e744336385
C-6: ConnectorRuntime enforces capability_mask per operation.
READ-only ACs cannot invoke MUTATE operations (wipe, lock, retire).
C-7: AC validated against database (exists, active, not expired)
before connector invocation.
C-9: Delegated AC capability bounded by delegator's capability.
C-10: Command counter uses atomic SQL increment with limit check.
M-23: expire_stale() uses same atomic SQL pattern.
H-1: Sensitive credential fields hidden from repr/logs via repr=False.
H-2: Stub backend requires ALLOW_STUB_CREDENTIALS=true to activate.
H-3: Kerberos backend raises CredentialResolutionError instead of
returning stub ticket.
H-4: Chronicle INTENT emitted before execution, RESULT after.
H-5: device_id validated as UUID before Graph API URL interpolation.
H-8: ConnectorRuntime enforces governance for all connector invocations.
Signed-off-by: Tyler King <tking@guildhouse.dev>
53 lines
1.5 KiB
Python
53 lines
1.5 KiB
Python
from __future__ import annotations
|
|
|
|
import collections
|
|
import collections.abc
|
|
import typing
|
|
from typing import Any
|
|
|
|
from pydantic_core import PydanticOmit, core_schema
|
|
|
|
SEQUENCE_ORIGIN_MAP: dict[Any, Any] = {
|
|
typing.Deque: collections.deque, # noqa: UP006
|
|
collections.deque: collections.deque,
|
|
list: list,
|
|
typing.List: list, # noqa: UP006
|
|
tuple: tuple,
|
|
typing.Tuple: tuple, # noqa: UP006
|
|
set: set,
|
|
typing.AbstractSet: set,
|
|
typing.Set: set, # noqa: UP006
|
|
frozenset: frozenset,
|
|
typing.FrozenSet: frozenset, # noqa: UP006
|
|
typing.Sequence: list,
|
|
typing.MutableSequence: list,
|
|
typing.MutableSet: set,
|
|
# this doesn't handle subclasses of these
|
|
# parametrized typing.Set creates one of these
|
|
collections.abc.MutableSet: set,
|
|
collections.abc.Set: frozenset,
|
|
}
|
|
|
|
|
|
def serialize_sequence_via_list(
|
|
v: Any, handler: core_schema.SerializerFunctionWrapHandler, info: core_schema.SerializationInfo
|
|
) -> Any:
|
|
items: list[Any] = []
|
|
|
|
mapped_origin = SEQUENCE_ORIGIN_MAP.get(type(v), None)
|
|
if mapped_origin is None:
|
|
# we shouldn't hit this branch, should probably add a serialization error or something
|
|
return v
|
|
|
|
for index, item in enumerate(v):
|
|
try:
|
|
v = handler(item, index)
|
|
except PydanticOmit: # noqa: PERF203
|
|
pass
|
|
else:
|
|
items.append(v)
|
|
|
|
if info.mode_is_json():
|
|
return items
|
|
else:
|
|
return mapped_origin(items)
|