fluidattacks_core_auth 12.0.0__tar.gz

fluidattacks_core_auth-12.0.0/.envrc

@@ -0,0 +1 @@
+use_flake ".#python311.devShell"

fluidattacks_core_auth-12.0.0/.gitignore

@@ -0,0 +1,7 @@
+dist-*/
+/.cargo-cache
+target/
+.direnv/
+.venv/
+.vscode/settings.json
+.zed/settings.json

fluidattacks_core_auth-12.0.0/PKG-INFO

@@ -0,0 +1,14 @@
+Metadata-Version: 2.5
+Name: fluidattacks_core_auth
+Version: 12.0.0
+Summary: Fluid Attacks Core Auth Library
+Author-email: Development <development@fluidattacks.com>
+License: MPL-2.0
+Classifier: Development Status :: 1 - Planning
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: >=3.11
+Requires-Dist: fluidattacks-core-rustport>=12.0.0

fluidattacks_core_auth-12.0.0/build/default.nix

@@ -0,0 +1,19 @@
+{ src, workspace_root }:
+{
+  inherit src workspace_root;
+  root_path = "develops/fluidattacks-core/python/auth";
+  module_name = "fluidattacks_core";
+  pypi_token = {
+    method = "oidc";
+  };
+  override = {
+    checks = {
+      basedpyright = false;
+    };
+    configs = {
+      import_linter = ../import-linter.cfg;
+      mypy = ../mypy.ini;
+      ruff = ../ruff.toml;
+    };
+  };
+}

fluidattacks_core_auth-12.0.0/build/filter.nix

@@ -0,0 +1,13 @@
+path_filter: src:
+path_filter {
+  root = src;
+  include = [
+    "fluidattacks_core"
+    "tests"
+    "import-linter.cfg"
+    "mypy.ini"
+    "pyproject.toml"
+    "ruff.toml"
+    "uv.lock"
+  ];
+}

fluidattacks_core_auth-12.0.0/flake.lock

@@ -0,0 +1,303 @@
+{
+  "nodes": {
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1768135262,
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "nix_filter": {
+      "locked": {
+        "lastModified": 1757882181,
+        "narHash": "sha256-+cCxYIh2UNalTz364p+QYmWHs0P+6wDhiWR4jDIKQIU=",
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "rev": "59c44d1909c72441144b93cf0f054be7fe764de5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1758690382,
+        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1758690382,
+        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1761373498,
+        "narHash": "sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_flake": {
+      "locked": {
+        "lastModified": 1778253243,
+        "narHash": "sha256-KkH2QvU6iRLDTGGEwH5jnMqHWj4zMTuHxi1S1zdr01w=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "4fcda7103530b23c5ca44286344912082aad4220",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1761781027,
+        "narHash": "sha256-YDvxPAm2WnxrznRqWwHLjryBGG5Ey1ATEJXrON+TWt8=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "795a980d25301e5133eca37adae37283ec3c8e66",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "python_builder",
+          "pyproject-build-systems",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1758265079,
+        "narHash": "sha256-amLaLNwKSZPShQHzfgmc/9o76dU8xzN0743dWgvYlr8=",
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "rev": "02e9418fd4af638447dca4b17b1280da95527fc9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "pyproject-nix_2": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1762427963,
+        "narHash": "sha256-CkPlAbIQ87wmjy5qHibfzk4DmMGBNqFer+lLfXjpP5M=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "4540ea004e04fcd12dd2738d51383d10f956f7b9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "pyproject-nix_3": {
+      "inputs": {
+        "nixpkgs": [
+          "python_builder",
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1760402624,
+        "narHash": "sha256-jF6UKLs2uGc2rtved8Vrt58oTWjTQoAssuYs/0578Z4=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "84c4ea102127c77058ea1ed7be7300261fafc7d2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "python_builder": {
+      "inputs": {
+        "nix_filter": "nix_filter",
+        "nixpkgs_flake": "nixpkgs_flake",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix_2",
+        "shell-helpers": "shell-helpers",
+        "uv2nix": "uv2nix_2"
+      },
+      "locked": {
+        "dir": "common/utils/python-builder",
+        "lastModified": 1787250154,
+        "narHash": "sha256-K5gcXYdMptekSODkJpTjMez8RtNAT09qM+UhvHK2Jb4=",
+        "ref": "refs/heads/trunk",
+        "rev": "44642cdb6027b0fd00646123248a84858c753eeb",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/fluidattacks/universe"
+      },
+      "original": {
+        "dir": "common/utils/python-builder",
+        "rev": "44642cdb6027b0fd00646123248a84858c753eeb",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/fluidattacks/universe"
+      }
+    },
+    "root": {
+      "inputs": {
+        "python_builder": "python_builder"
+      }
+    },
+    "shell-helpers": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "python_builder",
+          "nixpkgs_flake"
+        ]
+      },
+      "locked": {
+        "dir": "common/utils/shell-helpers",
+        "lastModified": 1787145059,
+        "narHash": "sha256-i5i+qLR9JhcNasrQvzG4S/0AotpZAqTHXa4/68MmvwA=",
+        "ref": "refs/heads/trunk",
+        "rev": "e0d58302690af6f38b7544265e59c625b63df76f",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/fluidattacks/universe"
+      },
+      "original": {
+        "dir": "common/utils/shell-helpers",
+        "rev": "e0d58302690af6f38b7544265e59c625b63df76f",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/fluidattacks/universe"
+      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "python_builder",
+          "pyproject-build-systems",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "python_builder",
+          "pyproject-build-systems",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1758933732,
+        "narHash": "sha256-HAmm1GBS1myZCFuog0DC2ZLaynvZtiUI2Crmo+cdQI0=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "273ce18f913d8559e0d04f820d724308966d7c4d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
+    "uv2nix_2": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3",
+        "pyproject-nix": "pyproject-nix_3"
+      },
+      "locked": {
+        "lastModified": 1761872265,
+        "narHash": "sha256-i25GRgp2vUOebY70L3NTAgkd+Pr1hnn5xM3qHxH0ONU=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "74dfb62871be152ad3673b143b0cc56105a4f3c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

fluidattacks_core_auth-12.0.0/flake.nix

@@ -0,0 +1,29 @@
+{
+  description = "Fluid Attacks Core auth package.";
+
+  inputs = {
+    python_builder = {
+      url = "git+ssh://git@gitlab.com/fluidattacks/universe?shallow=1&rev=44642cdb6027b0fd00646123248a84858c753eeb&dir=common/utils/python-builder";
+    };
+  };
+
+  outputs =
+    { self, ... }@inputs:
+    let
+      build_args =
+        {
+          system,
+          python_version,
+          nixpkgs,
+          builders,
+          scripts,
+        }:
+        import ./build {
+          src = import ./build/filter.nix nixpkgs.nix-filter self;
+          workspace_root = ./.;
+        };
+    in
+    {
+      packages = inputs.python_builder.outputs.build build_args;
+    };
+}

fluidattacks_core_auth-12.0.0/fluidattacks_core/auth/__init__.py

@@ -0,0 +1,14 @@
+"""Credential handling shared by every CLI that talks to the platform.
+
+The decisions live in the shared client: which credential is in force, and what can be
+done when the platform rejects one. What lives here is the one thing that cannot, because
+it depends on the caller's own GraphQL client: recognising the rejection in a response.
+"""
+
+from .recovery import (
+    is_login_required,
+)
+
+__all__ = [
+    "is_login_required",
+]

fluidattacks_core_auth-12.0.0/fluidattacks_core/auth/recovery.py

@@ -0,0 +1,29 @@
+"""Recognise a rejected credential in a GraphQL response."""
+
+import json
+from types import ModuleType
+
+
+def _rustport() -> ModuleType:
+    # Imported on use, not at module load: the extension is built by maturin, so a
+    # source checkout can import this module without it.
+    from fluidattacks_core import rustport  # noqa: PLC0415
+
+    return rustport
+
+
+def is_login_required(errors: object) -> bool:
+    """Whether a GraphQL error payload says the credential was rejected.
+
+    Pass the `errors` list the platform returned, whatever client produced it. The
+    contract lives in the shared client, so nothing here walks the payload or pins the
+    code: this only re-serialises what a Python client already parsed. On a match,
+    `rustport.recover` decides what can be done about it.
+    """
+    if errors is None:
+        return False
+    try:
+        body = json.dumps({"errors": errors})
+    except (TypeError, ValueError):
+        return False
+    return bool(_rustport().says_login_required(body))

fluidattacks_core_auth-12.0.0/import-linter.cfg

@@ -0,0 +1,21 @@
+[importlinter]
+  root_package = fluidattacks_core
+  include_external_packages = True
+
+[importlinter:contract:portion]
+  name = Single Portion
+  type = layers
+  containers =
+    fluidattacks_core
+  exhaustive = true
+  layers =
+    auth
+
+[importlinter:contract:dag]
+  name = Direct Acyclic Graph
+  type = layers
+  containers =
+    fluidattacks_core.auth
+  exhaustive = true
+  layers =
+    recovery

fluidattacks_core_auth-12.0.0/mypy.ini

@@ -0,0 +1,32 @@
+[mypy]
+disallow_any_decorated = True
+disallow_any_expr = False
+disallow_any_explicit = False
+disallow_any_generics = True
+disallow_any_unimported = True
+disallow_incomplete_defs = True
+disallow_subclassing_any = True
+disallow_untyped_calls = True
+disallow_untyped_decorators = True
+disallow_untyped_defs = True
+
+check_untyped_defs = True
+no_implicit_optional = True
+strict = True
+strict_equality = True
+strict_optional = True
+
+warn_redundant_casts = True
+warn_unused_ignores = True
+warn_no_return = True
+warn_return_any = False
+warn_unreachable = True
+
+explicit_package_bases = True
+
+ignore_errors = False
+ignore_missing_imports = False
+allow_untyped_globals = False
+allow_redefinition = False
+local_partial_types = False
+implicit_reexport = False

fluidattacks_core_auth-12.0.0/pyproject.toml

@@ -0,0 +1,40 @@
+[project]
+name = "fluidattacks_core_auth"
+version = "12.0.0"
+description = "Fluid Attacks Core Auth Library"
+authors = [{ name = "Development", email = "development@fluidattacks.com" }]
+license = { text = "MPL-2.0" }
+classifiers = [
+  "Development Status :: 1 - Planning",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Topic :: Software Development :: Libraries",
+]
+requires-python = ">=3.11"
+dependencies = ["fluidattacks-core-rustport>=12.0.0"]
+
+[dependency-groups]
+dev = [
+  "deptry>=0.23.1",
+  "import-linter==2.11",
+  "mypy==1.19.1",
+  "pytest-cov>=7.0.0",
+  "pytest==9.0.3",
+  "ruff==0.15.0",
+]
+
+[tool.deptry]
+known_first_party = ["fluidattacks_core"]
+
+[tool.uv]
+exclude-newer = "7 days"
+exclude-newer-package = { fluidattacks-core-rustport = "2099-01-01T00:00:00Z" }
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["fluidattacks_core"]

fluidattacks_core_auth-12.0.0/ruff.toml

@@ -0,0 +1,45 @@
+cache-dir = ".ruff_cache"
+line-length = 100
+indent-width = 4
+target-version = "py311"
+include = ["fluidattacks_core/**/*.py", "tests/**/*.py"]
+
+[lint]
+preview = true
+explicit-preview-rules = true
+select = ["ALL"]
+extend-select = ["PLR1702", "PLR0916"]
+ignore = [
+  # General omissions. Do not add to this list.
+  "COM812",
+  "D100",
+  "D101",
+  "D102",
+  "D103",
+  "D104",
+  "D107",
+  "D203",
+  "D213",
+  "PLR2004",
+]
+fixable = ["ALL"]
+unfixable = []
+dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"
+
+[lint.per-file-ignores]
+"tests/*.py" = ["S101"]
+
+[format]
+quote-style = "double"
+indent-style = "space"
+skip-magic-trailing-comma = false
+line-ending = "lf"
+
+[lint.mccabe]
+max-complexity = 8
+
+[lint.pylint]
+max-branches = 8
+max-nested-blocks = 4
+max-statements = 25
+max-bool-expr = 5

fluidattacks_core_auth-12.0.0/tests/test_auth_recovery.py

@@ -0,0 +1,55 @@
+import json
+from types import SimpleNamespace
+from typing import Any
+
+import pytest
+
+from fluidattacks_core.auth import recovery
+
+_CODE = "LOGIN_REQUIRED"
+_REJECTED: list[dict[str, Any]] = [{"message": "Login required", "extensions": {"code": _CODE}}]
+
+
+@pytest.fixture(autouse=True)
+def _stub(monkeypatch: pytest.MonkeyPatch) -> None:
+    # Stands in for the shared client, which owns the contract: this module only hands it
+    # a body to look at.
+    def says_login_required(body: str) -> bool:
+        return _CODE in body
+
+    fake = SimpleNamespace(says_login_required=says_login_required)
+    monkeypatch.setattr(recovery, "_rustport", lambda: fake)
+
+
+def test_recognises_a_rejected_credential() -> None:
+    assert recovery.is_login_required(_REJECTED)
+
+
+def test_ignores_any_other_error() -> None:
+    # Only the platform's own code counts, so an unrelated failure is not mistaken for an
+    # auth problem and retried pointlessly.
+    assert not recovery.is_login_required([{"message": "boom"}])
+    assert not recovery.is_login_required([{"extensions": {"code": "OTHER"}}])
+
+
+def test_tolerates_any_payload_shape() -> None:
+    # Whatever client produced it, this must not raise on the way to a verdict.
+    assert not recovery.is_login_required(None)
+    assert not recovery.is_login_required([{"extensions": "not a dict"}])
+    # Something a json encoder cannot take is not a rejection either.
+    assert not recovery.is_login_required([{"extensions": {"code": object()}}])
+
+
+def test_passes_the_payload_to_the_shared_client(monkeypatch: pytest.MonkeyPatch) -> None:
+    # The contract is checked there, not here, so what matters is that it gets the errors.
+    seen: list[str] = []
+
+    def says_login_required(body: str) -> bool:
+        seen.append(body)
+        return False
+
+    monkeypatch.setattr(
+        recovery, "_rustport", lambda: SimpleNamespace(says_login_required=says_login_required)
+    )
+    recovery.is_login_required(_REJECTED)
+    assert json.loads(seen[0]) == {"errors": _REJECTED}