vilopa 0.0.1__py3-none-any.whl

mita/__init__.py

@@ -0,0 +1,5 @@
+"""mita: execute and verify data-erasure and access requests."""
+
+from importlib.metadata import version
+
+__version__ = version("vilopa")

mita/cli.py

@@ -0,0 +1,220 @@
+"""mita command-line interface."""
+
+from __future__ import annotations
+
+import json
+import os
+from collections.abc import Sequence
+from enum import StrEnum
+from pathlib import Path
+from typing import Annotated, Any
+
+import psycopg
+import typer
+
+from mita import __version__
+from mita.connectors import postgres
+from mita.core import datamap
+from mita.core.detect import ColumnReport, Confidence
+from mita.core.lint import LintResult, lint
+
+app = typer.Typer(
+    no_args_is_help=True,
+    help="Execute and verify data-erasure and access requests.",
+)
+datamap_app = typer.Typer(no_args_is_help=True, help="Validate and inspect data maps.")
+app.add_typer(datamap_app, name="datamap")
+
+
+def _print_version(value: bool) -> None:
+    if value:
+        typer.echo(f"mita {__version__}")
+        raise typer.Exit
+
+
+@app.callback()
+def main(
+    version: Annotated[
+        bool,
+        typer.Option("--version", callback=_print_version, is_eager=True, help="Show version."),
+    ] = False,
+) -> None:
+    """mita: delete a person's data from every system you mapped, and prove it."""
+
+
+@datamap_app.command("validate")
+def validate(
+    path: Annotated[Path, typer.Argument(exists=True, dir_okay=False, readable=True)],
+) -> None:
+    """Check a data map for structural and cross-reference problems."""
+    try:
+        dm = datamap.load(path)
+    except datamap.DataMapError as exc:
+        for problem in exc.problems:
+            typer.echo(f"{path}: {problem}", err=True)
+        typer.echo(f"{path}: {len(exc.problems)} problem(s)", err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(f"{path}: ok ({len(dm.tables)} tables, {len(dm.connectors)} connector(s))")
+
+
+@datamap_app.command("schema")
+def schema() -> None:
+    """Print the data map JSON Schema."""
+    typer.echo(json.dumps(datamap.json_schema(), indent=2))
+
+
+class Threshold(StrEnum):
+    LOW = "low"
+    MEDIUM = "medium"
+    HIGH = "high"
+
+
+SampleRows = Annotated[
+    int, typer.Option(min=0, help="Rows sampled per table. 0 classifies by name and type only.")
+]
+AsJson = Annotated[bool, typer.Option("--json", help="Print JSON instead of text.")]
+
+
+@app.command("scan")
+def scan(
+    dsn_env: Annotated[
+        str, typer.Option(help="Environment variable holding the Postgres connection string.")
+    ] = "DATABASE_URL",
+    connector: Annotated[
+        str, typer.Option(help="Connector name to prefix refs with, as in your data map.")
+    ] = "db",
+    schemas: Annotated[
+        list[str] | None, typer.Option("--schema", help="Only scan this schema. Repeatable.")
+    ] = None,
+    sample_rows: SampleRows = 200,
+    show_all: Annotated[
+        bool, typer.Option("--all", help="Also list columns with no finding.")
+    ] = False,
+    as_json: AsJson = False,
+) -> None:
+    """Find columns that look like personal data in a live Postgres database.
+
+    Reads the schema and samples values in a read-only transaction. Values are never
+    printed: the report shows categories, confidences and counts only.
+    """
+    reports = _scan(dsn_env, schemas, sample_rows)
+    shown = [r for r in reports if show_all or r.finding is not None]
+    if as_json:
+        typer.echo(json.dumps([_report_json(r, connector) for r in shown], indent=2))
+        return
+    rows = [
+        (
+            r.column.ref(connector),
+            str(r.finding.category) if r.finding else "-",
+            str(r.finding.confidence) if r.finding else "-",
+            "; ".join(r.finding.reasons) if r.finding else "",
+        )
+        for r in shown
+    ]
+    _echo_table(("COLUMN", "CATEGORY", "CONFIDENCE", "WHY"), rows)
+    found = [r.finding for r in reports if r.finding is not None]
+    by_level = ", ".join(
+        f"{sum(1 for f in found if f.confidence is level)} {level}"
+        for level in reversed(Confidence)
+    )
+    typer.echo(
+        f"\n{len(reports)} columns scanned, {len(found)} look like personal data ({by_level})"
+    )
+
+
+@app.command("lint")
+def lint_command(
+    path: Annotated[Path, typer.Argument(exists=True, dir_okay=False, readable=True)],
+    connectors: Annotated[
+        list[str] | None, typer.Option("--connector", help="Only lint this connector. Repeatable.")
+    ] = None,
+    fail_on: Annotated[
+        Threshold, typer.Option(help="Lowest confidence that fails the lint when unmapped.")
+    ] = Threshold.MEDIUM,
+    sample_rows: SampleRows = 200,
+    as_json: AsJson = False,
+) -> None:
+    """Fail when the database has personal data the data map does not cover, or the map
+    names tables and columns the database no longer has."""
+    try:
+        dm = datamap.load(path)
+    except datamap.DataMapError as exc:
+        for problem in exc.problems:
+            typer.echo(f"{path}: {problem}", err=True)
+        raise typer.Exit(1) from exc
+
+    declared = {c.name: c for c in dm.connectors}
+    for name in connectors or ():
+        if name not in declared:
+            typer.echo(f"{path}: no connector named {name!r}", err=True)
+            raise typer.Exit(2)
+    selected = [declared[name] for name in connectors] if connectors else list(dm.connectors)
+
+    threshold = Confidence[fail_on.name]
+    results: dict[str, LintResult] = {}
+    for connector in selected:
+        reports = _scan(connector.dsn_env, None, sample_rows)
+        results[connector.name] = lint(dm, connector.name, reports, fail_on=threshold)
+
+    failed = any(result.errors for result in results.values())
+    if as_json:
+        out: dict[str, Any] = {
+            "ok": not failed,
+            "connectors": {
+                name: {
+                    "issues": [
+                        {"severity": str(i.severity), "ref": i.ref, "message": i.message}
+                        for i in result.issues
+                    ],
+                    "below_threshold": result.below_threshold,
+                }
+                for name, result in results.items()
+            },
+        }
+        typer.echo(json.dumps(out, indent=2))
+    else:
+        for name, result in results.items():
+            for issue in result.issues:
+                typer.echo(f"{path}: {issue}", err=True)
+            warnings = len(result.issues) - len(result.errors)
+            summary = f"{path}: {name}: {len(result.errors)} error(s), {warnings} warning(s)"
+            if result.below_threshold:
+                summary += (
+                    f"; {result.below_threshold} finding(s) below {fail_on} confidence"
+                    " not checked (see mita scan)"
+                )
+            typer.echo(summary)
+    if failed:
+        raise typer.Exit(1)
+
+
+def _scan(dsn_env: str, schemas: Sequence[str] | None, sample_rows: int) -> list[ColumnReport]:
+    dsn = os.environ.get(dsn_env)
+    if not dsn:
+        typer.echo(f"environment variable {dsn_env} is not set", err=True)
+        raise typer.Exit(2)
+    try:
+        with postgres.connect(dsn) as conn:
+            return postgres.scan(conn, schemas=schemas, sample_rows=sample_rows)
+    except psycopg.Error as exc:
+        typer.echo(f"cannot scan the database in ${dsn_env}: {exc}", err=True)
+        raise typer.Exit(2) from exc
+
+
+def _report_json(report: ColumnReport, connector: str) -> dict[str, Any]:
+    finding = report.finding
+    return {
+        "ref": report.column.ref(connector),
+        "data_type": report.column.data_type,
+        "sampled": report.sampled,
+        "category": str(finding.category) if finding else None,
+        "confidence": str(finding.confidence) if finding else None,
+        "reasons": list(finding.reasons) if finding else [],
+    }
+
+
+def _echo_table(header: tuple[str, ...], rows: Sequence[tuple[str, ...]]) -> None:
+    widths = [max(len(row[i]) for row in (header, *rows)) for i in range(len(header) - 1)]
+    for row in (header, *rows):
+        cells = [cell.ljust(width) for cell, width in zip(row, widths, strict=False)]
+        typer.echo("  ".join([*cells, row[-1]]).rstrip())

mita/connectors/postgres.py

@@ -0,0 +1,101 @@
+"""Read a live Postgres schema and sample column values for detection.
+
+`connect` opens a read-only session with a statement timeout, so a scan can be pointed at a
+production replica without risk of writes or runaway queries. Identifiers only ever reach
+the database through `psycopg.sql.Identifier`. Sampled values go straight to detection and
+are dropped; they are never returned.
+
+Sampling reads the first rows the table returns (no ORDER BY), which is cheap on large
+tables but not random. Columns that sampling misses are still classified by name.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from typing import Any
+
+import psycopg
+from psycopg import sql
+
+from mita.core import detect
+from mita.core.catalog import ColumnInfo
+
+Connection = psycopg.Connection[tuple[Any, ...]]
+
+SAMPLED_TYPES = detect.TEXT_TYPES | {"bigint", "numeric"}
+"""Types whose values can hold an identifier detection recognises (phones fit in bigint)."""
+MAX_VALUE_CHARS = 2000
+"""Longer values are truncated in the query, so one huge document cannot exhaust memory."""
+
+_COLUMNS_SQL = r"""
+SELECT c.table_schema, c.table_name, c.column_name,
+       CASE WHEN c.data_type = 'USER-DEFINED' THEN c.udt_name ELSE c.data_type END
+FROM information_schema.columns c
+JOIN information_schema.tables t
+  ON t.table_schema = c.table_schema AND t.table_name = c.table_name
+WHERE t.table_type = 'BASE TABLE'
+  AND c.table_schema NOT IN ('pg_catalog', 'information_schema')
+  AND c.table_schema NOT LIKE 'pg\_%%'
+  AND (%(schemas)s::text[] IS NULL OR c.table_schema = ANY (%(schemas)s::text[]))
+ORDER BY c.table_schema, c.table_name, c.ordinal_position
+"""
+
+
+def connect(dsn: str, *, statement_timeout_ms: int = 30_000) -> Connection:
+    conn = psycopg.connect(
+        dsn,
+        application_name="mita",
+        options=f"-c statement_timeout={int(statement_timeout_ms)}",
+    )
+    conn.read_only = True
+    return conn
+
+
+def columns(conn: Connection, schemas: Sequence[str] | None = None) -> list[ColumnInfo]:
+    """Every column of every ordinary table, outside the system schemas."""
+    rows = conn.execute(_COLUMNS_SQL, {"schemas": list(schemas) if schemas else None})
+    return [ColumnInfo(str(s), str(t), str(c), str(d)) for s, t, c, d in rows.fetchall()]
+
+
+def scan(
+    conn: Connection, *, schemas: Sequence[str] | None = None, sample_rows: int = 200
+) -> list[detect.ColumnReport]:
+    """Classify every column. `sample_rows=0` classifies by name and type only."""
+    by_table: dict[tuple[str, str], list[ColumnInfo]] = {}
+    for column in columns(conn, schemas):
+        by_table.setdefault((column.schema, column.table), []).append(column)
+
+    reports: list[detect.ColumnReport] = []
+    for (schema, table), table_columns in by_table.items():
+        names = [c.name for c in table_columns if c.data_type in SAMPLED_TYPES]
+        samples = _sample(conn, schema, table, names, sample_rows) if names and sample_rows else {}
+        for column in table_columns:
+            values = samples.get(column.name, [])
+            reports.append(
+                detect.ColumnReport(column, len(values), detect.classify(column, values))
+            )
+    return reports
+
+
+def _sample(
+    conn: Connection, schema: str, table: str, names: Sequence[str], limit: int
+) -> dict[str, list[str]]:
+    query = sql.SQL("SELECT {} FROM {} LIMIT {}").format(
+        sql.SQL(", ").join(
+            sql.SQL("left({}::text, {})").format(sql.Identifier(name), sql.Literal(MAX_VALUE_CHARS))
+            for name in names
+        ),
+        sql.Identifier(schema, table),
+        sql.Literal(limit),
+    )
+    out: dict[str, list[str]] = {name: [] for name in names}
+    try:
+        # A savepoint, so one unreadable table does not abort the whole scan.
+        with conn.transaction():
+            for row in conn.execute(query):
+                for name, value in zip(names, row, strict=True):
+                    if value is not None:
+                        out[name].append(value)
+    except psycopg.errors.InsufficientPrivilege:
+        return {}
+    return out

mita/core/catalog.py

@@ -0,0 +1,21 @@
+"""What a connector's live schema looks like, independent of how it was read."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class ColumnInfo:
+    """One column of one table, as the database reports it."""
+
+    schema: str
+    table: str
+    name: str
+    data_type: str
+
+    def table_ref(self, connector: str) -> str:
+        return f"{connector}.{self.schema}.{self.table}"
+
+    def ref(self, connector: str) -> str:
+        return f"{connector}.{self.schema}.{self.table}.{self.name}"

mita/core/datamap.py

@@ -0,0 +1,321 @@
+"""The data map: where a person's data lives and what erasure does to it.
+
+The map is a YAML file kept in the user's repository and reviewed in pull requests.
+Loading happens in two stages:
+
+1. Structure (pydantic): shapes, enums and required fields; unknown keys are rejected.
+2. Semantics (`check`): cross-references a JSON Schema cannot express. Every problem is
+   reported at once, so a user can fix their map in a single pass.
+
+Names are addressed as `connector.schema.table` and `connector.schema.table.column`.
+Schema, table and column names may hold any character except `.` and whitespace; they
+are only ever sent to a database through `psycopg.sql.Identifier`.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import StrEnum
+from pathlib import Path
+from typing import Annotated, Any, Literal
+
+import yaml
+from pydantic import BaseModel, ConfigDict, Field, StringConstraints, ValidationError
+
+_PART = r"[^.\s]+"
+NAME_PATTERN = r"^[a-z][a-z0-9_]{0,62}$"
+TABLE_REF_PATTERN = rf"^[a-z][a-z0-9_]{{0,62}}\.{_PART}\.{_PART}$"
+COLUMN_REF_PATTERN = rf"^[a-z][a-z0-9_]{{0,62}}\.{_PART}\.{_PART}\.{_PART}$"
+
+Name = Annotated[str, StringConstraints(pattern=NAME_PATTERN)]
+TableRef = Annotated[str, StringConstraints(pattern=TABLE_REF_PATTERN)]
+ColumnRef = Annotated[str, StringConstraints(pattern=COLUMN_REF_PATTERN)]
+NonEmpty = Annotated[str, StringConstraints(strip_whitespace=True, min_length=1)]
+# ISO 8601 date period with at least one part (P6Y, P18M, P1Y6M, P30D). No lookahead:
+# pydantic's regex engine does not support it.
+IsoPeriod = Annotated[str, StringConstraints(pattern=r"^P(\d+Y(\d+M)?(\d+D)?|\d+M(\d+D)?|\d+D)$")]
+EnvVar = Annotated[str, StringConstraints(pattern=r"^[A-Z][A-Z0-9_]*$")]
+
+
+class PiiCategory(StrEnum):
+    """What kind of personal data a column holds. `none` marks a reviewed, non-PII column."""
+
+    EMAIL = "email"
+    PHONE = "phone"
+    NAME = "name"
+    ADDRESS = "address"
+    PIN_CODE = "pin_code"
+    PAN = "pan"
+    AADHAAR = "aadhaar"
+    DOB = "dob"
+    IP_ADDRESS = "ip_address"
+    GSTIN = "gstin"
+    UPI_ID = "upi_id"
+    PAYMENT_REF = "payment_ref"
+    FREE_TEXT = "free_text"
+    OTHER = "other"
+    NONE = "none"
+
+
+class Normalizer(StrEnum):
+    """How an identifier is normalised before it is matched or hashed."""
+
+    EXACT = "exact"
+    EMAIL = "email"
+    IN_MOBILE = "in_mobile"
+
+
+class TableErase(StrEnum):
+    """What erasure does to a matching row."""
+
+    DELETE_ROW = "delete_row"
+    UPDATE_COLUMNS = "update_columns"
+    RETAIN = "retain"
+
+
+class ColumnStrategy(StrEnum):
+    """What erasure does to one column of a row that is kept (`update_columns`)."""
+
+    NULLIFY = "nullify"
+    PSEUDONYMIZE = "pseudonymize"
+    RETAIN = "retain"
+
+
+class _Model(BaseModel):
+    model_config = ConfigDict(extra="forbid", frozen=True, populate_by_name=True)
+
+
+class Retention(_Model):
+    """Why data is kept despite an erasure request, and for how long."""
+
+    reason: NonEmpty = Field(description="Plain-language reason. Shown in evidence records.")
+    period: IsoPeriod = Field(description="ISO 8601 period, e.g. P6Y or P18M.")
+    from_column: str | None = Field(
+        default=None, description="Timestamp column the period counts from."
+    )
+    rule_ref: str | None = Field(
+        default=None, description="The law or policy clause this relies on."
+    )
+
+
+class Column(_Model):
+    pii: PiiCategory
+    strategy: ColumnStrategy | None = Field(
+        default=None, description="Required for PII columns in `update_columns` tables."
+    )
+    retain: Retention | None = Field(default=None, description="Required when strategy is retain.")
+    note: str | None = None
+
+
+class Match(_Model):
+    """A column that identifies the principal directly, without a foreign-key path."""
+
+    key: Name = Field(description="A key declared under `principal.keys`.")
+    column: str
+
+
+class Table(_Model):
+    erase: TableErase
+    retain: Retention | None = Field(
+        default=None, description="Required when erase is retain; the whole row is kept."
+    )
+    match: tuple[Match, ...] = ()
+    columns: dict[str, Column] = Field(default_factory=dict)
+
+
+class PrincipalKey(_Model):
+    column: str = Field(description="Column of the root table holding this identifier.")
+    normalize: Normalizer = Normalizer.EXACT
+
+
+class Principal(_Model):
+    root: TableRef = Field(description="The table whose row is the person.")
+    keys: dict[Name, PrincipalKey] = Field(min_length=1)
+
+
+class Connector(_Model):
+    name: Name
+    kind: Literal["postgres"]
+    dsn_env: EnvVar = Field(description="Environment variable holding the connection string.")
+
+
+class Relation(_Model):
+    """A link the database does not enforce as a foreign key."""
+
+    from_: ColumnRef = Field(alias="from")
+    to: ColumnRef
+
+
+class DataMap(_Model):
+    version: Literal[0]
+    connectors: tuple[Connector, ...] = Field(min_length=1)
+    principal: Principal
+    tables: dict[TableRef, Table] = Field(min_length=1)
+    relations: tuple[Relation, ...] = ()
+
+
+@dataclass(frozen=True)
+class Problem:
+    path: str
+    message: str
+
+    def __str__(self) -> str:
+        return f"{self.path}: {self.message}"
+
+
+class DataMapError(Exception):
+    def __init__(self, problems: list[Problem]) -> None:
+        self.problems = problems
+        super().__init__(f"{len(problems)} problem(s) in data map")
+
+
+def load(path: Path) -> DataMap:
+    """Read, parse and validate a data map. Raises DataMapError listing every problem."""
+    try:
+        raw = yaml.load(path.read_text(encoding="utf-8"), Loader=_StrictLoader)  # noqa: S506
+    except yaml.YAMLError as exc:
+        raise DataMapError([Problem("$", f"invalid YAML: {exc}")]) from exc
+    return from_obj(raw)
+
+
+def from_obj(raw: object) -> DataMap:
+    """Validate an already-parsed object. Raises DataMapError listing every problem."""
+    try:
+        datamap = DataMap.model_validate(raw)
+    except ValidationError as exc:
+        raise DataMapError(
+            [Problem(_format_loc(err["loc"]), err["msg"]) for err in exc.errors()]
+        ) from exc
+    problems = check(datamap)
+    if problems:
+        raise DataMapError(problems)
+    return datamap
+
+
+def check(dm: DataMap) -> list[Problem]:
+    """Cross-reference checks. Returns every problem found, in document order."""
+    problems: list[Problem] = []
+
+    def add(path: str, message: str) -> None:
+        problems.append(Problem(path, message))
+
+    connector_names: set[str] = set()
+    for i, connector in enumerate(dm.connectors):
+        if connector.name in connector_names:
+            add(f"connectors[{i}].name", f"duplicate connector {connector.name!r}")
+        connector_names.add(connector.name)
+
+    root = dm.tables.get(dm.principal.root)
+    if root is None:
+        add("principal.root", f"table {dm.principal.root!r} is not declared under tables")
+    else:
+        if root.erase is TableErase.RETAIN:
+            add("principal.root", "the root table cannot use erase: retain")
+        for key, spec in dm.principal.keys.items():
+            if spec.column not in root.columns:
+                add(
+                    f"principal.keys.{key}.column",
+                    f"column {spec.column!r} is not listed under the root table's columns",
+                )
+
+    for ref, table in dm.tables.items():
+        base = f"tables[{ref!r}]"
+        connector_name = ref.split(".", 1)[0]
+        if connector_name not in connector_names:
+            add(base, f"connector {connector_name!r} is not declared")
+        problems.extend(_check_table(base, table))
+        for i, match in enumerate(table.match):
+            if match.key not in dm.principal.keys:
+                add(
+                    f"{base}.match[{i}].key", f"key {match.key!r} is not declared in principal.keys"
+                )
+            if match.column not in table.columns:
+                add(
+                    f"{base}.match[{i}].column",
+                    f"column {match.column!r} is not listed under this table's columns",
+                )
+
+    for i, relation in enumerate(dm.relations):
+        if relation.from_ == relation.to:
+            add(f"relations[{i}]", "a relation cannot point at itself")
+        for side, column_ref in (("from", relation.from_), ("to", relation.to)):
+            table_ref = column_ref.rsplit(".", 1)[0]
+            if table_ref not in dm.tables:
+                add(f"relations[{i}].{side}", f"table {table_ref!r} is not declared under tables")
+
+    return problems
+
+
+def _check_table(base: str, table: Table) -> list[Problem]:
+    problems: list[Problem] = []
+
+    if table.erase is TableErase.RETAIN and table.retain is None:
+        problems.append(Problem(base, "erase: retain needs a retain block with a reason"))
+    if table.erase is not TableErase.RETAIN and table.retain is not None:
+        problems.append(Problem(f"{base}.retain", "a table retain block needs erase: retain"))
+
+    has_strategy = False
+    for name, column in table.columns.items():
+        path = f"{base}.columns.{name}"
+        if column.strategy is not None:
+            has_strategy = True
+            if table.erase is not TableErase.UPDATE_COLUMNS:
+                problems.append(
+                    Problem(f"{path}.strategy", "strategy only applies to update_columns tables")
+                )
+        elif table.erase is TableErase.UPDATE_COLUMNS and column.pii is not PiiCategory.NONE:
+            problems.append(Problem(path, f"{column.pii} column needs a strategy"))
+
+        if column.strategy is ColumnStrategy.RETAIN and column.retain is None:
+            problems.append(Problem(path, "strategy: retain needs a retain block with a reason"))
+        if column.strategy is not ColumnStrategy.RETAIN and column.retain is not None:
+            problems.append(Problem(f"{path}.retain", "a retain block needs strategy: retain"))
+
+    if table.erase is TableErase.UPDATE_COLUMNS and not has_strategy:
+        problems.append(Problem(base, "update_columns table has no column with a strategy"))
+
+    return problems
+
+
+def json_schema() -> dict[str, Any]:
+    """The JSON Schema for data map files, as committed in schemas/datamap.schema.json."""
+    schema = DataMap.model_json_schema(by_alias=True)
+    return {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "title": "mita data map",
+        **{k: v for k, v in schema.items() if k != "title"},
+    }
+
+
+def _format_loc(loc: tuple[int | str, ...]) -> str:
+    out = ""
+    for part in loc:
+        if isinstance(part, int):
+            out += f"[{part}]"
+        elif "." in part:
+            out += f"[{part!r}]"
+        else:
+            out += f".{part}" if out else part
+    return out or "$"
+
+
+class _StrictLoader(yaml.SafeLoader):
+    """SafeLoader that rejects duplicate keys, which PyYAML otherwise silently overwrites.
+
+    A duplicated table key would make a whole table vanish from the map without warning.
+    """
+
+
+def _construct_mapping(loader: yaml.SafeLoader, node: yaml.MappingNode) -> dict[Any, Any]:
+    seen: set[object] = set()
+    for key_node, _ in node.value:
+        key = loader.construct_object(key_node)
+        if key in seen:
+            raise yaml.constructor.ConstructorError(
+                None, None, f"duplicate key {key!r}", key_node.start_mark
+            )
+        seen.add(key)
+    return loader.construct_mapping(node)
+
+
+_StrictLoader.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, _construct_mapping)