tai42-storage-github 0.2.2__tar.gz → 0.3.0__tar.gz

{tai42_storage_github-0.2.2/src/tai42_storage_github.egg-info → tai42_storage_github-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tai42-storage-github
-Version: 0.2.2
+Version: 0.3.0
 Summary: GitHub-backed Storage provider (text + binary/media) for the TAI ecosystem.
 Author-email: tai42 <oss@tai42.ai>
 License-Expression: Apache-2.0
@@ -20,7 +20,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
 Requires-Dist: tai42-contract<0.4,>=0.3
-Requires-Dist: tai42-kit<0.4,>=0.2
+Requires-Dist: tai42-kit<0.5,>=0.4
 Requires-Dist: httpx>=0.28
 Requires-Dist: pydantic>=2.12
 Requires-Dist: pydantic-settings>=2.11

{tai42_storage_github-0.2.2 → tai42_storage_github-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tai42-storage-github"
-version = "0.2.2"
+version = "0.3.0"
 description = "GitHub-backed Storage provider (text + binary/media) for the TAI ecosystem."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -26,7 +26,7 @@ dependencies = [
     # The pure interface contract (Storage, ObjectStat, assert_not_root, tai42_app).
     "tai42-contract>=0.3,<0.4",
     # Pooled clients + settings primitives (PooledClient, TaiBaseSettings, cache).
-    "tai42-kit>=0.2,<0.4",
+    "tai42-kit>=0.4,<0.5",
     "httpx>=0.28",
     "pydantic>=2.12",
     "pydantic-settings>=2.11",

{tai42_storage_github-0.2.2 → tai42_storage_github-0.3.0}/src/tai42_storage_github/settings.py

@@ -18,6 +18,13 @@ class GithubStorageSettings(TaiBaseSettings):
     repo: str | None = None
     branch: str = "main"
     token: SecretStr | None = None
+    # Base-URL templates for the three REST surfaces the provider speaks, default to
+    # the real GitHub hosts. Overridable (like ``S3Settings.endpoint``) so a test can
+    # point the plugin at a hermetic stand-in; each carries ``{username}``/``{repo}``/
+    # ``{branch}`` placeholders the provider fills per request.
+    raw_base_url: str = "https://raw.githubusercontent.com/{username}/{repo}/refs/heads/{branch}"
+    contents_api_url: str = "https://api.github.com/repos/{username}/{repo}/contents"
+    trees_api_url: str = "https://api.github.com/repos/{username}/{repo}/git/trees/{branch}"
     timeout_total: float = 15.0
     max_connections: int = 200
     max_keepalive_connections: int = 50

{tai42_storage_github-0.2.2 → tai42_storage_github-0.3.0}/src/tai42_storage_github/storage.py

@@ -21,22 +21,38 @@ from tai42_storage_github.settings import GithubStorageSettings, github_storage_
 
 logger = logging.getLogger(__name__)
 
-RAW_BASE_URL = "https://raw.githubusercontent.com/{username}/{repo}/refs/heads/{branch}"
-CONTENTS_API_URL = "https://api.github.com/repos/{username}/{repo}/contents"
-TREES_API_URL = "https://api.github.com/repos/{username}/{repo}/git/trees/{branch}"
-
 # Conservative upload cap below GitHub's Contents API limit; an oversize file
 # raises before the request. Reads are uncapped (raw endpoint).
 MAX_UPLOAD_BYTES = 1024 * 1024
 
 
 def _join(base: str, path: str) -> str:
-    """Join ``path`` onto ``base``, dropping empty and stray-slash segments."""
-    joined = "/".join(segment for segment in path.split("/") if segment)
+    """Join ``path`` onto ``base``, dropping empty and stray-slash segments.
+
+    A ``..`` segment is rejected loudly: preserved, it would climb out of the
+    configured repo/branch base and let a caller-supplied path reach an arbitrary
+    raw/contents URL (path traversal).
+    """
+    segments = [segment for segment in path.split("/") if segment]
+    if ".." in segments:
+        raise ValueError(f"path traversal ('..') is not allowed in storage path: {path!r}")
+    joined = "/".join(segments)
     base = base.rstrip("/")
     return f"{base}/{joined}" if joined else base
 
 
+def _raw_url(settings: GithubStorageSettings, path: str) -> str:
+    """The RAW-endpoint URL for ``path``, from the configured raw base-URL template."""
+    base = settings.raw_base_url.format(username=settings.username, repo=settings.repo, branch=settings.branch)
+    return _join(base, path)
+
+
+def _contents_url(settings: GithubStorageSettings, path: str) -> str:
+    """The Contents-API URL for ``path``, from the configured contents base-URL template."""
+    base = settings.contents_api_url.format(username=settings.username, repo=settings.repo)
+    return _join(base, path)
+
+
 def _configured_settings() -> GithubStorageSettings:
     """The cached settings; raises a clear config error naming the env vars when
     owner/repo is unset."""
@@ -83,7 +99,7 @@ def _raise_for_status(resp: httpx.Response, action: str, path: str, url: str) ->
 class GithubStorage(Storage):
     async def load(self, path: str) -> str:
         settings = _configured_settings()
-        url = _join(RAW_BASE_URL.format(username=settings.username, repo=settings.repo, branch=settings.branch), path)
+        url = _raw_url(settings, path)
         async with tai42_app.clients.client_ctx(GithubHttpxClient) as client:
             resp = await client.get(url, headers=_auth_headers(settings))
             self._guard_read(resp, path, url)
@@ -91,7 +107,7 @@ class GithubStorage(Storage):
 
     async def load_bytes(self, path: str) -> bytes:
         settings = _configured_settings()
-        url = _join(RAW_BASE_URL.format(username=settings.username, repo=settings.repo, branch=settings.branch), path)
+        url = _raw_url(settings, path)
         async with tai42_app.clients.client_ctx(GithubHttpxClient) as client:
             resp = await client.get(url, headers=_auth_headers(settings))
             self._guard_read(resp, path, url)
@@ -114,7 +130,7 @@ class GithubStorage(Storage):
         raised on loudly rather than acting on a partial listing.
         """
         settings = _configured_settings()
-        url = TREES_API_URL.format(username=settings.username, repo=settings.repo, branch=settings.branch)
+        url = settings.trees_api_url.format(username=settings.username, repo=settings.repo, branch=settings.branch)
         async with tai42_app.clients.client_ctx(GithubHttpxClient) as client:
             resp = await client.get(url, headers=_api_headers(settings), params={"recursive": "1"})
             _raise_for_status(resp, "listing", prefix or "/", url)
@@ -145,7 +161,7 @@ class GithubStorage(Storage):
                 f"{MAX_UPLOAD_BYTES}-byte GitHub Contents API upload cap. Store large objects elsewhere."
             )
         settings = _configured_settings()
-        url = _join(CONTENTS_API_URL.format(username=settings.username, repo=settings.repo), path)
+        url = _contents_url(settings, path)
         headers = _api_headers(settings)
         encoded = base64.b64encode(data).decode("ascii")
         async with tai42_app.clients.client_ctx(GithubHttpxClient) as client:
@@ -169,7 +185,7 @@ class GithubStorage(Storage):
 
     async def delete(self, path: str) -> None:
         settings = _configured_settings()
-        url = _join(CONTENTS_API_URL.format(username=settings.username, repo=settings.repo), path)
+        url = _contents_url(settings, path)
         headers = _api_headers(settings)
         async with tai42_app.clients.client_ctx(GithubHttpxClient) as client:
             get_resp = await client.get(url, headers=headers, params={"ref": settings.branch})

{tai42_storage_github-0.2.2 → tai42_storage_github-0.3.0}/src/tai42_storage_github/tai-plugin.yml

@@ -2,7 +2,7 @@ spec_version: 1
 namespace: tai42
 name: storage-github
 package: tai42-storage-github
-version: 0.2.2
+version: 0.3.0
 description: GitHub-backed Storage provider (text + binary/media) for the TAI ecosystem.
 license: Apache-2.0
 homepage: https://tai42.ai

{tai42_storage_github-0.2.2 → tai42_storage_github-0.3.0/src/tai42_storage_github.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tai42-storage-github
-Version: 0.2.2
+Version: 0.3.0
 Summary: GitHub-backed Storage provider (text + binary/media) for the TAI ecosystem.
 Author-email: tai42 <oss@tai42.ai>
 License-Expression: Apache-2.0
@@ -20,7 +20,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
 Requires-Dist: tai42-contract<0.4,>=0.3
-Requires-Dist: tai42-kit<0.4,>=0.2
+Requires-Dist: tai42-kit<0.5,>=0.4
 Requires-Dist: httpx>=0.28
 Requires-Dist: pydantic>=2.12
 Requires-Dist: pydantic-settings>=2.11

{tai42_storage_github-0.2.2 → tai42_storage_github-0.3.0}/src/tai42_storage_github.egg-info/requires.txt

@@ -1,5 +1,5 @@
 tai42-contract<0.4,>=0.3
-tai42-kit<0.4,>=0.2
+tai42-kit<0.5,>=0.4
 httpx>=0.28
 pydantic>=2.12
 pydantic-settings>=2.11