intermittent commit

2026-07-14 13:22:10 +02:00
parent 8aa1943581
commit e6f7c45f0a
76 changed files with 6039 additions and 2188 deletions
@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from typing import Mapping
+
+
+@dataclass(frozen=True, slots=True)
+class HttpFetchResponse:
+    status: int
+    headers: dict[str, str]
+    body: bytes
+
+    def text(self, encoding: str = "utf-8") -> str:
+        return self.body.decode(encoding)
+
+
+def is_http_url(value: str) -> bool:
+    try:
+        validate_http_url(value)
+    except ValueError:
+        return False
+    return True
+
+
+def validate_http_url(value: str, *, label: str = "URL") -> str:
+    parsed = urllib.parse.urlparse(str(value).strip())
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise ValueError(f"{label} must be an absolute HTTP(S) URL.")
+    if parsed.username or parsed.password:
+        raise ValueError(f"{label} must not include embedded credentials.")
+    return urllib.parse.urlunparse(parsed)
+
+
+def fetch_http(
+    url: str,
+    *,
+    timeout: float = 15,
+    label: str = "URL",
+    method: str = "GET",
+    headers: Mapping[str, str] | None = None,
+) -> HttpFetchResponse:
+    request = urllib.request.Request(
+        validate_http_url(url, label=label),
+        headers=dict(headers or {}),
+        method=method,
+    )
+    with urllib.request.urlopen(request, timeout=timeout) as response:  # noqa: S310 - URL is validated by validate_http_url.  # nosec B310  # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
+        return HttpFetchResponse(
+            status=int(getattr(response, "status", 0)),
+            headers=dict(response.headers.items()),
+            body=response.read(),
+        )
+
+
+def fetch_http_text(
+    url: str,
+    *,
+    timeout: float = 15,
+    label: str = "URL",
+    method: str = "GET",
+    headers: Mapping[str, str] | None = None,
+    encoding: str = "utf-8",
+) -> str:
+    return fetch_http(url, timeout=timeout, label=label, method=method, headers=headers).text(encoding)
@@ -95,6 +95,11 @@ MODULE_SYSTEM_SCOPES = frozenset(
    for legacy, module in LEGACY_TO_MODULE_SCOPES.items()
    if legacy.startswith("system:")
 )
+LEGACY_SYSTEM_SCOPES = frozenset(
+    legacy
+    for legacy in LEGACY_TO_MODULE_SCOPES
+    if legacy.startswith("system:")
+)
 MODULE_TENANT_SCOPES = frozenset(LEGACY_TO_MODULE_SCOPES.values()) - MODULE_SYSTEM_SCOPES


@@ -110,7 +115,7 @@ def compatible_required_scopes(required: str) -> tuple[str, ...]:

 def scopes_grant_compatible(scopes: Iterable[str], required: str) -> bool:
    granted = list(scopes)
-    if required in MODULE_SYSTEM_SCOPES:
+    if required in MODULE_SYSTEM_SCOPES or required in LEGACY_SYSTEM_SCOPES:
        return "*" in granted or "system:*" in granted or any(
            scope != "tenant:*" and scopes_grant([scope], alias)
            for scope in granted
@@ -3,6 +3,8 @@ from __future__ import annotations
 from dataclasses import dataclass
 from typing import Iterable

+from govoplan_core.security.scope_aliases import LEGACY_SCOPE_ALIASES
+

@dataclass(frozen=True, slots=True)
 class PermissionDefinition:
@@ -96,28 +98,6 @@ KNOWN_SCOPES = frozenset(item.scope for item in ALL_PERMISSIONS)
 TENANT_SCOPES = frozenset(item.scope for item in TENANT_PERMISSIONS)
 SYSTEM_SCOPES = frozenset(item.scope for item in SYSTEM_PERMISSIONS)

-LEGACY_SCOPE_ALIASES: dict[str, frozenset[str]] = {
-    # Only names that are no longer canonical remain runtime aliases. Canonical
-    # permissions keep their narrow meaning; the Alembic migration expands old
-    # role records once so upgraded installations do not lose prior access.
-    "campaign:write": frozenset({
-        "campaign:create", "campaign:update", "campaign:copy", "campaign:archive", "campaign:delete", "campaign:share",
-        "recipients:read", "recipients:write", "recipients:import",
-    }),
-    "attachments:read": frozenset({"files:read", "files:download"}),
-    "attachments:write": frozenset({"files:upload", "files:organize", "files:share", "files:delete"}),
-    "admin:users": frozenset({
-        "admin:users:read", "admin:users:create", "admin:users:update", "admin:users:suspend",
-        "admin:groups:read", "admin:groups:write", "admin:groups:manage_members",
-        "admin:roles:read", "admin:roles:write", "admin:roles:assign",
-    }),
-    "admin:users:write": frozenset({"admin:users:create", "admin:users:update", "admin:users:suspend", "admin:roles:assign", "admin:groups:manage_members"}),
-    "admin:api_keys:write": frozenset({"admin:api_keys:create", "admin:api_keys:revoke"}),
-    "admin:settings": frozenset({"admin:settings:read", "admin:settings:write", "admin:api_keys:read", "admin:api_keys:create", "admin:api_keys:revoke"}),
-    "system:tenants:write": frozenset({"system:tenants:create", "system:tenants:update", "system:tenants:suspend"}),
-    "system:access:write": frozenset({"system:access:assign", "system:roles:assign", "system:accounts:create", "system:accounts:update", "system:accounts:suspend"}),
-}
-
 DEFAULT_TENANT_ROLES: dict[str, dict[str, object]] = {
    "owner": {"name": "Owner", "description": "Full tenant access, including administration and delivery.", "permissions": ["tenant:*"], "is_builtin": True, "is_assignable": True},
    "tenant_admin": {"name": "Tenant administrator", "description": "Manage tenant settings, users, groups and roles. Real delivery remains separately delegable.", "permissions": [
@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+LEGACY_SCOPE_ALIASES: dict[str, frozenset[str]] = {
+    # Only names that are no longer canonical remain runtime aliases. Canonical
+    # permissions keep their narrow meaning; migrations expand old role records
+    # once so upgraded installations do not lose prior access.
+    "campaign:write": frozenset({
+        "campaign:create",
+        "campaign:update",
+        "campaign:copy",
+        "campaign:archive",
+        "campaign:delete",
+        "campaign:share",
+        "recipients:read",
+        "recipients:write",
+        "recipients:import",
+    }),
+    "attachments:read": frozenset({"files:read", "files:download"}),
+    "attachments:write": frozenset({"files:upload", "files:organize", "files:share", "files:delete"}),
+    "admin:users": frozenset({
+        "admin:users:read",
+        "admin:users:create",
+        "admin:users:update",
+        "admin:users:suspend",
+        "admin:groups:read",
+        "admin:groups:write",
+        "admin:groups:manage_members",
+        "admin:roles:read",
+        "admin:roles:write",
+        "admin:roles:assign",
+    }),
+    "admin:users:write": frozenset({
+        "admin:users:create",
+        "admin:users:update",
+        "admin:users:suspend",
+        "admin:roles:assign",
+        "admin:groups:manage_members",
+    }),
+    "admin:api_keys:write": frozenset({"admin:api_keys:create", "admin:api_keys:revoke"}),
+    "admin:settings": frozenset({
+        "admin:settings:read",
+        "admin:settings:write",
+        "admin:api_keys:read",
+        "admin:api_keys:create",
+        "admin:api_keys:revoke",
+    }),
+    "system:tenants:write": frozenset({"system:tenants:create", "system:tenants:update", "system:tenants:suspend"}),
+    "system:access:write": frozenset({
+        "system:access:assign",
+        "system:roles:assign",
+        "system:accounts:create",
+        "system:accounts:update",
+        "system:accounts:suspend",
+    }),
+}
@@ -38,8 +38,8 @@ def _normalize_fernet_key(value: str) -> bytes:
    try:
        Fernet(candidate)
        return candidate
-    except Exception:
-        pass
+    except (TypeError, ValueError):
+        raw = None
    try:
        raw = base64.b64decode(candidate)
    except Exception as exc: