cadrumo.application.operations.registry_schema_validation module

Closed-schema validation helpers for the operation registry.

The public registry keeps the model and registry classes in their historical module. These helpers own the recursive schema rules that those classes use, so the rules can evolve without turning the registry facade into one large validation unit.

FORBIDDEN_CREDENTIAL_FREE_FIELD_PARTS

Field-name tokens a credential-free journal request may not carry.

A NAME tripwire, not the wall. What actually keeps a secret out of the journal is the storage policy plus the separate ephemeral-secret channel; this catches the case where a field is added whose name says plainly what it holds. Matching is on whole _-separated tokens, so it never fires on a word that merely contains one of these.

The second group are the words THIS codebase uses for credential material and that the first group missed: the certificate path spells its material cert/certificate/pem/private, and the Cl@ve factors are a pin and a one-time code. certificate_pem, clave_pin and otp_code all split into tokens the original set did not hold, so each would have journalled its own name unchallenged.

clave is deliberately ABSENT despite naming the Cl@ve authentication system, because it is a homonym: AEAT also spells an operation key clave, and clave/clave_operacion/clave_declarado are real fields on the detail rows an amendment journals. Adding it would refuse a lawful M184 or M347 amendment to catch a credential nothing names that way.

is_hex64_shaped_schema(value, *, definitions=None, _seen_refs=frozenset({}))

Report whether one field’s JSON-schema fragment matches Hex64 shape.

ContentDigest is a bare assignment to Hex64Str (ContentDigest is Hex64Str), not a distinct type, and Hex64Str is deliberately shared by several unrelated concepts (WorkUnitId, CalculationRevisionId, SnapshotId, TransactionId). There is therefore no runtime type-identity test for ContentDigest specifically - only a SHAPE test for 64 lowercase hex characters. Recurses through local $defs references, anyOf (an X | None field), and items (a tuple[X, ...] field) to reach the underlying string schema.

Return type:

bool

Parameters:

• value (object)

• definitions (dict[str, object] | None)

• _seen_refs (frozenset[str])

is_hex64_string_schema(mapping)

Recognize the direct JSON-schema shape of one lowercase Hex64 value.

Return type:

bool

Parameters:

mapping (dict[str, object])

is_hex64_any_of_schema(mapping, *, definitions=None, _seen_refs=frozenset({}))

Search non-null branches of an optional JSON-schema value for Hex64.

Return type:

bool

Parameters:

• mapping (dict[str, object])

• definitions (dict[str, object] | None)

• _seen_refs (frozenset[str])

is_hex64_items_schema(mapping, *, definitions=None, _seen_refs=frozenset({}))

Search a homogeneous tuple/array item schema for Hex64.

Return type:

bool

Parameters:

• mapping (dict[str, object])

• definitions (dict[str, object] | None)

• _seen_refs (frozenset[str])

validate_credential_free_schema(schema, *, definitions=None)

Reject request schemas capable of carrying credentials or transports.

A field name matching ONLY the digest forbidden token (no other forbidden token also matches) is admitted when its schema shape is exactly Hex64 - a compare-and-swap content digest, never a bearer token or passphrase by shape. A field matching any OTHER forbidden token is refused regardless of shape, and regardless of whether it also matches digest; the exemption never widens any token but digest and never overrides a second, independently-matched forbidden token on the same field.

Return type:

None

Parameters:

• schema (object)

• definitions (dict[str, object] | None)

validate_credential_free_schema_items(items, *, definitions=None)

Recursively inspect every branch in a JSON-schema list container.

Return type:

None

Parameters:

• items (list[object])

• definitions (dict[str, object] | None)

validate_credential_free_schema_format(mapping)

Reject schema formats that can carry credentials in journal input.

Return type:

None

Parameters:

mapping (dict[str, object])

validate_credential_free_schema_properties(mapping, *, definitions=None)

Reject forbidden names while admitting only digest-shaped exceptions.

Return type:

None

Parameters:

• mapping (dict[str, object])

• definitions (dict[str, object] | None)

strict_model_json_schema(model_type)

Return one exact closed schema after enforcing the public model baseline.

Return type:

dict[str, object]

Parameters:

model_type (type[BaseModel])

validate_closed_json_schema(schema, *, path)

Refuse every untyped or open branch of one generated public schema.

Return type:

None

Parameters:

• schema (dict[str, object])

• path (str)

reject_secret_capable_schema_branch(schema, *, path)

Reject public schema branches that can carry opaque secrets.

Return type:

None

Parameters:

• schema (dict[str, object])

• path (str)

validate_schema_definitions(schema, *, path)

Validate every named schema definition recursively.

Return type:

None

Parameters:

• schema (dict[str, object])

• path (str)

validate_schema_combinator(schema, *, path)

Validate the first declared JSON-schema combinator and its branches.

Return type:

bool

Parameters:

• schema (dict[str, object])

• path (str)

validate_closed_object_schema(schema, *, path)

Require an object branch to enumerate and close every property.

Return type:

None

Parameters:

• schema (dict[str, object])

• path (str)

validate_closed_array_schema(schema, *, path)

Require a homogeneous array or a fully fixed tuple to be closed.

Return type:

None

Parameters:

• schema (dict[str, object])

• path (str)

validate_closed_tuple_schema(schema, prefix_items, *, path)

Require fixed tuple bounds and recursively validate each item.

Return type:

None

Parameters:

• schema (dict[str, object])

• prefix_items (object)

• path (str)