safeuploads 1.0.1__tar.gz → 1.1.1__tar.gz

safeuploads-1.1.1/.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# Every change needs a review from the maintainer. safeuploads is maintained by one
+# person (see CONTRIBUTING.md), so this is a single entry rather than a routing
+# table — it exists so review is requested automatically rather than remembered.
+* @joaovitoriasilva

safeuploads-1.1.1/.github/FUNDING.yml

@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: joaovitoriasilva # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: endurain # Replace with a single Patreon username
+#open_collective: # Replace with a single Open Collective username
+#ko_fi: # Replace with a single Ko-fi username
+#tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+#community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: endurain # Replace with a single Liberapay username
+#issuehunt: # Replace with a single IssueHunt username
+#otechie: # Replace with a single Otechie username
+#lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: ['https://buymeacoffee.com/endurain'] # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

safeuploads-1.1.1/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,35 @@
+---
+name: 🐞 Bug report
+about: Report a bug
+title: "[BUG]: "
+labels: [bug]
+assignees: ''
+---
+
+## Checklist
+
+- [ ] I have searched **existing issues** to make sure this bug hasn't already been reported.
+- [ ] I have checked the **documentation** at [https://safeuploads.endurain.com](https://safeuploads.endurain.com) and didn't find a solution.
+
+## Description
+
+Describe the bug you encountered.
+
+## Steps to Reproduce
+
+1. Version
+2. Go to '...'
+3. Click on '...'
+4. See error
+
+## Expected Behavior
+
+What did you expect to happen?
+
+## Screenshots, logs or files
+
+If applicable, add screenshots, logs or files to help explain your problem. If you do not wish to upload sensitive information to the issue you can send that info to [joao@endurain.com](joao@endurain.com).
+
+## Additional Context
+
+Add any other context about the problem here.

safeuploads-1.1.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 📚 Documentation
+    url: https://safeuploads.endurain.com
+    about: Please check our documentation before creating an issue.

safeuploads-1.1.1/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: 💡 Feature request
+about: Suggest an idea or enhancement for this project
+title: "[FEATURE]: "
+labels: [enhancement]
+assignees: ''
+---
+
+## Summary
+
+Briefly describe the feature you'd like to see.
+
+## Motivation
+
+Why is this feature important? What problem does it solve?
+
+## Proposed Solution
+
+How would this feature work? Describe any ideas you have.
+
+## Alternatives
+
+Have you considered any alternatives?
+
+## Additional Context
+
+Add screenshots, mockups, or examples if relevant.

safeuploads-1.1.1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+## What does this PR do?
+ 
+A clear description of the change.
+ 
+## Related issue
+ 
+Required for anything beyond a small bug fix or typo.
+Don't forget to reference the issue so it auto-closes works, for example use `Closes #XYZ`
+ 
+## Type of change
+ 
+Check all that apply
+ 
+- [ ] Bug fix
+- [ ] New feature (exception during freeze; link prior discussion/acknowledgment)
+- [ ] Documentation
+- [ ] Refactor / code quality
+- [ ] Translation
+- [ ] Other (describe below)
+
+## Checklist
+ 
+- [ ] This PR is focused on a single concern
+- [ ] An issue was opened and acknowledged before writing this code (if not a small fix)
+- [ ] If this PR introduces a new feature during freeze, it was discussed and explicitly acknowledged first
+- [ ] The PR is under ~300 lines changed, excluding lock files, migrations, and generated code
+- [ ] Tests have been added or updated where applicable
+- [ ] Documentation has been updated where applicable
+- [ ] Commit messages follow Conventional Commits format
+
+## Notes for the reviewer
+ 
+Anything that would help review this. Tricky areas, alternative approaches considered, screenshots, etc.

{safeuploads-1.0.1 → safeuploads-1.1.1}/.github/copilot-instructions.md

@@ -77,7 +77,7 @@ Committing should use clear messages following [Conventional Commits](https://ww
 
 **Format:** `<type>(<scope>)!: <description>` — `(<scope>)` and the breaking-change `!` are optional.
 
-The following rules are enforced automatically on every PR (against the PR title and every commit subject) by `.forgejo/workflows/conventional-commits.yml`. Validation follows the [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) spec, with a single project-policy addition (the allowed-type whitelist). Generated commit messages must comply:
+The following rules are enforced automatically on every PR (against the PR title and every commit subject) by `.github/workflows/conventional-commits.yml`. Validation follows the [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) spec, with a single project-policy addition (the allowed-type whitelist). Generated commit messages must comply:
 
 - **Header format:** `<type>(<scope>)!: <description>` — the `(<scope>)` and breaking-change `!` are optional, and a space is required after the colon.
 - **Allowed types (project policy):** `build`, `chore`, `ci`, `docs`, `feat`, `fix`, `perf`, `refactor`, `revert`, `style`, `test`. Types are matched case-insensitively per the spec.

safeuploads-1.1.1/.github/dependabot.yml

@@ -0,0 +1,56 @@
+# Dependabot keeps dependencies *fresh*; the separate `audit-safeuploads` workflow
+# is what catches an advisory against a version already pinned. Both are needed.
+#
+# Updates are grouped so a week's worth of patch bumps arrives as one reviewable
+# pull request rather than a dozen. `uv.lock` is regenerated by Dependabot's uv
+# support, so the lockfile and `pyproject.toml` stay in step.
+version: 2
+
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      # Matches the Conventional Commits check in `conventional-commits.yml`.
+      prefix: chore
+      include: scope
+    groups:
+      # The runtime dependency set is small and deliberate, so these are worth
+      # reading individually rather than batching.
+      production-dependencies:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+      development-dependencies:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+
+  # Every action is pinned to a commit SHA, so without this they never move.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:30"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      github-actions:
+        patterns:
+          - "*"

{safeuploads-1.0.1/.forgejo → safeuploads-1.1.1/.github}/scripts/check_conventional_commits.py

@@ -12,9 +12,9 @@ Usage::
     check_conventional_commits.py "feat(api): add endpoint"
     git log --format=%s base..head | check_conventional_commits.py --stdin
 
-Designed to run with the Python interpreter already available on the Forgejo
-runner image. Uses only the standard library so there is no third-party
-supply-chain surface.
+Designed to run with the Python interpreter already available on the GitHub
+Actions runner image. Uses only the standard library so there is no
+third-party supply-chain surface.
 """
 
 from __future__ import annotations
@@ -57,7 +57,7 @@ _HEADER_RE = re.compile(
     (?P<type>[A-Za-z]+)
     (?:\((?P<scope>[^)]+)\))?
     (?P<breaking>!)?
-    :\ 
+    :\x20
     (?P<description>.+?)
     \s*$
     """,
@@ -102,6 +102,7 @@ def _safe_log_value(value: str) -> str:
 
 
 def _iter_messages(args: argparse.Namespace) -> Iterable[str]:
+    """Yield messages from stdin or CLI arguments."""
     if args.stdin:
         for line in sys.stdin:
             stripped = line.rstrip("\n")
@@ -112,6 +113,7 @@ def _iter_messages(args: argparse.Namespace) -> Iterable[str]:
 
 
 def main(argv: list[str] | None = None) -> int:
+    """Validate all messages and return a process exit code."""
     parser = argparse.ArgumentParser(
         description="Validate Conventional Commits headers.",
     )
@@ -150,8 +152,8 @@ def main(argv: list[str] | None = None) -> int:
 
     if failures:
         print(
-            f"\n{failures} of {checked} message(s) failed Conventional Commits "
-            "validation.",
+            f"\n{failures} of {checked} message(s) failed "
+            "Conventional Commits validation.",
             file=sys.stderr,
         )
         return 1

safeuploads-1.1.1/.github/scripts/smoke_import.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Smoke-test that the built safeuploads wheel is self-contained.
+
+Imports the installed package (not the source tree) and constructs
+a FileValidator to prove the distribution's declared dependencies
+are sufficient to actually use the library.
+"""
+
+from __future__ import annotations
+
+import sys
+from importlib.metadata import version
+
+from safeuploads import FileSecurityConfig, FileValidator
+
+
+def main() -> int:
+    """Exercise the installed package and return a process exit code.
+
+    Returns:
+        0 on success, 1 if a check fails.
+    """
+    print(f"safeuploads version: {version('safeuploads')}")
+
+    validator = FileValidator(config=FileSecurityConfig())
+    if not isinstance(validator, FileValidator):
+        print("FileValidator construction failed.", file=sys.stderr)
+        return 1
+
+    print("Smoke test passed: package imported and validator built.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

safeuploads-1.1.1/.github/workflows/audit-safeuploads.yml

@@ -0,0 +1,58 @@
+name: Audit dependencies
+
+# Dependabot keeps dependencies *fresh*; it does not tell you when a version you
+# are already pinned to turns out to be vulnerable. This job scans the resolved
+# lockfile against the OSV / PyPI advisory databases, on every dependency change
+# and on a schedule so a newly-published advisory against an unchanged pin is
+# still surfaced.
+
+on:
+  push:
+    branches:
+      - main
+    paths: &paths
+      - pyproject.toml
+      - uv.lock
+      - .github/workflows/audit-safeuploads.yml
+  pull_request:
+    paths: *paths
+  schedule:
+    # Daily, offset from the dependency-update run so the two do not contend.
+    - cron: '30 5 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    name: safeuploads (pip-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # Resolve uv from `[tool.uv] required-version` in pyproject.toml, so CI
+          # and local development are held to the same floor and ceiling.
+          version-file: pyproject.toml
+
+      # Audit the full resolved set - runtime dependencies plus every optional
+      # extra - because a host enabling ``safeuploads[fastapi]`` inherits those too.
+      # ``--no-emit-project`` drops the editable self-reference, which carries no
+      # hash and which pip-audit therefore rejects.
+      - name: Export the resolved dependency set
+        run: >-
+          uv export --frozen --all-extras --no-dev --no-emit-project
+          --format requirements-txt --output-file "$RUNNER_TEMP/requirements.txt"
+
+      - name: Scan for known vulnerabilities
+        run: uvx pip-audit --strict --requirement "$RUNNER_TEMP/requirements.txt" --disable-pip

{safeuploads-1.0.1/.forgejo → safeuploads-1.1.1/.github}/workflows/conventional-commits.yml

@@ -4,21 +4,20 @@ on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
 
-permissions:
-  contents: read
-  pull-requests: read
-
 concurrency:
-  group: ${{ forgejo.workflow }}-${{ forgejo.event.pull_request.number }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   validate:
-    runs-on: codeberg-small
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: https://data.forgejo.org/actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -26,19 +25,19 @@ jobs:
         # The PR title is passed through an environment variable to prevent
         # shell injection via crafted titles (see security-and-owasp guidelines).
         env:
-          PR_TITLE: ${{ forgejo.event.pull_request.title }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
-          python3 .forgejo/scripts/check_conventional_commits.py "$PR_TITLE"
+          python3 .github/scripts/check_conventional_commits.py "$PR_TITLE"
 
       - name: Validate commits in PR
         # Validates every commit subject between the PR base and head. Use the
         # base/head SHAs from the event payload so we don't depend on the local
         # checkout ref layout.
         env:
-          BASE_SHA: ${{ forgejo.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ forgejo.event.pull_request.head.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
           git fetch --no-tags origin "$BASE_SHA" "$HEAD_SHA"
-          git log --format=%s "$BASE_SHA".."$HEAD_SHA" \
-            | python3 .forgejo/scripts/check_conventional_commits.py --stdin
+          git log --no-merges --format=%s "$BASE_SHA".."$HEAD_SHA" \
+            | python3 .github/scripts/check_conventional_commits.py --stdin

safeuploads-1.1.1/.github/workflows/docs.yml

@@ -0,0 +1,81 @@
+name: Deploy documentation
+
+# ``dry-run`` only exists on ``workflow_dispatch``. On a push ``inputs.dry-run``
+# is null, so every ``!= true`` guard below passes and the site deploys.
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: Build docs but do not deploy
+        required: false
+        default: false
+        type: boolean
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'safeuploads/**/*.py'
+      - '.github/workflows/docs.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: github-pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build documentation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # Resolve uv from `[tool.uv] required-version` in pyproject.toml, so CI
+          # and local development are held to the same floor and ceiling.
+          version-file: pyproject.toml
+
+      # mkdocstrings imports the package to render the API reference, so sync the
+      # default dependencies plus the docs group and install the project itself.
+      - name: Sync documentation dependencies
+        run: uv sync --frozen --group docs
+
+      - name: Build documentation
+        run: uv run --no-sync mkdocs build --site-dir site
+
+      - name: Configure GitHub Pages
+        if: ${{ inputs.dry-run != true }}
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload GitHub Pages artifact
+        if: ${{ inputs.dry-run != true }}
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site
+
+  deploy:
+    name: Deploy documentation
+    if: ${{ inputs.dry-run != true }}
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

{safeuploads-1.0.1 → safeuploads-1.1.1}/.github/workflows/fuzz.yml

@@ -6,16 +6,15 @@ on:
     - cron: "0 3 * * 0"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # Cancel in-progress runs for the same branch to avoid wasted
 # runner minutes.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# Principle of least privilege: only read access by default.
-permissions:
-  contents: read
-
 jobs:
   fuzz:
     name: Fuzz
@@ -23,21 +22,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y libmagic1
 
-      - name: Set up Python 3.13
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
-
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
+          version-file: pyproject.toml
 
       - name: Install dependencies
         run: uv sync --frozen --dev

safeuploads-1.0.1/.github/workflows/lint&test.yml → safeuploads-1.1.1/.github/workflows/lint-and-test.yml

@@ -6,16 +6,15 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 # Cancel in-progress runs for the same branch/PR to avoid wasted
 # runner minutes and race conditions on shared resources.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# Principle of least privilege: only read access by default.
-permissions:
-  contents: read
-
 jobs:
   # ----------------------------------------------------------------
   # Lint
@@ -27,19 +26,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python 3.13
-        uses: actions/setup-python@v6
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          python-version: "3.13"
+          fetch-depth: 1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
+          # Resolve uv from `[tool.uv] required-version` in pyproject.toml, so CI
+          # and local development are held to the same floor and ceiling.
+          version-file: pyproject.toml
 
       - name: Install dependencies
         run: uv sync --frozen --dev
@@ -50,6 +47,9 @@ jobs:
       - name: Check formatting with ruff
         run: uv run ruff format --check safeuploads tests examples
 
+      - name: Type check with mypy
+        run: uv run mypy
+
   # ----------------------------------------------------------------
   # Test
   # Runs the full pytest suite with coverage. Only runs after lint
@@ -62,24 +62,18 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y libmagic1
 
-      - name: Set up Python 3.13
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
-
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
+          version-file: pyproject.toml
 
       - name: Install dependencies
-        run: uv sync --frozen --dev
+        run: uv sync --frozen --dev --extra fastapi
 
       - name: Audit Python dependencies
         run: uvx pip-audit --require-hashes --disable-pip -r <(uv export --frozen --no-header --no-emit-project --no-dev)
@@ -88,9 +82,9 @@ jobs:
         run: uv run pytest --cov-fail-under=90
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: safeuploads-coverage
           path: .coverage
-          retention-days: 7
+          retention-days: 7

safeuploads-1.1.1/.github/workflows/mirror.yml

@@ -0,0 +1,30 @@
+name: Mirror to GitLab
+
+on:
+  push:
+
+concurrency:
+  group: gitlab-mirror
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Push full mirror to GitLab
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+        run: |
+          set -euo pipefail
+          mirror_dir="$RUNNER_TEMP/safeuploads.git"
+          git clone --mirror \
+            "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+            "$mirror_dir"
+          cd "$mirror_dir"
+          git remote set-url --push origin \
+            "https://oauth2:${GITLAB_TOKEN}@gitlab.com/endurain-project/safeuploads.git"
+          git push --mirror