자기 임시파일만 정리하는 합성 저장 모듈

"""Synthetic single-file replacement in an explicitly trusted private directory."""
from pathlib import Path
from uuid import uuid4
import json,re,os,hashlib

def save(root,key,record,check=lambda:None):
    if not isinstance(key,str) or re.fullmatch(r'[a-z][a-z0-9-]{0,39}',key) is None:
        raise ValueError('invalid key')
    if not isinstance(record,dict) or set(record)!={'phase','sample'}:
        raise ValueError('exact synthetic record fields required')
    if record['phase'] not in ('prepared','confirmed') or not isinstance(record['sample'],str) or not 1<=len(record['sample'])<=200:
        raise ValueError('bounded synthetic record required')
    data=json.dumps(record,ensure_ascii=False,sort_keys=True).encode('utf-8')
    root=Path(root)
    if not root.is_absolute() or not root.is_dir() or root.is_symlink():
        raise ValueError('explicit existing trusted directory required')
    target=root/(key+'.json');stage=root/('.'+key+'-'+uuid4().hex+'.tmp')
    created=False
    check()
    try:
        with stage.open('xb') as stream:
            created=True
            stream.write(data);stream.flush();os.fsync(stream.fileno())
        check()
        os.replace(stage,target);created=False
    except Exception as error:
        if created:
            try:stage.unlink(missing_ok=True)
            except Exception as cleanup:
                raise ExceptionGroup('save and owned-stage cleanup failed',[error,cleanup]) from None
        raise
    return {'key':key,'payload_sha256':hashlib.sha256(data).hexdigest(),'bytes':len(data),'state':'stored'}