]:
+    """
+    Detect git repository info from the project root.
+
+    Falls back to sensible defaults when git is not available or not a repo.
+    Returns a dict with keys: repo_name, repo_url, branch, commit_sha, scm_provider, canonical_repo_id.
+    """
+    root = project_root.resolve()
+    repo_name = root.name
+    repo_url = f"local://{root}"
+    branch = "main"
+    commit_sha = _sha256_hex(str(root).encode("utf-8"))[:12]
+    scm_provider = "local"
+
+    remote_url = _run_git(root, "config", "--get", "remote.origin.url")
+    if remote_url:
+        repo_url = remote_url
+        # Extract repo name from URL (e.g., git@github.com:org/repo.git -> repo)
+        if "/" in repo_url:
+            name_part = repo_url.rstrip("/").rsplit("/", 1)[-1]
+            if name_part.endswith(".git"):
+                name_part = name_part[:-4]
+            if name_part:
+                repo_name = name_part
+        scm_provider = _infer_scm_provider(repo_url)
+
+    branch_out = _run_git(root, "rev-parse", "--abbrev-ref", "HEAD")
+    if branch_out:
+        branch = branch_out
+
+    sha_out = _run_git(root, "rev-parse", "HEAD")
+    if sha_out:
+        commit_sha = sha_out
+
+    canonical_repo_id = derive_canonical_repo_id(repo_url, root)
+
+    return {
+        "repo_name": repo_name,
+        "repo_url": repo_url,
+        "branch": branch,
+        "commit_sha": commit_sha,
+        "scm_provider": scm_provider,
+        "canonical_repo_id": canonical_repo_id,
+    }

apisec_code_bolt/core/state.py

@@ -0,0 +1,59 @@
+"""Repository state file management for Nth-run routing.
+
+Manages the `apisec-code-bolt/state.yaml` file in the repository root.
+This file contains only the applicationId — written once after first registration.
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+logger = logging.getLogger(__name__)
+
+STATE_DIR_NAME = "apisec-code-bolt"
+STATE_FILE_NAME = "state.yaml"
+
+
+@dataclass
+class RepoState:
+    """Minimal state persisted in the repository."""
+
+    application_id: str
+
+
+def state_file_path(project_root: Path) -> Path:
+    """Return the path to the state file for the given project root."""
+    return project_root / STATE_DIR_NAME / STATE_FILE_NAME
+
+
+def read_state(project_root: Path) -> RepoState | None:
+    """Read state from the repository. Returns None if no state file exists."""
+    path = state_file_path(project_root)
+    if not path.exists():
+        return None
+    try:
+        with open(path) as f:
+            data: dict[str, Any] = yaml.safe_load(f) or {}
+        app_id = data.get("applicationId", "")
+        if not app_id:
+            return None
+        return RepoState(application_id=app_id)
+    except Exception:
+        logger.warning("Failed to read state file at %s", path, exc_info=True)
+        return None
+
+
+def write_state(project_root: Path, state: RepoState) -> Path:
+    """Write state to the repository. Creates directory if needed."""
+    path = state_file_path(project_root)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    data = {"applicationId": state.application_id}
+    with open(path, "w") as f:
+        yaml.safe_dump(data, f, default_flow_style=False)
+    logger.info("State file written: %s", path)
+    return path