chatenv 0.2.5__tar.gz → 0.2.6__tar.gz

{chatenv-0.2.5/src/chatenv.egg-info → chatenv-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chatenv
-Version: 0.2.5
+Version: 0.2.6
 Summary: ChatArch typed environment profile manager
 Author-email: rexwzh <1073853456@qq.com>
 License-Expression: MIT

{chatenv-0.2.5 → chatenv-0.2.6}/src/chatenv/__init__.py

@@ -22,4 +22,4 @@ __all__ = [
     "__version__",
 ]
 
-__version__ = "0.2.5"
+__version__ = "0.2.6"

{chatenv-0.2.5 → chatenv-0.2.6}/src/chatenv/cli.py

@@ -659,15 +659,18 @@ def token_refresh(
 ):
     """Write refreshed generic runtime token JSON for SERVICE/PROFILE."""
     values = _read_token_values(read_stdin=read_stdin, value_file=value_file)
-    payload = _token_store(ctx).write(
-        service,
-        profile,
-        values=values,
-        token_type=token_type,
-        summary=_parse_summary(summary),
-        expires_at=expires_at,
-        source="refresh",
-    )
+    try:
+        payload = _token_store(ctx).write(
+            service,
+            profile,
+            values=values,
+            token_type=token_type,
+            summary=_parse_summary(summary),
+            expires_at=expires_at,
+            source="refresh",
+        )
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
     if output_format == "json":
         _echo_json(payload)
     else:
@@ -681,7 +684,10 @@ def token_refresh(
 @click.pass_context
 def token_status(ctx: click.Context, service: str, profile: str, output_format: str):
     """Show safe runtime token metadata for SERVICE/PROFILE."""
-    payload = _token_store(ctx).status(service, profile)
+    try:
+        payload = _token_store(ctx).status(service, profile)
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
     if output_format == "json":
         _echo_json(payload)
     else:
@@ -721,7 +727,10 @@ def token_list(ctx: click.Context, service: str | None, output_format: str):
 @click.pass_context
 def token_clear(ctx: click.Context, service: str, profile: str, execute: bool, output_format: str):
     """Clear a generic runtime token file for SERVICE/PROFILE."""
-    payload = _token_store(ctx).clear(service, profile, execute=execute)
+    try:
+        payload = _token_store(ctx).clear(service, profile, execute=execute)
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
     if output_format == "json":
         _echo_json(payload)
     else:

{chatenv-0.2.5 → chatenv-0.2.6}/src/chatenv/tokens.py

@@ -36,12 +36,32 @@ def _safe_segment(value: str, *, default: str) -> str:
     return cleaned or default
 
 
+def _strict_token_profile_segment(value: str | None) -> str:
+    if value is None:
+        return DEFAULT_PROFILE
+    raw = str(value)
+    stripped = raw.strip()
+    if not stripped:
+        raise ValueError("token profile must not be empty")
+    if stripped != raw:
+        raise ValueError("token profile must not contain leading or trailing whitespace")
+    if stripped in {".", ".."}:
+        raise ValueError("token profile must not be '.' or '..'")
+    if "/" in stripped or "\\" in stripped:
+        raise ValueError("token profile must be a single path segment")
+    if re.search(r"[^A-Za-z0-9_.-]", stripped):
+        raise ValueError("token profile may contain only letters, numbers, dot, underscore, and hyphen")
+    if stripped.strip(".-") != stripped:
+        raise ValueError("token profile must not start or end with dot or hyphen")
+    return stripped
+
+
 def normalize_service_name(value: str) -> str:
     return _safe_segment(value, default="Service")
 
 
 def normalize_token_profile(value: str | None) -> str:
-    return _safe_segment(value or DEFAULT_PROFILE, default=DEFAULT_PROFILE)
+    return _strict_token_profile_segment(value)
 
 
 def _coerce_mapping(value: dict[str, Any] | None) -> dict[str, Any]:

{chatenv-0.2.5 → chatenv-0.2.6/src/chatenv.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chatenv
-Version: 0.2.5
+Version: 0.2.6
 Summary: ChatArch typed environment profile manager
 Author-email: rexwzh <1073853456@qq.com>
 License-Expression: MIT

{chatenv-0.2.5 → chatenv-0.2.6}/tests/test_chatenv_core.py

@@ -2,6 +2,7 @@ import json
 from pathlib import Path
 from types import SimpleNamespace
 
+import pytest
 from click.testing import CliRunner
 import chatenv.discovery as discovery_module
 import chatenv.cli as cli_module
@@ -294,6 +295,48 @@ def test_token_store_list_and_clear_are_generic(tmp_path):
     assert store.status("PyPI", "RexWzh")["token_present"] is False
 
 
+def test_token_store_rejects_aliasing_profile_segments(tmp_path):
+    from chatenv.tokens import TokenStore, normalize_token_profile
+
+    store = TokenStore(home=tmp_path / "arch")
+    store.write("PyPI", "RexWzh", values={"session": "opaque-value"}, token_type="web_session")
+
+    invalid_profiles = [
+        "",
+        " ",
+        ".",
+        "..",
+        "../RexWzh",
+        "RexWzh/other",
+        "RexWzh\\other",
+        " RexWzh",
+        "RexWzh ",
+        ".RexWzh",
+        "RexWzh.",
+        "Rex Wzh",
+    ]
+    for profile in invalid_profiles:
+        with pytest.raises(ValueError):
+            normalize_token_profile(profile)
+        with pytest.raises(ValueError):
+            store.status("PyPI", profile)
+
+    assert store.status("PyPI", "RexWzh")["token_present"] is True
+    assert store.status("PyPI", None)["profile"] == "default"
+
+
+def test_token_cli_reports_invalid_profile_without_aliasing(tmp_path):
+    runner = CliRunner()
+    result = runner.invoke(
+        cli,
+        ["--home", str(tmp_path / "arch"), "token", "status", "PyPI", "../RexWzh", "--format", "json"],
+    )
+
+    assert result.exit_code != 0
+    assert "single path segment" in result.output
+    assert "Traceback" not in result.output
+
+
 def test_store_profile_roundtrip(tmp_path):
     store = EnvStore(tmp_path / "envs")
     UnitConfig.load_from_sources(env_values={"UNIT_KEY": "secret", "UNIT_VALUE": "x"})

{chatenv-0.2.5 → chatenv-0.2.6}/tests/test_version.py

@@ -4,7 +4,7 @@ from click.testing import CliRunner
 
 
 def test_version_present():
-    assert __version__ == "0.2.5"
+    assert __version__ == "0.2.6"
 
 
 def test_cli_version_option():