gitpane 1.0.0__py3-none-any.whl

gitpane/history_rewrite/protocol.py

@@ -0,0 +1,320 @@
+"""Transport history rewrite records without changing their bytes."""
+
+from __future__ import annotations
+
+import re
+from typing import TYPE_CHECKING
+
+from gitpane.config import COMMIT_HEADER_LIMIT_BYTES, HISTORY_REWRITE_SPOOL_LIMIT_BYTES, PROCESS_CHUNK_BYTES
+from gitpane.history.repository_value import validate_oid
+from gitpane.history_rewrite.value import ChangeKind, ExportCommit, FileChange, RawCommit, RewriteRefusal, RewriteRefusalKind, RewriteTargetKind, validate_path
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Iterable, Iterator
+    from typing import BinaryIO
+
+    from gitpane.history_rewrite.value import ImportCommit, RewriteTarget
+
+SIGNATURE_HEADER_SET = frozenset({b"gpgsig", b"gpgsig-sha256"})
+SUPPORTED_HEADER_SET = frozenset({b"tree", b"parent", b"author", b"committer", b"encoding"}) | SIGNATURE_HEADER_SET
+FILE_MODE_SET = frozenset({b"100644", b"100755", b"120000", b"160000"})
+ESCAPE_BY_BYTE = {ord("a"): 7, ord("b"): 8, ord("t"): 9, ord("n"): 10, ord("v"): 11, ord("f"): 12, ord("r"): 13, ord('"'): 34, ord("\\"): 92}
+OCTAL_ESCAPE_LENGTH = 3
+PRINTABLE_BYTE_START = 32
+PRINTABLE_BYTE_END = 127
+MARK_PATTERN = re.compile(r":[1-9][0-9]*")
+
+
+def check_cancelled(cancelled: Callable[[], bool] | None) -> None:
+    """Stop CPU and file work between bounded blocks when its owner cancels."""
+    if cancelled is not None and cancelled():
+        raise ValueError("History preparation cancelled; source unchanged")
+
+
+def read_line(stream: BinaryIO, cancelled: Callable[[], bool] | None = None, limit: int = COMMIT_HEADER_LIMIT_BYTES) -> bytes:
+    """Read a bounded protocol line even when a transport returns short reads."""
+    result = bytearray()
+    while True:
+        check_cancelled(cancelled)
+        chunk = stream.readline(limit + 1 - len(result))
+        if not chunk:
+            if result:
+                raise ValueError("Truncated Git protocol line")
+            return b""
+        result.extend(chunk)
+        if len(result) > limit:
+            raise ValueError("Git header exceeds the supported size; source unchanged")
+        if chunk.endswith(b"\n"):
+            return bytes(result)
+
+
+def copy_bytes(source: BinaryIO, length: int, destination: BinaryIO | None = None, cancelled: Callable[[], bool] | None = None) -> None:
+    """Transfer an exact data block without retaining a large message in memory."""
+    while length:
+        check_cancelled(cancelled)
+        chunk = source.read(min(length, PROCESS_CHUNK_BYTES))
+        if not chunk:
+            raise ValueError("Truncated Git data record")
+        if destination is not None:
+            write_bytes(destination, chunk)
+        length -= len(chunk)
+
+
+def write_bytes(destination: BinaryIO, content: bytes) -> None:
+    """Refuse oversized or incomplete writes to a private import spool."""
+    if destination.tell() + len(content) > HISTORY_REWRITE_SPOOL_LIMIT_BYTES:
+        raise ValueError("History import exceeds its private file size limit")
+    if destination.write(content) != len(content):
+        raise OSError("Incomplete private import write")
+
+
+def read_nul_records(stream: BinaryIO, cancelled: Callable[[], bool] | None = None) -> Iterator[bytes]:
+    """Read bounded NUL-framed records without loading a complete batch response."""
+    pending = bytearray()
+    while chunk := stream.read(PROCESS_CHUNK_BYTES):
+        check_cancelled(cancelled)
+        pieces = chunk.split(b"\0")
+        first_piece = True
+        for piece in pieces:
+            if not first_piece:
+                yield bytes(pending)
+                pending.clear()
+            pending.extend(piece)
+            if len(pending) > COMMIT_HEADER_LIMIT_BYTES:
+                raise ValueError("Git path check exceeds the supported record size")
+            first_piece = False
+    if pending:
+        raise ValueError("Truncated Git path check")
+
+
+def _length(value: bytes) -> int:
+    if not value or not value.isdigit():
+        raise ValueError("Invalid Git data length")
+    return int(value)
+
+
+def _oid(value: bytes) -> str:
+    return validate_oid(value.decode("ascii"))
+
+
+def _reference(value: bytes) -> str:
+    """Accept an object ID or numeric mark, never an arbitrary revision expression."""
+    reference = value.decode("ascii")
+    if MARK_PATTERN.fullmatch(reference):
+        return reference
+    return validate_oid(reference)
+
+
+def decode_path(value: bytes) -> bytes:
+    """Decode Git's C quoting without interpreting shell syntax or Unicode."""
+    if not value.startswith(b'"'):
+        return validate_path(value)
+    if not value.endswith(b'"') or len(value) < 2:
+        raise ValueError("Invalid quoted Git path")
+    content = value[1:-1]
+    result = bytearray()
+    position = 0
+    while position < len(content):
+        byte = content[position]
+        position += 1
+        if byte == ord('"'):
+            raise ValueError("Unescaped quote in Git path")
+        if byte != ord("\\"):
+            result.append(byte)
+            continue
+        if position == len(content):
+            raise ValueError("Incomplete Git path escape")
+        byte = content[position]
+        if byte in ESCAPE_BY_BYTE:
+            result.append(ESCAPE_BY_BYTE[byte])
+            position += 1
+            continue
+        octal = content[position:position + OCTAL_ESCAPE_LENGTH]
+        if len(octal) != OCTAL_ESCAPE_LENGTH or any(digit not in b"01234567" for digit in octal) or int(octal, 8) > 255:
+            raise ValueError("Invalid Git path escape")
+        result.append(int(octal, 8))
+        position += OCTAL_ESCAPE_LENGTH
+    return validate_path(bytes(result))
+
+
+def encode_path(path: bytes) -> bytes:
+    """Quote every special path byte so it cannot become an import directive."""
+    validate_path(path)
+    result = bytearray(b'"')
+    for byte in path:
+        if PRINTABLE_BYTE_START <= byte < PRINTABLE_BYTE_END and byte not in (ord('"'), ord("\\")):
+            result.append(byte)
+        else:
+            result.extend(f"\\{byte:03o}".encode("ascii"))
+    result.extend(b'"')
+    return bytes(result)
+
+
+def matches_target(path: bytes, target: RewriteTarget) -> bool:
+    """Match exact bytes or descendants separated by a slash."""
+    return path == target.path or (target.kind == RewriteTargetKind.FOLDER and path.startswith(target.path + b"/"))
+
+
+def read_export(stream: BinaryIO, cancelled: Callable[[], bool] | None = None) -> list[ExportCommit]:
+    """Parse only the closed no-data export grammar, requiring its final done record."""
+    if read_line(stream, cancelled) != b"feature done\n":
+        raise ValueError("Missing export done feature")
+    records: list[ExportCommit] = []
+    oid_set: set[str] = set()
+    mark_set: set[str] = set()
+    line = read_line(stream, cancelled)
+    while line != b"done\n":
+        check_cancelled(cancelled)
+        if line == b"\n":
+            line = read_line(stream, cancelled)
+            continue
+        if line.startswith(b"reset "):
+            line = read_line(stream, cancelled)
+            if line.startswith(b"from "):
+                _reference(line.removeprefix(b"from ").removesuffix(b"\n"))
+                line = read_line(stream, cancelled)
+            continue
+        if not line.startswith(b"commit "):
+            raise ValueError("Unknown or incomplete Git export record")
+        mark_line = read_line(stream, cancelled)
+        if not mark_line.startswith(b"mark "):
+            raise ValueError("Missing commit mark")
+        mark = _reference(mark_line.removeprefix(b"mark ").removesuffix(b"\n"))
+        if not mark.startswith(":") or mark in mark_set:
+            raise ValueError("Invalid or duplicate commit mark")
+        oid_line = read_line(stream, cancelled)
+        if not oid_line.startswith(b"original-oid "):
+            raise ValueError("Missing original commit ID")
+        oid = _oid(oid_line.removeprefix(b"original-oid ").removesuffix(b"\n"))
+        if oid in oid_set:
+            raise ValueError("Duplicate exported commit")
+        line = read_line(stream, cancelled)
+        if line.startswith(b"author "):
+            line = read_line(stream, cancelled)
+        if not line.startswith(b"committer "):
+            raise ValueError("Missing export committer")
+        line = read_line(stream, cancelled)
+        if line.startswith(b"encoding "):
+            line = read_line(stream, cancelled)
+        if not line.startswith(b"data "):
+            raise ValueError("Missing export message")
+        copy_bytes(stream, _length(line.removeprefix(b"data ").removesuffix(b"\n")), cancelled=cancelled)
+        line = read_line(stream, cancelled)
+        # An empty root has only its commit terminator here; keep the next command as lookahead.
+        next_command = False
+        if line == b"\n":
+            line = read_line(stream, cancelled)
+            next_command = line.startswith((b"commit ", b"reset ")) or line == b"done\n"
+        parent_refs: list[str] = []
+        if line.startswith(b"from "):
+            parent_refs.append(_reference(line.removeprefix(b"from ").removesuffix(b"\n")))
+            line = read_line(stream, cancelled)
+        while line.startswith(b"merge "):
+            parent_refs.append(_reference(line.removeprefix(b"merge ").removesuffix(b"\n")))
+            line = read_line(stream, cancelled)
+        changes: list[FileChange] = []
+        while line != b"\n" and not next_command:
+            if line.startswith(b"M "):
+                _, mode, object_oid, path = line.removesuffix(b"\n").split(b" ", 3)
+                if mode not in FILE_MODE_SET:
+                    raise ValueError("Unsupported Git file mode")
+                changes.append(FileChange(ChangeKind.MODIFY, decode_path(path), mode, _oid(object_oid)))
+            elif line.startswith(b"D "):
+                changes.append(FileChange(ChangeKind.DELETE, decode_path(line.removeprefix(b"D ").removesuffix(b"\n"))))
+            else:
+                raise ValueError("Unsupported or truncated Git file directive")
+            line = read_line(stream, cancelled)
+        records.append(ExportCommit(oid, mark, tuple(parent_refs), tuple(changes)))
+        oid_set.add(oid)
+        mark_set.add(mark)
+        if not next_command:
+            line = read_line(stream, cancelled)
+    if stream.read(1):
+        raise ValueError("Unexpected bytes after export done")
+    return records
+
+
+def read_raw_commits(stream: BinaryIO, cancelled: Callable[[], bool] | None = None) -> dict[str, RawCommit]:
+    """Read raw cat-file commit headers while keeping message bytes in their spool."""
+    commit_by_oid: dict[str, RawCommit] = {}
+    while line := read_line(stream, cancelled):
+        oid_raw, object_type, size_raw = line.removesuffix(b"\n").split(b" ")
+        oid = _oid(oid_raw)
+        if object_type != b"commit" or oid in commit_by_oid:
+            raise ValueError("Expected one complete raw commit per object ID")
+        size = _length(size_raw)
+        start = stream.tell()
+        value_by_header: dict[bytes, bytes] = {}
+        header_names: list[bytes] = []
+        parent_oids: list[str] = []
+        previous_header = b""
+        while True:
+            line = read_line(stream, cancelled)
+            consumed = stream.tell() - start
+            if consumed > size or consumed > COMMIT_HEADER_LIMIT_BYTES or not line:
+                raise ValueError(f"Invalid or oversized commit header for {oid}")
+            if line == b"\n":
+                break
+            if line.startswith(b" "):
+                if not previous_header or previous_header in SUPPORTED_HEADER_SET - SIGNATURE_HEADER_SET:
+                    raise ValueError(f"Invalid header continuation for {oid}")
+                continue
+            header, separator, value = line.removesuffix(b"\n").partition(b" ")
+            if not separator or not header:
+                raise ValueError(f"Invalid raw commit header for {oid}")
+            if header == b"parent":
+                parent_oids.append(_oid(value))
+            elif header in value_by_header and header in SUPPORTED_HEADER_SET:
+                raise ValueError(f"Repeated commit header for {oid}")
+            value_by_header[header] = value
+            header_names.append(header)
+            previous_header = header
+        for required in (b"tree", b"author", b"committer"):
+            if required not in value_by_header:
+                raise ValueError(f"Missing commit header for {oid}")
+        offset = stream.tell()
+        length = size - (offset - start)
+        copy_bytes(stream, length, cancelled=cancelled)
+        if stream.read(1) != b"\n":
+            raise ValueError(f"Truncated raw commit {oid}")
+        commit_by_oid[oid] = RawCommit(oid, _oid(value_by_header[b"tree"]), tuple(parent_oids), value_by_header[b"author"], value_by_header[b"committer"],
+                                      value_by_header.get(b"encoding"), offset, length, tuple(header_names), bool(set(header_names) & SIGNATURE_HEADER_SET))
+    return commit_by_oid
+
+
+def write_import(destination: BinaryIO, commits: Iterable[ImportCommit], raw_source: BinaryIO, private_ref: bytes, cancelled: Callable[[], bool] | None = None) -> None:
+    """Emit only generated private commits, restoring each original raw message."""
+    if not re.fullmatch(rb"refs/heads/[A-Za-z0-9_-]+(?:/[A-Za-z0-9_-]+)*", private_ref):
+        raise ValueError("Invalid private import reference")
+    write_bytes(destination, b"feature done\n")
+    for commit in commits:
+        check_cancelled(cancelled)
+        raw = commit.raw
+        for header in raw.header_names:
+            if header not in SUPPORTED_HEADER_SET:
+                raise RewriteRefusal(RewriteRefusalKind.UNSUPPORTED_METADATA,
+                                     f"Unsupported commit header {header.decode('ascii', 'replace')!r} in {raw.oid}; rewrite refused, use a compatible history editor")
+        if not MARK_PATTERN.fullmatch(commit.mark):
+            raise ValueError("Invalid import mark")
+        write_bytes(destination, b"reset " + private_ref + b"\n\ncommit " + private_ref + b"\nmark " + commit.mark.encode("ascii") + b"\nauthor " + raw.author
+                    + b"\ncommitter " + raw.committer + b"\n")
+        if raw.encoding is not None:
+            write_bytes(destination, b"encoding " + raw.encoding + b"\n")
+        write_bytes(destination, b"data " + str(raw.message_length).encode("ascii") + b"\n")
+        raw_source.seek(raw.message_offset)
+        copy_bytes(raw_source, raw.message_length, destination, cancelled)
+        write_bytes(destination, b"\n")
+        first_parent = True
+        for parent_ref in commit.parent_refs:
+            reference = _reference(parent_ref.encode("ascii"))
+            write_bytes(destination, (b"from " if first_parent else b"merge ") + reference.encode("ascii") + b"\n")
+            first_parent = False
+        for change in commit.changes:
+            if change.kind == ChangeKind.MODIFY:
+                if change.mode not in FILE_MODE_SET:
+                    raise ValueError("Invalid import mode")
+                write_bytes(destination, b"M " + change.mode + b" " + validate_oid(change.oid).encode("ascii") + b" " + encode_path(change.path) + b"\n")
+            else:
+                write_bytes(destination, b"D " + encode_path(change.path) + b"\n")
+        write_bytes(destination, b"\n")
+    write_bytes(destination, b"done\n")