mostlyright-data 0.29.2__tar.gz → 0.29.3__tar.gz

{mostlyright_data-0.29.2 → mostlyright_data-0.29.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mostlyright-data
-Version: 0.29.2
+Version: 0.29.3
 Summary: Mostly Right hosted CLI for reviewed datasets
 Project-URL: Homepage, https://mostlyright.md/
 Project-URL: Documentation, https://mostlyright.md/docs/guides/cli/

{mostlyright_data-0.29.2 → mostlyright_data-0.29.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mostlyright-data"
-version = "0.29.2"
+version = "0.29.3"
 description = "Mostly Right hosted CLI for reviewed datasets"
 readme = "README.md"
 requires-python = ">=3.11"

{mostlyright_data-0.29.2 → mostlyright_data-0.29.3}/src/mostlyright/data_harness/ux/credential_store.py

@@ -895,8 +895,13 @@ def _validate_private_file(
     if os.name == "posix":
         valid = valid and info.st_uid == os.geteuid() and stat.S_IMODE(info.st_mode) == 0o600
     elif os.name == "nt":
-        valid = path is not None and _windows_acl_is_private(
-            path, require_confidential=require_confidential
+        # The DACL proof adds to the regular-file, single-link test as the owner and mode test does
+        # above. A second name is how a hard link steers a read or write to another path, and a
+        # DACL says nothing about it.
+        valid = (
+            valid
+            and path is not None
+            and _windows_acl_is_private(path, require_confidential=require_confidential)
         )
     if not valid:
         raise _permission_refusal()