
    cj                       d dl mZ d dlZd dlZd dlmZ d dlmZ h dZh dZ	 ej
        dej                   ej
        dej                   ej
        d	ej                  gZh d
Zh dZd ej
        d          fd ej
        d          fd ej
        d          fd ej
        d          fd ej
        d          fd ej
        d          fd ej
        d          fd ej
        d          fd ej
        d          fg	ZdZh dZ ed !           G d" d#                      Zd4d)Zd5d,Zd6d.Zd7d1Zd8d3ZdS )9    )annotationsN)	dataclass)Path>   .db.key.p12.pdf.pem.pfx.xls.docx.dump.xlsx.sqlite.parquet.sqlite3>   .env
.env.local
token.jsoncredentials.jsonzgithub[_-]?tokenz
.*secret.*z.*credential.*>   dbdatalogsbackupsexportsimportsreportsruntimesecrets	databaseslocal_runtime>   .vite.mypy_cache.ruff_cache.pytest_cachedistnode_modules
github_patzgithub_pat_[A-Za-z0-9_]{20,}
github_ghpzgh[pousr]_[A-Za-z0-9_]{20,}private_keyz6-----BEGIN (?:RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----aws_access_keyzAKIA[0-9A-Z]{16}api_key_assignmentz>(?i)(api[_-]?key|token|secret)\s*=\s*['\"]?[A-Za-z0-9_\-]{20,}gog_passwordzGOG_KEYRING_PASSWORD\s*=bearer_tokenzA(?i)authorization\s*[:=]\s*['\"]?bearer\s+[A-Za-z0-9._~+/=-]{20,}
openai_keyzsk-(?:proj-)?[A-Za-z0-9_-]{20,}slack_tokenzxox[baprs]-[A-Za-z0-9-]{20,})zexamples/synthetic/ztests/fixtures/zconfig.example/>   tests/unit/test_git_safety.py(src/jarvis_finance/quality/git_safety.py)tests/integration/test_dummy_data_load.pyT)frozenc                  $    e Zd ZU ded<   ded<   dS )SafetyFindingstrpathreasonN)__name__
__module____qualname____annotations__     a/home/agent/.hermes/worktrees/FinanceManager-main-deploy/src/jarvis_finance/quality/git_safety.pyr6   r6      s"         IIIKKKKKr?   r6   r8   r   rootreturnr7   c                P    |                      |                                          S N)relative_toas_posix)r8   rA   s     r@   _relrG   $   s"    D!!**,,,r?   relboolc                >    |                      t                    p| dv S )N>   frontend/package.jsonfrontend/tsconfig.jsonfrontend/package-lock.json)
startswithALLOW_PREFIXES)rH   s    r@   is_allowed_exceptionrP   '   s+    >>.))  FS  5F  .F  Fr?   
list[Path]c           
         	 t          j        ddt                     ddgddd          }t          |j                                                                                   k    rRt          j        ddt                     ddd	d
dgdd          } fd|j                            d          D             S n"# t          t           j	        t          f$ r Y nw xY wd                      d          D             S )zLReturn commit candidates in Git repos, or all files for standalone fixtures.gitz-Cz	rev-parsez--show-toplevelT)checkcapture_outputtextzls-filesz--cachedz--othersz--exclude-standardz-z)rT   rU   c                D    g | ]}||                     d           z  S )utf-8)decode).0rH   rA   s     r@   
<listcomp>z$_candidate_files.<locals>.<listcomp>:   s0    ]]]3Y\]D3::g...]]]r?       c                b    g | ],}|                                 s|                                *|-S r>   )
is_symlinkis_file)rZ   r8   s     r@   r[   z$_candidate_files.<locals>.<listcomp>=   s4    TTTT0A0ATT\\^^TDTTTr?   *)
subprocessrunr7   r   stdoutstripresolvesplitOSErrorCalledProcessErrorUnicodeDecodeErrorrglob)rA   probetrackeds   `  r@   _candidate_filesrm   +   s    D#d))[2CD	
 
 
 ""$$%%--//477 nc$iiZMacgh#  G
 ^]]]'.:N:Nu:U:U]]]] 8 Z24FG   TTTZZ__TTTTs   B7B< <CC
str | Pathlist[SafetyFinding]c           	     0   t          |                                           } g }t          |           D ]dj        v s	dj        v rt	          |           }t          |          j        }                                r$|                    t          |d                     r                                rt          d |D                       r$|                    t          |d                     |rA|d         t          v r2t          |          s#|                    t          |d                     j                                        }|t          v s|                    d          r)|d	k    r#|                    t          |d
                     t          fdt           D                       r#|                    t          |d                     j                                        dv r2t          |          s#|                    t          |d                     j                                        t$          v rLt          |          s=|                    t          |dj                                                              |t&          v rn	                     dd          }n# t*          $ r Y w xY wt,          D ]@\  }}|                    |          r&|                    t          |d|                      A|S )Nz.git__pycache__symlink_blockedc              3  (   K   | ]}|t           v V  d S rD   )FORBIDDEN_RUNTIME_PARTS)rZ   parts     r@   	<genexpr>zscan_path.<locals>.<genexpr>M   s(      EE4t..EEEEEEr?   runtime_cache_file_blockedr   &runtime_or_real_data_directory_blockedz.env.z.env.exampleforbidden_secret_filenamec              3  L   K   | ]}|                     j                  V  d S rD   )searchname)rZ   pr8   s     r@   rv   zscan_path.<locals>.<genexpr>U   s1      DDqqxx	""DDDDDDr?   forbidden_secret_like_filename>   .csv.json=csv_json_only_allowed_in_examples_synthetic_or_tests_fixtureszforbidden_file_type:rX   ignore)encodingerrorszsecret_pattern:)r   re   rm   partsrG   r^   appendr6   is_diranyFORBIDDEN_TOP_LEVEL_DIRSrP   r|   lowerFORBIDDEN_NAMESrN   FORBIDDEN_NAME_PATTERNSsuffixFORBIDDEN_SUFFIXESALLOW_SECRET_MARKER_PATHS	read_textrg   SECRET_PATTERNSr{   )	rA   findingsrH   	rel_parts
lower_namerV   labelpatternr8   s	           @r@   	scan_pathr   @   s   ::D$&H &&  O  OTZ=DJ#>#>4IIO	?? 	OOM#/@AABBB;;== 	EE9EEEEE 	OOM#/KLLMMM 	Z1)AAAJ^_bJcJcAOOM#/WXXYYYY__&&
((Z-B-B7-K-K(PZ^lPlPlOOM#/JKKLLLDDDD,CDDDDD 	ROOM#/OPPQQQ;"333<PQT<U<U3OOM#/nooppp;"444=QRU=V=V4OOM#/[dkFWFWFYFY/[/[\\]]]+++	>>78>DDDD 	 	 	H	- 	O 	ONE7~~d## Oc3LU3L3L M MNNN	O Os   #J;;
K	K	Nonec                    t          |           }|r1d                    d |D                       }t          d|           d S )N
c              3  8   K   | ]}|j          d |j         V  dS )z: N)r8   r9   )rZ   fs     r@   rv   zassert_safe.<locals>.<genexpr>i   s4      FFqv3333FFFFFFr?   zGit safety scan failed:
)r   join
ValueError)rA   r   detailss      r@   assert_safer   f   sY    H @))FFXFFFFF>W>>???@ @r?   )r8   r   rA   r   rB   r7   )rH   r7   rB   rI   )rA   r   rB   rQ   )rA   rn   rB   ro   )rA   rn   rB   r   )
__future__r   rera   dataclassesr   pathlibr   r   r   compileIr   r   rt   r   rO   r   r6   rG   rP   rm   r   r   r>   r?   r@   <module>r      s   " " " " " " 				     ! ! ! ! ! !       K  K  K JJJ%2:&924@@*"*]\^\`BaBacmcecmn  BD  BF  dG  dG  H  R  R  R jjj :2:=>>?:2:<==>JBJXYYZzrz"5667:2:&ghhiZRZ ;<<=ZRZ deef:2:@AABJBJ>??@
 O    $       - - - -F F F FU U U U*$ $ $ $L@ @ @ @ @ @r?   