mixedbread 0.49.0__tar.gz → 0.51.0__tar.gz

{mixedbread-0.49.0 → mixedbread-0.51.0}/.gitignore

@@ -1,4 +1,5 @@
 .prism.log
+.stdy.log
 _dev
 
 __pycache__

mixedbread-0.51.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.51.0"
+}

{mixedbread-0.49.0 → mixedbread-0.51.0}/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## 0.51.0 (2026-05-20)
+
+Full Changelog: [v0.50.0...v0.51.0](https://github.com/mixedbread-ai/mixedbread-python/compare/v0.50.0...v0.51.0)
+
+### Features
+
+* **api:** api update ([c59f556](https://github.com/mixedbread-ai/mixedbread-python/commit/c59f5561b5e782ae7e35b9cbfb498f357856c8f8))
+* **api:** api update ([842efa8](https://github.com/mixedbread-ai/mixedbread-python/commit/842efa840415d1a6d8f754f9c1594655283858c9))
+* **api:** api update ([6fe066e](https://github.com/mixedbread-ai/mixedbread-python/commit/6fe066e17443211a47a21f677344bf8c349e6fde))
+* **api:** api update ([eac4b8f](https://github.com/mixedbread-ai/mixedbread-python/commit/eac4b8f34275c9377765cfe62f677d5ca36cf061))
+* **api:** api update ([66aa7dc](https://github.com/mixedbread-ai/mixedbread-python/commit/66aa7dc394357766b869a3d067e4c130cdf482e8))
+* **internal/types:** support eagerly validating pydantic iterators ([3e9c5ac](https://github.com/mixedbread-ai/mixedbread-python/commit/3e9c5ac9ab56db4eddf8a6a2f219a8789c9c45ac))
+* support setting headers via env ([38de0ee](https://github.com/mixedbread-ai/mixedbread-python/commit/38de0ee2781d9e27d6aecafe89f5a5b5baaed75c))
+
+
+### Bug Fixes
+
+* **client:** add missing f-string prefix in file type error message ([fe74792](https://github.com/mixedbread-ai/mixedbread-python/commit/fe74792cd81bb58bd62e58c086d6d1ee6c233c25))
+* use correct field name format for multipart file arrays ([361fcd6](https://github.com/mixedbread-ai/mixedbread-python/commit/361fcd66f8422020375b076d4c70a83c2b82241d))
+
+
+### Chores
+
+* **internal:** reformat pyproject.toml ([8802c53](https://github.com/mixedbread-ai/mixedbread-python/commit/8802c53023895e9248f03b92477c9a17013ec7b7))
+
+## 0.50.0 (2026-04-23)
+
+Full Changelog: [v0.49.0...v0.50.0](https://github.com/mixedbread-ai/mixedbread-python/compare/v0.49.0...v0.50.0)
+
+### Features
+
+* **api:** api update ([9cb94bc](https://github.com/mixedbread-ai/mixedbread-python/commit/9cb94bcfc4cf74adfd82b1ff6e8166d5bf597bf7))
+* **api:** api update ([c7f1a92](https://github.com/mixedbread-ai/mixedbread-python/commit/c7f1a92a897408fe54d22ae773e617c0eb9be584))
+* **api:** api update ([34d8ca8](https://github.com/mixedbread-ai/mixedbread-python/commit/34d8ca84c2ed2fd3a7bf77a84047741b537a178a))
+* **api:** api update ([4ad956c](https://github.com/mixedbread-ai/mixedbread-python/commit/4ad956c1b52e6a08dc44958cb331451f5bec75af))
+* **api:** api update ([a24ebe9](https://github.com/mixedbread-ai/mixedbread-python/commit/a24ebe9e241e075c2958cefecfe9e972a5bcd55f))
+* include results in store search events response ([8bb1069](https://github.com/mixedbread-ai/mixedbread-python/commit/8bb1069f016d97cf24bf4f7031c180ca3752e07d))
+* **internal:** implement indices array format for query and form serialization ([e52e262](https://github.com/mixedbread-ai/mixedbread-python/commit/e52e262bd9acd3caa49cf9ba08a29b260b722bf0))
+
+
+### Bug Fixes
+
+* **client:** preserve hardcoded query params when merging with user params ([83d3f20](https://github.com/mixedbread-ai/mixedbread-python/commit/83d3f201d14edd8afa08a6046c2315097d6509d4))
+* ensure file data are only sent as 1 parameter ([0957f16](https://github.com/mixedbread-ai/mixedbread-python/commit/0957f16bb9a20c72499ae6ee86b9494c1e1ee5c8))
+* sanitize endpoint path params ([7d519be](https://github.com/mixedbread-ai/mixedbread-python/commit/7d519be7f4ea6b2ce11c9915ee1ac903ebb97cea))
+
+
+### Performance Improvements
+
+* **client:** optimize file structure copying in multipart requests ([63a2728](https://github.com/mixedbread-ai/mixedbread-python/commit/63a272878dc28300f5169d38cb523cc641498fed))
+
+
+### Chores
+
+* **ci:** skip lint on metadata-only changes ([a3ec133](https://github.com/mixedbread-ai/mixedbread-python/commit/a3ec133b88d1a70a066c17e29dd2ebd5decffb25))
+* **internal:** more robust bootstrap script ([5b52286](https://github.com/mixedbread-ai/mixedbread-python/commit/5b5228640759a7bf277d9478f10eeca3d358e10f))
+* **internal:** update gitignore ([cf3aa78](https://github.com/mixedbread-ai/mixedbread-python/commit/cf3aa78ec44036bbedce95735ee7ab43cc4d566a))
+* **tests:** bump steady to v0.19.4 ([d6e32d5](https://github.com/mixedbread-ai/mixedbread-python/commit/d6e32d5abe0e137375ea79373033c07057b22c83))
+* **tests:** bump steady to v0.19.5 ([59351b9](https://github.com/mixedbread-ai/mixedbread-python/commit/59351b9dcb0eaf2578c985c80a0501d610ff357d))
+* **tests:** bump steady to v0.19.6 ([ac0e7ac](https://github.com/mixedbread-ai/mixedbread-python/commit/ac0e7acc35384a0ae9f78040b60bce03f8258d81))
+* **tests:** bump steady to v0.19.7 ([839ee9c](https://github.com/mixedbread-ai/mixedbread-python/commit/839ee9c7c60749ae03a125f84e87a7be9365daac))
+* **tests:** bump steady to v0.20.1 ([31e2274](https://github.com/mixedbread-ai/mixedbread-python/commit/31e2274bfe265fbebae02c86beae2f575f9b7b18))
+* **tests:** bump steady to v0.20.2 ([6879b15](https://github.com/mixedbread-ai/mixedbread-python/commit/6879b159d830df5df58696899c7551c709595ed4))
+* **tests:** bump steady to v0.22.1 ([3f6450d](https://github.com/mixedbread-ai/mixedbread-python/commit/3f6450dbda2fe9baeee031495fd10f4d87fa815a))
+
+
+### Refactors
+
+* **tests:** switch from prism to steady ([cc454cf](https://github.com/mixedbread-ai/mixedbread-python/commit/cc454cfbe5752c8e439361c52fb31d2d2b14180d))
+
 ## 0.49.0 (2026-03-19)
 
 Full Changelog: [v0.48.0...v0.49.0](https://github.com/mixedbread-ai/mixedbread-python/compare/v0.48.0...v0.49.0)

{mixedbread-0.49.0 → mixedbread-0.51.0}/CONTRIBUTING.md

@@ -85,7 +85,7 @@ $ pip install ./path-to-wheel-file.whl
 
 ## Running tests
 
-Most tests require you to [set up a mock server](https://github.com/stoplightio/prism) against the OpenAPI spec to run the tests.
+Most tests require you to [set up a mock server](https://github.com/dgellow/steady) against the OpenAPI spec to run the tests.
 
 ```sh
 $ ./scripts/mock

{mixedbread-0.49.0 → mixedbread-0.51.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: mixedbread
-Version: 0.49.0
+Version: 0.51.0
 Summary: The official Python library for the Mixedbread API
 Project-URL: Homepage, https://github.com/mixedbread-ai/mixedbread-python
 Project-URL: Repository, https://github.com/mixedbread-ai/mixedbread-python

{mixedbread-0.49.0 → mixedbread-0.51.0}/api.md

@@ -1,7 +1,7 @@
 # Shared Types
 
 ```python
-from mixedbread.types import SearchFilter, SearchFilterCondition, Usage
+from mixedbread.types import SearchFilterCondition, Usage
 ```
 
 # Mixedbread
@@ -30,13 +30,29 @@ Types:
 
 ```python
 from mixedbread.types import (
+    AgenticSearchConfig,
+    AudioChunkGeneratedMetadata,
+    AudioURL,
+    CodeChunkGeneratedMetadata,
+    ContextualizationConfig,
     ExpiresAfter,
+    FileCounts,
+    ImageChunkGeneratedMetadata,
+    ImageURLOutput,
+    MarkdownChunkGeneratedMetadata,
+    MarkdownHeading,
+    PdfChunkGeneratedMetadata,
+    RerankConfig,
     ScoredAudioURLInputChunk,
     ScoredImageURLInputChunk,
     ScoredTextInputChunk,
     ScoredVideoURLInputChunk,
     Store,
     StoreChunkSearchOptions,
+    StoreConfig,
+    TextChunkGeneratedMetadata,
+    VideoChunkGeneratedMetadata,
+    VideoURL,
     StoreDeleteResponse,
     StoreMetadataFacetsResponse,
     StoreQuestionAnsweringResponse,
@@ -61,12 +77,15 @@ Types:
 
 ```python
 from mixedbread.types.stores import (
-    ScoredStoreFile,
-    StoreFileStatus,
+    AudioURLInputChunk,
+    ImageURLInputChunk,
     StoreFile,
+    StoreFileConfig,
+    StoreFileStatus,
+    TextInputChunk,
+    VideoURLInputChunk,
     FileListResponse,
     FileDeleteResponse,
-    FileSearchResponse,
 )
 ```
 
@@ -77,7 +96,6 @@ Methods:
 - <code title="patch /v1/stores/{store_identifier}/files/{file_identifier}">client.stores.files.<a href="./src/mixedbread/resources/stores/files.py">update</a>(file_identifier, \*, store_identifier, \*\*<a href="src/mixedbread/types/stores/file_update_params.py">params</a>) -> <a href="./src/mixedbread/types/stores/store_file.py">StoreFile</a></code>
 - <code title="post /v1/stores/{store_identifier}/files/list">client.stores.files.<a href="./src/mixedbread/resources/stores/files.py">list</a>(store_identifier, \*\*<a href="src/mixedbread/types/stores/file_list_params.py">params</a>) -> <a href="./src/mixedbread/types/stores/file_list_response.py">FileListResponse</a></code>
 - <code title="delete /v1/stores/{store_identifier}/files/{file_identifier}">client.stores.files.<a href="./src/mixedbread/resources/stores/files.py">delete</a>(file_identifier, \*, store_identifier) -> <a href="./src/mixedbread/types/stores/file_delete_response.py">FileDeleteResponse</a></code>
-- <code title="post /v1/stores/files/search">client.stores.files.<a href="./src/mixedbread/resources/stores/files.py">search</a>(\*\*<a href="src/mixedbread/types/stores/file_search_params.py">params</a>) -> <a href="./src/mixedbread/types/stores/file_search_response.py">FileSearchResponse</a></code>
 
 # Parsing
 
@@ -87,10 +105,13 @@ Types:
 
 ```python
 from mixedbread.types.parsing import (
+    Chunk,
+    ChunkElement,
     ChunkingStrategy,
+    DocumentParserResult,
     ElementType,
-    ParsingJobStatus,
     ParsingJob,
+    ParsingJobStatus,
     ReturnFormat,
     JobListResponse,
     JobDeleteResponse,
@@ -204,7 +225,9 @@ Types:
 
 ```python
 from mixedbread.types import (
+    APIKeyCreateOrUpdateParams,
     DataSource,
+    DataSourceAPIKeyParams,
     DataSourceOauth2Params,
     DataSourceType,
     LinearDataSource,
@@ -243,7 +266,7 @@ Methods:
 Types:
 
 ```python
-from mixedbread.types import APIKey, APIKeyCreated, APIKeyDeleteResponse
+from mixedbread.types import APIKey, APIKeyCreated, Scope, APIKeyDeleteResponse
 ```
 
 Methods:

{mixedbread-0.49.0 → mixedbread-0.51.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mixedbread"
-version = "0.49.0"
+version = "0.51.0"
 description = "The official Python library for the Mixedbread API"
 dynamic = ["readme"]
 license = "Apache-2.0"
@@ -168,7 +168,7 @@ show_error_codes = true
 #
 # We also exclude our `tests` as mypy doesn't always infer
 # types correctly and Pyright will still catch any type errors.
-exclude = ['src/mixedbread/_files.py', '_dev/.*.py', 'tests/.*']
+exclude = ["src/mixedbread/_files.py", "_dev/.*.py", "tests/.*"]
 
 strict_equality = true
 implicit_reexport = true

{mixedbread-0.49.0 → mixedbread-0.51.0}/src/mixedbread/_base_client.py

@@ -540,6 +540,10 @@ class BaseClient(Generic[_HttpxClientT, _DefaultStreamT]):
                 files = cast(HttpxRequestFiles, ForceMultipartDict())
 
         prepared_url = self._prepare_url(options.url)
+        # preserve hard-coded query params from the url
+        if params and prepared_url.query:
+            params = {**dict(prepared_url.params.items()), **params}
+            prepared_url = prepared_url.copy_with(raw_path=prepared_url.raw_path.split(b"?", 1)[0])
         if "_" in prepared_url.host:
             # work around https://github.com/encode/httpx/discussions/2880
             kwargs["extensions"] = {"sni_hostname": prepared_url.host.replace("_", "-")}

{mixedbread-0.49.0 → mixedbread-0.51.0}/src/mixedbread/_client.py

@@ -27,6 +27,7 @@ from ._types import (
 )
 from ._utils import (
     is_given,
+    is_mapping_t,
     maybe_transform,
     get_async_library,
     async_maybe_transform,
@@ -150,6 +151,15 @@ class Mixedbread(SyncAPIClient):
             except KeyError as exc:
                 raise ValueError(f"Unknown environment: {environment}") from exc
 
+        custom_headers_env = os.environ.get("MIXEDBREAD_CUSTOM_HEADERS")
+        if custom_headers_env is not None:
+            parsed: dict[str, str] = {}
+            for line in custom_headers_env.split("\n"):
+                colon = line.find(":")
+                if colon >= 0:
+                    parsed[line[:colon].strip()] = line[colon + 1 :].strip()
+            default_headers = {**parsed, **(default_headers if is_mapping_t(default_headers) else {})}
+
         super().__init__(
             version=__version__,
             base_url=base_url,
@@ -547,6 +557,15 @@ class AsyncMixedbread(AsyncAPIClient):
             except KeyError as exc:
                 raise ValueError(f"Unknown environment: {environment}") from exc
 
+        custom_headers_env = os.environ.get("MIXEDBREAD_CUSTOM_HEADERS")
+        if custom_headers_env is not None:
+            parsed: dict[str, str] = {}
+            for line in custom_headers_env.split("\n"):
+                colon = line.find(":")
+                if colon >= 0:
+                    parsed[line[:colon].strip()] = line[colon + 1 :].strip()
+            default_headers = {**parsed, **(default_headers if is_mapping_t(default_headers) else {})}
+
         super().__init__(
             version=__version__,
             base_url=base_url,

{mixedbread-0.49.0 → mixedbread-0.51.0}/src/mixedbread/_files.py

@@ -3,8 +3,8 @@ from __future__ import annotations
 import io
 import os
 import pathlib
-from typing import overload
-from typing_extensions import TypeGuard
+from typing import Sequence, cast, overload
+from typing_extensions import TypeVar, TypeGuard
 
 import anyio
 
@@ -17,7 +17,9 @@ from ._types import (
     HttpxFileContent,
     HttpxRequestFiles,
 )
-from ._utils import is_tuple_t, is_mapping_t, is_sequence_t
+from ._utils import is_list, is_mapping, is_tuple_t, is_mapping_t, is_sequence_t
+
+_T = TypeVar("_T")
 
 
 def is_base64_file_input(obj: object) -> TypeGuard[Base64FileInput]:
@@ -97,7 +99,7 @@ async def async_to_httpx_files(files: RequestFiles | None) -> HttpxRequestFiles
     elif is_sequence_t(files):
         files = [(key, await _async_transform_file(file)) for key, file in files]
     else:
-        raise TypeError("Unexpected file type input {type(files)}, expected mapping or sequence")
+        raise TypeError(f"Unexpected file type input {type(files)}, expected mapping or sequence")
 
     return files
 
@@ -121,3 +123,51 @@ async def async_read_file_content(file: FileContent) -> HttpxFileContent:
         return await anyio.Path(file).read_bytes()
 
     return file
+
+
+def deepcopy_with_paths(item: _T, paths: Sequence[Sequence[str]]) -> _T:
+    """Copy only the containers along the given paths.
+
+    Used to guard against mutation by extract_files without copying the entire structure.
+    Only dicts and lists that lie on a path are copied; everything else
+    is returned by reference.
+
+    For example, given paths=[["foo", "files", "file"]] and the structure:
+        {
+            "foo": {
+                "bar": {"baz": {}},
+                "files": {"file": <content>}
+            }
+        }
+    The root dict, "foo", and "files" are copied (they lie on the path).
+    "bar" and "baz" are returned by reference (off the path).
+    """
+    return _deepcopy_with_paths(item, paths, 0)
+
+
+def _deepcopy_with_paths(item: _T, paths: Sequence[Sequence[str]], index: int) -> _T:
+    if not paths:
+        return item
+    if is_mapping(item):
+        key_to_paths: dict[str, list[Sequence[str]]] = {}
+        for path in paths:
+            if index < len(path):
+                key_to_paths.setdefault(path[index], []).append(path)
+
+        # if no path continues through this mapping, it won't be mutated and copying it is redundant
+        if not key_to_paths:
+            return item
+
+        result = dict(item)
+        for key, subpaths in key_to_paths.items():
+            if key in result:
+                result[key] = _deepcopy_with_paths(result[key], subpaths, index + 1)
+        return cast(_T, result)
+    if is_list(item):
+        array_paths = [path for path in paths if index < len(path) and path[index] == "<array>"]
+
+        # if no path expects a list here, nothing will be mutated inside it - return by reference
+        if not array_paths:
+            return cast(_T, item)
+        return cast(_T, [_deepcopy_with_paths(entry, array_paths, index + 1) for entry in item])
+    return item

{mixedbread-0.49.0 → mixedbread-0.51.0}/src/mixedbread/_models.py

@@ -25,7 +25,9 @@ from typing_extensions import (
     ClassVar,
     Protocol,
     Required,
+    Annotated,
     ParamSpec,
+    TypeAlias,
     TypedDict,
     TypeGuard,
     final,
@@ -79,7 +81,15 @@ from ._compat import (
 from ._constants import RAW_RESPONSE_HEADER
 
 if TYPE_CHECKING:
+    from pydantic import GetCoreSchemaHandler, ValidatorFunctionWrapHandler
+    from pydantic_core import CoreSchema, core_schema
     from pydantic_core.core_schema import ModelField, ModelSchema, LiteralSchema, ModelFieldsSchema
+else:
+    try:
+        from pydantic_core import CoreSchema, core_schema
+    except ImportError:
+        CoreSchema = None
+        core_schema = None
 
 __all__ = ["BaseModel", "GenericModel"]
 
@@ -396,6 +406,76 @@ class BaseModel(pydantic.BaseModel):
             )
 
 
+class _EagerIterable(list[_T], Generic[_T]):
+    """
+    Accepts any Iterable[T] input (including generators), consumes it
+    eagerly, and validates all items upfront.
+
+    Validation preserves the original container type where possible
+    (e.g. a set[T] stays a set[T]).  Serialization (model_dump / JSON)
+    always emits a list — round-tripping through model_dump() will not
+    restore the original container type.
+    """
+
+    @classmethod
+    def __get_pydantic_core_schema__(
+        cls,
+        source_type: Any,
+        handler: GetCoreSchemaHandler,
+    ) -> CoreSchema:
+        (item_type,) = get_args(source_type) or (Any,)
+        item_schema: CoreSchema = handler.generate_schema(item_type)
+        list_of_items_schema: CoreSchema = core_schema.list_schema(item_schema)
+
+        return core_schema.no_info_wrap_validator_function(
+            cls._validate,
+            list_of_items_schema,
+            serialization=core_schema.plain_serializer_function_ser_schema(
+                cls._serialize,
+                info_arg=False,
+            ),
+        )
+
+    @staticmethod
+    def _validate(v: Iterable[_T], handler: "ValidatorFunctionWrapHandler") -> Any:
+        original_type: type[Any] = type(v)
+
+        # Normalize to list so list_schema can validate each item
+        if isinstance(v, list):
+            items: list[_T] = v
+        else:
+            try:
+                items = list(v)
+            except TypeError as e:
+                raise TypeError("Value is not iterable") from e
+
+        # Validate items against the inner schema
+        validated: list[_T] = handler(items)
+
+        # Reconstruct original container type
+        if original_type is list:
+            return validated
+        # str(list) produces the list's repr, not a string built from items,
+        # so skip reconstruction for str and its subclasses.
+        if issubclass(original_type, str):
+            return validated
+        try:
+            return original_type(validated)
+        except (TypeError, ValueError):
+            # If the type cannot be reconstructed, just return the validated list
+            return validated
+
+    @staticmethod
+    def _serialize(v: Iterable[_T]) -> list[_T]:
+        """Always serialize as a list so Pydantic's JSON encoder is happy."""
+        if isinstance(v, list):
+            return v
+        return list(v)
+
+
+EagerIterable: TypeAlias = Annotated[Iterable[_T], _EagerIterable]
+
+
 def _construct_field(value: object, field: FieldInfo, key: str) -> object:
     if value is None:
         return field_get_default(field)

{mixedbread-0.49.0 → mixedbread-0.51.0}/src/mixedbread/_qs.py

@@ -2,17 +2,13 @@ from __future__ import annotations
 
 from typing import Any, List, Tuple, Union, Mapping, TypeVar
 from urllib.parse import parse_qs, urlencode
-from typing_extensions import Literal, get_args
+from typing_extensions import get_args
 
-from ._types import NotGiven, not_given
+from ._types import NotGiven, ArrayFormat, NestedFormat, not_given
 from ._utils import flatten
 
 _T = TypeVar("_T")
 
-
-ArrayFormat = Literal["comma", "repeat", "indices", "brackets"]
-NestedFormat = Literal["dots", "brackets"]
-
 PrimitiveData = Union[str, int, float, bool, None]
 # this should be Data = Union[PrimitiveData, "List[Data]", "Tuple[Data]", "Mapping[str, Data]"]
 # https://github.com/microsoft/pyright/issues/3555
@@ -101,7 +97,10 @@ class Querystring:
                     items.extend(self._stringify_item(key, item, opts))
                 return items
             elif array_format == "indices":
-                raise NotImplementedError("The array indices format is not supported yet")
+                items = []
+                for i, item in enumerate(value):
+                    items.extend(self._stringify_item(f"{key}[{i}]", item, opts))
+                return items
             elif array_format == "brackets":
                 items = []
                 key = key + "[]"

{mixedbread-0.49.0 → mixedbread-0.51.0}/src/mixedbread/_types.py

@@ -47,6 +47,9 @@ AnyMapping = Mapping[str, object]
 ModelT = TypeVar("ModelT", bound=pydantic.BaseModel)
 _T = TypeVar("_T")
 
+ArrayFormat = Literal["comma", "repeat", "indices", "brackets"]
+NestedFormat = Literal["dots", "brackets"]
+
 
 # Approximates httpx internal ProxiesTypes and RequestFiles types
 # while adding support for `PathLike` instances

{mixedbread-0.49.0 → mixedbread-0.51.0}/src/mixedbread/_utils/__init__.py

@@ -1,3 +1,4 @@
+from ._path import path_template as path_template
 from ._sync import asyncify as asyncify
 from ._proxy import LazyProxy as LazyProxy
 from ._utils import (
@@ -23,7 +24,6 @@ from ._utils import (
     coerce_integer as coerce_integer,
     file_from_path as file_from_path,
     strip_not_given as strip_not_given,
-    deepcopy_minimal as deepcopy_minimal,
     get_async_library as get_async_library,
     maybe_coerce_float as maybe_coerce_float,
     get_required_header as get_required_header,

mixedbread-0.51.0/src/mixedbread/_utils/_path.py

@@ -0,0 +1,127 @@
+from __future__ import annotations
+
+import re
+from typing import (
+    Any,
+    Mapping,
+    Callable,
+)
+from urllib.parse import quote
+
+# Matches '.' or '..' where each dot is either literal or percent-encoded (%2e / %2E).
+_DOT_SEGMENT_RE = re.compile(r"^(?:\.|%2[eE]){1,2}$")
+
+_PLACEHOLDER_RE = re.compile(r"\{(\w+)\}")
+
+
+def _quote_path_segment_part(value: str) -> str:
+    """Percent-encode `value` for use in a URI path segment.
+
+    Considers characters not in `pchar` set from RFC 3986 §3.3 to be unsafe.
+    https://datatracker.ietf.org/doc/html/rfc3986#section-3.3
+    """
+    # quote() already treats unreserved characters (letters, digits, and -._~)
+    # as safe, so we only need to add sub-delims, ':', and '@'.
+    # Notably, unlike the default `safe` for quote(), / is unsafe and must be quoted.
+    return quote(value, safe="!$&'()*+,;=:@")
+
+
+def _quote_query_part(value: str) -> str:
+    """Percent-encode `value` for use in a URI query string.
+
+    Considers &, = and characters not in `query` set from RFC 3986 §3.4 to be unsafe.
+    https://datatracker.ietf.org/doc/html/rfc3986#section-3.4
+    """
+    return quote(value, safe="!$'()*+,;:@/?")
+
+
+def _quote_fragment_part(value: str) -> str:
+    """Percent-encode `value` for use in a URI fragment.
+
+    Considers characters not in `fragment` set from RFC 3986 §3.5 to be unsafe.
+    https://datatracker.ietf.org/doc/html/rfc3986#section-3.5
+    """
+    return quote(value, safe="!$&'()*+,;=:@/?")
+
+
+def _interpolate(
+    template: str,
+    values: Mapping[str, Any],
+    quoter: Callable[[str], str],
+) -> str:
+    """Replace {name} placeholders in `template`, quoting each value with `quoter`.
+
+    Placeholder names are looked up in `values`.
+
+    Raises:
+        KeyError: If a placeholder is not found in `values`.
+    """
+    # re.split with a capturing group returns alternating
+    # [text, name, text, name, ..., text] elements.
+    parts = _PLACEHOLDER_RE.split(template)
+
+    for i in range(1, len(parts), 2):
+        name = parts[i]
+        if name not in values:
+            raise KeyError(f"a value for placeholder {{{name}}} was not provided")
+        val = values[name]
+        if val is None:
+            parts[i] = "null"
+        elif isinstance(val, bool):
+            parts[i] = "true" if val else "false"
+        else:
+            parts[i] = quoter(str(values[name]))
+
+    return "".join(parts)
+
+
+def path_template(template: str, /, **kwargs: Any) -> str:
+    """Interpolate {name} placeholders in `template` from keyword arguments.
+
+    Args:
+        template: The template string containing {name} placeholders.
+        **kwargs: Keyword arguments to interpolate into the template.
+
+    Returns:
+        The template with placeholders interpolated and percent-encoded.
+
+        Safe characters for percent-encoding are dependent on the URI component.
+        Placeholders in path and fragment portions are percent-encoded where the `segment`
+        and `fragment` sets from RFC 3986 respectively are considered safe.
+        Placeholders in the query portion are percent-encoded where the `query` set from
+        RFC 3986 §3.3 is considered safe except for = and & characters.
+
+    Raises:
+        KeyError: If a placeholder is not found in `kwargs`.
+        ValueError: If resulting path contains /./ or /../ segments (including percent-encoded dot-segments).
+    """
+    # Split the template into path, query, and fragment portions.
+    fragment_template: str | None = None
+    query_template: str | None = None
+
+    rest = template
+    if "#" in rest:
+        rest, fragment_template = rest.split("#", 1)
+    if "?" in rest:
+        rest, query_template = rest.split("?", 1)
+    path_template = rest
+
+    # Interpolate each portion with the appropriate quoting rules.
+    path_result = _interpolate(path_template, kwargs, _quote_path_segment_part)
+
+    # Reject dot-segments (. and ..) in the final assembled path.  The check
+    # runs after interpolation so that adjacent placeholders or a mix of static
+    # text and placeholders that together form a dot-segment are caught.
+    # Also reject percent-encoded dot-segments to protect against incorrectly
+    # implemented normalization in servers/proxies.
+    for segment in path_result.split("/"):
+        if _DOT_SEGMENT_RE.match(segment):
+            raise ValueError(f"Constructed path {path_result!r} contains dot-segment {segment!r} which is not allowed")
+
+    result = path_result
+    if query_template is not None:
+        result += "?" + _interpolate(query_template, kwargs, _quote_query_part)
+    if fragment_template is not None:
+        result += "#" + _interpolate(fragment_template, kwargs, _quote_fragment_part)
+
+    return result