sarj-python-lint 1.108.0__tar.gz → 1.108.50__tar.gz

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sarj-python-lint
-Version: 1.108.0
+Version: 1.108.50
 Summary: Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults
 Project-URL: Homepage, https://code-standards.sarj.ai/rules/python/
 Project-URL: Documentation, https://code-standards.sarj.ai/rules/python/

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sarj-python-lint"
-version = "1.108.0"
+version = "1.108.50"
 description = "Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults"
 readme = "README.md"
 authors = [{ name = "sarj-ai" }]

sarj_python_lint-1.108.50/src/sarj_python_lint/rules/_loguru.py

@@ -0,0 +1,17 @@
+from __future__ import annotations
+
+import ast
+from typing import TYPE_CHECKING
+
+
+if TYPE_CHECKING:
+    from sarj_python_lint._file_context import PythonFileContext
+    from sarj_python_lint.rules._resource_provenance import ResourceProvenance
+
+
+def logger_imports_untouched(context: PythonFileContext, provenance: ResourceProvenance) -> bool:
+    for node in context.nodes(ast.Name, ast.Attribute):
+        qualified = context.imports.resolved_qualified_name(node)
+        if qualified in {"loguru", "loguru.logger"} and not provenance.imported(node, qualified):
+            return False
+    return True

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/src/sarj_python_lint/rules/_resource_provenance.py

@@ -26,6 +26,7 @@ _RESOURCE_OWNERS = MappingProxyType(
         "httpx": frozenset({"Client", "AsyncClient"}),
         "asyncio": frozenset({"sleep", "CancelledError", "exceptions.CancelledError"}),
         "contextlib": frozenset({"ExitStack", "AsyncExitStack", "_BaseExitStack"}),
+        "functools": frozenset({"cache", "lru_cache", "cached_property"}),
         "subprocess": frozenset({"Popen", "TimeoutExpired"}),
         "re": frozenset({"compile", "Match", "Pattern"}),
         "operator": frozenset({"setitem", "delitem", "iadd", "iconcat", "imul", "iand", "isub", "ixor", "ior"}),
@@ -309,7 +310,14 @@ class ResourceProvenance:
                 isinstance(parent, ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef)
                 and node in parent.decorator_list
                 and self.context.imports.resolved_qualified_name(node)
-                in {"typing.final", "typing_extensions.final", "dataclasses.dataclass"}
+                in {
+                    "typing.final",
+                    "typing_extensions.final",
+                    "dataclasses.dataclass",
+                    "functools.cache",
+                    "functools.lru_cache",
+                    "functools.cached_property",
+                }
             )
         )
 

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/src/sarj_python_lint/rules/fastapi_explicit_openapi_contract.py

@@ -256,11 +256,14 @@ class FastapiExplicitOpenapiContract(Rule):
         tree = context.tree
         if tree is None:
             return []
+        functions = context.nodes(ast.FunctionDef, ast.AsyncFunctionDef)
+        if not any(function.decorator_list for function in functions):
+            return []
         index = context.fastapi
         scopes = _function_scopes(tree)
         findings: list[_Finding] = []
         declared: list[tuple[int, Route]] = []
-        for function in context.nodes(ast.FunctionDef, ast.AsyncFunctionDef):
+        for function in functions:
             all_routes = index.routes(function)
             declared.extend((scopes[id(function)], route) for route in all_routes)
             routes = tuple(route for route in all_routes if not route.is_hidden)

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/src/sarj_python_lint/rules/no_async_function_cache.py

@@ -50,7 +50,8 @@ class NoAsyncFunctionCache(Rule):
             "Async generators, transformed functions, ambiguous or rebound imports, and generated files are excluded.",
             "Wildcard imports and names rebound by relative imports or imports outside the module body are excluded conservatively.",
             "lru_cache with disabled, dynamic, or unpacked maxsize arguments is excluded; an omitted size or literal positive integer or None is required.",
-            "Indirect wrapping calls and runtime monkeypatches are not resolved. Test code is checked because coroutine reuse fails there too.",
+            "Visible mutations, deletion, or escape of functools providers invalidate their native identity conservatively.",
+            "Indirect wrapping calls and opaque runtime or interprocedural mutations are not resolved. Test code is checked because coroutine reuse fails there too.",
             "No automatic rewrite is offered because cache lifetime, cancellation, and concurrency require an explicit design decision.",
         ),
         examples=(
@@ -99,6 +100,10 @@ class NoAsyncFunctionCache(Rule):
                 or is_suppressed(context.source_lines, decorator.lineno, self.code)
             ):
                 continue
+            target = decorator.func if isinstance(decorator, ast.Call) else decorator
+            qualified = context.imports.resolved_qualified_name(target)
+            if qualified is None or not context.static_resource_provenance.imported(target, qualified):
+                continue
             diagnostics.append(
                 Diagnostic(
                     path=context.path,

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/src/sarj_python_lint/rules/no_loguru_exc_info.py

@@ -18,10 +18,12 @@ from sarj_python_lint.rule_base import (
     is_suppressed,
 )
 from sarj_python_lint.rules._imports import ambiguous_import_names as _ambiguous_import_names
+from sarj_python_lint.rules._loguru import logger_imports_untouched
 
 
 if TYPE_CHECKING:
     from sarj_python_lint._file_context import PythonFileContext
+    from sarj_python_lint.rules._resource_provenance import ResourceProvenance
 
 
 _METHODS = frozenset({"trace", "debug", "info", "success", "warning", "error", "critical", "log"})
@@ -46,8 +48,8 @@ class NoLoguruExcInfo(Rule):
             "Safe fixes handle only a direct proven Loguru logger call with literal arguments and keywords, replacing unused exc_info=True with opt(exception=True). Existing bind/opt chains, dynamic argument evaluation and commented calls remain review-only.",
             "Only unambiguous Loguru imports and immediate bind/opt chains with literal exc_info=True are checked.",
             "A literal message is required; templates using exc_info or the record, explicit exception capture, and exception() are excluded.",
-            "Unknown receivers, stored logger aliases, dynamic exc_info values, ambiguous imports, and generated files are excluded.",
-            "Runtime monkeypatches of Loguru objects or methods are not resolved.",
+            "Unknown receivers, stored logger aliases, dynamic exc_info values, ambiguous or escaped imports, and generated files are excluded.",
+            "Visible namespace or logger mutations invalidate import proof. Interprocedural effects and runtime monkeypatches are not resolved.",
             "An intentionally stored field can use a diagnostic-specific suppression. More complex logging context remains review-only.",
         ),
         examples=(
@@ -121,18 +123,22 @@ class NoLoguruExcInfo(Rule):
         shadowed = _ambiguous_import_names(context)
         if "*" in shadowed:
             return []
+        provenance: ResourceProvenance | None = None
         diagnostics: list[Diagnostic] = []
         for call in context.nodes(ast.Call):
             if not isinstance(call.func, ast.Attribute) or call.func.attr not in _METHODS:
                 continue
-            keyword = next((item for item in call.keywords if item.arg == "exc_info"), None)
-            if keyword is None or not isinstance(keyword.value, ast.Constant) or keyword.value.value is not True:
+            keyword = _unused_exc_info_keyword(call)
+            if keyword is None or is_suppressed(context.source_lines, keyword.lineno, self.code):
                 continue
-            if (
-                not _is_unconfigured_loguru(call.func.value, context, shadowed)
-                or not _has_unused_exc_info(call)
-                or is_suppressed(context.source_lines, keyword.lineno, self.code)
-            ):
+            receiver = _unconfigured_loguru_root(call.func.value, context, shadowed)
+            if receiver is None:
+                continue
+            if provenance is None:
+                provenance = context.static_resource_provenance
+                if not logger_imports_untouched(context, provenance):
+                    return []
+            if not provenance.imported(receiver, "loguru.logger"):
                 continue
             diagnostics.append(
                 Diagnostic(
@@ -147,12 +153,23 @@ class NoLoguruExcInfo(Rule):
         return diagnostics
 
 
-def _is_unconfigured_loguru(receiver: ast.expr, context: PythonFileContext, shadowed: frozenset[str]) -> bool:
+def _unused_exc_info_keyword(call: ast.Call) -> ast.keyword | None:
+    keyword = next((item for item in call.keywords if item.arg == "exc_info"), None)
+    if keyword is None or not isinstance(keyword.value, ast.Constant) or keyword.value.value is not True:
+        return None
+    if not _has_unused_exc_info(call):
+        return None
+    return keyword
+
+
+def _unconfigured_loguru_root(
+    receiver: ast.expr, context: PythonFileContext, shadowed: frozenset[str]
+) -> ast.expr | None:
     opted = False
     while isinstance(receiver, ast.Call) and isinstance(receiver.func, ast.Attribute):
         method = receiver.func.attr
         if method not in {"bind", "opt"}:
-            return False
+            return None
         if method == "opt" and not opted:
             opted = True
             if any(
@@ -163,14 +180,16 @@ def _is_unconfigured_loguru(receiver: ast.expr, context: PythonFileContext, shad
                 )
                 for keyword in receiver.keywords
             ):
-                return False
+                return None
         receiver = receiver.func.value
     root = receiver
     while isinstance(root, ast.Attribute):
         root = root.value
-    return not (isinstance(root, ast.Name) and root.id in shadowed) and context.imports.resolves(
+    if (isinstance(root, ast.Name) and root.id in shadowed) or not context.imports.resolves(
         receiver, sources=_LOGURU, symbol="logger"
-    )
+    ):
+        return None
+    return receiver
 
 
 def _has_unused_exc_info(call: ast.Call) -> bool:

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/src/sarj_python_lint/rules/no_loguru_printf_format.py

@@ -18,6 +18,7 @@ from sarj_python_lint.rule_base import (
     Severity,
     is_suppressed,
 )
+from sarj_python_lint.rules._loguru import logger_imports_untouched
 
 
 if TYPE_CHECKING:
@@ -121,7 +122,7 @@ class NoLoguruPrintfFormat(Rule):
                 continue
             if provenance is None:
                 provenance = context.static_resource_provenance
-                if not _logger_imports_untouched(context, provenance):
+                if not logger_imports_untouched(context, provenance):
                     return []
             if not provenance.imported(receiver, "loguru.logger") or is_suppressed(
                 context.source_lines, call.lineno, self.code
@@ -140,14 +141,6 @@ class NoLoguruPrintfFormat(Rule):
         return diagnostics
 
 
-def _logger_imports_untouched(context: PythonFileContext, provenance: ResourceProvenance) -> bool:
-    for node in context.nodes(ast.Name, ast.Attribute):
-        qualified = context.imports.resolved_qualified_name(node)
-        if qualified in {"loguru", "loguru.logger"} and not provenance.imported(node, qualified):
-            return False
-    return True
-
-
 def _logger_root(receiver: ast.expr) -> ast.expr | None:
     while isinstance(receiver, ast.Call) and isinstance(receiver.func, ast.Attribute):
         if (

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/src/sarj_python_lint/rules/no_secret_in_log.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import ast
+from dataclasses import dataclass
 from pathlib import PurePosixPath
 from typing import TYPE_CHECKING, ClassVar, override
 
@@ -15,6 +16,7 @@ from sarj_python_lint.rule_base import (
     RuleExample,
 )
 from sarj_python_lint.rules._logging import LOG_METHODS, is_logger_expr
+from sarj_python_lint.rules._loguru import logger_imports_untouched
 
 
 if TYPE_CHECKING:
@@ -22,6 +24,7 @@ if TYPE_CHECKING:
     from pathlib import Path
 
     from sarj_python_lint._file_context import PythonFileContext
+    from sarj_python_lint.rules._resource_provenance import ResourceProvenance
 
 
 # A whole redaction token (`token_prefix`, `password_hash`, `secret_masked`,
@@ -30,6 +33,16 @@ if TYPE_CHECKING:
 _REDACTION_TOKENS = frozenset(
     {"prefix", "suffix", "redact", "redacted", "mask", "masked", "hash", "hint", "len", "length", "tag"}
 )
+_LOGURU_OPT_PARAMETERS = frozenset({"exception", "record", "lazy", "colors", "raw", "capture", "depth", "ansi"})
+_LOGURU_LOG_METHODS = frozenset(
+    {"trace", "debug", "info", "success", "warning", "error", "critical", "exception", "log"}
+)
+
+
+@dataclass(frozen=True, slots=True)
+class _OptBindingCandidate:
+    root: ast.expr
+    values: tuple[ast.expr, ...]
 
 
 def _is_raw_secret_reference(value: ast.expr) -> bool:
@@ -89,6 +102,9 @@ class NoSecretInLog(Rule):
         category=RuleCategory.SECURITY,
         limitations=(
             "Detection covers direct secret-named message and argument values, terminal attributes, constant secret-key subscripts, identity slices, f-string and literal format arguments, string concatenation, nested literal containers, literal keyword unpacking, and immediate structured-logger bindings.",
+            "Immediate opt calls on a proven untouched native Loguru logger expose only the first bind's values. Positional or expanded chain arguments, unsupported opt keyword names, custom wrappers, stored aliases, and visibly mutated or escaped imports are excluded from this added coverage.",
+            "This added coverage requires a native Loguru logging method and a positional message, with no terminal keyword or expanded arguments. Terminal fields are excluded even with capture=False, rather than evaluating option state or merging fields that may override bindings.",
+            "Earlier inner bindings are not merged: a safe outer binding hides earlier bindings, including nonconflicting fields. Opaque runtime effects remain unresolved.",
             "Logger recognition and secret classification are lexical; general aliases, arbitrary calls, dynamic containers, and interprocedural dataflow are not inspected.",
         ),
         examples=(
@@ -125,28 +141,24 @@ class NoSecretInLog(Rule):
         tree = context.tree
         if tree is None:
             return []
+        provenance: ResourceProvenance | None = None
+        untouched = False
         diags: list[Diagnostic] = []
         for node in context.nodes(ast.Call):
             function = node.func
             if not isinstance(function, ast.Attribute) or not _is_logging_call(node):
                 continue
-            message_index = 1 if function.attr == "log" else 0
-            for arg in node.args[message_index:]:
-                diags.extend(
-                    Diagnostic(
-                        path=path,
-                        line=unsafe.lineno,
-                        col=unsafe.col_offset + 1,
-                        code=self.code,
-                        message="Credential-like reference is interpolated into a log message and may expose sensitive data — omit it.",
-                    )
-                    for unsafe in _unsafe_message_values(arg)
-                )
+            _collect_message_secrets(path, node, self.code, diags)
             _collect_keyword_secrets(path, node, self.code, diags)
-            diags.extend(
-                _diagnostic(path, value, self.code, "structured logger binding")
-                for value in _bound_logger_values(function.value)
-            )
+            bound_values = _bound_logger_values(function.value)
+            candidate = _opt_binding_candidate(node)
+            if candidate is not None:
+                if provenance is None:
+                    provenance = context.static_resource_provenance
+                    untouched = logger_imports_untouched(context, provenance)
+                if untouched and provenance.imported(candidate.root, "loguru.logger"):
+                    bound_values = candidate.values
+            diags.extend(_diagnostic(path, value, self.code, "structured logger binding") for value in bound_values)
         return diags
 
 
@@ -158,6 +170,50 @@ def _bound_logger_values(receiver: ast.expr) -> tuple[ast.expr, ...]:
     return tuple(secret for keyword in receiver.keywords for secret in _unsafe_message_values(keyword.value))
 
 
+def _opt_binding_candidate(call: ast.Call) -> _OptBindingCandidate | None:
+    receiver = _loguru_terminal_receiver(call)
+    if receiver is None:
+        return None
+    binding = receiver
+    if not isinstance(binding, ast.Call) or not isinstance(binding.func, ast.Attribute) or binding.func.attr != "opt":
+        return None
+    while isinstance(binding, ast.Call) and isinstance(binding.func, ast.Attribute) and binding.func.attr == "opt":
+        binding = binding.func.value
+    if not isinstance(binding, ast.Call) or not isinstance(binding.func, ast.Attribute) or binding.func.attr != "bind":
+        return None
+    values = _bound_logger_values(binding)
+    if not values:
+        return None
+    root = _loguru_chain_root(receiver)
+    if root is None:
+        return None
+    return _OptBindingCandidate(root=root, values=values)
+
+
+def _loguru_terminal_receiver(call: ast.Call) -> ast.expr | None:
+    function = call.func
+    if (
+        not isinstance(function, ast.Attribute)
+        or function.attr not in _LOGURU_LOG_METHODS
+        or len(call.args) <= int(function.attr == "log")
+        or call.keywords
+        or any(isinstance(argument, ast.Starred) for argument in call.args)
+    ):
+        return None
+    return function.value
+
+
+def _loguru_chain_root(receiver: ast.expr) -> ast.expr | None:
+    root = receiver
+    while isinstance(root, ast.Call) and isinstance(root.func, ast.Attribute):
+        if root.func.attr not in {"bind", "opt"} or root.args or any(keyword.arg is None for keyword in root.keywords):
+            return None
+        if root.func.attr == "opt" and any(keyword.arg not in _LOGURU_OPT_PARAMETERS for keyword in root.keywords):
+            return None
+        root = root.func.value
+    return root
+
+
 def _diagnostic(path: Path, value: ast.expr, code: str, context: str) -> Diagnostic:
     return Diagnostic(
         path=path,
@@ -183,6 +239,24 @@ def _unsafe_formatted_values(parts: list[ast.expr]) -> tuple[ast.expr, ...]:
     )
 
 
+def _collect_message_secrets(path: Path, node: ast.Call, code: str, diags: list[Diagnostic]) -> None:
+    function = node.func
+    if not isinstance(function, ast.Attribute):
+        return
+    message_index = 1 if function.attr == "log" else 0
+    for arg in node.args[message_index:]:
+        diags.extend(
+            Diagnostic(
+                path=path,
+                line=unsafe.lineno,
+                col=unsafe.col_offset + 1,
+                code=code,
+                message="Credential-like reference is interpolated into a log message and may expose sensitive data — omit it.",
+            )
+            for unsafe in _unsafe_message_values(arg)
+        )
+
+
 def _collect_keyword_secrets(path: Path, node: ast.Call, code: str, diags: list[Diagnostic]) -> None:
     for kw in node.keywords:
         if kw.arg is None:

{sarj_python_lint-1.108.0 → sarj_python_lint-1.108.50}/src/sarj_python_lint/rules/require_explicit_psycopg_transaction.py

@@ -313,6 +313,8 @@ class _Analysis:
             state.constants[target.id] = value
 
     def executions(self, statement: ast.stmt, state: _State) -> None:
+        if not state.bindings:
+            return
         for node in _eager_nodes(statement):
             if (
                 not isinstance(node, ast.Call)