scrapely-python 0.1.30__tar.gz → 0.1.31__tar.gz

{scrapely_python-0.1.30 → scrapely_python-0.1.31}/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.1.31] - 2026-10-20
+
+- The storage client percent-encodes request ids and key-value store record keys as one URL path segment and refuses `''`, `.` and `..`. A request id such as `..` read from a queue used to send the call to another resource.
+
 ## [0.1.30] - 2026-10-20
 
 - Removed `apify_margin_percentage` from the pricing info models; the API no longer returns it.

{scrapely_python-0.1.30 → scrapely_python-0.1.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scrapely-python
-Version: 0.1.30
+Version: 0.1.31
 Summary: Scrapely Python SDK - A toolkit for building Actors on the Scrapely platform
 Author-email: Scrapely <support@scrape.ly>
 License-Expression: MIT AND Apache-2.0

{scrapely_python-0.1.30 → scrapely_python-0.1.31}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "scrapely-python"
-version = "0.1.30"
+version = "0.1.31"
 description = "Scrapely Python SDK - A toolkit for building Actors on the Scrapely platform"
 readme = "README.md"
 license = "MIT AND Apache-2.0"

{scrapely_python-0.1.30 → scrapely_python-0.1.31}/src/scrapely/__init__.py

@@ -227,7 +227,7 @@ if TYPE_CHECKING:  # Static analysers and IDEs see the lazy names as plain impor
         set_api_storage,
     )
 
-__version__ = '0.1.30'
+__version__ = '0.1.31'
 __all__ = [
     # Core
     'Actor',

{scrapely_python-0.1.30 → scrapely_python-0.1.31}/src/scrapely/actor.py

@@ -1756,10 +1756,10 @@ class Actor(metaclass=_ActorMeta):
 
         opts = options or MetamorphOptions()
 
-        # Wire format (server contract): the server copies the current INPUT to
-        # INPUT-METAMORPH-<n> itself and tracks the metamorph count in run
-        # stats; the new input (if any) is read from the request body's
-        # `input` field. targetActorId/build are accepted in the body.
+        # Wire format (server contract): the new input (if any) goes in the
+        # request body's `input` field; the server stores it as
+        # INPUT-METAMORPH-<n> (INPUT keeps the original) and tracks the
+        # metamorph count in run stats. targetActorId/build are accepted in the body.
         client = cls.new_client()
         body: Dict[str, Any] = {'targetActorId': target_actor_id}
         if opts.build:

{scrapely_python-0.1.30 → scrapely_python-0.1.31}/src/scrapely/storage/client.py

@@ -47,9 +47,32 @@ def is_storage_uuid(value: str) -> bool:
     return bool(STORAGE_UUID_REGEX.match(value))
 
 
+def path_segment(value: str) -> str:
+    """Percent-encode a value so it stays one URL path segment.
+
+    `''`, `.` and `..` are rejected: a URL parser resolves dot segments even when
+    percent-encoded, so the call would land on the parent resource.
+    """
+    if not isinstance(value, str):
+        raise TypeError(f'Expected a string for a URL path segment, got {type(value).__name__}')
+    if value in ('', '.', '..'):
+        raise ValueError(f'"{value}" cannot be used as a URL path segment.')
+    return quote(value, safe='')
+
+
 def kvs_record_path(store_id: str, key: str) -> str:
     """Build a KVS record path with a URL-encoded key."""
-    return f'/v2/key-value-stores/{store_id}/records/{quote(key, safe="")}'
+    return f'/v2/key-value-stores/{store_id}/records/{path_segment(key)}'
+
+
+def rq_request_path(queue_id: str, request_id: str, suffix: str = '') -> str:
+    """Build the path of one queued request with the id URL-encoded.
+
+    Request ids come from queue contents, which another client may have written:
+    unencoded, an id such as `..` or `../../key-value-stores/x` would send the
+    call to another resource.
+    """
+    return f'/v2/request-queues/{queue_id}/requests/{path_segment(request_id)}{suffix}'
 
 
 def build_rq_params(
@@ -478,7 +501,7 @@ class ApiStorageClient:
 
     async def rq_get_request(self, queue_id: str, request_id: str) -> Optional[Request]:
         try:
-            data = await self.api_client.get_json(f'/v2/request-queues/{queue_id}/requests/{request_id}')
+            data = await self.api_client.get_json(rq_request_path(queue_id, request_id))
             return Request.from_dict(data)
         except ApiClientError as err:
             if err.status_code == 404:
@@ -523,7 +546,7 @@ class ApiStorageClient:
         payload = request.to_dict()
         payload['handledAt'] = datetime.now(timezone.utc).isoformat().replace('+00:00', 'Z')
         data = await self.api_client.put_json(
-            f'/v2/request-queues/{queue_id}/requests/{request.id}',
+            rq_request_path(queue_id, request.id),
             payload,
             params=build_rq_params(client_key),
         )
@@ -561,12 +584,12 @@ class ApiStorageClient:
         # Persist retryCount/errorMessages before unlocking, so the next fetch
         # sees them and max_request_retries is ever reached.
         await self.api_client.put_json(
-            f'/v2/request-queues/{queue_id}/requests/{request.id}',
+            rq_request_path(queue_id, request.id),
             request.to_dict(),
             params=build_rq_params(client_key, forefront=forefront),
         )
         await self.api_client.delete(
-            f'/v2/request-queues/{queue_id}/requests/{request.id}/lock',
+            rq_request_path(queue_id, request.id, '/lock'),
             params=build_rq_params(client_key, forefront=forefront),
         )
         return ProcessedRequest(
@@ -601,7 +624,7 @@ class ApiStorageClient:
         )
 
     async def rq_delete_request(self, queue_id: str, request_id: str) -> None:
-        await self.api_client.delete(f'/v2/request-queues/{queue_id}/requests/{request_id}')
+        await self.api_client.delete(rq_request_path(queue_id, request_id))
 
     async def rq_prolong_request_lock(
         self,
@@ -614,7 +637,7 @@ class ApiStorageClient:
     ) -> Dict[str, Any]:
         """Prolong the lock on a request (REST API: PUT /requests/{id}/lock)."""
         data = await self.api_client.put_json(
-            f'/v2/request-queues/{queue_id}/requests/{request_id}/lock',
+            rq_request_path(queue_id, request_id, '/lock'),
             params=build_rq_params(client_key, lock_secs=lock_secs, forefront=forefront),
         )
         return {'lockExpiresAt': data.get('lockExpiresAt')}

{scrapely_python-0.1.30 → scrapely_python-0.1.31}/src/scrapely_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scrapely-python
-Version: 0.1.30
+Version: 0.1.31
 Summary: Scrapely Python SDK - A toolkit for building Actors on the Scrapely platform
 Author-email: Scrapely <support@scrape.ly>
 License-Expression: MIT AND Apache-2.0