Repository navigation
Check uuid shape through one helper; python_script's Uuid::parse_str also accepts braced, urn and unhyphenated forms #1845
Description
[agent] Filed by the scheduled architecture audit (audit-core). Register: register.
Kind: refactor. Register ID: A15.
Problem
"Is this segment a uuid" is answered four ways in core:
utils::target::is_uuid_shaped(public, any case): target.rs L329-L336- a private twin,
utils::redact::is_uuid_shaped: redact.rs L78-L85 patch::path_safety::is_canonical_uuid(lowercase, hyphenated 8-4-4-4-12): path_safety.rs L51-L70uuid::Uuid::parse_strinpython_script::same_hosted_artifact: python_script.rs L99-L101
The last one has drifted. Uuid::parse_str also accepts the 32-hex simple form, {braced} and urn:uuid: forms. So a hosted-URL grant segment that every other recognizer (hosted_patch_url_uuids uses is_canonical_uuid) rejects is accepted there as a uuid.
The CLI also re-tests the core rule with 14 looks_like_uuid_* tests (crates/socket-patch-cli/src/lib.rs L475-L562).
Proposed change
- Keep two named rules in one place,
patch::path_safety:is_canonical_uuid(path segments the server mints) andis_uuid_shaped(user input, any case). - Delete
redact's private copy. - Replace the three
Uuid::parse_str(..).is_ok()calls withis_canonical_uuid. - Re-export or move
target::is_uuid_shapedthere.
Size
4 files in core (plus the import in the CLI). About −30 lines.
Acceptance criteria
- Existing
target,redact,path_safetyandpython_scripttests pass. - Add one
same_hosted_artifacttest where a braced or unhyphenated uuid grant segment is not treated as a rotation. - Drop the CLI's duplicated
looks_like_uuid_*tests, or keep a single smoke test.
Activity
mikolalysenko commentedon Oct 29, 2026
[agent] Triaged: priority:p3 (cross-cutting refactor). Related to the older tracking issue #705 (one
utils::uuidgrammar). This is one concrete instance of it, not a duplicate.Generated by Claude Code
mikolalysenko commentedon Oct 30, 2026
[agent] Janitor: closing as a duplicate of #705, the older tracking issue for one UUID grammar in core. Both ask for the same change: one named rule (canonical lowercase for server-minted path segments, any case for user input), with the
Uuid::parse_strgrant checks inpython_script.rsreplaced by it.Site list on origin/main
5ca56238, carried over for #705 (several of #705's original sites are gone):utils::target::is_uuid_shaped,crates/socket-patch-core/src/utils/target.rs:329utils::redact::is_uuid_shaped,crates/socket-patch-core/src/utils/redact.rs:79patch::path_safety::is_canonical_uuid,crates/socket-patch-core/src/patch/path_safety.rs:51uuid::Uuid::parse_str×3 inpython_script::same_hosted_artifact,crates/socket-patch-core/src/utils/python_script.rs:99-101. These accept simple, braced andurn:uuid:forms thathosted_patch_url_uuidsrejects.looks_like_uuid_*tests incrates/socket-patch-cli/src/lib.rs:480-562Extra acceptance item from here: a
same_hosted_artifacttest where a braced or unhyphenated grant segment isn't treated as a rotation. Reopen if you want the two tracked separately.Generated by Claude Code