vexpath 0.1.0__tar.gz → 0.1.2__tar.gz

{vexpath-0.1.0 → vexpath-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vexpath
-Version: 0.1.0
+Version: 0.1.2
 Summary: Command-line tool: generate SBOMs, match advisories, analyse reachability and emit signed VEX.
 Project-URL: Homepage, https://github.com/Unknown122-coder/vexpath
 Project-URL: Documentation, https://github.com/Unknown122-coder/vexpath/tree/main/docs
@@ -27,7 +27,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: rich>=13.9
 Requires-Dist: typer>=0.15
-Requires-Dist: vexpath-core==0.1.0
+Requires-Dist: vexpath-core==0.1.2
 Description-Content-Type: text/markdown
 
 # vexpath

{vexpath-0.1.0 → vexpath-0.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vexpath"
-version = "0.1.0"
+version = "0.1.2"
 description = "Command-line tool: generate SBOMs, match advisories, analyse reachability and emit signed VEX."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -45,7 +45,7 @@ classifiers = [
 ]
 
 dependencies = [
-    "vexpath-core==0.1.0",
+    "vexpath-core==0.1.2",
     "typer>=0.15",
     "rich>=13.9",
 ]

{vexpath-0.1.0 → vexpath-0.1.2}/src/vexpath/commands/auth.py

@@ -187,6 +187,44 @@ def _environment() -> dict[str, str]:
     return dict(os.environ)
 
 
+def fetch_policy(credential: credentials.Credential, project: str) -> str:
+    """Read the expression a project is governed by.
+
+    So that a policy set once in the dashboard governs every build, instead
+    of every build having to be told the rule on its command line. The
+    expression is returned rather than the preset name: the answer must not
+    depend on the client's idea of what a preset means.
+    """
+    try:
+        with httpx.Client(timeout=_TIMEOUT, follow_redirects=True) as client:
+            response = client.get(
+                f"{credential.api_url}/v1/projects/{project}/policy",
+                headers={"Authorization": f"Bearer {credential.secret}"},
+            )
+    except httpx.HTTPError as exc:
+        fail(f"{credential.api_url} could not be reached for the project policy: {exc}")
+
+    if response.status_code == 401:
+        fail_config("the platform rejected the credential. Run 'vexpath login' again.")
+    if response.status_code == 404:
+        fail_config(
+            f"no policy for project {project!r}. Either the project does not exist "
+            f"in this organisation, or it has no policy yet -- set one in the "
+            f"dashboard, or drop --policy project to use the default."
+        )
+    if response.status_code >= 400:
+        fail(f"the project policy could not be read: {response.status_code}")
+
+    try:
+        expression = str(response.json()["expression"])
+    except (ValueError, KeyError, TypeError):
+        fail("the platform returned a policy this build cannot read")
+
+    if not expression.strip():
+        fail_config(f"project {project!r} has an empty policy, which gates nothing")
+    return expression
+
+
 def upload_results(
     credential: credentials.Credential, project: str, results: Mapping[str, Any]
 ) -> dict[str, Any]:

{vexpath-0.1.0 → vexpath-0.1.2}/src/vexpath/commands/scan.py

@@ -125,10 +125,11 @@ def command(
         typer.Option(
             "--policy",
             help=(
-                "The gate: a preset name, a CEL expression, or a path to a file "
-                "holding one. Exits 1 when it fails. Run 'vexpath policy list' to "
-                "see the presets. Without this, nothing is gated and the scan "
-                "only reports."
+                "The gate: 'project' to use the policy set in the dashboard for "
+                "--project, or a preset name, a CEL expression, or a path to a "
+                "file holding one. Exits 1 when it fails. Run 'vexpath policy "
+                "list' to see the presets. Without this, nothing is gated and "
+                "the scan only reports."
             ),
         ),
     ] = None,
@@ -178,7 +179,12 @@ def command(
     # Resolved before any analysis runs. A missing credential or a forgotten
     # --project discovered after a four-minute scan has thrown the scan away,
     # and the person who sees that message is already in a hurry.
-    credential = _upload_credential(upload=upload, project=project)
+    credential = _upload_credential(upload=upload, project=project, policy=policy)
+    # Before any analysis too, and for the same reason: a policy that cannot
+    # be fetched should not be discovered after a four-minute scan. This may
+    # resolve a credential even without --upload, because reading the
+    # project's policy is itself an authenticated call.
+    resolved_policy = _resolve_policy(policy, project=project, credential=credential)
 
     source = advisory_source(snapshot, result_noun="scan")
     scopes = (
@@ -190,7 +196,7 @@ def command(
         sbom_path=sbom,
         lockfile=lockfile,
         include_scopes=scopes,
-        policy=_resolve_policy(policy),
+        policy=resolved_policy,
         reachability=not no_reach,
         entry_points=tuple(
             entry.strip() for entry in (entry_point or "").split(",") if entry.strip()
@@ -233,18 +239,32 @@ def command(
         raise typer.Exit(code=int(ExitCode.POLICY_FAILED))
 
 
-def _upload_credential(*, upload: bool, project: str | None) -> credentials.Credential | None:
+def _upload_credential(
+    *, upload: bool, project: str | None, policy: str | None = None
+) -> credentials.Credential | None:
     """The credential to upload with, or None when no upload was asked for.
 
     Resolved up front so the two mistakes that waste a whole scan -- no
     credential, and --upload without --project -- are reported before the
     analysis starts rather than after it.
+
+    ``--project`` also means something without ``--upload``: ``--policy
+    project`` names the project whose policy to fetch. Refusing that
+    combination made it impossible to check a build against the
+    organisation's gate without also publishing the results, which are two
+    unrelated decisions.
     """
+    wants_project_policy = (policy or "").strip() == PROJECT_POLICY
+
     if not upload:
-        if project is not None:
+        if project is not None and not wants_project_policy:
             # Saying nothing would silently discard the flag, and the person
             # would wait for a result that never appears on the platform.
-            fail_config("--project only means something with --upload.")
+            fail_config("--project only means something with --upload or --policy project.")
+        if wants_project_policy:
+            # Reading the policy is itself authenticated, so the credential
+            # is resolved here for the same reason: before the analysis.
+            return auth.credential_or_exit()
         return None
     if not project:
         fail_config("--upload needs --project to say where the result goes.")
@@ -262,15 +282,39 @@ def _upload(credential: credentials.Credential, project: str, results: object) -
     note(f"uploaded to {credential.api_url} as scan {scan_id}")
 
 
-def _resolve_policy(source: str | None) -> str | None:
+#: What ``--policy`` means when it means "ask the platform".
+PROJECT_POLICY = "project"
+
+
+def _resolve_policy(
+    source: str | None,
+    *,
+    project: str | None = None,
+    credential: object | None = None,
+) -> str | None:
     """Turn the flag into something the core can compile.
 
     A preset name wins over a file of the same name: the presets are a closed
     vocabulary, and a file called ``balanced`` in a working directory must not
     silently change what the default means.
+
+    ``--policy project`` fetches the expression the dashboard holds for
+    ``--project``, so a rule written once governs every build instead of
+    every build repeating it. Nothing local can shadow that word: it is
+    checked before the preset table and before the filesystem, because a file
+    called ``project`` quietly replacing the organisation's gate is exactly
+    the substitution this flag must not allow.
     """
     if source is None:
         return None
+
+    if source.strip() == PROJECT_POLICY:
+        if not project:
+            fail_config("--policy project needs --project to say which project's policy to use")
+        resolved = credential or auth.credential_or_exit()
+        assert isinstance(resolved, credentials.Credential)  # narrowed for the type checker
+        return auth.fetch_policy(resolved, project)
+
     if source in PRESETS:
         return source
     candidate = Path(source)

{vexpath-0.1.0 → vexpath-0.1.2}/src/vexpath/credentials.py

@@ -34,7 +34,14 @@ KEY_ENVIRONMENT_VARIABLE = "VEXPATH_API_KEY"
 #: Where the platform lives, overridable for a self-hosted install.
 URL_ENVIRONMENT_VARIABLE = "VEXPATH_API_URL"
 
-DEFAULT_API_URL = "https://api.vexpath.dev"
+#: The deployment this tool talks to when nothing says otherwise.
+#:
+#: It was ``https://api.vexpath.dev`` until 2026-11-12, which is a hostname
+#: nobody owns: ``vexpath login`` stored it silently and the first upload
+#: failed with a DNS error naming a domain the user had never heard of. A
+#: default that points nowhere is worse than no default, because it fails
+#: later and somewhere else.
+DEFAULT_API_URL = "https://vexpath.fly.dev"
 
 #: Overrides the whole configuration directory, which is what a test needs and
 #: what a container with a read-only home directory needs too.

{vexpath-0.1.0 → vexpath-0.1.2}/tests/test_cli.py

@@ -1027,3 +1027,69 @@ def test_vex_export_refuses_an_unknown_format(
     )
     assert result.exit_code == int(ExitCode.CONFIG_ERROR)
     assert "'openvex' or 'cyclonedx'" in result.stderr
+
+
+# --- --policy project ------------------------------------------------------
+
+
+def test_the_project_policy_cannot_be_shadowed_by_a_local_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A file called ``project`` must not replace the organisation's gate.
+
+    ``--policy`` accepts a path, so a file of that name in a working
+    directory is the obvious substitution attack on a centrally managed
+    policy: drop ``project`` in the repository, and the gate becomes whatever
+    the repository says. The word is therefore resolved before the preset
+    table and before the filesystem.
+    """
+    from vexpath.commands import auth
+    from vexpath.commands import scan as scan_module
+
+    (tmp_path / "project").write_text("findings.exists(f, false)", encoding="utf-8")
+
+    fetched: list[str] = []
+
+    def fake_fetch(credential: object, project: str) -> str:
+        fetched.append(project)
+        return "findings.exists(f, f.kev)"
+
+    monkeypatch.setattr(auth, "fetch_policy", fake_fetch)
+    monkeypatch.chdir(tmp_path)
+
+    resolved = scan_module._resolve_policy("project", project="svc", credential=_credential())
+
+    assert resolved == "findings.exists(f, f.kev)"
+    assert fetched == ["svc"]
+
+
+def test_the_project_policy_needs_a_project() -> None:
+    import typer
+
+    from vexpath.commands import scan as scan_module
+
+    # fail_config raises typer.Exit, not SystemExit: the CLI exits through
+    # Typer so the exit code stays in one place.
+    with pytest.raises(typer.Exit):
+        scan_module._resolve_policy("project", project=None, credential=_credential())
+
+
+def test_a_preset_still_wins_over_a_file_of_the_same_name(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from vexpath.commands import scan as scan_module
+
+    (tmp_path / "balanced").write_text("findings.exists(f, false)", encoding="utf-8")
+    monkeypatch.chdir(tmp_path)
+
+    assert scan_module._resolve_policy("balanced") == "balanced"
+
+
+def _credential() -> object:
+    from vexpath.credentials import Credential
+
+    return Credential(
+        secret="vexpath_live_xxxxxxxxxxxx",
+        api_url="https://example.invalid",
+        source="file",
+    )