🚧 WIP

src/git_auto_tracker/security/__init__.py

@@ -0,0 +1 @@
+"""Security validation (Section 33)."""

src/git_auto_tracker/security/validator.py

@@ -0,0 +1,32 @@
+"""Security validation entry point (Section 33).
+
+Delegates to changes.filters for pattern matching; kept as a separate
+component so future policies (skip, quarantine) can evolve independently.
+"""
+
+from __future__ import annotations
+
+from git_auto_tracker.changes.filters import find_forbidden, validate_security
+from git_auto_tracker.changes.models import ChangeSet
+from git_auto_tracker.config import SecurityConfig
+
+__all__ = ["SecurityValidator", "find_forbidden", "validate_security"]
+
+
+class SecurityValidator:
+    """Checks a ChangeSet against configured forbidden patterns."""
+
+    def __init__(self, security: SecurityConfig) -> None:
+        self._security = security
+
+    def find_forbidden(self, change_set: ChangeSet) -> list[str]:
+        return find_forbidden(
+            [r.path for r in change_set.all_records()] + [
+                r.previous_path or r.path for r in change_set.renamed
+            ],
+            self._security,
+        )
+
+    def validate(self, change_set: ChangeSet) -> None:
+        """Raise SecurityError when a forbidden file is present."""
+        validate_security(change_set, self._security)