mostlyright-data 0.19.8__tar.gz → 0.20.0__tar.gz

{mostlyright_data-0.19.8 → mostlyright_data-0.20.0}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: mostlyright-data
-Version: 0.19.8
+Version: 0.20.0
 Summary: Mostly Right hosted CLI for reviewed datasets
 Project-URL: Homepage, https://mostlyright.md/
 Project-URL: Documentation, https://mostlyright.md/docs/guides/cli/
-Requires-Python: >=3.13
+Requires-Python: >=3.11
 Provides-Extra: build
 Requires-Dist: hatchling==1.28.0; extra == 'build'
 Requires-Dist: uv-build==0.11.3; extra == 'build'
@@ -22,7 +22,7 @@ they finish.
 
 ## Requirements
 
-Use CPython 3.13 or newer.
+Use CPython 3.11 or newer.
 
 ## Install
 

{mostlyright_data-0.19.8 → mostlyright_data-0.20.0}/README.md

@@ -10,7 +10,7 @@ they finish.
 
 ## Requirements
 
-Use CPython 3.13 or newer.
+Use CPython 3.11 or newer.
 
 ## Install
 

{mostlyright_data-0.19.8 → mostlyright_data-0.20.0}/pyproject.toml

@@ -1,9 +1,9 @@
 [project]
 name = "mostlyright-data"
-version = "0.19.8"
+version = "0.20.0"
 description = "Mostly Right hosted CLI for reviewed datasets"
 readme = "README.md"
-requires-python = ">=3.13"
+requires-python = ">=3.11"
 # The published Harness package is a pure-Python, stdlib-only hosted client.  Dataset execution,
 # native readers, and worker publication live in Mostly Right Studio.
 dependencies = []

{mostlyright_data-0.19.8 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/thin/__init__.py

@@ -1,6 +1,6 @@
 """The pure-Python hosted lane: auth, submit, stream, download, receipts.
 
-Every module in this package is importable on a bare CPython 3.13 with no compiled extension in
+Every module in this package is importable on a bare CPython 3.11 with no compiled extension in
 site-packages. That is the whole contract of the package and it is asserted rather than intended:
 :mod:`tests.test_thin_profile` installs the base distribution into a fresh environment, refuses any
 ``.so``/``.pyd``/``.dylib`` it finds, and imports the command router there.

{mostlyright_data-0.19.8 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/ux/credential_store.py

@@ -789,8 +789,13 @@ def _ensure_private_directory(path: Path) -> None:
             created = True
         except FileExistsError:
             created = False
-        if created and os.name == "posix":
-            os.chmod(path, 0o700, follow_symlinks=False)
+        if os.name == "posix":
+            if created:
+                # The umask may have stripped bits from the mode ``mkdir`` was asked for, and a
+                # directory this call just made is one it owns.
+                os.chmod(path, 0o700)
+            else:
+                _narrow_private_directory(path)
         _validate_private_directory(path)
     except OSError:
         raise CredentialStoreError(
@@ -798,6 +803,42 @@ def _ensure_private_directory(path: Path) -> None:
         ) from None
 
 
+def _narrow_private_directory(path: Path) -> None:
+    """Bring a directory this user already owns down to 0700 before the gate below reads it.
+
+    Another tool can have created the same directory under an ordinary umask, which lands it at
+    0755 and makes every later read and write refuse it.  It is still this effective user's
+    directory, so narrowing it is repair rather than a decision.
+
+    The descriptor is the whole safety argument.  ``O_NOFOLLOW`` and ``O_DIRECTORY`` mean a symlink
+    and a non-directory never open at all, so neither can be chmod'ed and both leave through the
+    ``OSError`` the caller turns into a refusal, and the owner is read off the same descriptor the
+    mode is written through, so a directory belonging to somebody else is left exactly as found for
+    :func:`_validate_private_directory` to refuse.
+    """
+
+    try:
+        descriptor = os.open(
+            path,
+            os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0),
+        )
+    except PermissionError:
+        # A directory without its owner-read bit cannot be opened, so the descriptor argument is
+        # unavailable and the kind and owner are read from the name instead.
+        info = os.lstat(path)
+        if stat.S_ISDIR(info.st_mode) and info.st_uid == os.geteuid():
+            os.chmod(path, 0o700)
+        return
+    try:
+        info = os.fstat(descriptor)
+        if not stat.S_ISDIR(info.st_mode) or info.st_uid != os.geteuid():
+            return
+        if stat.S_IMODE(info.st_mode) != 0o700:
+            os.fchmod(descriptor, 0o700)
+    finally:
+        os.close(descriptor)
+
+
 def _validate_private_directory(path: Path) -> None:
     try:
         info = path.stat(follow_symlinks=False)

{mostlyright_data-0.19.8 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/ux/credentials.py

@@ -199,7 +199,7 @@ def store_credentials(
     except LoginError:
         raise
     except CredentialStoreError as error:
-        raise _login_store_error(error) from None
+        raise login_store_error(error) from None
     except OSError:
         raise LoginError(
             "LOGIN_CREDENTIAL_MIGRATION_FAILED",
@@ -251,7 +251,7 @@ def read_credentials(
     except LoginError:
         raise
     except CredentialStoreError as error:
-        raise _login_store_error(error) from None
+        raise login_store_error(error) from None
     except OSError:
         raise LoginError(
             "LOGIN_CREDENTIALS_UNREADABLE",
@@ -392,16 +392,19 @@ def _native_backend_name(directory: Path) -> str:
     try:
         return native_backend(directory).name
     except CredentialStoreError as error:
-        raise _login_store_error(error) from None
+        raise login_store_error(error) from None
 
 
 def _backend_for(directory: Path, backend_name: str) -> CredentialBackend:
     if backend_name == "secure-file":
-        return SecureFileBackend(directory, explicit=True)
+        try:
+            return SecureFileBackend(directory, explicit=True)
+        except CredentialStoreError as error:
+            raise login_store_error(error) from None
     try:
         backend = native_backend(directory)
     except CredentialStoreError as error:
-        raise _login_store_error(error) from None
+        raise login_store_error(error) from None
     if backend.name != backend_name:
         raise LoginError(
             "LOGIN_CREDENTIAL_STORE_UNAVAILABLE",
@@ -588,7 +591,7 @@ def _install_manifest(path: Path, backend_name: str) -> None:
             stage.unlink()
 
 
-def _login_store_error(error: CredentialStoreError) -> LoginError:
+def login_store_error(error: CredentialStoreError) -> LoginError:
     suffix = error.code.removeprefix("CREDENTIAL_")
     details = {
         "CREDENTIAL_STORE_UNAVAILABLE": (
@@ -606,7 +609,7 @@ def _login_store_error(error: CredentialStoreError) -> LoginError:
     }
     return LoginError(
         f"LOGIN_CREDENTIAL_{suffix}",
-        details.get(error.code, "the protected credential operation failed"),
+        details.get(error.code, error.detail or "the protected credential operation failed"),
     )
 
 
@@ -622,6 +625,7 @@ __all__ = [
     "credentials_path",
     "default_credentials_dir",
     "install_credential_manifest",
+    "login_store_error",
     "read_credentials",
     "refuse_existing_credentials",
     "remove_credential_manifest_under_held_lock",

{mostlyright_data-0.19.8 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/ux/login.py

@@ -63,6 +63,7 @@ from mostlyright.data_harness.ux.credentials import (
     StoredCredentials,
     credential_transaction_store,
     install_credential_manifest,
+    login_store_error,
     refuse_existing_credentials,
 )
 
@@ -529,7 +530,7 @@ def run_login(
         if not manifest_path.exists():
             install_credential_manifest(manifest_path, store.backend.name)
     except CredentialStoreError as error:
-        raise LoginError("LOGIN_CREDENTIAL_RECOVERY_REQUIRED", error.detail) from None
+        raise login_store_error(error) from None
     live_transport = transport or UrlLibDeviceFlowTransport()
 
     authorization = request_device_code(resolved_cloud_url, transport=live_transport)

{mostlyright_data-0.19.8 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/ux/remediation.py

@@ -11,7 +11,7 @@ neither affordable nor honest:
 * **Families.** Every code prefix is assigned to a family -- 224 of them, plus 18 compound
   prefixes, across 38 families. A family is one paragraph: what this class of failure is about,
   where to look, and what to do. Every prefix has one, so no code can fail to say something useful.
-* **Curated codes.** The 102 failures a person actually meets get their own exact sentences, and
+* **Curated codes.** The 103 failures a person actually meets get their own exact sentences, and
   where one command is the whole answer, the command itself.
 
 Those four counts are not a note somebody remembered to update:
@@ -1770,6 +1770,19 @@ CODES: dict[str, Remediation] = {
             "mr-data login --force.",
         ),
     ),
+    # `mr-data` narrows a credential directory it already owns, so what is left for this code to
+    # report is something it may not touch on its own.
+    "LOGIN_CREDENTIAL_STORE_PERMISSIONS": Remediation(
+        lines=(
+            "The place the device credential is kept is not a private folder this account owns, "
+            "so nothing was read from it or written to it.",
+            "That place is ~/.mostlyright. A folder there that you own is narrowed to your "
+            "account automatically, so the usual causes are a link, a file, or a folder of "
+            "another account at that name, or a volume that does not accept the change.",
+            "Look at what sits at that path and who owns it. Put a folder you own there, then "
+            "run mr-data login again.",
+        ),
+    ),
     "LOGIN_CREDENTIALS_UNREADABLE": Remediation(
         lines=(
             "The stored credential at the path named above exists but cannot be read as the file "