e744336385
C-6: ConnectorRuntime enforces capability_mask per operation.
READ-only ACs cannot invoke MUTATE operations (wipe, lock, retire).
C-7: AC validated against database (exists, active, not expired)
before connector invocation.
C-9: Delegated AC capability bounded by delegator's capability.
C-10: Command counter uses atomic SQL increment with limit check.
M-23: expire_stale() uses same atomic SQL pattern.
H-1: Sensitive credential fields hidden from repr/logs via repr=False.
H-2: Stub backend requires ALLOW_STUB_CREDENTIALS=true to activate.
H-3: Kerberos backend raises CredentialResolutionError instead of
returning stub ticket.
H-4: Chronicle INTENT emitted before execution, RESULT after.
H-5: device_id validated as UUID before Graph API URL interpolation.
H-8: ConnectorRuntime enforces governance for all connector invocations.
Signed-off-by: Tyler King <tking@guildhouse.dev>
66 lines
1.8 KiB
Python
66 lines
1.8 KiB
Python
import json
|
|
import pickle
|
|
from enum import Enum
|
|
from pathlib import Path
|
|
from typing import Any, Callable, Union
|
|
|
|
from pydantic.v1.types import StrBytes
|
|
|
|
|
|
class Protocol(str, Enum):
|
|
json = 'json'
|
|
pickle = 'pickle'
|
|
|
|
|
|
def load_str_bytes(
|
|
b: StrBytes,
|
|
*,
|
|
content_type: str = None,
|
|
encoding: str = 'utf8',
|
|
proto: Protocol = None,
|
|
allow_pickle: bool = False,
|
|
json_loads: Callable[[str], Any] = json.loads,
|
|
) -> Any:
|
|
if proto is None and content_type:
|
|
if content_type.endswith(('json', 'javascript')):
|
|
pass
|
|
elif allow_pickle and content_type.endswith('pickle'):
|
|
proto = Protocol.pickle
|
|
else:
|
|
raise TypeError(f'Unknown content-type: {content_type}')
|
|
|
|
proto = proto or Protocol.json
|
|
|
|
if proto == Protocol.json:
|
|
if isinstance(b, bytes):
|
|
b = b.decode(encoding)
|
|
return json_loads(b)
|
|
elif proto == Protocol.pickle:
|
|
if not allow_pickle:
|
|
raise RuntimeError('Trying to decode with pickle with allow_pickle=False')
|
|
bb = b if isinstance(b, bytes) else b.encode()
|
|
return pickle.loads(bb)
|
|
else:
|
|
raise TypeError(f'Unknown protocol: {proto}')
|
|
|
|
|
|
def load_file(
|
|
path: Union[str, Path],
|
|
*,
|
|
content_type: str = None,
|
|
encoding: str = 'utf8',
|
|
proto: Protocol = None,
|
|
allow_pickle: bool = False,
|
|
json_loads: Callable[[str], Any] = json.loads,
|
|
) -> Any:
|
|
path = Path(path)
|
|
b = path.read_bytes()
|
|
if content_type is None:
|
|
if path.suffix in ('.js', '.json'):
|
|
proto = Protocol.json
|
|
elif path.suffix == '.pkl':
|
|
proto = Protocol.pickle
|
|
|
|
return load_str_bytes(
|
|
b, proto=proto, content_type=content_type, encoding=encoding, allow_pickle=allow_pickle, json_loads=json_loads
|
|
)
|