clan_lib: allow explicit readonly access to inventory attributes

pkgs/clan-cli/clan_lib/persist/inventory_store.py

@@ -109,7 +109,7 @@ class InventoryStore:
         flake: FlakeInterface,
         inventory_file_name: str = "inventory.json",
         _allowed_path_transforms: list[str] | None = None,
-        _keys: list[str] | None = None,
+        _keys: set[str] | None = None,
     ) -> None:
         """InventoryStore constructor
 
@@ -132,8 +132,8 @@ class InventoryStore:
         self._keys = _keys
 
     @classmethod
-    def default_keys(cls) -> list[str]:
-        return list(InventorySnapshot.__annotations__.keys())
+    def default_keys(cls) -> set[str]:
+        return set(InventorySnapshot.__annotations__.keys())
 
     @classmethod
     def default_selectors(cls) -> list[str]:
@@ -152,7 +152,7 @@ class InventoryStore:
         - Contains all machines
         - and more
         """
-        raw_value = self.get_readonly_raw()
+        raw_value = self.get_readonly_raw(self._keys)
         if self._keys:
             filtered = cast(
                 "InventorySnapshot",
@@ -162,8 +162,8 @@ class InventoryStore:
             filtered = cast("InventorySnapshot", raw_value)
         return sanitize(filtered, self._allowed_path_transforms, [])
 
-    def get_readonly_raw(self) -> Inventory:
-        attrs = "{" + ",".join(self._keys) + "}"
+    def get_readonly_raw(self, keys: set[str]) -> Inventory:
+        attrs = "{" + ",".join(keys) + "}"
         return self._flake.select(f"clanInternals.inventoryClass.inventory.{attrs}")
 
     def _get_persisted(self) -> InventorySnapshot:

pkgs/clan-cli/clan_lib/persist/inventory_store_test.py

@@ -102,7 +102,7 @@ def test_simple_read_write(setup_test_files: Path) -> None:
     store = InventoryStore(
         flake=MockFlake(nix_file),
         inventory_file_name=json_file.name,
-        _keys=["foo", "protected"],
+        _keys={"foo", "protected"},
     )
     store._flake.invalidate_cache()
     data = store.read()  # type: ignore[assignment]
@@ -147,7 +147,7 @@ def test_simple_deferred(setup_test_files: Path) -> None:
         inventory_file_name=json_file.name,
         # Needed to allow auto-transforming deferred modules
         _allowed_path_transforms=["foo.*"],
-        _keys=["foo"],  # disable toplevel filtering
+        _keys={"foo"},  # disable toplevel filtering
     )
 
     data = store.read()
@@ -228,7 +228,7 @@ def test_manipulate_list(setup_test_files: Path) -> None:
     store = InventoryStore(
         flake=MockFlake(nix_file),
         inventory_file_name=json_file.name,
-        _keys=["empty", "predefined"],
+        _keys={"empty", "predefined"},
     )
 
     data = store.read()
@@ -270,7 +270,7 @@ def test_static_list_items(setup_test_files: Path) -> None:
     store = InventoryStore(
         flake=MockFlake(nix_file),
         inventory_file_name=json_file.name,
-        _keys=["empty", "predefined"],
+        _keys={"empty", "predefined"},
     )
 
     data = store.read()

pkgs/clan-cli/clan_lib/tags/list.py

@@ -41,7 +41,7 @@ def list_tags(flake: Flake) -> TagList:
             for tag in role_tags:
                 tags.add(tag)
 
-    global_tags = inventory_store.get_readonly_raw().get("tags", {})
+    global_tags = inventory_store.get_readonly_raw({"tags"}).get("tags", {})
 
     for tag in global_tags:
         if tag not in tags: