pywrit 0.2.8__tar.gz → 0.2.9__tar.gz

{pywrit-0.2.8/src/pywrit.egg-info → pywrit-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.2.8
+Version: 0.2.9
 Summary: Python client + CLI for Writ — the gate before the write
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/withwrit/pywrit
@@ -154,7 +154,11 @@ Python scanning never needs it.
 TS/JS is **scan-only**: findings are listed with verbs for your policy file,
 but `writ scan --apply` never rewrites TS/JS files — gate those by hand.
 Covered patterns: `fetch`/`axios` writes, `fs` writes, SQL through knex-style
-clients, Prisma writes, and JS SDK calls such as `stripe.refunds.create(...)`.
+clients, Prisma writes, JS SDK calls such as `stripe.refunds.create(...)`, and
+generated REST resource clients: `create` / `update` / `patch` / `remove`
+methods (plus their `...WithHttpInfo` variants) that build request options
+with an explicit write HTTP method and route them through the client request
+pipeline (twilio-style generated clients, e.g. `twilio-node`).
 (Still not covered: the *Python* SDK equivalents like `stripe.Refund.create(...)`
 — see "Not covered" above.)
 
@@ -177,6 +181,13 @@ job summary. The check fails when an ungated finding meets your
 No API key needed. Full reference: [docs/github-action.md](docs/github-action.md) ·
 example workflow: [examples/github-action/writ-scan.yml](examples/github-action/writ-scan.yml)
 
+## GitHub App
+
+Install the [Writ GitHub App](https://docs.withwrit.com/git-hub-app) on selected
+repositories: every push and pull request is scanned for ungated write-sites,
+with results as a check run on the PR and in the
+[portal](https://app.withwrit.com), where you manage policy, keys, and the audit log.
+
 ## MCP server (`writ-mcp`)
 
 Give any MCP-compatible agent point-of-action policy checks. `writ-mcp` is a

{pywrit-0.2.8 → pywrit-0.2.9}/README.md

@@ -132,7 +132,11 @@ Python scanning never needs it.
 TS/JS is **scan-only**: findings are listed with verbs for your policy file,
 but `writ scan --apply` never rewrites TS/JS files — gate those by hand.
 Covered patterns: `fetch`/`axios` writes, `fs` writes, SQL through knex-style
-clients, Prisma writes, and JS SDK calls such as `stripe.refunds.create(...)`.
+clients, Prisma writes, JS SDK calls such as `stripe.refunds.create(...)`, and
+generated REST resource clients: `create` / `update` / `patch` / `remove`
+methods (plus their `...WithHttpInfo` variants) that build request options
+with an explicit write HTTP method and route them through the client request
+pipeline (twilio-style generated clients, e.g. `twilio-node`).
 (Still not covered: the *Python* SDK equivalents like `stripe.Refund.create(...)`
 — see "Not covered" above.)
 
@@ -155,6 +159,13 @@ job summary. The check fails when an ungated finding meets your
 No API key needed. Full reference: [docs/github-action.md](docs/github-action.md) ·
 example workflow: [examples/github-action/writ-scan.yml](examples/github-action/writ-scan.yml)
 
+## GitHub App
+
+Install the [Writ GitHub App](https://docs.withwrit.com/git-hub-app) on selected
+repositories: every push and pull request is scanned for ungated write-sites,
+with results as a check run on the PR and in the
+[portal](https://app.withwrit.com), where you manage policy, keys, and the audit log.
+
 ## MCP server (`writ-mcp`)
 
 Give any MCP-compatible agent point-of-action policy checks. `writ-mcp` is a

{pywrit-0.2.8 → pywrit-0.2.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pywrit"
-version = "0.2.8"
+version = "0.2.9"
 description = "Python client + CLI for Writ — the gate before the write"
 readme = "README.md"
 license = "MIT"

{pywrit-0.2.8 → pywrit-0.2.9}/src/pywrit/cli.py

@@ -860,7 +860,10 @@ _TSJS_HTTP_VERBS = "post|put|patch|delete|del"
 # Patterns are dotted callee chains (after import aliasing and dropping a
 # leading `this`): `a|b` alternatives, `*` one segment, `**` any segments.
 # Conditions: None, "method" (a literal write method in an options object
-# or as a leading string arg), "sql" (first arg is a literal SQL write).
+# or as a leading string arg), "sql" (first arg is a literal SQL write),
+# "resource_write" (generated REST resource method: the enclosing
+# create/update/patch/remove-style method routes a request that carries an
+# explicit write HTTP method; reads never match).
 _TSJS_RULES = (
     ("child-process", "exec",
      ("child_process.exec|execSync|execFile|execFileSync|spawn|spawnSync|"
@@ -886,6 +889,14 @@ _TSJS_RULES = (
     ("http-config-write", "http",
      ("axios|got|ky|superagent", "axios|got|ky.request",
       "http|https.request"), "method"),
+    # Generated REST resource clients (twilio-style): resource methods named
+    # create/update/patch/remove (+ ...WithHttpInfo) that build request
+    # options with an explicit write HTTP method and route them through the
+    # client request pipeline (Version.request / Domain.request). The
+    # callee is the pipeline, so the pattern is unanchored and the condition
+    # does the work: it never fires on method: "get" or read-named methods
+    # (fetch/list/page/stream/each).
+    ("resource-write", "http", ("**",), "resource_write"),
 )
 
 
@@ -1176,7 +1187,37 @@ def _tsjs_has_write_method(call, f):
     return False
 
 
-def _tsjs_classify(call, chain, f):
+_TSJS_RESOURCE_WRITE_NAMES = frozenset(
+    ("create", "update", "patch", "remove", "del", "delete"))
+_TSJS_HTTPINFO_SUFFIX = "withhttpinfo"
+
+
+def _tsjs_resource_write_func(func_name):
+    """True for generated-REST-resource write methods: create/update/patch/
+    remove (plus del/delete variants) and their ...WithHttpInfo forms.
+    Read-style names (fetch/list/page/stream/each/get) never match."""
+    if not func_name:
+        return False
+    n = func_name.lower()
+    if n.endswith(_TSJS_HTTPINFO_SUFFIX):
+        n = n[:-len(_TSJS_HTTPINFO_SUFFIX)]
+    return n in _TSJS_RESOURCE_WRITE_NAMES
+
+
+def _tsjs_resource_write(call, func_name, f):
+    """Generated-resource write: inside a create/update/patch/remove-style
+    method, a request that carries an explicit write HTTP method (a literal
+    `method: "post"`-style options key, or the method as a leading string
+    arg) routed through a call. The callee is the request pipeline and may
+    be any name (operationVersion.update, this.request, Version.fetch for
+    DELETE-that-returns-a-body), so only the literal decides write-vs-read:
+    `method: "get"` is never a write and read-named enclosing methods never
+    match."""
+    return _tsjs_resource_write_func(func_name) and \
+        _tsjs_has_write_method(call, f)
+
+
+def _tsjs_classify(call, chain, f, func_name):
     for rid, kind, pats, cond in _TSJS_COMPILED:
         if not any(_tsjs_glob(p, chain) for p in pats):
             continue
@@ -1187,6 +1228,9 @@ def _tsjs_classify(call, chain, f):
             lit = f.literal(args[0]) if args else None
             if lit is None or not _TSJS_SQL_WRITE.match(lit):
                 continue
+        if cond == "resource_write" and \
+                not _tsjs_resource_write(call, func_name, f):
+            continue
         return rid, kind
     return None
 
@@ -1229,7 +1273,7 @@ def _tsjs_scan_source(src, filename, parser):
         if chain[-1] in _TSJS_GATE_NAMES:
             gated.add(fkey)
             continue
-        hit = _tsjs_classify(node, chain, f)
+        hit = _tsjs_classify(node, chain, f, fkey[0])
         if hit:
             snippet = " ".join(f.text(node).split())[:100]
             sites.append((_WriteSite(filename, fkey[0], cls,

{pywrit-0.2.8 → pywrit-0.2.9/src/pywrit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.2.8
+Version: 0.2.9
 Summary: Python client + CLI for Writ — the gate before the write
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/withwrit/pywrit
@@ -154,7 +154,11 @@ Python scanning never needs it.
 TS/JS is **scan-only**: findings are listed with verbs for your policy file,
 but `writ scan --apply` never rewrites TS/JS files — gate those by hand.
 Covered patterns: `fetch`/`axios` writes, `fs` writes, SQL through knex-style
-clients, Prisma writes, and JS SDK calls such as `stripe.refunds.create(...)`.
+clients, Prisma writes, JS SDK calls such as `stripe.refunds.create(...)`, and
+generated REST resource clients: `create` / `update` / `patch` / `remove`
+methods (plus their `...WithHttpInfo` variants) that build request options
+with an explicit write HTTP method and route them through the client request
+pipeline (twilio-style generated clients, e.g. `twilio-node`).
 (Still not covered: the *Python* SDK equivalents like `stripe.Refund.create(...)`
 — see "Not covered" above.)
 
@@ -177,6 +181,13 @@ job summary. The check fails when an ungated finding meets your
 No API key needed. Full reference: [docs/github-action.md](docs/github-action.md) ·
 example workflow: [examples/github-action/writ-scan.yml](examples/github-action/writ-scan.yml)
 
+## GitHub App
+
+Install the [Writ GitHub App](https://docs.withwrit.com/git-hub-app) on selected
+repositories: every push and pull request is scanned for ungated write-sites,
+with results as a check run on the PR and in the
+[portal](https://app.withwrit.com), where you manage policy, keys, and the audit log.
+
 ## MCP server (`writ-mcp`)
 
 Give any MCP-compatible agent point-of-action policy checks. `writ-mcp` is a

{pywrit-0.2.8 → pywrit-0.2.9}/tests/test_scan_tsjs.py

@@ -113,15 +113,16 @@ class FixtureRulesTest(unittest.TestCase):
             verbs = __import__("json").loads(policy.read_text())
         self.assertEqual(code, 0)
         n = len(_expected())
-        self.assertIn("ts/js files scanned: 7  skipped: 0  (scan only, no --apply)", out)
-        self.assertIn("ts/js write sites: %d in 11 function(s)" % n, out)
+        self.assertIn("ts/js files scanned: 9  skipped: 0  (scan only, no --apply)", out)
+        self.assertIn("ts/js write sites: %d in 18 function(s)" % n, out)
         self.assertIn("ts/js gated: 1/%d" % n, out)  # gated.ts calls writCheck
         self.assertIn("    payments/refunds.service.ts:10 [sdk] stripe-write "
                       "issueRefund(): stripe.refunds.create({ charge: chargeId })", out)
         self.assertIn("    http.ts:10 [http] fetch-write createOrder(): fetch(url, "
                       "{ method: \"POST\", body: JSON.stringify(body) })", out)
         for v in ("payments.refund", "payments.record", "payments.export",
-                  "storage.save", "storage.create", "http.create", "legacy.write"):
+                  "storage.save", "storage.create", "http.create", "legacy.write",
+                  "rest.create", "rest.update", "rest.delete"):
             self.assertEqual(verbs.get(v), "require_grant", v)
         self.assertIn("nothing to instrument (ts/js findings are scan-only", out)
 
@@ -238,6 +239,68 @@ class FileWalkTest(unittest.TestCase):
         self.assertEqual(got, ["src/a.ts"])
 
 
+class ResourceWriteTest(unittest.TestCase):
+    """Regression for generated REST resource clients (twilio-style): the
+    fixture has a version request pipeline plus a resource class and a
+    factory-pattern list whose create/update/patch/remove methods route
+    requests with an explicit write HTTP method. Only those methods are
+    findings; fetch/list/get reads (even through pipeline calls) are not."""
+
+    EXPECTED = {
+        ("rest/account.ts", 52, "resource-write"),  # update()
+        ("rest/account.ts", 56, "resource-write"),  # updateWithHttpInfo()
+        ("rest/account.ts", 60, "resource-write"),  # remove() via Version.fetch
+        ("rest/account.ts", 64, "resource-write"),  # removeWithHttpInfo()
+        ("rest/account.ts", 68, "resource-write"),  # patch()
+        ("rest/message.ts", 14, "resource-write"),  # factory create()
+        ("rest/message.ts", 18, "resource-write"),  # factory remove()
+    }
+
+    @unittest.skipUnless(HAVE_EXTRA, "polyglot extra not installed")
+    def test_fixture_layout_flags_writes_not_reads(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = _copy_fixtures(pathlib.Path(td) / "repo")
+            code, out = _run_scan(root)
+        self.assertEqual(code, 0)
+        rest = {f for f in _findings(out) if f[0].startswith("rest/")}
+        self.assertEqual(rest, self.EXPECTED, out)
+
+    @unittest.skipUnless(HAVE_EXTRA, "polyglot extra not installed")
+    def test_json_mode_reports_resource_finding(self):
+        with tempfile.TemporaryDirectory() as td:
+            root = pathlib.Path(td) / "repo"
+            (root / "rest").mkdir(parents=True)
+            (root / "rest" / "account.ts").write_text(
+                "class Version {\n"
+                "  update(opts: any) { return this.request(opts); }\n"
+                "}\n"
+                "class AccountContext {\n"
+                "  constructor(private version: Version) {}\n"
+                "  update() {\n"
+                "    return this.version.update({ uri: \"/x\", method: \"post\" });\n"
+                "  }\n"
+                "  fetch() {\n"
+                "    return this.version.fetch({ uri: \"/x\", method: \"get\" });\n"
+                "  }\n"
+                "}\n")
+            buf = io.StringIO()
+            with contextlib.redirect_stdout(buf):
+                code = cli.scan_cmd(_args(root, pathlib.Path(td) / "policy.json",
+                                          format="json"))
+            out = buf.getvalue()
+        self.assertEqual(code, 0)
+        doc = __import__("json").loads(out)
+        self.assertEqual(doc["files_scanned"], 1)
+        findings = doc["findings"]
+        self.assertEqual(len(findings), 1, doc)
+        f = findings[0]
+        self.assertEqual((f["file"], f["line"], f["function"], f["verb"]),
+                         ("rest/account.ts", 7, "update", "rest.update"))
+        self.assertEqual((f["kind"], f["language"], f["gated"]),
+                         ("http", "tsjs", False))
+        self.assertIn('method: "post"', f["snippet"])
+
+
 class MissingExtraTest(unittest.TestCase):
     def test_hint_once_and_python_still_scanned(self):
         with tempfile.TemporaryDirectory() as td: