Repository navigation
Expand file tree
/
Copy pathcodec.py
More file actions
341 lines (281 loc) · 14.3 KB
/
Copy pathcodec.py
File metadata and controls
341 lines (281 loc) · 14.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
"""The canonical BabelQueue wire envelope — the single Python implementation.
The shape is frozen as ``{job, trace_id, data, meta, attempts}`` (schema_version 1)
so a Python service interoperates byte-for-byte with the PHP/Laravel, Go, ... SDKs.
The ``job`` field carries the message URN (never a class name); ``trace_id`` is a
cross-service correlation id preserved across every hop. Pure stdlib — no deps.
Full spec: https://babelqueue.com
"""
from __future__ import annotations
import json
import logging
import time
import uuid
from typing import Any, Dict, List, Mapping, Optional, Tuple
from ._envelope_shape import CORE_META_KEYS
from .exceptions import BabelQueueError, EnvelopeKeyError
SCHEMA_VERSION = 1
SOURCE_LANG = "python"
#: Non-canonical keys (message-envelope.md §10), as ``(container, key)`` pairs where the
#: container is ``None`` for the top level or ``"meta"``. Policy K-15: decode WARNS and drops
#: them (old producers keep working); encode NEVER emits them and REJECTS an envelope that
#: carries one (ADR-0031 (c)). The top-level ``urn`` alias is not in this table: it is an inbound
#: alias that decode folds into ``job`` (see :meth:`EnvelopeCodec.decode`), but encode rejects it.
FORBIDDEN_KEYS: Tuple[Tuple[Optional[str], str], ...] = (
(None, "timestamp"),
("meta", "max_retries"),
("meta", "attempts"),
("meta", "source"),
("meta", "ts"),
)
#: The closed ASCII whitespace set of ADR-0032 §5 (space, \t, \n, \v, \f, \r) — the single source for
#: every trim / blank check in the SDK (cross-SDK parity, GR-5): never a bare ``str.strip()``,
#: which also strips Unicode spaces such as U+00A0, U+2003 and U+3000. The transport modules
#: import it instead of keeping their own copy.
ASCII_WHITESPACE = " \t\n\v\f\r"
#: Logger every forbidden-key warning is reported through (one record per dropped key).
logger = logging.getLogger("babelqueue.codec")
def strip_forbidden_keys(envelope: Dict[str, Any]) -> List[str]:
"""Remove the non-canonical keys of message-envelope.md §10 from ``envelope`` in place.
Returns the RFC 6901 pointers of the keys that were dropped (e.g. ``"/meta/max_retries"``),
in a stable order, and logs one ``WARNING`` on :data:`logger` per dropped key naming its
pointer. Unknown keys that are not forbidden are left untouched (forward compatibility).
"""
dropped: List[str] = []
for container, key in FORBIDDEN_KEYS:
target = envelope if container is None else envelope.get(container)
if not isinstance(target, dict) or key not in target:
continue
del target[key]
pointer = "/" + key if container is None else f"/{container}/{key}"
dropped.append(pointer)
_warn_dropped(pointer)
return dropped
def parse_envelope(raw: Any) -> Dict[str, Any]:
"""Parse a raw JSON body into a dict **as-is** — no forbidden-key drop, no warning.
For read-only projections of a body that is forwarded unchanged (e.g. a transport
deriving broker attributes from it): logging a "dropped" key there would be false,
because the bytes on the wire keep it. Returns ``{}`` for malformed/non-object input.
Consumers that act on the envelope use :meth:`EnvelopeCodec.decode` instead.
"""
try:
decoded = json.loads(raw)
except (ValueError, TypeError):
return {}
return decoded if isinstance(decoded, dict) else {}
def has_forbidden_keys(envelope: Mapping[str, Any]) -> bool:
"""Whether ``envelope`` carries any of the non-canonical keys of message-envelope.md §10.
The top-level ``urn`` alias is NOT included (it is not a §10 key: decode folds it into ``job``),
although ``encode`` also rejects it — a caller deciding whether a raw body needs normalising
before re-emit must check ``"urn" in envelope`` as well.
"""
return _has_forbidden_keys(envelope)
def _is_valid_urn(value: Any) -> bool:
"""A usable identity: a string that is not blank under the ASCII set (ADR-0032 §5/§6).
Any non-string — including the falsy ``0`` / ``False`` / ``[]`` / ``{}`` — is not a URN.
"""
return isinstance(value, str) and value.strip(ASCII_WHITESPACE) != ""
def _parse_object(raw: Any) -> Optional[Dict[str, Any]]:
"""The parsed JSON object, or ``None`` when ``raw`` is malformed or not an object."""
try:
decoded = json.loads(raw)
except (ValueError, TypeError):
return None
return decoded if isinstance(decoded, dict) else None
def _fold_identity(decoded: Dict[str, Any]) -> Dict[str, Any]:
"""Drop forbidden keys and fold the ``urn`` alias into ``job`` (ADR-0031 (c), ADR-0032 §6)."""
strip_forbidden_keys(decoded)
if "job" in decoded and not isinstance(decoded["job"], str):
logger.warning(
"Ignored the non-string envelope key /job (%s)%s (ADR-0032 §6).",
type(decoded["job"]).__name__,
"; falling back to urn" if _is_valid_urn(decoded.get("urn")) else "",
)
if "urn" in decoded:
alias = decoded.pop("urn")
if _is_valid_urn(decoded.get("job")):
_warn_dropped("/urn")
elif _is_valid_urn(alias):
decoded["job"] = alias
return decoded
def _warn_dropped(pointer: str) -> None:
logger.warning(
"Dropped forbidden envelope key %s from the envelope "
"(non-canonical, message-envelope.md §10).",
pointer,
)
def _first_encode_violation(envelope: Mapping[str, Any]) -> Optional[str]:
"""RFC 6901 pointer of the first key encode refuses to write, or ``None``."""
for container, key in FORBIDDEN_KEYS:
target = envelope if container is None else envelope.get(container)
if isinstance(target, Mapping) and key in target:
return "/" + key if container is None else f"/{container}/{key}"
if "urn" in envelope:
return "/urn"
return None
def _has_forbidden_keys(envelope: Mapping[str, Any]) -> bool:
for container, key in FORBIDDEN_KEYS:
target = envelope if container is None else envelope.get(container)
if isinstance(target, Mapping) and key in target:
return True
return False
class EnvelopeCodec:
"""Builds, encodes and decodes the canonical envelope."""
SCHEMA_VERSION = SCHEMA_VERSION
SOURCE_LANG = SOURCE_LANG
@staticmethod
def make(
urn: str,
data: Mapping[str, Any],
*,
queue: str = "default",
trace_id: Optional[str] = None,
meta: Optional[Mapping[str, Any]] = None,
) -> Dict[str, Any]:
"""Build the canonical envelope for a ``(urn, data)`` pair.
``trace_id`` is reused when given (trace continuation), otherwise a fresh
UUID is minted. ``attempts`` starts at 0 and is the top-level transport
counter (kept out of the immutable ``meta`` block).
``meta`` (ADR-0031 (b)) adds producer-supplied entries (e.g. ``{"ext": {"acme": 1}}``) to
the ``meta`` block next to the core keys. An entry whose key is a core ``meta`` key
(``id``, ``queue``, ``lang``, ``schema_version``, ``created_at``) or a forbidden ``meta``
key (message-envelope.md §10) raises :class:`~babelqueue.exceptions.EnvelopeKeyError`.
"""
urn = (urn or "").strip(ASCII_WHITESPACE)
if not urn:
raise BabelQueueError(
"A polyglot message must expose a stable, non-empty URN so consumers "
"can identify it without any class name."
)
trace_id = (trace_id or "").strip(ASCII_WHITESPACE) or str(uuid.uuid4())
extra: Dict[str, Any] = {}
if meta is not None:
if not isinstance(meta, Mapping):
raise BabelQueueError("The producer meta must be a mapping of string keys to values.")
forbidden_meta = {key for container, key in FORBIDDEN_KEYS if container == "meta"}
for key, value in meta.items():
if key in CORE_META_KEYS or key in forbidden_meta:
raise EnvelopeKeyError(
f"/meta/{key}",
f"The producer meta key /meta/{key} is reserved or forbidden "
"(core meta keys and message-envelope.md §10 keys cannot be set).",
)
extra[key] = value
meta_block: Dict[str, Any] = {
"id": str(uuid.uuid4()),
"queue": queue,
"lang": SOURCE_LANG,
"schema_version": SCHEMA_VERSION,
"created_at": int(time.time() * 1000),
}
meta_block.update(extra)
envelope: Dict[str, Any] = {
"job": urn,
"trace_id": trace_id,
"data": dict(data),
"meta": meta_block,
"attempts": 0,
}
return envelope
@staticmethod
def from_message(message: Any, queue: str = "default") -> Dict[str, Any]:
"""Build the envelope from a message object (see :class:`PolyglotMessage`).
If the message also exposes ``get_babel_trace_id()`` (see
:class:`HasTraceId`) and returns a non-empty value, that trace id is reused.
"""
get_trace = getattr(message, "get_babel_trace_id", None)
trace_id = get_trace() if callable(get_trace) else None
return EnvelopeCodec.make(
message.get_babel_urn(),
message.to_payload(),
queue=queue,
trace_id=trace_id,
)
@staticmethod
def encode(envelope: Mapping[str, Any]) -> str:
"""Encode the envelope as compact UTF-8 JSON (unescaped unicode/slashes).
Forbidden keys (message-envelope.md §10) are never emitted: an envelope that carries one
(top-level ``timestamp``; ``meta.max_retries`` / ``meta.attempts`` / ``meta.source`` /
``meta.ts``) or the inbound-only top-level ``urn`` alias raises
:class:`~babelqueue.exceptions.EnvelopeKeyError` (ADR-0031 (c)) and nothing is written.
Envelopes produced by :meth:`decode` are always safe to re-encode: decode already drops
those keys. Unknown, non-forbidden keys are kept as-is.
"""
pointer = _first_encode_violation(envelope)
if pointer is not None:
raise EnvelopeKeyError(
pointer,
f"Refusing to encode the forbidden envelope key {pointer} "
"(non-canonical, message-envelope.md §10).",
)
return json.dumps(envelope, ensure_ascii=False, separators=(",", ":"))
@staticmethod
def decode(raw: str) -> Dict[str, Any]:
"""Decode a raw JSON body; returns ``{}`` for malformed/non-object input.
Unknown keys are kept as-is (forward compatibility). Forbidden keys
(message-envelope.md §10) are dropped and reported as warnings on :data:`logger`
(policy K-15: warn, never reject), so re-encoding never re-emits them.
The ``urn`` alias is folded into ``job`` (ADR-0031 (c), ADR-0032 §6): a ``job`` that is
not a string (``null``, number, boolean, object, array — falsy or not) is ignored with a
warning; a ``job`` that is missing, empty or only ASCII whitespace is ignored silently.
In both cases a valid string ``urn`` becomes ``job``. When ``job`` is valid, it wins and
``urn`` is dropped with a warning naming ``/urn``. A ``urn`` that is not a valid string is
ignored (dropped). The decoded envelope never keeps a ``urn`` key.
A readable JSON object with neither a valid ``job`` nor a valid ``urn`` raises
:class:`~babelqueue.exceptions.BabelQueueError` (ADR-0032 §6). Malformed or non-object
input still yields ``{}`` (the poison-path convention). Runtime and transport paths that
must tolerate an identity-less document use :meth:`decode_lenient` instead.
"""
parsed = _parse_object(raw)
if parsed is None:
return {}
decoded = _fold_identity(parsed)
if not _is_valid_urn(decoded.get("job")):
raise BabelQueueError(
"The envelope has neither a valid string 'job' nor a valid string 'urn' "
"(ADR-0032 section 6)."
)
return decoded
@staticmethod
def decode_lenient(raw: str) -> Dict[str, Any]:
"""Like :meth:`decode`, but an envelope without any valid identity does not raise.
The forbidden-key drop, the ``urn`` fold and the non-string ``job`` warning are identical;
a document with neither a valid ``job`` nor a valid ``urn`` comes back without a usable
``job`` (:meth:`urn` is ``""``, :meth:`accepts` is ``False``). For the runtime dispatch,
the transports' attempts reconciliation and ``redrive``, which must keep routing such a
body down the poison / pass-through path instead of failing the delivery. Malformed or
non-object input yields ``{}``.
"""
parsed = _parse_object(raw)
return {} if parsed is None else _fold_identity(parsed)
@staticmethod
def urn(envelope: Mapping[str, Any]) -> str:
"""The message URN: canonical ``job``, with ``urn`` accepted as an alias.
A ``job`` that is not a valid string (missing, non-string, empty or only ASCII
whitespace) falls back to ``urn``; a ``urn`` that is not a valid string is ignored.
"""
job = envelope.get("job")
if _is_valid_urn(job):
return str(job)
alias = envelope.get("urn")
return str(alias) if _is_valid_urn(alias) else ""
@staticmethod
def accepts(envelope: Mapping[str, Any]) -> bool:
"""Whether a consumer should accept this envelope (consumer-side validation).
Rejects messages with no URN, an unsupported ``meta.schema_version``, a
missing/blank ``trace_id``, or a non-object ``data`` / non-integer
``attempts``. (Accepts the ``urn`` alias, unlike the producer JSON Schema.)
"""
if EnvelopeCodec.urn(envelope) == "":
return False
meta = envelope.get("meta")
if not isinstance(meta, dict) or meta.get("schema_version") != SCHEMA_VERSION:
return False
if not isinstance(envelope.get("data"), dict):
return False
attempts = envelope.get("attempts")
if not isinstance(attempts, int) or isinstance(attempts, bool):
return False
trace_id = envelope.get("trace_id")
if not isinstance(trace_id, str) or trace_id.strip(ASCII_WHITESPACE) == "":
return False
return True