mirror of
https://github.com/kuhyx/steam-backlog-enforcer.git
synced 2026-11-10 18:07:07 +01:00
Krzysztof kuhy Rudnicki
2d45515665
The 250-line split left function-sized copies behind: the confidence-only batch fetch was the search half of _fetch_batch verbatim (now _search_batch, and _SearchCtx carries one _HLTBExtras instead of two of its dicts); the workout and LeetCode bonuses each had the same loopback GET and answer cache (now _status_api); the poll-count refetch lived in both _cmd_done and _polls_reporting (now refetch_poll_counts); the candidate-selection prelude in both scanning and _scanning_assign; the /etc/hosts rewrite loop in both block and unblock (now rewrite_hosts_lines with a per-line rule); the timed HLTB fetch and its rate line; and the whitelist constants each module only half used. _hltb_cached's dead facade constants go too. Tests patch where the code now lives. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHCbkJWXHjtTUaqvnHRAqA
101 lines
3.7 KiB
Python
101 lines
3.7 KiB
Python
"""Whitelist hardening: time-locked exceptions, reason validation, immutability."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from collections import Counter
|
|
import logging
|
|
import math
|
|
import re
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
# ──────────────────────────────────────────────────────────────
|
|
# Constants
|
|
# ──────────────────────────────────────────────────────────────
|
|
|
|
_MIN_REASON_WORDS: int = 5
|
|
_MIN_REASON_LENGTH: int = 25
|
|
_MIN_ENTROPY: float = 3.0
|
|
# Reject runs of the same character longer than this (e.g. "aaaa").
|
|
_MAX_CHAR_RUN: int = 3
|
|
|
|
|
|
# ──────────────────────────────────────────────────────────────
|
|
# Reason validation
|
|
# ──────────────────────────────────────────────────────────────
|
|
|
|
|
|
def _shannon_entropy(text: str) -> float:
|
|
"""Return Shannon entropy (bits per character) for *text*.
|
|
|
|
Whitespace is excluded before counting so spaces don't inflate entropy.
|
|
|
|
Args:
|
|
text: Input string to measure.
|
|
|
|
Returns:
|
|
Entropy in bits per character, or 0.0 for empty input.
|
|
"""
|
|
chars = [c.lower() for c in text if not c.isspace()]
|
|
if not chars:
|
|
return 0.0
|
|
total = len(chars)
|
|
counts = Counter(chars)
|
|
return -sum((c / total) * math.log2(c / total) for c in counts.values())
|
|
|
|
|
|
def validate_reason(reason: str) -> str | None:
|
|
"""Validate that a whitelist exception reason is genuine.
|
|
|
|
Returns None when the reason is acceptable, or a human-readable error
|
|
string that explains why it was rejected.
|
|
|
|
Args:
|
|
reason: User-supplied justification text.
|
|
|
|
Returns:
|
|
None if valid, or an error message string if invalid.
|
|
"""
|
|
stripped = reason.strip()
|
|
|
|
if len(stripped) < _MIN_REASON_LENGTH:
|
|
return (
|
|
f"Reason is too short ({len(stripped)} chars; "
|
|
f"need at least {_MIN_REASON_LENGTH})."
|
|
)
|
|
|
|
words = stripped.split()
|
|
if len(words) < _MIN_REASON_WORDS:
|
|
return (
|
|
f"Reason must contain at least {_MIN_REASON_WORDS} words "
|
|
f"(got {len(words)})."
|
|
)
|
|
|
|
entropy = _shannon_entropy(stripped)
|
|
if entropy < _MIN_ENTROPY:
|
|
return (
|
|
f"Reason appears to be random characters "
|
|
f"(entropy {entropy:.2f} < {_MIN_ENTROPY}). "
|
|
"Write a genuine justification."
|
|
)
|
|
|
|
# Reject runs of the same character: aaaa, bbbbbb, etc.
|
|
if re.search(r"(.)\1{3,}", stripped, re.IGNORECASE):
|
|
return "Reason contains repeated characters. Write a genuine justification."
|
|
|
|
# Reject simple two-character alternating patterns: ababab, asasas, etc.
|
|
if re.search(r"(..)(\1){3,}", stripped, re.IGNORECASE):
|
|
return "Reason contains repetitive patterns. Write a genuine justification."
|
|
|
|
return None
|
|
|
|
|
|
# ──────────────────────────────────────────────────────────────
|
|
# Immutability helpers
|
|
# ──────────────────────────────────────────────────────────────
|
|
|
|
# From <linux/fs.h>. FS_IOC_GETFLAGS is the 64-bit encoding of _IOR('f', 1,
|
|
# long); FS_IMMUTABLE_FL is the "immutable" bit that `chattr +i` sets.
|
|
_FS_IOC_GETFLAGS = 0x80086601
|
|
_FS_IMMUTABLE_FL = 0x00000010
|