Share one hosted Pipenv URL recognizer

Hosted Pipenv refused to rotate its own pin when --patch-server-url
carried a path prefix, and treated its own hosted sdist pins as user
sources. Vendored Pipenv called any https host's /patch/pypi/ URL a
Socket reference and told the user to run rollback for a foreign
source, while a path-prefixed or sdist hosted pin got the
"user-declared" remedy instead.

Both now ask lock_inventory::pypi::hosted_pypi_reference: the
hosted_patch_url_uuids origin policy plus the hosted_artifact_url
tail grammar. The two private segment-count grammars are deleted.
Vendored Pipenv passes the run's --patch-server-url origin.

Fixes #563

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-core/src/patch/redirect/pipenv.rs

@@ -6,6 +6,7 @@ use serde_json::{json, Value};
 
 use super::{DepOverride, FileEdit, RewriteResult, RewriteWarning};
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
+use crate::vendor::lock_inventory::pypi::hosted_pypi_reference;
 
 pub(super) struct Property {
     pub(super) name: String,
@@ -242,40 +243,16 @@ pub(super) fn rewrite(
     }
 }
 
-/// Whether `value` is a Socket-issued hosted reference for `dep` — served
-/// from the same origin as the grant's own artifact URL (patch.socket.dev,
-/// or a `--patch-server-url` host), with the `/patch/pypi/<name>/<version>/
-/// <grant>/<uuid>/<wheel>` shape for this package and version. Such an entry
-/// is ours to rotate; anything else is a user's or a fork's source.
+/// Whether `value` is a Socket-issued hosted reference for `dep`: the shared
+/// recognizer ([`hosted_pypi_reference`]) accepts it on the grant's own
+/// origin (patch.socket.dev, or a `--patch-server-url` host, path prefix
+/// included), and it names this package and version. Such an entry is ours
+/// to rotate; anything else is a user's or a fork's source.
 fn owned_url(value: &str, dep: &DepOverride) -> bool {
-    let Ok(url) = reqwest::Url::parse(value) else {
-        return false;
-    };
-    let Ok(ours) = reqwest::Url::parse(&dep.artifact_url) else {
-        return false;
-    };
-    let same_origin = url.scheme() == ours.scheme()
-        && url.host_str() == ours.host_str()
-        && url.port_or_known_default() == ours.port_or_known_default();
-    let parts: Vec<_> = url.path().split('/').collect();
-    (same_origin
-        || (url.scheme() == "https" && url.host_str() == Some(super::SOCKET_PATCH_SERVER_HOST)))
-        && url.username().is_empty()
-        && url.password().is_none()
-        && url.query().is_none()
-        && parts.len() == 8
-        && parts[1] == "patch"
-        && parts[2] == "pypi"
-        && canonicalize_pypi_name(parts[3]) == canonicalize_pypi_name(&dep.name)
-        && parts[4] == dep.version
-        && !parts[5].is_empty()
-        && !parts[6].is_empty()
-        && parts[7].ends_with(".whl")
-        && parts[7]
-            .split('-')
-            .next()
-            .is_some_and(|name| canonicalize_pypi_name(name) == canonicalize_pypi_name(&dep.name))
-        && parts[7].split('-').nth(1) == Some(dep.version.as_str())
+    hosted_pypi_reference(value, std::slice::from_ref(&dep.artifact_url)).is_some_and(|coords| {
+        canonicalize_pypi_name(&coords.name) == canonicalize_pypi_name(&dep.name)
+            && coords.version == dep.version
+    })
 }
 
 /// Why a Pipfile.lock plan did not happen. Only a [`PlanError::Conflict`]
@@ -651,6 +628,30 @@ mod tests {
         assert!(second.contains("/rotated/") && !second.contains("/tok/"));
     }
 
+
+    /// Hosted Pipenv recognizes its own pins through the shared recognizer
+    /// (#563): a path-prefixed `--patch-server-url` deployment rotates its
+    /// grant instead of refusing its own previous reference, and a hosted
+    /// sdist pin is ours too.
+    #[test]
+    fn owned_url_accepts_path_prefixed_origins_and_sdists() {
+        let mut dep = dependency("urllib3", "1.26.18", "patch-one");
+        dep.artifact_url = "https://patches.internal.example/socket/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl".into();
+        assert!(
+            owned_url(&dep.artifact_url, &dep),
+            "the URL hosted mode just wrote is ours"
+        );
+        assert!(owned_url("https://patch.socket.dev/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18.tar.gz", &dep));
+        assert!(!owned_url("https://patches.internal.example.org/socket/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl", &dep));
+        assert!(!owned_url("https://user@patch.socket.dev/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl", &dep));
+        assert!(!owned_url("https://patch.socket.dev/patch/pypi/requests/2.28.1/tok/patch-one/requests-2.28.1-py3-none-any.whl", &dep));
+        let (first, _) = plan(&lock(), &dep, None).unwrap();
+        dep.artifact_url = dep.artifact_url.replace("/tok/", "/rotated/");
+        let (second, rotation) =
+            plan(&first, &dep, None).expect("rotation on a path-prefixed origin");
+        assert!(!rotation.is_empty());
+        assert!(second.contains("/rotated/") && !second.contains("/tok/"));
+    }
 }
 
 #[cfg(test)]

crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs

@@ -165,6 +165,25 @@ pub(crate) fn hosted_artifact_url(url: &str) -> Result<HostedArtifactUrl, String
 
 // ── registry view ──
 
+/// A Socket-HOSTED pypi patch reference's coordinates, or `None` when
+/// `url` is not one — the ONE "is this lock entry ours" grammar hosted
+/// Pipenv rotation (`redirect::pipenv`) and the vendored Pipenv guard
+/// (`vendor::pypi_pipenv`) share. Ours means both: served from an accepted
+/// origin (patch.socket.dev or one of `origins`, with no userinfo —
+/// [`crate::patch::redirect::hosted_patch_url_uuids`]'s origin policy), and
+/// a [`hosted_artifact_url`] whose `…/patch/pypi/<name>/<version>/<grant>/
+/// <uuid>/<artifact>` tail is matched from the END, so a path-prefixed
+/// `--patch-server-url` deployment and a hosted sdist are recognized too.
+pub(crate) fn hosted_pypi_reference(url: &str, origins: &[String]) -> Option<HostedArtifactUrl> {
+    crate::patch::redirect::hosted_patch_url_uuids(url, origins)?;
+    hosted_artifact_url(url).ok().filter(|coords| {
+        coords
+            .uuid_level
+            .as_deref()
+            .is_some_and(|uuid| !uuid.is_empty())
+    })
+}
+
 /// Inventory the pypi lock the project carries. Fetchable resolution
 /// (URL + sha256 of a pure `-none-any` wheel) comes from `uv.lock` and
 /// PEP 751 / PEP 723 script locks; `poetry.lock` entries carry the pure

crates/socket-patch-core/src/vendor/pypi.rs

@@ -694,6 +694,7 @@ async fn pypi_prelude<'p>(
     dry_run: bool,
     pipenv_version: &tokio::sync::OnceCell<Option<u32>>,
     installed_sites: &InstalledSiteListings,
+    hosted_origins: &[String],
 ) -> Result<PypiPrelude<'p>, VendorOutcome> {
     // The purl may carry `?artifact_id=` variant qualifiers; everything here
     // keys off the qualifier-free base.
@@ -866,6 +867,7 @@ async fn pypi_prelude<'p>(
                 &canon_name,
                 &record.uuid,
                 version,
+                hosted_origins,
             ) {
                 Ok(target) => target,
                 // A refusal carries no warnings: probe nothing for it.
@@ -1011,6 +1013,9 @@ pub(crate) async fn service_preflight(
         false,
         pipenv_version,
         installed_sites,
+        // Only the verdict matters here, and the hosted-reference refusal
+        // carries the same code as the user-declared one.
+        &[],
     )
     .await
     .ok()
@@ -1038,6 +1043,10 @@ pub async fn vendor_pypi_with_pipenv_version<'a>(
     installed_sites: &InstalledSiteListings,
 ) -> VendorOutcome {
     let site_packages = site_packages.into();
+    let hosted_origins: Vec<String> = service
+        .and_then(|s| s.patch_server_url.clone())
+        .into_iter()
+        .collect();
     let PypiPrelude {
         base,
         raw_name,
@@ -1058,6 +1067,7 @@ pub async fn vendor_pypi_with_pipenv_version<'a>(
         dry_run,
         pipenv_version,
         installed_sites,
+        &hosted_origins,
     )
     .await
     {
@@ -1283,6 +1293,7 @@ pub async fn vendor_pypi_with_pipenv_version<'a>(
             &rel_wheel,
             &artifact.sha256_hex,
             &record.uuid,
+            &hosted_origins,
         )
         .await
         .map(|(wiring, meta)| (wiring, MetaSlot::Pipenv(meta))),
@@ -4214,10 +4225,18 @@ wheels = [
             .unwrap();
         let rel_wheel = format!(".socket/vendor/pypi/{UUID}/six-1.16.0-py2.py3-none-any.whl");
         let p = load_pipenv_project(root).await.unwrap();
-        let (wiring, _meta) =
-            wire_pipenv(&p, root, "six", "1.16.0", &rel_wheel, &"0".repeat(64), UUID)
-                .await
-                .unwrap();
+        let (wiring, _meta) = wire_pipenv(
+            &p,
+            root,
+            "six",
+            "1.16.0",
+            &rel_wheel,
+            &"0".repeat(64),
+            UUID,
+            &[],
+        )
+        .await
+        .unwrap();
         let uuid_dir = root.join(format!(".socket/vendor/pypi/{UUID}"));
         tokio::fs::create_dir_all(&uuid_dir).await.unwrap();
         let wheel = uuid_dir.join("six-1.16.0-py2.py3-none-any.whl");
@@ -4279,6 +4298,7 @@ wheels = [
             &rel_wheel,
             &"0".repeat(64),
             UUID,
+            &[],
         )
         .await
         .unwrap_or_else(|_| panic!("rewire"));
@@ -4354,10 +4374,18 @@ wheels = [
             .unwrap();
         let rel_wheel = format!(".socket/vendor/pypi/{UUID}/six-1.16.0-py2.py3-none-any.whl");
         let p = load_pipenv_project(root).await.unwrap();
-        let (wiring, _meta) =
-            wire_pipenv(&p, root, "six", "1.16.0", &rel_wheel, &"0".repeat(64), UUID)
-                .await
-                .unwrap();
+        let (wiring, _meta) = wire_pipenv(
+            &p,
+            root,
+            "six",
+            "1.16.0",
+            &rel_wheel,
+            &"0".repeat(64),
+            UUID,
+            &[],
+        )
+        .await
+        .unwrap();
         let uuid_dir = root.join(format!(".socket/vendor/pypi/{UUID}"));
         tokio::fs::create_dir_all(&uuid_dir).await.unwrap();
         let wheel = uuid_dir.join("six-1.16.0-py2.py3-none-any.whl");
@@ -4489,10 +4517,18 @@ wheels = [
             .unwrap();
         let rel_wheel = format!(".socket/vendor/pypi/{UUID}/six-1.16.0-py2.py3-none-any.whl");
         let p = load_pipenv_project(root).await.unwrap();
-        let (wiring, _meta) =
-            wire_pipenv(&p, root, "six", "1.16.0", &rel_wheel, &"0".repeat(64), UUID)
-                .await
-                .unwrap();
+        let (wiring, _meta) = wire_pipenv(
+            &p,
+            root,
+            "six",
+            "1.16.0",
+            &rel_wheel,
+            &"0".repeat(64),
+            UUID,
+            &[],
+        )
+        .await
+        .unwrap();
         let uuid_dir = root.join(format!(".socket/vendor/pypi/{UUID}"));
         tokio::fs::create_dir_all(&uuid_dir).await.unwrap();
         tokio::fs::write(uuid_dir.join("six-1.16.0-py2.py3-none-any.whl"), b"wheel")