mostlyright-data 0.31.1__tar.gz → 0.31.3__tar.gz

{mostlyright_data-0.31.1 → mostlyright_data-0.31.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mostlyright-data
-Version: 0.31.1
+Version: 0.31.3
 Summary: Mostly Right hosted CLI for reviewed datasets
 Project-URL: Homepage, https://mostlyright.md/
 Project-URL: Documentation, https://mostlyright.md/docs/guides/cli/

{mostlyright_data-0.31.1 → mostlyright_data-0.31.3}/src/mostlyright/data_harness/thin/transport.py

@@ -10,10 +10,20 @@ to relax any of it.
 
 from __future__ import annotations
 
+import hashlib
+import http.client
 import ipaddress
+import math
+import re
 import ssl
+import threading
+import time
 from collections.abc import Callable, Iterator, Mapping
 from contextlib import contextmanager
+from email.message import Message
+from email.utils import parsedate_to_datetime
+from http.cookiejar import Cookie, CookieJar, DefaultCookiePolicy
+from http.cookies import CookieError, SimpleCookie
 from typing import Any, Protocol
 from urllib.error import HTTPError
 from urllib.parse import urlsplit
@@ -119,8 +129,9 @@ class UrlLibTransport:
 
     def __init__(self, *, timeout: float | Callable[[], float] = REQUEST_TIMEOUT_SECONDS) -> None:
         self._timeout = timeout if callable(timeout) else float(timeout)
+        self._context = ssl.create_default_context()
         self._opener = build_opener(
-            ProxyHandler({}), HTTPSHandler(context=ssl.create_default_context()), _NoRedirect()
+            ProxyHandler({}), HTTPSHandler(context=self._context), _NoRedirect()
         )
 
     def _clock(self) -> float:
@@ -171,6 +182,221 @@ class UrlLibTransport:
             response.close()
 
 
+class _RoutingCookiePolicy(DefaultCookiePolicy):
+    """Only Cloud Run's observed host-only routing cookie is retained."""
+
+    def set_ok(self, cookie: Cookie, request: Request) -> bool:
+        if (
+            cookie.name != "GAESA"
+            or cookie.domain_specified
+            or not cookie.path_specified
+            or cookie.path != "/"
+            or len(cookie.value or "") > 4096
+        ):
+            return False
+        # Cloud Run emits this without Secure. The transport accepts only
+        # verified HTTPS, and the stored form must never permit an HTTP send.
+        cookie.secure = True
+        return super().set_ok(cookie, request)
+
+
+class _RoutingCookieResponse:
+    def __init__(self, header: str) -> None:
+        self.headers = Message()
+        self.headers["Set-Cookie"] = header
+
+    def info(self) -> Message:
+        return self.headers
+
+
+def _remember_routing_cookie(
+    jar: CookieJar, response: http.client.HTTPResponse, request: Request
+) -> None:
+    candidates = [
+        value
+        for key, value in response.getheaders()
+        if key.lower() == "set-cookie" and value.partition("=")[0].strip() == "GAESA"
+    ]
+    if len(candidates) != 1:
+        return
+    header = candidates[0]
+    if (
+        len(header) > 8192
+        or "\r" in header
+        or "\n" in header
+        or len(re.findall(r"(?:^|[;,])\s*GAESA\s*=", header)) != 1
+    ):
+        return
+    parsed = SimpleCookie()
+    try:
+        parsed.load(header)
+        if set(parsed) != {"GAESA"}:
+            return
+        routing = parsed["GAESA"]
+        if not re.fullmatch(r"[\x21\x23-\x2b\x2d-\x3a\x3c-\x5b\x5d-\x7e]*", routing.value):
+            return
+        if routing["max-age"]:
+            age = routing["max-age"]
+            if (
+                not re.fullmatch(r"-?\d+", age)
+                or len(age.lstrip("-")) > 10
+                or abs(int(age)) > 2_147_483_647
+            ):
+                return
+        if routing["expires"]:
+            parsedate_to_datetime(routing["expires"])
+    except (CookieError, ValueError, OverflowError):
+        return
+    try:
+        jar.extract_cookies(_RoutingCookieResponse(header), request)
+    except (ValueError, OverflowError):
+        # Optional routing metadata must never invalidate a complete answer.
+        return
+
+
+class ReusableHttpsTransport(UrlLibTransport):
+    """One serialized, verified HTTPS connection for repeated query requests.
+
+    urllib deliberately sends Connection: close. A query client reuses its
+    own connection instead, never a global credential-bearing pool. Changing
+    origin closes the old socket. Responses are bounded and fully framed;
+    any failure discards the socket and is raised without replaying a POST.
+    Only the host-only root GAESA routing cookie is retained in memory, bound
+    to this client's exact origin and authorization context, never login cookies.
+    Streams retain the original urllib/proxy-free/redirect-free behavior.
+    """
+
+    def __init__(self, *, timeout: float | Callable[[], float] = REQUEST_TIMEOUT_SECONDS) -> None:
+        super().__init__(timeout=timeout)
+        self._lock = threading.Lock()
+        self._connection: http.client.HTTPSConnection | None = None
+        self._connection_origin: tuple[str, str, int] | None = None
+        self._routing = CookieJar(policy=_RoutingCookiePolicy())
+        self._routing_context: tuple[tuple[str, str, int], bytes] | None = None
+
+    def _discard(self) -> None:
+        connection, self._connection = self._connection, None
+        self._connection_origin = None
+        if connection is not None:
+            connection.close()
+
+    def close(self) -> None:
+        with self._lock:
+            self._discard()
+            self._routing.clear()
+            self._routing_context = None
+
+    def __enter__(self) -> ReusableHttpsTransport:
+        return self
+
+    def __exit__(self, *_args: Any) -> None:
+        self.close()
+
+    def __del__(self) -> None:
+        connection = getattr(self, "_connection", None)
+        if connection is not None:
+            connection.close()
+
+    def request(
+        self, method: str, url: str, headers: Mapping[str, str], body: bytes | None, maximum: int
+    ) -> tuple[int, bytes, Mapping[str, str]]:
+        if type(maximum) is not int or maximum < 0:
+            raise ThinLaneError("THIN_REQUEST_INVALID", "the response ceiling must be nonnegative")
+        parts = urlsplit(url)
+        service_origin(
+            f"{parts.scheme}://{parts.netloc}", "request origin", allow_loopback_http=False
+        )
+        if parts.scheme != "https" or parts.fragment or parts.hostname is None:
+            raise ThinLaneError(
+                "THIN_REQUEST_INVALID", "a reusable request requires a valid HTTPS URL"
+            )
+        origin = (parts.scheme, parts.hostname.lower(), parts.port or 443)
+        if any(
+            name.lower() == "host" and value.lower() != parts.netloc.lower()
+            for name, value in headers.items()
+        ):
+            raise ThinLaneError(
+                "THIN_REQUEST_INVALID", "the Host header differs from the request origin"
+            )
+        budget = self._clock()
+        if not math.isfinite(budget) or budget <= 0:
+            raise TimeoutError("the request deadline has elapsed")
+        deadline = time.monotonic() + budget
+        if not self._lock.acquire(timeout=budget):
+            raise TimeoutError("the request deadline elapsed waiting for its connection")
+
+        def remaining() -> float:
+            value = deadline - time.monotonic()
+            if value <= 0:
+                raise TimeoutError("the request deadline has elapsed")
+            return value
+
+        try:
+            context_headers = sorted(
+                (name.lower(), value)
+                for name, value in headers.items()
+                if name.lower() in {"authorization", "proxy-authorization", "cookie", "x-api-key"}
+            )
+            context = (origin, hashlib.sha256(repr(context_headers).encode()).digest())
+            if context != self._routing_context:
+                self._routing.clear()
+                self._routing_context = context
+            caller_cookie = any(name.lower() == "cookie" for name in headers)
+            cookie_request = Request(url, headers=dict(with_user_agent(headers)), method=method)
+            if not caller_cookie:
+                self._routing.add_cookie_header(cookie_request)
+            if self._connection_origin != origin:
+                self._discard()
+            if self._connection is None:
+                self._connection = http.client.HTTPSConnection(
+                    origin[1], origin[2], timeout=remaining(), context=self._context
+                )
+                self._connection_origin = origin
+            connection = self._connection
+            connection.timeout = remaining()
+            if connection.sock is not None:
+                connection.sock.settimeout(remaining())
+            path = parts.path or "/"
+            if parts.query:
+                path += "?" + parts.query
+            connection.request(method, path, body=body, headers=dict(cookie_request.header_items()))
+            if connection.sock is not None:
+                connection.sock.settimeout(remaining())
+            response = connection.getresponse()
+            expected = response.length
+            chunks: list[bytes] = []
+            length = 0
+            while length <= maximum:
+                if connection.sock is not None:
+                    connection.sock.settimeout(remaining())
+                chunk = response.read1(min(64 * 1024, maximum + 1 - length))
+                if not chunk:
+                    break
+                chunks.append(chunk)
+                length += len(chunk)
+            raw = b"".join(chunks)
+            if length > maximum:
+                raise ThinLaneError(
+                    "THIN_RESPONSE_TOO_LARGE",
+                    "the response exceeded the byte ceiling for its route",
+                )
+            if expected is not None and length != expected:
+                raise http.client.IncompleteRead(raw, expected - length)
+            if not caller_cookie:
+                _remember_routing_cookie(self._routing, response, cookie_request)
+            status = int(response.status)
+            response_headers = {key.lower(): value for key, value in response.headers.items()}
+            response.close()
+            if response.will_close or connection.sock is None or status < 200:
+                self._discard()
+            return status, raw, response_headers
+        except BaseException:
+            self._discard()
+            raise
+        finally:
+            self._lock.release()
+
+
 def service_origin(value: str, label: str, *, allow_loopback_http: bool) -> str:
     """Return ``value`` when it is a bare HTTPS origin, and refuse it otherwise.
 

{mostlyright_data-0.31.1 → mostlyright_data-0.31.3}/src/mostlyright/data_harness/thin/v4_public.py

@@ -46,6 +46,7 @@ from mostlyright.data_harness.thin.session import (
 )
 from mostlyright.data_harness.thin.transport import (
     MAX_JSON_RESPONSE_BYTES,
+    ReusableHttpsTransport,
     ThinLaneError,
     Transport,
     UrlLibTransport,
@@ -896,10 +897,25 @@ class PublicQueryClient(CloudClient):
     def __init__(self, credentials, *, transport=None) -> None:
         # Let Cloud's gateway deadline return its own refusal and request id first.
         super().__init__(credentials, transport=transport)
+        self._owned_query_transport = (
+            ReusableHttpsTransport(timeout=150.0) if transport is None else None
+        )
         self._query_client = CloudClient(
-            credentials, transport=transport or UrlLibTransport(timeout=150.0)
+            credentials,
+            transport=transport if transport is not None else self._owned_query_transport,
         )
 
+    def close(self) -> None:
+        """Close this client's owned query connection; injected transports stay caller-owned."""
+        if self._owned_query_transport is not None:
+            self._owned_query_transport.close()
+
+    def __enter__(self) -> PublicQueryClient:
+        return self
+
+    def __exit__(self, *_args: Any) -> None:
+        self.close()
+
     def query_table(self, table_id: str, body: Mapping[str, Any]) -> dict[str, Any]:
         answer = self._query_client.call(
             "POST",