|
| 1 | +"""Team security module — path masking, content filtering, access control, opt-out.""" |
| 2 | + |
| 3 | +import fnmatch |
| 4 | +import os |
| 5 | +import re |
| 6 | +import sys |
| 7 | + |
| 8 | + |
| 9 | +# ── Path Masking ── |
| 10 | + |
| 11 | +def mask_paths(file_list, mask_patterns): |
| 12 | + """Mask sensitive file paths using glob patterns. |
| 13 | +
|
| 14 | + Args: |
| 15 | + file_list: List of file path strings |
| 16 | + mask_patterns: List of glob patterns (e.g., "**/credentials/**", "**/.env*") |
| 17 | +
|
| 18 | + Returns: |
| 19 | + New list with matched paths replaced by "[MASKED]" |
| 20 | + """ |
| 21 | + if not mask_patterns: |
| 22 | + return file_list |
| 23 | + |
| 24 | + masked = [] |
| 25 | + for fp in file_list: |
| 26 | + normalized = fp.replace("\\", "/") |
| 27 | + if _path_matches(normalized, mask_patterns): |
| 28 | + masked.append("[MASKED]") |
| 29 | + else: |
| 30 | + masked.append(fp) |
| 31 | + return masked |
| 32 | + |
| 33 | + |
| 34 | +def _path_matches(path, patterns): |
| 35 | + """Check if path matches any glob pattern.""" |
| 36 | + for pattern in patterns: |
| 37 | + # Normalize pattern |
| 38 | + p = pattern.replace("\\", "/") |
| 39 | + # Direct fnmatch |
| 40 | + if fnmatch.fnmatch(path, p): |
| 41 | + return True |
| 42 | + # Check if any path component matches a keyword pattern |
| 43 | + parts = path.lower().split("/") |
| 44 | + p_parts = p.lower().replace("**/", "").replace("/**", "").split("/") |
| 45 | + for keyword in p_parts: |
| 46 | + if not keyword or keyword == "*": |
| 47 | + continue |
| 48 | + for part in parts: |
| 49 | + if fnmatch.fnmatch(part, keyword): |
| 50 | + return True |
| 51 | + return False |
| 52 | + |
| 53 | + |
| 54 | +# ── Content Filtering ── |
| 55 | + |
| 56 | +def filter_content(text, filter_keywords, mode="redact"): |
| 57 | + """Filter sensitive content from text. |
| 58 | +
|
| 59 | + Args: |
| 60 | + text: Text to filter |
| 61 | + filter_keywords: List of keywords to detect |
| 62 | + mode: "redact" = replace sentence with [REDACTED], "skip" = return None |
| 63 | +
|
| 64 | + Returns: |
| 65 | + Filtered text, or None if mode=skip and keyword found |
| 66 | + """ |
| 67 | + if not text or not filter_keywords: |
| 68 | + return text |
| 69 | + |
| 70 | + text_lower = text.lower() |
| 71 | + for kw in filter_keywords: |
| 72 | + if kw.lower() in text_lower: |
| 73 | + if mode == "skip": |
| 74 | + return None |
| 75 | + elif mode == "redact": |
| 76 | + # Replace the sentence containing the keyword |
| 77 | + sentences = re.split(r'([.!?\n])', text) |
| 78 | + result = [] |
| 79 | + for i in range(0, len(sentences), 2): |
| 80 | + sent = sentences[i] if i < len(sentences) else "" |
| 81 | + sep = sentences[i + 1] if i + 1 < len(sentences) else "" |
| 82 | + if kw.lower() in sent.lower(): |
| 83 | + result.append("[REDACTED]" + sep) |
| 84 | + else: |
| 85 | + result.append(sent + sep) |
| 86 | + return "".join(result) |
| 87 | + |
| 88 | + return text |
| 89 | + |
| 90 | + |
| 91 | +def filter_entry_data(entry_data, filter_keywords, mode="redact"): |
| 92 | + """Apply content filtering to all text fields of entry_data. |
| 93 | +
|
| 94 | + If mode=skip and keyword found, returns False (skip entire session). |
| 95 | + Otherwise modifies entry_data in-place and returns True. |
| 96 | + """ |
| 97 | + if not filter_keywords: |
| 98 | + return True |
| 99 | + |
| 100 | + # Check if session should be skipped entirely |
| 101 | + if mode == "skip": |
| 102 | + all_text = " ".join( |
| 103 | + entry_data.get("user_prompts", []) + |
| 104 | + entry_data.get("summary_hints", []) + |
| 105 | + entry_data.get("commands_run", []) |
| 106 | + ) |
| 107 | + for kw in filter_keywords: |
| 108 | + if kw.lower() in all_text.lower(): |
| 109 | + return False |
| 110 | + |
| 111 | + # Redact mode |
| 112 | + for field in ("user_prompts", "summary_hints", "commands_run"): |
| 113 | + items = entry_data.get(field, []) |
| 114 | + filtered = [] |
| 115 | + for item in items: |
| 116 | + result = filter_content(item, filter_keywords, mode) |
| 117 | + if result is not None: |
| 118 | + filtered.append(result) |
| 119 | + entry_data[field] = filtered |
| 120 | + |
| 121 | + return True |
| 122 | + |
| 123 | + |
| 124 | +# ── Session Opt-out ── |
| 125 | + |
| 126 | +def should_skip_session(cwd, config): |
| 127 | + """Check if the current session should be skipped. |
| 128 | +
|
| 129 | + Checks: |
| 130 | + 1. CLAUDE_DIARY_SKIP=1 environment variable |
| 131 | + 2. Project name in config.skip_projects list |
| 132 | +
|
| 133 | + Returns: |
| 134 | + True if session should be skipped |
| 135 | + """ |
| 136 | + # Env var check |
| 137 | + if os.environ.get("CLAUDE_DIARY_SKIP", "").strip() in ("1", "true", "yes"): |
| 138 | + return True |
| 139 | + |
| 140 | + # Project skip list |
| 141 | + skip_projects = config.get("skip_projects", []) |
| 142 | + if skip_projects and cwd: |
| 143 | + project = os.path.basename(cwd.replace("\\", "/").rstrip("/")) |
| 144 | + if project in skip_projects: |
| 145 | + return True |
| 146 | + |
| 147 | + return False |
| 148 | + |
| 149 | + |
| 150 | +# ── Access Control ── |
| 151 | + |
| 152 | +ROLE_PERMISSIONS = { |
| 153 | + "member": {"own_diary": "full", "others_diary": "summary", "others_detail": False, "team_stats": True}, |
| 154 | + "lead": {"own_diary": "full", "others_diary": "full", "others_detail": "same_project", "team_stats": True}, |
| 155 | + "admin": {"own_diary": "full", "others_diary": "full", "others_detail": True, "team_stats": True}, |
| 156 | +} |
| 157 | + |
| 158 | + |
| 159 | +def check_access(viewer_role, viewer_name, target_name, target_project=None, viewer_projects=None): |
| 160 | + """Check if viewer has access to target's diary. |
| 161 | +
|
| 162 | + Args: |
| 163 | + viewer_role: "member", "lead", or "admin" |
| 164 | + viewer_name: Name of the person viewing |
| 165 | + target_name: Name of the diary owner |
| 166 | + target_project: Project of the diary entry |
| 167 | + viewer_projects: Projects the viewer is involved in |
| 168 | +
|
| 169 | + Returns: |
| 170 | + "full", "summary", or "none" |
| 171 | + """ |
| 172 | + if viewer_name == target_name: |
| 173 | + return "full" |
| 174 | + |
| 175 | + perms = ROLE_PERMISSIONS.get(viewer_role, ROLE_PERMISSIONS["member"]) |
| 176 | + |
| 177 | + if viewer_role == "admin": |
| 178 | + return "full" |
| 179 | + |
| 180 | + if viewer_role == "lead": |
| 181 | + if target_project and viewer_projects and target_project in viewer_projects: |
| 182 | + return "full" |
| 183 | + return perms["others_diary"] |
| 184 | + |
| 185 | + # member |
| 186 | + return "summary" |
| 187 | + |
| 188 | + |
| 189 | +def apply_access_filter(entry_data, access_level): |
| 190 | + """Filter entry_data based on access level. |
| 191 | +
|
| 192 | + "full": no filtering |
| 193 | + "summary": only project, categories, code_stats (no prompts, files, commands) |
| 194 | + "none": empty dict |
| 195 | + """ |
| 196 | + if access_level == "full": |
| 197 | + return entry_data |
| 198 | + |
| 199 | + if access_level == "none": |
| 200 | + return {} |
| 201 | + |
| 202 | + # summary mode |
| 203 | + return { |
| 204 | + "date": entry_data.get("date", ""), |
| 205 | + "time": entry_data.get("time", ""), |
| 206 | + "project": entry_data.get("project", ""), |
| 207 | + "categories": entry_data.get("categories", []), |
| 208 | + "code_stats": entry_data.get("code_stats"), |
| 209 | + "git_info": {"branch": entry_data.get("git_info", {}).get("branch", "")} if entry_data.get("git_info") else None, |
| 210 | + } |
0 commit comments