orchestrata_ultimate.promotion.identity_urls

Reference › orchestrata_ultimate › promotion › identity_urls

Extracts path-like values from systemd Environment= and Standard* settings for identity_checks, without mistaking URLs for paths. _strip_urls makes URLs opaque in three passes (user information, URLs with an authority, empty-authority local URLs), so the //host remainder of a database address is never judged as a path. environment_path_values parses the Environment line with shell quoting, splits each assignment on its first equals sign, drops URL parts, splits colon lists and returns the absolute segments. standard_io_path returns the path of a file:, append: or truncate: redirection of StandardOutput, StandardError or StandardInput, and nothing for systemd's other destinations. Together they close the ways a unit could reach a developer checkout without touching ExecStart or WorkingDirectory.

At a glance

Class diagram

No classes; see Functions.

Dependency diagram

API

Functions

Source

Permalink: https://gitlab.com/MSamy/orchestrata-ultimate-architecture/-/blob/a4cbc2bdf/src/orchestrata_ultimate/promotion/identity_urls.py

"""URL- and directive-value judging helpers for ``identity_core.py`` (U-T6b).

Split out 2026-09-23 so ``identity_core.py`` -- capped at its own 649-line
budget -- does not grow past it while closing the three residual findings
the U-T6 attempt-7 reviewer left non-blocking: userinfo-aware URL stripping,
the ``Environment=`` first-``=``-only split, and
``StandardOutput=``/``StandardError=``/``StandardInput=`` path judging.
``identity_core.py`` imports every public name straight back, so the
module's own public API -- and every existing test's import path -- is
unchanged.
"""

from __future__ import annotations

import re
import shlex

#: THREE passes now (attempt-7b adds pass 0 ahead of attempt-7's two):
#:
#: 0. Userinfo -- ``user:pass@``, or an EMPTY username (``:pass@``) -- lives
#:    between ``scheme://`` and the first ``@`` that itself precedes the
#:    authority's terminating ``/`` is opaque and is stripped FIRST. A colon
#:    inside it (``:pw@``, ``u:pw@``) would otherwise defeat pass 1's
#:    host/port match (which forbids a bare colon in the host segment) and
#:    the URL's own path -- e.g. the ``/0`` of ``redis://:pw@host/0`` --
#:    would leak through and be misjudged as a filesystem path (attempt-7
#:    residual finding 1).
#: 1. A REAL network URL has a non-empty authority (``redis://localhost:6379``,
#:    ``http://h:8080/mcp``). ITS OWN path/query/fragment is not a
#:    filesystem path on this machine at all -- it is a URL path on a
#:    REMOTE resource -- so the WHOLE thing, authority through path, is
#:    opaque and stripped entirely. Authority ends at the first ``/``,
#:    whitespace, or a ``:`` that is not immediately followed by a port
#:    number.
#: 2. ``file:///x``, ``sqlite:////x``, ``file:/x`` have an EMPTY authority --
#:    there is nothing between the scheme and the leading slash(es) of a
#:    REAL local path. Only ``scheme:`` plus that slash run is opaque;
#:    collapsing it to a single ``/`` recovers the real path for normal
#:    judging.
#:
#: Pass 0 MUST run before pass 1 (see above). Pass 1 MUST run before pass 2:
#: a real URL's own ``://`` would otherwise look like an empty-authority
#: scheme to pass 2's more permissive pattern before pass 1 gets to consume
#: it. Pass 2 additionally requires the scheme identifier to not be preceded
#: by a path/word character, or an ordinary colon-separated path list
#: (``/usr/bin:/opt/x``) would misread its own trailing directory name
#: (``bin``) as a URL scheme. It must also not be preceded by ``@``:
#: SCP-style ``git@host:/home/x/repo`` has no ``://`` at all (pass 1 never
#: engages), but ``host`` still LOOKS like a bare scheme to pass 2's pattern
#: alone -- excluding an ``@``-preceded identifier lets this correctly fall
#: through unchanged to the normal colon-split logic instead of being
#: swallowed as a fake empty-authority URL.
_URL_USERINFO = re.compile(r"([a-zA-Z][\w+.-]*://)[^/\s@]*@")
_URL_WITH_AUTHORITY = re.compile(r"[a-zA-Z][\w+.-]*://[^/\s:]+(?::\d+)?[^\s:]*")
_URL_EMPTY_AUTHORITY = re.compile(r"(?<![\w/@])[a-zA-Z][\w+.-]*:/+")


def _strip_urls(value: str) -> str:
    """Make every URL -- network or empty-authority local -- opaque to the
    ``=``/``:`` path-splitting logic below, in the order pass 0, pass 1,
    then pass 2 (see the constants' docstring for why the order is
    load-bearing)."""
    value = _URL_USERINFO.sub(r"\1", value)
    value = _URL_WITH_AUTHORITY.sub("", value)
    return _URL_EMPTY_AUTHORITY.sub("/", value)


def _path_like_segments(token: str) -> list[str]:
    """Every ``/``-rooted segment INSIDE a token, not just a token that IS
    one outright (amendment finding 3, D2 "every argument"): ``--data=/home/...``
    and PATH-style ``KEY=/a:/b`` values hide a path after ``=``/``:`` without
    the whole token starting with ``/``.

    A URL occurrence (``--url=http://127.0.0.1:8765/``) is stripped BEFORE
    the ``=``/``:`` split -- otherwise splitting exposes its ``//host``
    remainder as something that merely starts with ``/`` (amendment
    attempt-5 finding 2)."""
    sanitized = _strip_urls(token)
    return [part for part in re.split(r"[=:]", sanitized) if part.startswith("/")]


def environment_path_values(value: str) -> list[str]:
    """Absolute-path-shaped segments out of ``Environment=`` (space-separated
    KEY=VALUE, quoted if a value has spaces; PATH-style colon lists split).

    Rule (verbatim, attempt-7b residual finding 2): split each ``KEY=VALUE``
    token on the FIRST ``=`` only -- the value may itself contain any number
    of further ``=`` (a DSN's own query string, a nested assignment);
    quotes around the WHOLE assignment are removed before the split
    (``shlex.split`` already strips them, the same way it resolves systemd's
    own quoting of a value that contains whitespace). The value is then
    judged by the URL-vs-path-vs-opaque rules below.

    A URL-valued entry (``NEO4J_URI=bolt://host:port``) is skipped wholesale
    -- NOT split on ``:`` at all -- so its ``//host`` remainder is never
    mistaken for a path; a DIFFERENT, genuinely path-valued entry in the
    SAME Environment= line is still judged normally."""
    tokens: list[str] = []
    try:
        parts = shlex.split(value)
    except ValueError:
        parts = value.split()
    for part in parts:
        _, sep, val = part.partition("=")
        if not sep:
            continue
        for segment in _strip_urls(val).split(":"):
            if segment.startswith("/"):
                tokens.append(segment)
    return tokens


#: StandardOutput=/StandardError=/StandardInput= (attempt-7b residual
#: finding 3): only ``file:<path>``, ``append:<path>``, ``truncate:<path>``
#: carry a path that must resolve under ROOT or a system prefix (D2).
#: ``journal``, ``inherit``, ``null``, ``tty``, ``syslog``, ``kmsg``,
#: ``socket``, ``fd:<name>`` and ``journal+console``-style values are
#: systemd's fixed, opaque vocabulary for this directive -- never a
#: filesystem path -- and are left unjudged.
_STANDARD_IO_PATH_PREFIXES = ("file:", "append:", "truncate:")


def standard_io_path(value: str) -> str | None:
    """The path out of a resolved StandardOutput=/StandardError=/
    StandardInput= value, or ``None`` when the value is one of systemd's
    opaque destinations (see ``_STANDARD_IO_PATH_PREFIXES``'s docstring)."""
    for prefix in _STANDARD_IO_PATH_PREFIXES:
        if value.startswith(prefix):
            return value[len(prefix) :]
    return None