zenops-safe-relative-path 0.5.5

Relative path type that statically prevents `..` traversal.
Documentation
use std::fmt;

use crate::{SafeRelativePath, error::Error};
use serde::de;
use smol_str::{SmolStr, ToSmolStr};

/// A path that is exactly one segment — no separators, no traversal.
///
/// Narrower than [`SafeRelativePath`]: where `SafeRelativePath` allows any
/// number of components as long as none of them are `..`,
/// `SinglePathComponent` permits exactly one. Reach for it when a value
/// has to be a single name in a flat namespace — a package key, a
/// configuration map key, a directory entry — and you want the type
/// system to enforce that.
///
/// [`Deref`]s to [`SafeRelativePath`], so a `SinglePathComponent` can be
/// handed to anything that takes `&SafeRelativePath` without conversion.
///
/// # Example
///
/// ```
/// use zenops_safe_relative_path::SinglePathComponent;
///
/// assert!(SinglePathComponent::try_new("zsh").is_ok());
///
/// // More than one component — rejected.
/// assert!(SinglePathComponent::try_new("zsh/init.sh").is_err());
/// // Traversal — also rejected.
/// assert!(SinglePathComponent::try_new("..").is_err());
/// ```
///
/// [`Deref`]: std::ops::Deref
#[derive(Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Debug)]
pub struct SinglePathComponent(SmolStr);

impl SinglePathComponent {
    /// Try to wrap a string as a [`SinglePathComponent`].
    ///
    /// Fails on anything containing `/`, anything with `..` traversal, and
    /// the empty string.
    pub fn try_new(v: &str) -> Result<Self, Error> {
        let path = SafeRelativePath::from_relative_path(v)?;
        let first = path.0.components().map(|c| c.as_str()).next();
        if first == Some(v) {
            Ok(Self(v.to_smolstr()))
        } else {
            Err(Error::NotASinglePathComponent(v.to_string()))
        }
    }

    /// View this component as a [`SafeRelativePath`].
    ///
    /// `SinglePathComponent` already [`Deref`]s to [`SafeRelativePath`], so
    /// most call sites don't need this directly — it's exposed for places
    /// where an explicit conversion reads more clearly than a reborrow.
    ///
    /// [`Deref`]: std::ops::Deref
    pub fn as_safe_relative_path(&self) -> &SafeRelativePath {
        unsafe { SafeRelativePath::new_unchecked_from_str(self.0.as_str()) }
    }
}

impl AsRef<SafeRelativePath> for SinglePathComponent {
    fn as_ref(&self) -> &SafeRelativePath {
        self.as_safe_relative_path()
    }
}

impl fmt::Display for SinglePathComponent {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        fmt::Display::fmt(&self.0, f)
    }
}

impl std::ops::Deref for SinglePathComponent {
    type Target = SafeRelativePath;

    fn deref(&self) -> &Self::Target {
        self.as_safe_relative_path()
    }
}

#[cfg(feature = "schemars")]
impl schemars::JsonSchema for SinglePathComponent {
    fn schema_name() -> std::borrow::Cow<'static, str> {
        "SinglePathComponent".into()
    }

    fn json_schema(_: &mut schemars::SchemaGenerator) -> schemars::Schema {
        schemars::json_schema!({
            "type": "string",
            "description": "A single path component — no separators, no `..` traversal.",
            "pattern": "^[^/]+$",
        })
    }
}

impl<'de> de::Deserialize<'de> for SinglePathComponent {
    fn deserialize<D: de::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
        struct Visitor;

        impl<'de> de::Visitor<'de> for Visitor {
            type Value = SinglePathComponent;

            fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
                write!(f, "single path component")
            }

            fn visit_str<E: de::Error>(self, v: &str) -> Result<Self::Value, E> {
                SinglePathComponent::try_new(v).map_err(de::Error::custom)
            }
        }

        d.deserialize_any(Visitor)
    }
}