gdp-rs 0.1.0__tar.gz

gdp_rs-0.1.0/Cargo.lock

@@ -0,0 +1,137 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "gdp"
+version = "0.1.0"
+
+[[package]]
+name = "gdp-python"
+version = "0.1.0"
+dependencies = [
+ "gdp",
+ "pyo3",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.29.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "700d18fa267b73b9b521fd7e13580e2f446916f176cacee1ab63fcc8191f1655"
+dependencies = [
+ "libc",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.29.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b3fc0c4d08f6bb10e71fe39dfb9e2f59c6eb6854e22ec8092f50c69a4499adb"
+dependencies = [
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.29.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfc0b8e19df29aad7086cf977bb0c2a2f143e30567eb113e9cf72b62ca698330"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.29.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6100e8a4b5eba53afaa5ed078364851a0b2499c553a44c31026b929049b49dc6"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.29.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6143877a16e82b5a727b7127ff4cd86858a24a28d745d72f43e6f227c7b1bdb3"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"

gdp_rs-0.1.0/Cargo.toml

@@ -0,0 +1,34 @@
+[workspace]
+resolver = "3"
+members = ["crates/gdp", "bindings/python"]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.90"
+license = "MIT"
+repository = "https://github.com/cloudthinker-ai/proofbound"
+
+[workspace.lints.rust]
+unsafe_code = "forbid"
+unused_crate_dependencies = "deny"
+
+[workspace.lints.clippy]
+allow_attributes_without_reason = "deny"
+dbg_macro = "deny"
+expect_used = "deny"
+mem_forget = "deny"
+panic = "deny"
+todo = "deny"
+undocumented_unsafe_blocks = "deny"
+unimplemented = "deny"
+unwrap_used = "deny"
+
+[profile.dev]
+opt-level = 0
+
+[profile.release]
+opt-level = 3
+lto = true
+codegen-units = 1
+panic = "unwind"

gdp_rs-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Guillermo Rauch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

gdp_rs-0.1.0/PKG-INFO

@@ -0,0 +1,78 @@
+Metadata-Version: 2.4
+Name: gdp-rs
+Version: 0.1.0
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Rust
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Security
+Requires-Dist: pytest>=8,<10 ; extra == 'test'
+Requires-Dist: ruff>=0.11,<1 ; extra == 'test'
+Requires-Dist: mypy>=1.15,<2 ; extra == 'test'
+Requires-Dist: pyrefly>=1.3.1,<2 ; extra == 'test'
+Requires-Dist: fastapi>=0.141.1,<1 ; extra == 'test'
+Requires-Dist: httpx2>=2.13.1,<3 ; extra == 'test'
+Provides-Extra: test
+License-File: LICENSE
+Summary: Rust-backed proof contracts for Python authorization boundaries
+Keywords: authorization,proof-contracts,rust,gdp
+Author: CloudThinker AI
+License-Expression: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: Documentation, https://github.com/cloudthinker-ai/proofbound/blob/main/docs/python.md
+Project-URL: Homepage, https://github.com/cloudthinker-ai/proofbound
+Project-URL: Issues, https://github.com/cloudthinker-ai/proofbound/issues
+Project-URL: Security, https://github.com/cloudthinker-ai/proofbound/blob/main/SECURITY.md
+Project-URL: Source, https://github.com/cloudthinker-ai/proofbound
+
+# Proofbound for Python
+
+Rust-backed authorization contracts. The extension creates opaque names and proofs;
+the Python decorator checks them before a sensitive function runs.
+
+Proofbound is an early project with an evolving API. The Python distribution is
+`gdp-rs`, the import package is `gdp`, and the linter command is `gdp-lint`.
+
+## Install
+
+```bash
+pip install gdp-rs==0.1.0
+```
+
+CPython 3.11–3.14 is tested. Release wheels support Linux x64/ARM64 (glibc 2.17+),
+macOS ARM64 (11+) and Windows x64. Wheel installation does not require Rust;
+building from source requires Rust 1.90 or newer.
+
+## How it works
+
+A trusted application module performs the real permission or entitlement check,
+then issues a proof for named arguments. A sensitive function declares the proof
+it requires using `@requires`. Before the body runs, Rust verifies the exact
+issuer, ordered subject identities and active scope.
+
+Equal raw IDs named separately have different identities. Type hints and the
+AST linter add checks for accidental misuse. The library does not decide your
+policy, prevent permission revocation or make a check and write atomic. Python
+code running in the same process can bypass a decorator; this is not a sandbox.
+
+See the [Python API](https://github.com/cloudthinker-ai/proofbound/blob/main/docs/python.md),
+[guarantee matrix](https://github.com/cloudthinker-ai/proofbound/blob/main/docs/guarantees.md)
+and [executable SQLite example](https://github.com/cloudthinker-ai/proofbound/tree/main/examples/python).
+The [repository README](https://github.com/cloudthinker-ai/proofbound) includes
+trusted checker and protected function examples.
+
+## Attribution
+
+Inspired by Guillermo Rauch's MIT-licensed
+[gdp-ts](https://github.com/rauchg/gdp-ts), Matt Noonan's
+[Ghosts of Departed Proofs](https://kataskeue.com/gdp.pdf), and Ollie Charles's
+[Who Authorized These Ghosts!?](https://blog.ocharles.org.uk/posts/2019-08-09-who-authorized-these-ghosts.html).
+The original copyright notice and MIT license are preserved in the distribution.
+

gdp_rs-0.1.0/README.md

@@ -0,0 +1,43 @@
+# Proofbound for Python
+
+Rust-backed authorization contracts. The extension creates opaque names and proofs;
+the Python decorator checks them before a sensitive function runs.
+
+Proofbound is an early project with an evolving API. The Python distribution is
+`gdp-rs`, the import package is `gdp`, and the linter command is `gdp-lint`.
+
+## Install
+
+```bash
+pip install gdp-rs==0.1.0
+```
+
+CPython 3.11–3.14 is tested. Release wheels support Linux x64/ARM64 (glibc 2.17+),
+macOS ARM64 (11+) and Windows x64. Wheel installation does not require Rust;
+building from source requires Rust 1.90 or newer.
+
+## How it works
+
+A trusted application module performs the real permission or entitlement check,
+then issues a proof for named arguments. A sensitive function declares the proof
+it requires using `@requires`. Before the body runs, Rust verifies the exact
+issuer, ordered subject identities and active scope.
+
+Equal raw IDs named separately have different identities. Type hints and the
+AST linter add checks for accidental misuse. The library does not decide your
+policy, prevent permission revocation or make a check and write atomic. Python
+code running in the same process can bypass a decorator; this is not a sandbox.
+
+See the [Python API](https://github.com/cloudthinker-ai/proofbound/blob/main/docs/python.md),
+[guarantee matrix](https://github.com/cloudthinker-ai/proofbound/blob/main/docs/guarantees.md)
+and [executable SQLite example](https://github.com/cloudthinker-ai/proofbound/tree/main/examples/python).
+The [repository README](https://github.com/cloudthinker-ai/proofbound) includes
+trusted checker and protected function examples.
+
+## Attribution
+
+Inspired by Guillermo Rauch's MIT-licensed
+[gdp-ts](https://github.com/rauchg/gdp-ts), Matt Noonan's
+[Ghosts of Departed Proofs](https://kataskeue.com/gdp.pdf), and Ollie Charles's
+[Who Authorized These Ghosts!?](https://blog.ocharles.org.uk/posts/2019-08-09-who-authorized-these-ghosts.html).
+The original copyright notice and MIT license are preserved in the distribution.

gdp_rs-0.1.0/bindings/python/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "gdp-python"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+publish = false
+description = "Python adapter for the GDP Rust proof-contract core"
+readme = "README.md"
+
+[lib]
+name = "_gdp"
+crate-type = ["cdylib", "rlib"]
+
+[lints]
+workspace = true
+
+[dependencies]
+gdp = { path = "../../crates/gdp" }
+pyo3 = { version = "0.29", features = ["abi3-py311", "extension-module"] }

gdp_rs-0.1.0/bindings/python/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Guillermo Rauch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

gdp_rs-0.1.0/bindings/python/README.md

@@ -0,0 +1,43 @@
+# Proofbound for Python
+
+Rust-backed authorization contracts. The extension creates opaque names and proofs;
+the Python decorator checks them before a sensitive function runs.
+
+Proofbound is an early project with an evolving API. The Python distribution is
+`gdp-rs`, the import package is `gdp`, and the linter command is `gdp-lint`.
+
+## Install
+
+```bash
+pip install gdp-rs==0.1.0
+```
+
+CPython 3.11–3.14 is tested. Release wheels support Linux x64/ARM64 (glibc 2.17+),
+macOS ARM64 (11+) and Windows x64. Wheel installation does not require Rust;
+building from source requires Rust 1.90 or newer.
+
+## How it works
+
+A trusted application module performs the real permission or entitlement check,
+then issues a proof for named arguments. A sensitive function declares the proof
+it requires using `@requires`. Before the body runs, Rust verifies the exact
+issuer, ordered subject identities and active scope.
+
+Equal raw IDs named separately have different identities. Type hints and the
+AST linter add checks for accidental misuse. The library does not decide your
+policy, prevent permission revocation or make a check and write atomic. Python
+code running in the same process can bypass a decorator; this is not a sandbox.
+
+See the [Python API](https://github.com/cloudthinker-ai/proofbound/blob/main/docs/python.md),
+[guarantee matrix](https://github.com/cloudthinker-ai/proofbound/blob/main/docs/guarantees.md)
+and [executable SQLite example](https://github.com/cloudthinker-ai/proofbound/tree/main/examples/python).
+The [repository README](https://github.com/cloudthinker-ai/proofbound) includes
+trusted checker and protected function examples.
+
+## Attribution
+
+Inspired by Guillermo Rauch's MIT-licensed
+[gdp-ts](https://github.com/rauchg/gdp-ts), Matt Noonan's
+[Ghosts of Departed Proofs](https://kataskeue.com/gdp.pdf), and Ollie Charles's
+[Who Authorized These Ghosts!?](https://blog.ocharles.org.uk/posts/2019-08-09-who-authorized-these-ghosts.html).
+The original copyright notice and MIT license are preserved in the distribution.

gdp_rs-0.1.0/bindings/python/src/lib.rs

@@ -0,0 +1,3 @@
+#![deny(clippy::print_stdout, clippy::print_stderr)]
+
+mod py;

gdp_rs-0.1.0/bindings/python/src/py/fault.rs

@@ -0,0 +1,19 @@
+use std::panic::{AssertUnwindSafe, catch_unwind};
+
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct Fault;
+
+pub(super) fn contain<T>(operation: impl FnOnce() -> T) -> Result<T, Fault> {
+    catch_unwind(AssertUnwindSafe(operation)).map_err(|_| Fault)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Fault, contain};
+
+    #[test]
+    fn rust_faults_are_contained_without_their_payload() {
+        assert_eq!(contain(|| 7), Ok(7));
+        assert_eq!(contain(|| panic!("internal engine failure")), Err(Fault));
+    }
+}

gdp_rs-0.1.0/bindings/python/src/py/mod.rs

@@ -0,0 +1,75 @@
+mod fault;
+mod objects;
+
+use gdp::runtime::ProofError;
+use pyo3::exceptions::{PyPermissionError, PyRuntimeError, PyValueError};
+use pyo3::prelude::*;
+use pyo3::types::PyTuple;
+
+use objects::{Named, Names, Proof, ProofKind, Prover};
+
+pyo3::create_exception!(_gdp, AuthorizationError, PyPermissionError);
+
+pub(super) fn contain_fault<T>(operation: impl FnOnce() -> PyResult<T>) -> PyResult<T> {
+    fault::contain(operation)
+        .map_err(|_| PyRuntimeError::new_err("Rust proof engine internal fault"))?
+}
+
+pub(super) fn authorization_error(error: ProofError) -> PyErr {
+    AuthorizationError::new_err(error.to_string())
+}
+
+#[pyfunction]
+fn name(value: Py<PyAny>) -> Named {
+    Named::new(value, gdp::runtime::Name::fresh())
+}
+
+#[pyfunction]
+#[pyo3(signature = (*values))]
+fn names(values: &Bound<'_, PyTuple>) -> PyResult<Names> {
+    contain_fault(|| Names::new(values))
+}
+
+#[pyfunction]
+#[pyo3(signature = (kind, *, tag=None))]
+fn define_proof(kind: &str, tag: Option<Py<PyAny>>) -> PyResult<Prover> {
+    let _ = tag;
+    contain_fault(|| {
+        Ok(Prover::new(gdp::runtime::Prover::new(kind).map_err(
+            |error| PyValueError::new_err(error.to_string()),
+        )?))
+    })
+}
+
+#[pymodule]
+fn _gdp(module: &Bound<'_, PyModule>) -> PyResult<()> {
+    module.add("INTERFACE_VERSION", 1)?;
+    module.add(
+        "AuthorizationError",
+        module.py().get_type::<AuthorizationError>(),
+    )?;
+    module.add_class::<Named>()?;
+    module.add_class::<Names>()?;
+    module.add_class::<Proof>()?;
+    module.add_class::<ProofKind>()?;
+    module.add_class::<Prover>()?;
+    module.add_function(wrap_pyfunction!(name, module)?)?;
+    module.add_function(wrap_pyfunction!(names, module)?)?;
+    module.add_function(wrap_pyfunction!(define_proof, module)?)?;
+    module.add(
+        "__all__",
+        [
+            "INTERFACE_VERSION",
+            "AuthorizationError",
+            "Named",
+            "Names",
+            "Proof",
+            "ProofKind",
+            "Prover",
+            "name",
+            "names",
+            "define_proof",
+        ],
+    )?;
+    Ok(())
+}