Skip to content

file_policy

file_policy

File sensitivity policy — block access to secrets, credentials, and keys.

Functions

is_sensitive_file 

is_sensitive_file(path: Union[str, Path]) -> bool

Return True if path matches a sensitive file pattern.

Checks the original path, symlink targets, and resolved path against DEFAULT_SENSITIVE_PATTERNS. A symlink must not bypass the policy by hiding a sensitive name anywhere in its chain. Uses the Rust implementation when available, falls back to Python.

Source code in src/openjarvis/security/file_policy.py 
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
def is_sensitive_file(path: Union[str, Path]) -> bool:
    """Return ``True`` if *path* matches a sensitive file pattern.

    Checks the original path, symlink targets, and resolved path against
    ``DEFAULT_SENSITIVE_PATTERNS``. A symlink must not bypass the policy by
    hiding a sensitive name anywhere in its chain.
    Uses the Rust implementation when available, falls back to Python.
    """
    try:
        from openjarvis._rust_bridge import get_rust_module

        _rust = get_rust_module()
        check = _rust.is_sensitive_file
    except ImportError:
        check = _is_sensitive_file_py

    return any(check(str(candidate)) for candidate in _paths_for_policy(Path(path)))

filter_sensitive_paths 

filter_sensitive_paths(paths: Iterable[Union[str, Path]]) -> List[Path]

Return only non-sensitive paths from paths.

Source code in src/openjarvis/security/file_policy.py 
82
83
84
def filter_sensitive_paths(paths: Iterable[Union[str, Path]]) -> List[Path]:
    """Return only non-sensitive paths from *paths*."""
    return [Path(p) for p in paths if not is_sensitive_file(p)]