+ 4j/a0t$Rt^RIHt^RIt^RIt^RIt^RIHt^RI H t H t ^RI H t .R)Ot!R R]P4t!R R]4t]!R R 7!R R44t]!0R*m4tR]R&RRlt]!RR04tR]R&RRlt]P4!R4tRRltRRltRRltRRlt]!0R+m4t R]R &R!R"lt!R#R$lt"R%R&lt#R'R(lt$R#),a8Direct-URL / VCS requirement admission for the provider. Cloning a remote repo is one short step from arbitrary code execution because modern Python projects build via PEP 517 backends, which run user code. This module owns the policy types (:class:`VcsPolicy`, :class:`VcsConfig`), the URL classifier (:func:`split_vcs_scheme`, :func:`has_full_commit_sha`), and the admit-or-refuse decision (:func:`admit_vcs_url`) called eagerly during requirement ingestion. The actual clone path lives in :mod:`nab_index.vcs` and runs only after admission lets the URL through. ) annotationsN) dataclass)unquoteurlsplit)FULL_GIT_SHA_REUnsupportedVcsError VcsConfig VcsPolicyc$]tRt^ tRtRtRtRtR#)r aYWhether to honor VCS direct-URL requirements (``pkg @ git+https://...``). Cloning a remote repo is one short step from arbitrary code execution (modern Python projects build via PEP 517 backends, which run user code). Default posture is :attr:`BLOCK`; opt-in is per-protocol via ``vcs.allowed-schemes`` and per-repo via ``vcs.allowed-repos``. blockallowN)__name__ __module__ __qualname____firstlineno____doc__BLOCKALLOW__static_attributes__r k/home/user/pdf2html-billing-ledger-validate/.venv/lib/python3.14/site-packages/nab_python/_vcs_admission.pyr r s E8 Erc]tRt^6tRtRtR#)rzA VCS / direct-URL requirement was refused by policy. Raised eagerly during requirement ingestion; not surfaced as a "no candidates" backtrack so the user sees a clear diagnostic. r N)rrrrrrr rrrr6srT)frozencr]tRt^>t$Rt]P tR]R&] !4t R]R&R t R]R&Rt R ]R &R t R #) rzBundle of VCS opt-in knobs passed through the resolver stack. Default is fully restrictive (``BLOCK`` policy, empty allowlists, pin required). r policyfrozenset[str]allowed_schemesztuple[str, ...] allowed_reposTbool require_pinr N)rrrrrr rr__annotations__ frozensetrrr rr rrrr>s7 "FI'&/kO^1%'M?'Krgit+httpgit+gitr _VCS_SCHEMEScV^8dQhRR/#)returnrr )formats"r __annotate__r*Ws>rc\#)zReturn the VCS URL schemes nab recognises (e.g. ``git+https``). nab is git-only, so every entry is a ``git+`` scheme. Exposed so config parsing can reject an unknown ``vcs.allowed-schemes`` entry without importing the private scheme set. )r%r rrknown_vcs_schemesr,Ws  r_VCS_INSECURE_SCHEMESc V^8dQhRRRR/#)r'urlstrr(ztuple[str | None, str]r )r)s"rr*r*ds#"8rcz\F.pVPV R24'gKW\R4R3u# RV3#)aStrip a recognized VCS scheme prefix. ``"git+https://example.com/r.git@v1"`` -> ``("git+https", "https://example.com/r.git@v1")``. ``"https://example.com/file.whl"`` -> ``(None, "https://example.com/file.whl")``. Returns ``(None, url)`` for non-VCS URLs (e.g. plain ``https://`` archives or ``file://`` paths) so the caller can refuse them separately. Only ``git+`` schemes are recognised; ``hg+``/``bzr+``/``svn+`` are intentionally absent so they are refused as non-VCS. ://zgit+N)r% startswithlen)r/ vcs_schemes& rsplit_vcs_schemer6dsD# >>ZL, - -CKM 23 3# #;rz^([^/?#]*//)[^/?#]*@c V^8dQhRRRR/#)r'r/r0r(r )r)s"rr*r*zs223232rcfR\V4P9dV#\PRV4#)aDrop any authority ``user[:pass]@`` / SSH ``git@`` from ``url``. An ``allowed-repos`` prefix names a repo by scheme + host + path, not by credentials, so both the candidate URL and the prefix are stripped before the match. A URL with no userinfo is returned unchanged. The cut is made on the raw string, since :func:`urllib.parse.urlsplit` deletes every tab, CR and LF and does not record an empty ``?``: a URL rebuilt from the parse is not the one git is handed. @z\1)rnetloc_AUTHORITY_USERINFO_REsubr/s&r_without_userinfor>zs. (3-&&& ! % %eS 11rc V^8dQhRRRR/#)r' remainderr0r(r )r)s"rr*r*sKKKKrcDRV9dVPR4^,#T#)zLReturn ``remainder`` without a trailing ``@``, split on the last ``@``.r9) rpartition)r@s&r _drop_refrCs$+.)+;9   $Q 'JJrc V^8dQhRRRR/#)r' inner_urlr0r(r )r)s"rr*r*s//#/#/rc>\\V4P4#)zuReturn the path of ``inner_url`` with any trailing ``@`` dropped. An empty result means the URL names no repo. )rCrpath)rEs&r _repo_pathrHs Xi(-- ..rc V^8dQhRRRR/#)r'rGr0r(rr )r)s"rr*r*s33C3D3rc\V4PRR4p\P!V4pVP R4'd!VP R4'g VR, p\ V4;'dW!8g#)a^Return True if git would rewrite ``path`` before it fetches. Git applies RFC 3986 dot-segment removal at fetch time. ``path`` is decoded once so an encoded ``%2e%2e`` cannot slip past, and ``\`` is folded to ``/`` because Windows resolves it as a separator. A trailing ``/`` is put back: RFC 3986 keeps it and :func:`posixpath.normpath` does not. \/)rreplace posixpathnormpathendswithr)rGdecoded normaliseds& r_rewritten_by_gitrSsjdm##D#.G##G,JZ%8%8%=%=c = 2 2Z22r_REPO_BOUNDARY_CHARSc$V^8dQhRRRRRR/#)r'rEr0prefixr(rr )r)s"rr*r*s!%+%+C%+%+%+rcj\V4pVP'dVP RVP 2M VPp\V4p\;QJd3RWDP R4^,34F 'gK RM( RM$!RWDP R4^,344'dR#VP R4pVPV4'gR#V\V4RPR4pV'dV'dVR,\9dR#V^,\9#)aZReturn True if ``inner_url`` names a repo under ``prefix``. A bare :meth:`str.startswith` would admit a sibling repo whose URL merely begins with an allowed entry (``.../airflow.git`` would admit ``.../airflow.git.other``). The match here requires the prefix to end at a path-segment boundary: the candidate must equal the prefix, the prefix must already end in a separator, or the next candidate character must be ``/`` (path), ``@`` (ref) or ``#`` (fragment). Git treats the ``.git`` suffix as optional, so it is stripped from the prefix and skipped once on the candidate before the boundary check. Both URLs have their authority ``user[:pass]@`` / ``git@`` stripped by the caller. A path git would rewrite is refused first, since a ``..`` could pass the string match while git fetches a repo outside the prefix. The ref is dropped before that check, off the whole post-authority remainder rather than the path alone, matching the split :mod:`nab_index.vcs` makes at clone time; otherwise a ``..`` in the final segment hides as the ordinary name ``..@``. The prefix comparison below is on the raw URL. ?c38"TFp\V4xK R#5iN)rS).0parts& r '_repo_prefix_matches..s N/Mt T " "/MsTFz.gitN) rqueryrGrCany partition removesuffixr3r4 removeprefixrT)rErVpartsr@reporests&& r_repo_prefix_matchesrhs, Y E165::,a }-%**I Y D s NnnS6I!6L/M Nsss NnnS6I!6L/M NNN   (F    ' ' S[] # 0 0 8D v/C!C 7* **rc V^8dQhRRRR/#)r'r/r0r(rr )r)s"rr*r*s , ,S ,T ,rcVPR^4^,pVPR^4R,pVPR4^,pRV9dR#VPR^4^,p\\P !V44#)zReturn True if the URL pins to a 40-char hex commit hash. Looks for ``@`` in the path component (after the authority); ignores any ``#`` fragment. A ``user@host`` in the authority is left alone, matching the ref parsing in :mod:`nab_index.vcs`. #r2rLr9Fr_)splitrbrsplitrrmatch)r/ fragmentless after_schemerGrefs& rhas_full_commit_sharrsz99S!$Q'L%%eQ/3L  ! !# &q )D $ ++c1 a C %%c* ++rc V^8dQhRRRR/#)r'r/r0r(rr )r)s"rr*r*sc&9rc \RV R24#)z`. NzBrefusing direct-URL requirement (not a recognized VCS scheme) z note: nab supports git+https / git+ssh / git+http / git+file / git+git only; hg/bzr/svn and plain http(s)/file archive URLs are not supported.zrefusing VCS requirement z reason: vcs.policy is "block" (default). to allow: set vcs.policy = "allow" with appropriate vcs.allowed-schemes (and vcs.allowed-repos).z, zzrefusing VCS scheme z reason: scheme "z" not in vcs.allowed-schemes={z}.z note: "z4" is unauthenticated; consider an https/ssh variant.rLz.refusing VCS URL that names no repository z reason: the URL has no repository path. note: everything after the final @ is the ref, so a repo URL looks like git+https://host/org/repo.git@.c3`<"TF#p\\S4\V44xK% R#5irZ)rhr>)r[rVrEs& rr] admit_vcs_url..,s6 / !!),.?.G  /s+.TFzrefusing VCS repo zM reason: repo URL prefix not in vcs.allowed-repos. allowed prefixes: zrefusing unpinned VCS ref z reason: vcs.require-pin is true and no 40-char commit hash present. to allow: pin the requirement to a 40-char commit hash, or set vcs.require-pin = false (not recommended for reproducible installs).)r6rrr rrjoinsortedr-rH ValueErrorrustriprarr rr)r/rwschememsg allowed_str repo_path repo_admittedrEs&& @r admit_vcs_urlrsY)-FI ~ %< < "#&& }} ' %I I "#&& +++iiv'='= >?LL9  %##)(+ S " * * x(22 C"#&&2y)  ??3   %H H "#&&2 !..   !..    iiv';'; <=JJ  %%%0M 3 "#&& "5c":": %' ' "#&& Mm 2"3'T124 2"3'T12s$ G6 GG""GGG6)rrr >r$git+sshgit+filer# git+https>rkrLr9)%__conditional_annotations__r __future__renumrNre dataclassesr urllib.parserr nab_index.vcsr__all__Enumr Exceptionrrr"r%r!r,r-r6compiler;r>rCrHrSrTrhrrrur)rs@rrs #  !*)  ,) $    )  n)29j2I(J~J&$;<2"K /3"(1'AnA%+P , cr