saprfclib 0.1.0__tar.gz

saprfclib-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,68 @@
+name: Bug report
+description: Something behaves incorrectly against an SAP system
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Never paste real credentials, real hostnames, customer data, or an unsanitised
+        pcap.** Redact before posting. If this is a security issue, do not open an issue —
+        see SECURITY.md.
+
+  - type: input
+    id: version
+    attributes:
+      label: saprfclib version
+      placeholder: "0.1.0 (python -c 'import saprfclib; print(saprfclib.__version__)')"
+    validations:
+      required: true
+
+  - type: input
+    id: python
+    attributes:
+      label: Python version and OS
+      placeholder: "3.13.1 on Ubuntu 24.04"
+    validations:
+      required: true
+
+  - type: input
+    id: sap
+    attributes:
+      label: SAP system release
+      placeholder: "SAP NW 7.58 / S/4HANA 2023 / BTP ABAP environment"
+
+  - type: dropdown
+    id: transport
+    attributes:
+      label: Connection mode
+      options:
+        - Direct TCP (ashost/sysnr)
+        - SAProuter
+        - Message server (group logon)
+        - SNC
+        - WebSocket RFC (BTP)
+        - RFC server (inbound)
+    validations:
+      required: true
+
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: Include the full traceback if there is one, with credentials redacted.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction
+      description: Smallest snippet that shows the problem, with placeholders for connection parameters.
+      render: python

saprfclib-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/randomstr1ng/saprfclib/security/advisories/new
+    about: Report privately. Never open a public issue for a security problem.
+  - name: Documentation
+    url: https://randomstr1ng.github.io/saprfclib/
+    about: Getting started, cookbook, API reference, and wire-protocol docs.

saprfclib-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,24 @@
+name: Feature request
+description: Propose new functionality
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed API or behaviour
+      render: python
+
+  - type: checkboxes
+    id: constraints
+    attributes:
+      label: Constraints
+      options:
+        - label: This can be implemented in pure Python with no new native dependency
+          required: true

saprfclib-0.1.0/.github/ISSUE_TEMPLATE/protocol_gap.yml

@@ -0,0 +1,50 @@
+name: Protocol gap or wrong wire behaviour
+description: A field, type, or frame is unsupported, mis-parsed, or mis-serialized
+labels: ["protocol"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This project does not accept guessed wire values. A report that includes observed
+        bytes can be acted on; one that does not usually cannot. See CLAUDE.md for the
+        evidence tiers.
+
+        **Sanitise captures before attaching them** — no credentials, no real hostnames,
+        no customer data.
+
+  - type: textarea
+    id: area
+    attributes:
+      label: Which part of the protocol
+      placeholder: "e.g. DecFloat34 decode, tRFC TID format, 0x0514 session token"
+    validations:
+      required: true
+
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed bytes
+      description: Hex dump of the frame or field as seen on the wire, with offsets if known.
+      render: text
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What saprfclib produced or expected instead
+
+  - type: dropdown
+    id: evidence
+    attributes:
+      label: Evidence tier
+      options:
+        - Live capture (pcap from my own system)
+        - Behavioural probe (server accepted/rejected)
+        - Inference from a neighbouring confirmed field
+    validations:
+      required: true
+
+  - type: input
+    id: sap
+    attributes:
+      label: SAP system release
+      placeholder: "SAP NW 7.58 / S/4HANA 2023"

saprfclib-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## What this changes
+
+<!-- One or two sentences. -->
+
+## Evidence (required for any wire-behaviour change)
+
+<!--
+State the source for every wire value you added or changed. See CLAUDE.md.
+Delete this section only if the PR touches no protocol behaviour.
+-->
+
+- [ ] Live capture / golden fixture — fixture path:
+- [ ] Behavioural probe against a live system — describe:
+- [ ] Inference from a confirmed field — labelled `[ASSUMED]` in code and docs
+
+## Checklist
+
+- [ ] `hatch run test -m "not integration"` passes
+- [ ] `hatch run lint:check` passes
+- [ ] `hatch run lint:type` passes
+- [ ] No golden fixture was edited to make a test pass
+- [ ] No new non-Python runtime dependency
+- [ ] No SAP source, headers, binaries, or decompiler output added
+- [ ] `docs/protocol/` updated if wire behaviour changed
+- [ ] `CHANGELOG.md` updated under "Unreleased"
+- [ ] New source files carry the MPL-2.0 header

saprfclib-0.1.0/.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels: ["dependencies"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels: ["dependencies", "ci"]

saprfclib-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0          # required for hatch-vcs git-tag version derivation
+          persist-credentials: false
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Hatch
+        run: pip install hatch "hatchling>=1.21,<1.32"
+
+      - name: Lint (Ruff)
+        run: hatch run lint:check
+
+      - name: Type-check (mypy)
+        run: hatch run lint:type
+
+      - name: Test (pytest — offline only, no live SAP)
+        run: hatch run test -m "not integration"
+
+      - name: Build distribution
+        run: hatch build
+
+      - name: Verify importable wheel
+        run: |
+          pip install dist/*.whl --force-reinstall
+          python -c "import saprfclib; print(saprfclib.__version__)"
+
+  docs-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Hatch
+        run: pip install hatch "hatchling>=1.21,<1.32"
+
+      - name: Build docs (strict)
+        run: hatch run docs:build

saprfclib-0.1.0/.github/workflows/docs.yml

@@ -0,0 +1,52 @@
+name: Docs
+
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Hatch
+        run: pip install hatch "hatchling>=1.21,<1.32"
+
+      - name: Build docs
+        run: hatch run docs:build
+
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d  # v6.0.0
+
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0
+        with:
+          path: ./site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write
+      id-token: write
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128  # v5.0.0

saprfclib-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,109 @@
+name: Publish
+
+# Tag-driven release. hatch-vcs derives the version from the tag, so the tag is the
+# single source of truth — never hand-edit a version string.
+#
+#   git tag v0.2.0 && git push origin v0.2.0
+#
+# Uploads use PyPI Trusted Publishing (OIDC). No API token is stored in this repo.
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Hatch
+        run: pip install hatch "hatchling>=1.21,<1.32"
+
+      - name: Test before release (offline suite)
+        run: hatch run test -m "not integration"
+
+      - name: Build wheel + sdist
+        run: hatch build
+
+      - name: Show built version
+        run: ls -l dist/
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  testpypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/saprfclib
+    permissions:
+      id-token: write          # required for Trusted Publishing
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  pypi:
+    needs: testpypi
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi              # protect with a required reviewer in repo settings
+      url: https://pypi.org/p/saprfclib
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+
+  github-release:
+    needs: pypi
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      # `gh` ships on the runner, so no third-party action is needed in the
+      # release path. One less dependency to trust on a job that has write
+      # access to the repository.
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          gh release create "$TAG" dist/* \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "$TAG" \
+            --generate-notes

saprfclib-0.1.0/.github/workflows/security.yml

@@ -0,0 +1,102 @@
+name: Security
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "0 6 * * 1"   # Weekly Monday 06:00 UTC — catch new CVEs without code change
+
+permissions:
+  contents: read
+
+jobs:
+  trivy:
+    name: Trivy (dependency CVEs + secrets)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
+            | sh -s -- -b /usr/local/bin latest
+
+      - name: Dependency vulnerability scan (HIGH/CRITICAL)
+        # Scans pyproject.toml / requirements / installed packages for known CVEs.
+        # OSV + NVD + GitHub Advisory DB. Exit 1 on any HIGH or CRITICAL finding.
+        run: |
+          trivy fs \
+            --scanners vuln \
+            --pkg-types library \
+            --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            --format table \
+            .
+
+      - name: Secret scan
+        # Detects hardcoded credentials, API keys, private keys in source tree.
+        # Any finding fails the build — credentials must never be committed.
+        run: |
+          trivy fs \
+            --scanners secret \
+            --exit-code 1 \
+            --format table \
+            .
+
+  semgrep:
+    name: Semgrep (SAST)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Semgrep
+        run: pip install semgrep
+
+      - name: SAST scan
+        # p/python      — Python security rules (dangerous builtins, injection, etc.)
+        # p/secrets     — hardcoded credential patterns (belt-and-suspenders vs Trivy)
+        # p/trailofbits — Trail of Bits crypto/protocol rules (relevant for RFC wire code)
+        # --error: any finding → exit 1. Suppress false positives inline with # nosemgrep.
+        run: |
+          semgrep \
+            --config p/python \
+            --config p/secrets \
+            --config p/trailofbits \
+            --error \
+            --no-rewrite-rule-ids \
+            src/ tests/
+
+  zizmor:
+    name: Zizmor (GitHub Actions workflow audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Audit workflows
+        # GH_TOKEN enables zizmor's online audits — notably impostor-commit
+        # detection, which verifies that a pinned SHA actually belongs to the
+        # action's repository. Without it those audits are skipped, which is
+        # precisely the risk that pinning by SHA introduces.
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          pip install zizmor
+          zizmor --persona=regular .github/workflows/