sourcecode 3.1.1__py3-none-any.whl → 3.2.1__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "3.1.1"
+__version__ = "3.2.1"

sourcecode/chain_rules.py

@@ -274,16 +274,57 @@ def rule_matches(rule: AccessRule, method: str, path: str) -> bool:
     return any(ant_matches(pattern, path) for pattern in rule.patterns)
 
 
-def first_matching_rule(
-    rules: "list[AccessRule]", method: str, path: str
-) -> "Optional[AccessRule]":
-    """The rule Spring would apply: the first declared one that matches."""
+#: Matchers that see the DispatcherServlet path. An ant matcher matches the URL
+#: the filter chain receives — servlet path included, servlet CONTEXT path never,
+#: because the container has already stripped it. An mvc matcher matches the path
+#: relative to the servlet mapping, so the servlet path is not part of it.
+#: `requestMatchers` is either one depending on the Spring Security version and
+#: what is on the classpath — undecidable from source, so both readings are tried
+#: and the pattern is honoured if it covers the request under either.
+_SERVLET_PATH_MATCHERS = ("antMatchers", "regexMatchers", "requestMatchers")
+_SERVLET_RELATIVE_MATCHERS = ("mvcMatchers", "requestMatchers")
+
+
+def candidate_paths(rule: AccessRule, path: str, servlet_prefix: str = "") -> "tuple[str, ...]":
+    """The path(s) `rule`'s matcher compares against a mapping-relative `path`.
+
+    Without a declared servlet path the two readings coincide and this is just
+    `(path,)` — which is every repository that never set `spring.mvc.servlet.path`.
+    """
+    if not servlet_prefix or rule.is_any_request:
+        return (path,)
+    prefixed = f"{servlet_prefix.rstrip('/')}/{path.lstrip('/')}".rstrip("/") or "/"
+    out: list[str] = []
+    if rule.matcher in _SERVLET_PATH_MATCHERS:
+        out.append(prefixed)
+    if rule.matcher in _SERVLET_RELATIVE_MATCHERS or not out:
+        out.append(path)
+    return tuple(dict.fromkeys(out))
+
+
+def first_match(
+    rules: "list[AccessRule]", method: str, path: str, servlet_prefix: str = ""
+) -> "tuple[Optional[AccessRule], str]":
+    """`(rule Spring would apply, the path it matched)` — first declared wins.
+
+    The matched path is returned because with a servlet path declared it is not
+    the mapping-relative path the endpoint is keyed by, and a reader checking the
+    claim against the source line needs to see the URL the rule actually covers.
+    """
     for rule in rules:
         if rule.paths_unknown:
             # A rule whose paths could not be read may cover this request, and
             # everything after it is only reachable if it does not. Stopping here
             # is what keeps a later `permitAll` from being reported as the answer.
-            return rule
-        if rule_matches(rule, method, path):
-            return rule
-    return None
+            return rule, path
+        for candidate in candidate_paths(rule, path, servlet_prefix):
+            if rule_matches(rule, method, candidate):
+                return rule, candidate
+    return None, path
+
+
+def first_matching_rule(
+    rules: "list[AccessRule]", method: str, path: str, servlet_prefix: str = ""
+) -> "Optional[AccessRule]":
+    """The rule Spring would apply: the first declared one that matches."""
+    return first_match(rules, method, path, servlet_prefix)[0]