lambda-watcher 0.1.0__py3-none-any.whl

lambda_watcher/diffing/render_text.py

@@ -0,0 +1,198 @@
+"""Terminal rendering of a version diff, using rich."""
+
+from __future__ import annotations
+
+from rich.console import Console, Group
+from rich.panel import Panel
+from rich.rule import Rule
+from rich.syntax import Syntax
+from rich.table import Table
+from rich.text import Text
+
+from ..utils import human_size, rename_label, signed
+from .compare import VersionDiff
+
+_KIND_STYLE = {
+    "added": "green",
+    "removed": "red",
+    "modified": "yellow",
+    "renamed": "cyan",
+    "mode-changed": "magenta",
+}
+_SEVERITY_STYLE = {"high": "bold red", "medium": "yellow", "low": "dim"}
+
+
+def _label(change) -> str:
+    """How one file is named in a listing.
+
+    A rename writes the two paths as one, with the part that moved in braces —
+    the alternative is 90 characters of identical path twice over, wrapped
+    across two rows, for a version number that changed in the middle.
+    """
+    if change.kind != "renamed" or not change.old_path:
+        return change.path
+    head, was, now, tail = rename_label(change.old_path, change.path)
+    return f"{head}{{{was} \u2192 {now}}}{tail}"
+
+
+def _stat_line(diff: VersionDiff) -> Text:
+    counts = diff.counts()
+    text = Text()
+    for kind in ("added", "removed", "modified", "renamed"):
+        if counts.get(kind):
+            text.append(f"{counts[kind]} {kind}  ", style=_KIND_STYLE[kind])
+    if diff.vendor_files_changed:
+        text.append(f"{diff.vendor_files_changed} vendored (hidden)  ", style="dim")
+    if diff.diffs_computed:
+        text.append(f"+{diff.total_added_lines}", style="green")
+        text.append(" / ")
+        text.append(f"-{diff.total_removed_lines}", style="red")
+        text.append(" lines")
+    else:
+        text.append("line counts skipped (--no-patch)", style="dim")
+    return text
+
+
+def render_summary(console: Console, diff: VersionDiff) -> None:
+    header = Text()
+    header.append(diff.function_name, style="bold")
+    header.append(f"   v{diff.a_seq:04d} → v{diff.b_seq:04d}", style="bold cyan")
+    console.print(Panel(Group(header, _stat_line(diff)), border_style="cyan", expand=False))
+
+    if diff.runtime_change:
+        console.print(f"  [bold]runtime[/bold]  {diff.runtime_change[0]} → {diff.runtime_change[1]}")
+    if diff.handler_change:
+        before, after = diff.handler_change
+        console.print(f"  [bold]handler[/bold]  {before or '?'} → {after or '?'}")
+
+    size_a = diff.a_meta.get("total_size", 0)
+    size_b = diff.b_meta.get("total_size", 0)
+    if size_a or size_b:
+        console.print(
+            f"  [bold]size[/bold]     {human_size(size_a)} → {human_size(size_b)} "
+            f"([{'green' if size_b <= size_a else 'yellow'}]{signed(size_b - size_a)} B[/])"
+        )
+
+
+def render_dependencies(console: Console, diff: VersionDiff) -> None:
+    if not diff.deps:
+        return
+    table = Table(title="Dependencies", title_justify="left", header_style="bold", box=None,
+                  padding=(0, 2, 0, 0))
+    table.add_column("")
+    table.add_column("manager", style="dim")
+    table.add_column("package")
+    table.add_column("from", style="red")
+    table.add_column("to", style="green")
+    table.add_column("origin", style="dim")
+
+    marks = {"added": ("+", "green"), "removed": ("−", "red"), "changed": ("~", "yellow")}
+    for change in diff.deps:
+        mark, style = marks[change.kind]
+        table.add_row(
+            Text(mark, style=style),
+            change.manager,
+            change.name,
+            change.old_version or "—",
+            change.new_version or "—",
+            "declared" if change.is_declared else "installed",
+        )
+    console.print()
+    console.print(table)
+
+
+def render_context(console: Console, diff: VersionDiff) -> None:
+    rows: list[tuple[str, str, str]] = []
+    if diff.env_added:
+        rows.append(("Env vars added", ", ".join(diff.env_added), "green"))
+    if diff.env_removed:
+        rows.append(("Env vars removed", ", ".join(diff.env_removed), "red"))
+    if diff.services_added:
+        rows.append(("AWS services added", ", ".join(diff.services_added), "green"))
+    if diff.services_removed:
+        rows.append(("AWS services removed", ", ".join(diff.services_removed), "red"))
+    if not rows:
+        return
+    console.print()
+    for label, value, style in rows:
+        console.print(f"  [bold]{label}:[/bold] [{style}]{value}[/{style}]")
+    if diff.env_added:
+        console.print(
+            "  [dim]↑ these need to exist in the function's environment configuration[/dim]"
+        )
+
+
+def render_findings(console: Console, diff: VersionDiff) -> None:
+    if not diff.findings_new and not diff.findings_fixed:
+        return
+    console.print()
+    if diff.findings_new:
+        table = Table(title="New findings", title_justify="left", title_style="bold red",
+                      header_style="bold", box=None, padding=(0, 2, 0, 0), show_header=False)
+        table.add_column("", justify="right")
+        table.add_column("kind")
+        table.add_column("where", style="dim")
+        table.add_column("detail", style="dim")
+        for finding in diff.findings_new[:25]:
+            table.add_row(
+                Text(finding["severity"], style=_SEVERITY_STYLE.get(finding["severity"], "")),
+                finding["kind"],
+                f"{finding['path']}:{finding['line']}",
+                finding["detail"],
+            )
+        console.print(table)
+    if diff.findings_fixed:
+        console.print(f"[green]Resolved findings:[/green] {len(diff.findings_fixed)}")
+
+
+def render_files(console: Console, diff: VersionDiff, show_diffs: bool = True,
+                 max_files: int = 200) -> None:
+    if not diff.files:
+        console.print("\n[dim]No file-level changes.[/dim]")
+        return
+
+    console.print()
+    table = Table(title="Files", title_justify="left", header_style="bold", box=None,
+                  padding=(0, 2, 0, 0))
+    table.add_column("")
+    table.add_column("path")
+    table.add_column("+", justify="right", style="green")
+    table.add_column("−", justify="right", style="red")
+    table.add_column("size", justify="right", style="dim")
+
+    marks = {"added": "+", "removed": "−", "modified": "~", "renamed": "→", "mode-changed": "m"}
+    for change in diff.files[:max_files]:
+        table.add_row(
+            Text(marks.get(change.kind, "?"), style=_KIND_STYLE.get(change.kind, "")),
+            Text(_label(change), style="dim" if change.is_vendor else ""),
+            str(change.added_lines or ""),
+            str(change.removed_lines or ""),
+            signed(change.size_delta) if change.size_delta else "",
+        )
+    console.print(table)
+    if len(diff.files) > max_files:
+        console.print(f"[dim]… and {len(diff.files) - max_files} more files[/dim]")
+
+    if not show_diffs:
+        return
+
+    for change in diff.files:
+        if not change.diff_lines:
+            continue
+        console.print()
+        console.print(Rule(f"[bold]{_label(change)}[/bold]",
+                           style=_KIND_STYLE.get(change.kind, "white")))
+        body = "\n".join(change.diff_lines)
+        console.print(Syntax(body, "diff", theme="ansi_dark", word_wrap=False, background_color="default"))
+        if change.truncated:
+            console.print("[dim]… diff truncated (raise diff.max_diff_lines to see more)[/dim]")
+
+
+def render(console: Console, diff: VersionDiff, show_diffs: bool = True) -> None:
+    render_summary(console, diff)
+    render_dependencies(console, diff)
+    render_context(console, diff)
+    render_findings(console, diff)
+    render_files(console, diff, show_diffs=show_diffs)
+    if diff.is_empty:
+        console.print("\n[green]These two versions are identical.[/green]")

lambda_watcher/extract.py

@@ -0,0 +1,227 @@
+"""Safe extraction of Lambda deployment zips.
+
+Deployment packages are downloaded from a trusted account, but they are still
+archives from the internet: this module refuses path traversal, absolute paths,
+symlinks pointing outside the tree, and archives that would explode on disk.
+"""
+
+from __future__ import annotations
+
+import os
+import stat
+import zipfile
+from dataclasses import dataclass, field
+from pathlib import Path, PurePosixPath
+
+from .utils import LOG, rmtree
+
+
+class ExtractError(RuntimeError):
+    """The archive could not be safely extracted."""
+
+
+@dataclass
+class ExtractResult:
+    dest: Path
+    file_count: int = 0
+    dir_count: int = 0
+    total_uncompressed: int = 0
+    total_compressed: int = 0
+    skipped: list[str] = field(default_factory=list)
+    top_level: list[str] = field(default_factory=list)
+    is_encrypted: bool = False
+    #: Name of the single wrapping directory that was lifted away, if any.
+    wrapper_dir: str | None = None
+
+    @property
+    def compression_ratio(self) -> float:
+        if not self.total_compressed:
+            return 0.0
+        return self.total_uncompressed / self.total_compressed
+
+
+def _is_within(base: Path, target: Path) -> bool:
+    try:
+        target.resolve().relative_to(base.resolve())
+        return True
+    except ValueError:
+        return False
+
+
+def safe_member_path(base: Path, name: str) -> Path | None:
+    """Resolve an archive member to a path inside ``base``, or None if unsafe."""
+    if not name or name.startswith("/") or name.startswith("\\"):
+        return None
+    # Windows-created archives sometimes use backslashes as separators.
+    normalised = name.replace("\\", "/")
+    pure = PurePosixPath(normalised)
+    if pure.is_absolute() or any(part == ".." for part in pure.parts):
+        return None
+    # Drive letters (C:/...) are traversal on Windows.
+    if len(pure.parts) and ":" in pure.parts[0]:
+        return None
+    target = base / Path(*pure.parts)
+    if not _is_within(base, target):
+        return None
+    return target
+
+
+def peek_top_level(zip_path: Path) -> list[str]:
+    """Top-level entries of a zip without extracting it."""
+    try:
+        with zipfile.ZipFile(zip_path) as zf:
+            names = zf.namelist()
+    except (zipfile.BadZipFile, OSError):
+        return []
+    tops: list[str] = []
+    for name in names:
+        head = name.replace("\\", "/").split("/")[0]
+        if head and head not in tops and not head.startswith("__MACOSX"):
+            tops.append(head)
+    return tops
+
+
+def strip_wrapper_dir(dest: Path) -> str | None:
+    """Lift a lone wrapping directory's contents up into ``dest``.
+
+    GitHub - and npm, and anything built by ``git archive`` - wraps the whole
+    tree in one directory named after the ref: ``myrepo-main/``,
+    ``myrepo-1.2.3/``, ``myrepo-a1b2c3d/``. That name changes with every
+    download, and both the tree hash and the file diff key off paths, so
+    without this a re-download of the same project reads as "every file
+    removed, every file added" - and never as ``unchanged``.
+
+    Exactly one level is ever removed. A package whose real layout is a single
+    ``src/`` directory keeps it, because collapsing further would start
+    discarding structure the archive actually meant.
+
+    Returns the name of the directory that was removed, or None if the tree was
+    left alone.
+    """
+    try:
+        entries = list(dest.iterdir())
+    except OSError:
+        return None
+    if len(entries) != 1:
+        return None
+    wrapper = entries[0]
+    if wrapper.is_symlink() or not wrapper.is_dir():
+        return None
+
+    # Three renames rather than a move per child: the wrapper steps out to a
+    # sibling, the emptied dest goes away, and the wrapper takes its place.
+    # Cost is the same whether the tree holds ten files or ten thousand.
+    staged = dest.parent / f"{dest.name}.unwrapped"
+    if staged.exists():
+        rmtree(staged)
+    try:
+        wrapper.rename(staged)
+        dest.rmdir()
+        staged.rename(dest)
+    except OSError as exc:
+        LOG.warning("could not unwrap %s, keeping the tree as extracted: %s", wrapper.name, exc)
+        # Undo whichever half of the swap went through.
+        if staged.exists():
+            dest.mkdir(parents=True, exist_ok=True)
+            try:
+                staged.rename(dest / wrapper.name)
+            except OSError:
+                LOG.error("left an unwrapped tree at %s", staged)
+        return None
+    return wrapper.name
+
+
+def extract_zip(
+    zip_path: Path,
+    dest: Path,
+    max_uncompressed_bytes: int = 2 * 1024**3,
+    max_files: int = 200_000,
+    strip_wrapper: bool = True,
+) -> ExtractResult:
+    """Extract ``zip_path`` into ``dest``, enforcing the safety limits."""
+    dest.mkdir(parents=True, exist_ok=True)
+    result = ExtractResult(dest=dest)
+
+    try:
+        zf = zipfile.ZipFile(zip_path)
+    except zipfile.BadZipFile as exc:
+        raise ExtractError(f"not a valid zip archive: {exc}") from exc
+    except OSError as exc:
+        raise ExtractError(f"could not open archive: {exc}") from exc
+
+    with zf:
+        infos = zf.infolist()
+        if len(infos) > max_files:
+            raise ExtractError(f"archive has {len(infos)} entries (limit {max_files})")
+        planned = sum(i.file_size for i in infos)
+        if planned > max_uncompressed_bytes:
+            raise ExtractError(
+                f"archive expands to {planned / 1024 ** 2:.0f} MB "
+                f"(limit {max_uncompressed_bytes / 1024 ** 2:.0f} MB)"
+            )
+
+        written = 0
+        for info in infos:
+            name = info.filename
+            if name.startswith("__MACOSX/") or PurePosixPath(name).name == ".DS_Store":
+                result.skipped.append(name)
+                continue
+            if info.flag_bits & 0x1:
+                result.is_encrypted = True
+                raise ExtractError("archive is password protected")
+
+            target = safe_member_path(dest, name)
+            if target is None:
+                LOG.warning("skipping unsafe archive member %r in %s", name, zip_path.name)
+                result.skipped.append(name)
+                continue
+
+            mode = info.external_attr >> 16
+            if stat.S_ISLNK(mode):
+                # Symlinks in a deployment package are almost always vendored
+                # binaries; store the link text as a regular file so the tree
+                # stays self-contained and cannot escape the store.
+                target.parent.mkdir(parents=True, exist_ok=True)
+                link_target = zf.read(info).decode("utf-8", "replace")
+                target.write_text(link_target, encoding="utf-8")
+                result.file_count += 1
+                continue
+
+            if info.is_dir():
+                target.mkdir(parents=True, exist_ok=True)
+                result.dir_count += 1
+                continue
+
+            target.parent.mkdir(parents=True, exist_ok=True)
+            with zf.open(info) as src, target.open("wb") as out:
+                remaining = max_uncompressed_bytes - written
+                chunk_size = 1 << 20
+                while True:
+                    chunk = src.read(chunk_size)
+                    if not chunk:
+                        break
+                    remaining -= len(chunk)
+                    if remaining < 0:
+                        raise ExtractError("archive exceeded the uncompressed size limit")
+                    out.write(chunk)
+                    written += len(chunk)
+
+            result.file_count += 1
+            result.total_uncompressed += info.file_size
+            result.total_compressed += info.compress_size
+
+            # Preserve the executable bit; Lambda custom runtimes rely on it.
+            if mode and (mode & 0o111):
+                try:
+                    os.chmod(target, (target.stat().st_mode | 0o111) & 0o777)
+                except OSError:
+                    pass
+
+    if strip_wrapper:
+        result.wrapper_dir = strip_wrapper_dir(dest)
+
+    # Recorded after unwrapping: this is the tree everything downstream sees.
+    result.top_level = sorted(
+        {p.name for p in dest.iterdir()} if dest.exists() else set()
+    )
+    return result

lambda_watcher/gitmirror.py

@@ -0,0 +1,151 @@
+"""Optional per-function git repository, one commit per archived version.
+
+This is the shortest path to a review workflow you already know: every version
+is a commit tagged ``v0007``, so ``git diff v0002 v0010``, ``git log -p``, VS
+Code's diff viewer and any git GUI all work on a single function's history
+without ten unrelated Lambdas mixed into the same repo. It lives at
+``functions/<slug>/repo/``, and ``lambda-watcher open`` hands that folder to an
+editor.
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+
+from .config import GitMirrorConfig
+from .utils import LOG, matches_any, rmtree
+
+
+class GitUnavailable(RuntimeError):
+    """git is not installed or not usable."""
+
+
+@dataclass
+class MirrorResult:
+    repo: Path
+    commit: str | None
+    tag: str | None
+    created_repo: bool = False
+
+
+def git_available() -> bool:
+    return shutil.which("git") is not None
+
+
+def _run(repo: Path, *args: str, check: bool = True, env_extra: dict[str, str] | None = None) -> str:
+    import os
+
+    env = os.environ.copy()
+    # Keep the mirror hermetic: no user hooks, no global config surprises.
+    env.update({"GIT_CONFIG_NOSYSTEM": "1", "GIT_TERMINAL_PROMPT": "0"})
+    if env_extra:
+        env.update(env_extra)
+    proc = subprocess.run(
+        ["git", *args],
+        cwd=str(repo),
+        capture_output=True,
+        text=True,
+        env=env,
+        timeout=300,
+    )
+    if check and proc.returncode != 0:
+        raise RuntimeError(f"git {' '.join(args)} failed: {proc.stderr.strip() or proc.stdout.strip()}")
+    return proc.stdout.strip()
+
+
+def ensure_repo(repo: Path, cfg: GitMirrorConfig) -> bool:
+    """Create the mirror repo if needed. Returns True when it was created."""
+    if not git_available():
+        raise GitUnavailable("git executable not found on PATH")
+    created = False
+    if not (repo / ".git").exists():
+        repo.mkdir(parents=True, exist_ok=True)
+        _run(repo, "init", "-q", "-b", "main")
+        _run(repo, "config", "user.name", cfg.author_name)
+        _run(repo, "config", "user.email", cfg.author_email)
+        _run(repo, "config", "core.autocrlf", "false")
+        # Deployment packages contain binaries; keep git from mangling them.
+        (repo / ".gitattributes").write_text("* -text\n", encoding="utf-8")
+        created = True
+    return created
+
+
+def _clear_worktree(repo: Path) -> None:
+    for entry in repo.iterdir():
+        if entry.name == ".git":
+            continue
+        if entry.is_dir():
+            rmtree(entry)
+        else:
+            try:
+                entry.unlink()
+            except OSError:
+                pass
+
+
+def _copy_tree(src: Path, repo: Path, vendor_globs: list[str], include_vendor: bool) -> int:
+    copied = 0
+    for path in src.rglob("*"):
+        if path.is_dir():
+            continue
+        rel = path.relative_to(src).as_posix()
+        if rel.startswith(".git/") or rel == ".git":
+            continue
+        if not include_vendor and matches_any(rel, vendor_globs):
+            continue
+        target = repo / rel
+        target.parent.mkdir(parents=True, exist_ok=True)
+        try:
+            shutil.copy2(path, target)
+            copied += 1
+        except OSError as exc:
+            LOG.debug("git mirror skipped %s: %s", rel, exc)
+    return copied
+
+
+def commit_version(
+    repo: Path,
+    code_dir: Path,
+    cfg: GitMirrorConfig,
+    seq: int,
+    message: str,
+    when_iso: str | None = None,
+    vendor_globs: list[str] | None = None,
+) -> MirrorResult:
+    """Replace the worktree with ``code_dir`` and commit it as version ``seq``."""
+    created = ensure_repo(repo, cfg)
+    _clear_worktree(repo)
+    # .gitattributes is part of the repo, not of any version; restore it.
+    (repo / ".gitattributes").write_text("* -text\n", encoding="utf-8")
+    _copy_tree(code_dir, repo, vendor_globs or [], cfg.include_vendor)
+
+    _run(repo, "add", "-A")
+    status = _run(repo, "status", "--porcelain")
+    tag = f"{cfg.tag_prefix}{seq:04d}"
+    if not status:
+        # Identical content: still tag it so `git diff v2 v10` never 404s.
+        try:
+            head = _run(repo, "rev-parse", "HEAD")
+            _run(repo, "tag", "-f", tag, head, check=False)
+            return MirrorResult(repo, head, tag, created)
+        except RuntimeError:
+            return MirrorResult(repo, None, None, created)
+
+    env_extra = {}
+    if when_iso:
+        env_extra = {"GIT_AUTHOR_DATE": when_iso, "GIT_COMMITTER_DATE": when_iso}
+    _run(repo, "-c", f"user.name={cfg.author_name}", "-c", f"user.email={cfg.author_email}",
+         "commit", "-q", "-m", message, env_extra=env_extra)
+    head = _run(repo, "rev-parse", "HEAD")
+    _run(repo, "tag", "-f", tag, head, check=False)
+    return MirrorResult(repo, head, tag, created)
+
+
+def diff(repo: Path, tag_a: str, tag_b: str, extra_args: list[str] | None = None) -> str:
+    args = ["diff", tag_a, tag_b]
+    if extra_args:
+        args = ["diff", *extra_args, tag_a, tag_b]
+    return _run(repo, *args, check=False)