log-foundry 0.9.1.dev1__tar.gz → 0.9.1.dev3__tar.gz

{log_foundry-0.9.1.dev1 → log_foundry-0.9.1.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: log-foundry
-Version: 0.9.1.dev1
+Version: 0.9.1.dev3
 Summary: Generate logs for your console and JSON events for downstream consumption.
 License-Expression: MIT
 License-File: LICENSE

{log_foundry-0.9.1.dev1 → log_foundry-0.9.1.dev3}/pyproject.toml

@@ -20,7 +20,7 @@ dependencies = [
 ]
 
 # Optional features. Install with: pip install log-foundry[aws]
-version = "0.9.1.dev1"
+version = "0.9.1.dev3"
 
 [project.optional-dependencies]
 aws = ["boto3>=1.43.61"]              # SQSSink, SNSSink, KinesisSink, FirehoseSink
@@ -70,6 +70,25 @@ pytest-cov = "^7.1.0"
 ruff = ">=0.16,<0.17"
 mypy = "^2.3"
 
+# Supply-chain tooling (SPEC-023 FR-007). `optional = true` keeps it OUT of the
+# `poetry install --with dev` that every CI matrix leg runs — neither tool is needed to lint,
+# typecheck or test, and both drag in dependency trees of their own. The two security workflows
+# ask for it explicitly with `--with security`.
+#
+# In the lockfile rather than fetched ad hoc so the versions are pinned and Dependabot's existing
+# `pip` ecosystem maintains them under its cooldown, like every other dependency here.
+[tool.poetry.group.security]
+optional = true
+
+#
+# Both carry a `python = "<4.0"` marker for the same reason `clickhouse-connect` carries one:
+# `requires-python = ">=3.12"` has no upper bound, so Poetry solves against a range that runs past
+# 4.0, and a dependency capped at `<4.0` makes resolution fail outright. The marker scopes the tool
+# instead of narrowing the library's own declared range.
+[tool.poetry.group.security.dependencies]
+cyclonedx-bom = { version = "^7.3", python = "<4.0" }   # the `cyclonedx-py` CLI (SBOM generation)
+pip-audit = { version = "^2.10", python = "<4.0" }      # OSV/PyPI advisory audit of the env
+
 
 [tool.poetry-dynamic-versioning]
 enable = false
@@ -138,8 +157,6 @@ ignore = [
                 # behind an import.
     "PERF203",  # try/except inside a loop is deliberate in the worker's drain: one bad batch
                 # must not abort the rest.
-    "S608",     # postgres.py and sqlite.py build INSERTs around a table name they validate
-                # themselves; the values are always parameterised.
     "UP047",    # PEP 695 `def f[T](...)`. Valid on the 3.12 floor, but rewriting the public
                 # `@trace` decorator's generics is a change to the signature users read, and
                 # the TypeVar form is not deprecated. Its own PR if ever.
@@ -154,6 +171,13 @@ ignore = [
 # FileSink and RotatingFileSink hold a handle open ACROSS calls by design — that is what makes
 # them a sink rather than a per-event open(). A context manager would close it after one emit.
 "src/log_foundry/sinks/file.py" = ["SIM115"]
+# These two build an INSERT around a table name because SQL cannot parameterize an identifier.
+# The name is run through `valid_identifier` at construction, so it is a plain SQL identifier by
+# the time it reaches the f-string, and every VALUE is parameterised. Scoped to these two files
+# rather than ignored repository-wide: a future sink that builds SQL less carefully should still
+# trip this rule.
+"src/log_foundry/sinks/postgres.py" = ["S608"]
+"src/log_foundry/sinks/sqlite.py" = ["S608"]
 
 [tool.mypy]
 files = ["src"]

{log_foundry-0.9.1.dev1 → log_foundry-0.9.1.dev3}/src/log_foundry/sinks/http.py

@@ -46,6 +46,10 @@ def merge_headers(base: dict[str, str], http_kwargs: dict[str, object]) -> dict[
 class HTTPSink:
     """A :class:`~log_foundry.sinks.base.Sink` that POSTs each batch to an HTTP endpoint.
 
+    Credentials passed as ``auth`` are sent on every request to ``url`` as given. Nothing here
+    requires ``https://`` — over a plaintext endpoint a bearer token, and a basic-auth pair (which
+    is base64, not encryption), travel in the clear. Use ``https://`` for anything off the host.
+
     Attributes:
         failed: Requests abandoned past the retry bound.
         dropped_oversized: Events dropped for exceeding a destination's hard size limit (used by
@@ -154,7 +158,14 @@ class HTTPSink:
         return headers, data
 
     def _apply_auth(self, headers: dict[str, str]) -> None:
-        """Apply bearer-token (str) or basic-auth (user, pass) credentials, if not already set."""
+        """Apply bearer-token (str) or basic-auth (user, pass) credentials, if not already set.
+
+        The scheme of ``url`` is NOT checked here: an ``http://`` endpoint sends these credentials
+        in cleartext, and basic auth is base64, not encryption. That is deliberate — a plaintext
+        endpoint is a legitimate configuration (a sidecar collector on loopback, an in-cluster
+        aggregator), and this library does not get to overrule the application's own deployment.
+        The caller owns the choice; see the class docstring.
+        """
         if self._auth is None or "Authorization" in headers:
             return
         if isinstance(self._auth, str):

{log_foundry-0.9.1.dev1 → log_foundry-0.9.1.dev3}/src/log_foundry/sinks/sqlite.py

@@ -13,19 +13,16 @@ ClickHouse, …) are out of scope here (the latter is SPEC-011).
 from __future__ import annotations
 
 import json
-import re
 import sqlite3
 
+from log_foundry.sinks._chunk import valid_identifier
+
 __all__ = ["SQLiteSink"]
 
 # Columns projected out of each event for cheap SQL filtering. ``event`` (full JSON) is stored
 # alongside these and is the source of truth; these are convenience projections (NULL if absent).
 _COLUMNS = ("log_id", "trace_id", "span_id", "timestamp", "level", "function")
 
-# A table name is a config value, not untrusted input, but it is interpolated into DDL/DML (SQLite
-# cannot parameterize identifiers), so restrict it to a plain SQL identifier to foreclose injection.
-_IDENTIFIER = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
-
 
 class SQLiteSink:
     """A :class:`~log_foundry.sinks.base.Sink` that batch-inserts events into a SQLite table.
@@ -49,9 +46,7 @@ class SQLiteSink:
         connection: sqlite3.Connection | None = None,
         create_table: bool = True,
     ) -> None:
-        if not _IDENTIFIER.match(table):
-            raise ValueError(f"invalid table name {table!r}; expected a plain SQL identifier")
-        self._table = table
+        self._table = valid_identifier(table)
         self._owns_connection = connection is None
         # check_same_thread=False: the background worker (a different thread than the one that ran
         # configure()) is the sole writer, so SQLite's same-thread guard would only get in the way