langchain-xdataapi 0.1.1__tar.gz → 0.1.3__tar.gz

{langchain_xdataapi-0.1.1 → langchain_xdataapi-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: langchain-xdataapi
-Version: 0.1.1
+Version: 0.1.3
 Summary: LangChain tools for xdataapi.io: read-only public X (Twitter) profiles, tweets, threads, followers and search.
 Project-URL: Homepage, https://xdataapi.io
 Project-URL: Documentation, https://xdataapi.io/docs

{langchain_xdataapi-0.1.1 → langchain_xdataapi-0.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "langchain-xdataapi"
-version = "0.1.1"
+version = "0.1.3"
 description = "LangChain tools for xdataapi.io: read-only public X (Twitter) profiles, tweets, threads, followers and search."
 readme = "README.md"
 license = "MIT"

{langchain_xdataapi-0.1.1 → langchain_xdataapi-0.1.3}/src/langchain_xdataapi/tools.py

@@ -7,7 +7,9 @@ model that plans a multi-step read knows what the plan costs before it runs it.
 from __future__ import annotations
 
 import json
+import re
 from typing import Any, Literal, Sequence
+from urllib.parse import quote
 
 from langchain_core.callbacks import AsyncCallbackManagerForToolRun, CallbackManagerForToolRun
 from langchain_core.tools import BaseTool
@@ -16,10 +18,23 @@ from pydantic import BaseModel, ConfigDict, Field, model_validator
 from .client import XdataapiClient
 
 
+_USER_ID = re.compile(r"^\d{1,19}$")
+
+
 def _handle(value: str) -> str:
     return value.strip().lstrip("@")
 
 
+def _seg(value: Any) -> str:
+    """One URL path segment. The value comes from a model, so nothing in it may
+    act as a path: a slash is sent percent-encoded, and a segment that is empty
+    or only dots ("..") is refused, because encoding does not change a dot."""
+    s = str(value).strip()
+    if s.strip(".") == "":
+        raise ValueError("a handle, user or id must not be empty or only dots")
+    return quote(s, safe="")
+
+
 def _dump(payload: dict[str, Any]) -> str:
     return json.dumps(payload, ensure_ascii=False, separators=(",", ":"))
 
@@ -82,8 +97,10 @@ class GetUser(_Base):
     ) -> tuple[str, dict[str, Any] | None]:
         _one_of(handle, id, "handle or id")
         if id is not None:
-            return f"/v1/users/id/{id.strip()}", {"fresh": fresh}
-        return f"/v1/users/{_handle(handle or '')}", {"fresh": fresh}
+            if not _USER_ID.match(id.strip()):
+                raise ValueError("id must be a numeric user id")
+            return f"/v1/users/id/{_seg(id)}", {"fresh": fresh}
+        return f"/v1/users/{_seg(_handle(handle or ''))}", {"fresh": fresh}
 
 
 class _UsersArgs(BaseModel):
@@ -138,7 +155,7 @@ class GetUserTweets(_Base):
     def _call(
         self, user: str, count: int | None = None, cursor: str | None = None, fresh: bool | None = None
     ) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/users/{_handle(user)}/tweets", {
+        return f"/v1/users/{_seg(_handle(user))}/tweets", {
             "count": self.client.cap(count),
             "cursor": cursor,
             "fresh": fresh,
@@ -156,7 +173,7 @@ class GetFollowers(_Base):
     def _call(
         self, user: str, count: int | None = None, cursor: str | None = None, fresh: bool | None = None
     ) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/users/{_handle(user)}/followers", {
+        return f"/v1/users/{_seg(_handle(user))}/followers", {
             "count": self.client.cap(count),
             "cursor": cursor,
             "fresh": fresh,
@@ -174,7 +191,7 @@ class GetFollowerIds(_Base):
     def _call(
         self, user: str, count: int | None = None, cursor: str | None = None, fresh: bool | None = None
     ) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/users/{_handle(user)}/followers/ids", {
+        return f"/v1/users/{_seg(_handle(user))}/followers/ids", {
             "count": self.client.cap(count),
             "cursor": cursor,
             "fresh": fresh,
@@ -192,7 +209,7 @@ class GetFollowing(_Base):
     def _call(
         self, user: str, count: int | None = None, cursor: str | None = None, fresh: bool | None = None
     ) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/users/{_handle(user)}/following", {
+        return f"/v1/users/{_seg(_handle(user))}/following", {
             "count": self.client.cap(count),
             "cursor": cursor,
             "fresh": fresh,
@@ -259,7 +276,7 @@ class GetTweet(_Base):
     args_schema: type[BaseModel] = _TweetArgs
 
     def _call(self, id: str, fresh: bool | None = None) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/tweets/{id}", {"fresh": fresh}
+        return f"/v1/tweets/{_seg(id)}", {"fresh": fresh}
 
 
 class _TweetsArgs(BaseModel):
@@ -296,7 +313,7 @@ class GetThread(_Base):
     def _call(
         self, id: str, cursor: str | None = None, fresh: bool | None = None
     ) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/tweets/{id}/thread", {"cursor": cursor, "fresh": fresh}
+        return f"/v1/tweets/{_seg(id)}/thread", {"cursor": cursor, "fresh": fresh}
 
 
 class GetReplies(_Base):
@@ -307,7 +324,7 @@ class GetReplies(_Base):
     def _call(
         self, id: str, cursor: str | None = None, fresh: bool | None = None
     ) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/tweets/{id}/replies", {"cursor": cursor, "fresh": fresh}
+        return f"/v1/tweets/{_seg(id)}/replies", {"cursor": cursor, "fresh": fresh}
 
 
 class _CountedTweetArgs(BaseModel):
@@ -325,7 +342,7 @@ class GetQuotes(_Base):
     def _call(
         self, id: str, count: int | None = None, cursor: str | None = None, fresh: bool | None = None
     ) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/tweets/{id}/quotes", {
+        return f"/v1/tweets/{_seg(id)}/quotes", {
             "count": self.client.cap(count),
             "cursor": cursor,
             "fresh": fresh,
@@ -343,7 +360,7 @@ class GetRetweeters(_Base):
     def _call(
         self, id: str, count: int | None = None, cursor: str | None = None, fresh: bool | None = None
     ) -> tuple[str, dict[str, Any] | None]:
-        return f"/v1/tweets/{id}/retweeters", {
+        return f"/v1/tweets/{_seg(id)}/retweeters", {
             "count": self.client.cap(count),
             "cursor": cursor,
             "fresh": fresh,

{langchain_xdataapi-0.1.1 → langchain_xdataapi-0.1.3}/tests/test_tools.py

@@ -53,6 +53,30 @@ def test_get_user_wants_a_handle_or_an_id_and_not_both():
         tool.invoke({"id": "not-a-number"})
 
 
+@respx.mock
+def test_a_model_argument_cannot_leave_its_path_segment():
+    from langchain_xdataapi import GetTweet, GetUserTweets
+
+    route = respx.route(method="GET", host="api.xdataapi.io").mock(return_value=httpx.Response(404, json={"error": {"code": "not_found"}}))
+    GetUser(client=client()).invoke({"handle": "../me"})
+    assert route.calls.last.request.url.raw_path.startswith(b"/v1/users/..%2Fme")
+    GetUserTweets(client=client()).invoke({"user": "x/../../me"})
+    assert route.calls.last.request.url.raw_path.startswith(b"/v1/users/x%2F..%2F..%2Fme/tweets")
+    GetTweet(client=client()).invoke({"id": "20/../../me"})
+    assert route.calls.last.request.url.raw_path.startswith(b"/v1/tweets/20%2F..%2F..%2Fme")
+    # Encoding does not change a dot, so a segment of only dots is refused.
+    before = route.call_count
+    for bad in ("..", ".", " "):
+        with pytest.raises(ValueError, match="only dots"):
+            GetUserTweets(client=client()).invoke({"user": bad})
+        with pytest.raises(ValueError, match="only dots"):
+            GetTweet(client=client()).invoke({"id": bad})
+    assert route.call_count == before
+    # The id route takes digits only, also when the tool is called without its schema.
+    with pytest.raises(ValueError, match="numeric user id"):
+        GetUser(client=client())._call(id="1/../../me")
+
+
 @respx.mock
 def test_users_batch_by_ids_sends_ids_and_no_handles():
     route = respx.get(f"{BASE}/v1/users/batch").mock(return_value=httpx.Response(200, json={"data": []}))