api-foundry-query-engine 0.0.4__tar.gz → 0.0.6__tar.gz

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/PKG-INFO

@@ -1,10 +1,11 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.0.4
+Version: 0.0.6
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry
 Author-email: Daniel Repik <danrepik@icloud.com>
+License-File: LICENSE
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3.9
 Requires-Python: >=3.9

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/adapters/gateway_adapter.py

@@ -56,12 +56,20 @@ class GatewayAdapter(Adapter):
         if body is not None and len(body) > 0:
             store_params = json.loads(body)
 
+        roles = []
+        authorizer_info = event.get("requestContext", {}).get("authorizer", {})
+        claims = authorizer_info.get("claims", {})
+        roles = claims.get("roles", [])
+        subject = claims.get("subject")
+
         return Operation(
             entity=entity,
             action=action,
             store_params=store_params,
             query_params=query_params,
             metadata_params=metadata_params,
+            roles=roles,
+            subject=subject,
         )
 
     def _convert_parameters(self, parameters):

api_foundry_query_engine-0.0.6/api_foundry_query_engine/adapters/security_adapter.py

@@ -0,0 +1,106 @@
+from typing import Optional
+
+from api_foundry_query_engine.operation import Operation
+from api_foundry_query_engine.services.service import Service
+from api_foundry_query_engine.adapters.adapter import Adapter
+from api_foundry_query_engine.utils.logger import logger
+
+log = logger(__name__)
+
+
+class SecurityAdapter(Adapter):
+    def __init__(self, service: Optional[Service] = None, permissions: dict = None):
+        """
+        Initialize SecurityAdapter with a service and permissions.
+
+        Parameters:
+        - service (Service): The service used to process operations.
+        - permissions (dict): A dictionary containing the user's permissions,
+                              structured as:
+                              {
+                                  "read": ["field1", "field2", ...],
+                                  "write": ["field3", "field4", ...]
+                              }
+        """
+        super().__init__(service)
+        self.permissions = permissions or {"read": [], "write": []}
+
+    def unmarshal(self, event) -> Operation:
+        """
+        Unmarshal the event into an Operation object after validating query and store params.
+
+        Parameters:
+        - event (dict): Lambda event object.
+
+        Returns:
+        - Operation: The validated operation.
+        """
+        entity = event.get("entity")
+        action = event.get("action")
+        query_params = event.get("query_params", {})
+        store_params = event.get("store_params", {})
+
+        # Validate read permissions for query_params
+        invalid_query_params = [
+            key for key in query_params if key not in self.permissions["read"]
+        ]
+        if invalid_query_params:
+            raise PermissionError(
+                f"Query parameters not permitted: {invalid_query_params}"
+            )
+
+        # Validate write permissions for store_params
+        invalid_store_params = [
+            key for key in store_params if key not in self.permissions["write"]
+        ]
+        if invalid_store_params:
+            raise PermissionError(
+                f"Store parameters not permitted: {invalid_store_params}"
+            )
+
+        return Operation(
+            entity=entity,
+            action=action,
+            query_params=query_params,
+            store_params=store_params,
+        )
+
+    def marshal(self, result: list[dict]):
+        """
+        Filter the result based on read permissions before returning.
+
+        Parameters:
+        - result (list[dict]): The data set to return in the response.
+
+        Returns:
+        - list[dict]: Filtered response with only permitted fields.
+        """
+        filtered_result = []
+        for record in result:
+            filtered_record = {
+                key: value
+                for key, value in record.items()
+                if key in self.permissions["read"]
+            }
+            filtered_result.append(filtered_record)
+
+        return filtered_result
+
+    def process_event(self, event):
+        """
+        Process Lambda event using a domain function.
+
+        Parameters:
+        - event (dict): Lambda event object.
+
+        Returns:
+        - any: Result of the domain function.
+        """
+        try:
+            operation = self.unmarshal(event)
+            result = self.service.execute(operation)
+            log.debug(f"adapter result: {result}")
+            return self.marshal(result)
+        except PermissionError as e:
+            log.error(f"Permission error: {e}")
+            return {"error": str(e), "status": "permission_denied"}

api_foundry_query_engine-0.0.6/api_foundry_query_engine/connectors/athena_connector.py

@@ -0,0 +1,120 @@
+from api_foundry_query_engine.connectors.connection import Connection, Cursor
+from api_foundry_query_engine.utils.logger import logger
+import boto3
+import time
+
+# Initialize the logger
+log = logger(__name__)
+
+
+class AthenaCursor(Cursor):
+    def __init__(self, athena_client, db_config):
+        self.athena_client = athena_client
+        self.db_config = db_config
+
+    def execute(self, sql: str, parameters: dict, result_columns: list[str]) -> list:
+        """
+        Execute a SQL statement on the Athena database.
+
+        Parameters:
+        - sql (str): The SQL query to execute.
+        - parameters (dict): Parameters for the query (currently unused; substitute manually in the query).
+        - result_columns (list[str]): Column names for the results.
+
+        Returns:
+        - list[dict]: Query results as a list of dictionaries.
+        """
+        # Substitute parameters into the query manually (Athena doesn't support placeholders)
+        for key, value in parameters.items():
+            placeholder = f":{key}"
+            if isinstance(value, str):
+                value = f"'{value}'"  # Wrap strings in quotes
+            sql = sql.replace(placeholder, str(value))
+
+        log.info(f"Executing query: {sql}")
+
+        # Start the query execution
+        response = self.athena_client.start_query_execution(
+            QueryString=sql,
+            QueryExecutionContext={"Database": self.db_config["database"]},
+            ResultConfiguration={"OutputLocation": self.db_config["output_location"]},
+        )
+        query_execution_id = response["QueryExecutionId"]
+        log.info(f"Query execution started: {query_execution_id}")
+
+        # Wait for the query to complete
+        while True:
+            status_response = self.athena_client.get_query_execution(
+                QueryExecutionId=query_execution_id
+            )
+            status = status_response["QueryExecution"]["Status"]["State"]
+
+            if status in ["SUCCEEDED", "FAILED", "CANCELLED"]:
+                break
+            time.sleep(2)
+
+        if status == "FAILED":
+            raise Exception(
+                f"Query failed: {status_response['QueryExecution']['Status']['StateChangeReason']}"
+            )
+        elif status == "CANCELLED":
+            raise Exception("Query was cancelled.")
+
+        # Fetch results
+        results_response = self.athena_client.get_query_results(
+            QueryExecutionId=query_execution_id
+        )
+        rows = results_response["ResultSet"]["Rows"]
+
+        # Convert rows to dictionaries
+        result = []
+        for row in rows[1:]:  # Skip the first row (header row)
+            record = {
+                col: value.get("VarCharValue", None)
+                for col, value in zip(result_columns, row["Data"])
+            }
+            result.append(record)
+
+        return result
+
+    def close(self):
+        log.info("Closing Athena cursor (no persistent connection to close).")
+
+
+class AthenaConnection(Connection):
+    def __init__(self, db_config: dict) -> None:
+        """
+        Initialize the AthenaConnection with the given configuration.
+
+        Parameters:
+        - db_config (dict): A dictionary containing Athena connection configuration.
+          Required keys:
+            - 'region': AWS region of the Athena service.
+            - 'output_location': S3 bucket location for query results.
+            - 'database': Athena database name.
+        """
+        super().__init__(db_config)
+        self.athena_client = self.get_athena_client()
+
+    def engine(self) -> str:
+        return "athena"
+
+    def cursor(self) -> Cursor:
+        return AthenaCursor(self.athena_client, self.db_config)
+
+    def commit(self):
+        # Athena queries are read-only; no commit operation is required
+        log.info("Athena does not support transactions. Commit is a no-op.")
+
+    def close(self):
+        # Athena uses a stateless API, so there's nothing to close
+        log.info("Closing Athena connection (no persistent connection to close).")
+
+    def get_athena_client(self):
+        """
+        Get a Boto3 client for Athena.
+        """
+        region = self.db_config.get("region")
+        if not region:
+            raise ValueError("Athena configuration must include 'region'.")
+        return boto3.client("athena", region_name=region)

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/connectors/connection_factory.py

@@ -34,7 +34,7 @@ class ConnectionFactory:
         db_config = self.db_config_map.get(database)
         if not db_config:
             secret_name = json.loads(os.environ.get("SECRETS", "{}")).get(database)
-            log.info(f"secret_name: {secret_name}")
+            log.debug(f"secret_name: {secret_name}")
 
             if secret_name:
                 db_config = self.__get_secret(secret_name)
@@ -70,7 +70,7 @@ class ConnectionFactory:
         sts_client = boto3.client("sts", endpoint_url=endpoint_url)
 
         secret_account_id = os.environ.get("SECRET_ACCOUNT_ID", None)
-        log.info(f"secret_account_id: {secret_account_id}")
+        log.debug(f"secret_account_id: {secret_account_id}")
 
         if secret_account_id:
             # If a secret account ID is provided, assume a role in that account
@@ -99,7 +99,6 @@ class ConnectionFactory:
 
         # Get the secret value from AWS Secrets Manager
         log.info(f"db_secret_name: {db_secret_name}")
-        db_secret = secretsmanager.describe_secret(SecretId=db_secret_name)
         db_secret = secretsmanager.get_secret_value(SecretId=db_secret_name)
         log.debug(f"loading secret name: {db_secret}")
 

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/connectors/postgres_connection.py

@@ -26,11 +26,10 @@ class PostgresCursor(Cursor):
         """
         from psycopg2 import Error, IntegrityError, ProgrammingError
 
-        log.info(f"sql: {sql}, parameters: {parameters}")
+        log.info(f"sql: {sql}")
 
         try:
             # Execute the SQL statement with parameters
-            log.info(f"sql: {self.__cursor.mogrify(sql, parameters)}")
             self.__cursor.execute(sql, parameters)
             result = []
             for record in self.__cursor:
@@ -99,7 +98,7 @@ class PostgresConnection(Connection):
 
         connection_params.update(additional_config)
 
-        log.info(f"connection_params: {connection_params}")
+        log.info(f"connection_params: dbname: {dbname}, user: {user}, host: {host}, port: {port}")
 
         # Create a connection to the PostgreSQL database
         return connect(**connection_params)

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/dao/operation_dao.py

@@ -1,16 +1,29 @@
 from typing import Union
 
 from api_foundry_query_engine.dao.sql_custom_query_handler import SQLCustomQueryHandler
-from api_foundry_query_engine.dao.sql_delete_query_handler import SQLDeleteSchemaQueryHandler
-from api_foundry_query_engine.dao.sql_insert_query_handler import SQLInsertSchemaQueryHandler
-from api_foundry_query_engine.dao.sql_select_query_handler import SQLSelectSchemaQueryHandler
-from api_foundry_query_engine.dao.sql_subselect_query_handler import SQLSubselectSchemaQueryHandler
-from api_foundry_query_engine.dao.sql_update_query_handler import SQLUpdateSchemaQueryHandler
+from api_foundry_query_engine.dao.sql_delete_query_handler import (
+    SQLDeleteSchemaQueryHandler,
+)
+from api_foundry_query_engine.dao.sql_insert_query_handler import (
+    SQLInsertSchemaQueryHandler,
+)
+from api_foundry_query_engine.dao.sql_select_query_handler import (
+    SQLSelectSchemaQueryHandler,
+)
+from api_foundry_query_engine.dao.sql_subselect_query_handler import (
+    SQLSubselectSchemaQueryHandler,
+)
+from api_foundry_query_engine.dao.sql_update_query_handler import (
+    SQLUpdateSchemaQueryHandler,
+)
 from api_foundry_query_engine.utils.app_exception import ApplicationException
 from api_foundry_query_engine.dao.dao import DAO
 from api_foundry_query_engine.connectors.connection import Cursor
 from api_foundry_query_engine.operation import Operation
-from api_foundry_query_engine.utils.api_model import get_schema_object, get_path_operation
+from api_foundry_query_engine.utils.api_model import (
+    get_schema_object,
+    get_path_operation,
+)
 from api_foundry_query_engine.dao.sql_query_handler import SQLQueryHandler
 
 

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/dao/sql_custom_query_handler.py

@@ -33,9 +33,14 @@ class SQLCustomQueryHandler(SQLQueryHandler):
     def select_list_columns(self) -> List[SchemaObjectProperty]:
         raise NotImplementedError()
 
-    def selection_result_map(self) -> Dict:
-        log.info(f"outputs: {self.path_operation.outputs}")
-        return self.path_operation.outputs
+    @property
+    def selection_results(self) -> Dict:
+        if not hasattr(self, "_selection_results"):
+            self._selection_results = self.check_permissions(
+                "read", self.path_operation.permissions, self.path_operation.outputs
+            )
+            log.debug(f"selection_results: {self._selection_results}")
+        return self._selection_results
 
     def _compile(self):
         placeholder_pattern = re.compile(r":(\w+)")
@@ -59,8 +64,5 @@ class SQLCustomQueryHandler(SQLQueryHandler):
             if placeholder_name in self.operation.query_params
             else property.default
         )
-        log.info(f"placeholder_name: {placeholder_name}")
-        log.info(f"value: {value}, default: {property.default}")
-        log.info(f"placeholders: {self.generate_placeholders(property, value)}")
         self._placeholders.update(self.generate_placeholders(property, value))
         return self.placeholder(property, placeholder_name)

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/dao/sql_delete_query_handler.py

@@ -2,6 +2,9 @@ from api_foundry_query_engine.dao.sql_query_handler import SQLSchemaQueryHandler
 from api_foundry_query_engine.operation import Operation
 from api_foundry_query_engine.utils.app_exception import ApplicationException
 from api_foundry_query_engine.utils.api_model import SchemaObject
+from api_foundry_query_engine.utils.logger import logger
+
+log = logger(__name__)
 
 
 class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
@@ -10,8 +13,40 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
     ) -> None:
         super().__init__(operation, schema_object, engine)
 
+    def check_permission(self) -> bool:
+        """
+        Checks the user's permissions for the specified permission type.
+
+        Args:
+            permission_type (str): The type of permission to check ("read" or "write").
+            properties (List[str], optional): Specific properties to check. If None,
+                all schema properties are checked.
+
+        Returns:
+            List[str]: A list of properties the user is permitted to access.
+        """
+        # if permissions are not defined then no restrictions are applied
+        if not self.schema_object.permissions:
+            return True
+
+        for role in self.operation.roles:
+            role_permissions = self.schema_object.permissions.get(role, {})
+            log.info(f"role: {role}, role_permissions: {role_permissions}")
+            if len(role_permissions) == 0:
+                continue
+            allowed = role_permissions.get("delete", False)
+            if allowed:
+                return True
+
+        return False
+
     @property
     def sql(self) -> str:
+        if not self.check_permission():
+            raise ApplicationException(
+                402, f"Subject is not allowed to delete {self.schema_object.api_name}"
+            )
+
         concurrency_property = self.schema_object.concurrency_property
         if concurrency_property:
             if not self.operation.query_params.get(concurrency_property.api_name):

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/dao/sql_insert_query_handler.py

@@ -3,6 +3,9 @@ from api_foundry_query_engine.dao.sql_query_handler import SQLSchemaQueryHandler
 from api_foundry_query_engine.operation import Operation
 from api_foundry_query_engine.utils.app_exception import ApplicationException
 from api_foundry_query_engine.utils.api_model import SchemaObject, SchemaObjectProperty
+from api_foundry_query_engine.utils.logger import logger
+
+log = logger(__name__)
 
 
 class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
@@ -67,6 +70,10 @@ class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
         placeholders = []
         columns = []
 
+        allowed_properties = self.check_permissions(
+            "write", self.schema_object.permissions, self.schema_object.properties
+        )
+        log.info(f"allowed properties: {allowed_properties}")
         for name, value in self.operation.store_params.items():
             parts = name.split(".")
 
@@ -77,13 +84,21 @@ class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
                         "Properties can not be set on associated objects " + name,
                     )
 
-                property = self.schema_object.properties[parts[0]]
+                property = allowed_properties[parts[0]]
             except KeyError:
-                raise ApplicationException(400, f"Invalid property: {name}")
+                if parts[0] not in self.schema_object.properties:
+                    raise ApplicationException(400, f"Invalid property: {name}")
+                else:
+                    raise ApplicationException(
+                        402,
+                        f"Subject is not allowed to create with property: {parts[0]}",
+                    )
 
             columns.append(property.column_name)
             placeholders.append(self.placeholder(property, property.api_name))
-            self.store_placeholders[property.api_name] = property.convert_to_db_value(value)
+            self.store_placeholders[property.api_name] = property.convert_to_db_value(
+                value
+            )
 
         if self.key_property:
             if self.key_property.key_type == "sequence":

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/dao/sql_query_handler.py

@@ -108,10 +108,12 @@ class SQLQueryHandler:
     operation: Operation
     engine: str
 
-    def __init__(self, operation: Operation, engine: str):
+    def __init__(
+        self, operation: Operation, engine: str
+    ):  # , schema_object: SchemaObject):
         self.operation = operation
-        self.__select_list_columns = None
         self.engine = engine
+        self.__select_list_columns = None
 
     @property
     def sql(self) -> str:
@@ -124,14 +126,26 @@ class SQLQueryHandler:
     @property
     def select_list_columns(self) -> List[str]:
         if not self.__select_list_columns:
+            # Filter columns based on read permissions
             self.__select_list_columns = list(self.selection_results.keys())
         return self.__select_list_columns
 
     def marshal_record(self, record: dict) -> dict:
+        """
+        Converts a database record to an API-compatible dictionary,
+        removing properties the user is not allowed to read.
+
+        Args:
+            record (dict): A dictionary representing a single database record.
+
+        Returns:
+            dict: A dictionary with only the properties the user is allowed to see.
+        """
         result = {}
         for name, value in record.items():
-            property = self.selection_results[name]
-            result[property.api_name] = property.convert_to_api_value(value)
+            if name in self.selection_results:  # Check if the property is allowed
+                property = self.selection_results[name]
+                result[property.api_name] = property.convert_to_api_value(value)
         return result
 
     def placeholder(self, property: SchemaObjectProperty, param: str = "") -> str:
@@ -148,11 +162,59 @@ class SQLQueryHandler:
             return f":{param}"
         return f"%({param})s"
 
+    def check_permissions(
+        self,
+        permission_type: str,
+        permissions: Optional[dict],
+        properties: Optional[List[str]],
+    ) -> Dict[str, SchemaObjectProperty]:
+        """
+        Checks the user's permissions for the specified permission type.
+
+        Args:
+            permission_type (str): The type of permission to check ("read" or "write").
+            properties (List[str], optional): Specific properties to check. If None,
+                all schema properties are checked.
+
+        Returns:
+            List[str]: A list of properties the user is permitted to access.
+        """
+        # if permissions are not defined then no restrictions are applied
+        log.info(
+            f"checking permissions permission_type: {permission_type}, permissions: {permissions}"
+        )
+        if not permissions:
+            return properties
+
+        allowed_properties = {}
+
+        for role in self.operation.roles:
+            role_permissions = permissions.get(role, {})
+            log.info(f"role: {role}, role_permissions: {role_permissions}")
+            if len(role_permissions) == 0:
+                continue
+            for prop_name, property in properties.items():
+                log.info(f"prop_name: {prop_name}, property: {property}")
+                if permission_type == "read" and re.match(
+                    role_permissions.get("read", ""), prop_name
+                ):
+                    allowed_properties[prop_name] = property
+                if permission_type == "write" and re.match(
+                    role_permissions.get("write", ""), prop_name
+                ):
+                    allowed_properties[prop_name] = property
+
+        log.info(f"allowed_properties: {allowed_properties}")
+        return allowed_properties
+
+    @property
+    def selection_results(self) -> Dict:
+        raise NotImplementedError()
+
     def generate_sql_condition(
         self, property: SchemaObjectProperty, value, prefix: Optional[str] = None
     ) -> str:
         operand = "="
-
         if isinstance(value, str):
             parts = value.split("::", 1)
             operand = RELATIONAL_TYPES.get(parts[0], "=") if len(parts) > 1 else "="
@@ -223,15 +285,6 @@ class SQLQueryHandler:
         placeholders = self.generate_placeholders(property, value, prefix)
         return sql_condition, placeholders
 
-    @property
-    def selection_results(self) -> Dict:
-        if not hasattr(self, "_selection_results"):
-            self._selection_results = self.selection_result_map()
-        return self._selection_results
-
-    def selection_result_map(self) -> Dict:
-        raise NotImplementedError()
-
 
 class SQLSchemaQueryHandler(SQLQueryHandler):
     schema_object: SchemaObject
@@ -295,6 +348,26 @@ class SQLSchemaQueryHandler(SQLQueryHandler):
     def table_expression(self) -> str:
         return self.schema_object.table_name
 
+    @property
+    def selection_results(self) -> Dict:
+        """
+        Filters the schema properties to include only those the user is allowed to read.
+
+        Returns:
+            dict: A dictionary of allowed schema properties.
+        """
+        log.info("selection_result")
+        if not hasattr(self, "__selection_results"):
+            log.info(f"prefix_map: {self.prefix_map}")
+            filters = self.operation.metadata_params.get("_properties", ".*").split()
+            allowed_properties = self.check_permissions(
+                "read", self.schema_object.permissions, self.schema_object.properties
+            )
+            self.__selection_results = self.filter_and_prefix_keys(
+                filters, allowed_properties
+            )
+        return self.__selection_results
+
     @property
     def search_condition(self) -> str:
         self.search_placeholders = {}
@@ -330,14 +403,6 @@ class SQLSchemaQueryHandler(SQLQueryHandler):
             self.search_placeholders.update(holders)
         return f" WHERE {' AND '.join(conditions)}" if conditions else ""
 
-    def selection_result_map(self) -> dict:
-        if not self.__selection_result_map:
-            filters = self.operation.metadata_params.get("_properties", ".*").split()
-            self.__selection_result_map = self.filter_and_prefix_keys(
-                filters, self.schema_object.properties
-            )
-        return self.__selection_result_map
-
     def filter_and_prefix_keys(
         self, regex_list: List[str], properties: dict, prefix: Optional[str] = None
     ) -> dict:

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/dao/sql_select_query_handler.py

@@ -1,10 +1,7 @@
 from api_foundry_query_engine.dao.sql_query_handler import SQLSchemaQueryHandler
 from api_foundry_query_engine.operation import Operation
 from api_foundry_query_engine.utils.app_exception import ApplicationException
-from api_foundry_query_engine.utils.api_model import (
-    SchemaObject,
-    SchemaObjectProperty
-)
+from api_foundry_query_engine.utils.api_model import SchemaObject, SchemaObjectProperty
 from api_foundry_query_engine.utils.logger import logger
 
 log = logger(__name__)
@@ -119,52 +116,64 @@ class SQLSelectSchemaQueryHandler(SQLSchemaQueryHandler):
             + (f" {' '.join(joins)}" if len(joins) > 0 else "")
         )
 
-    def selection_result_map(self) -> dict:
-        if "count" in self.operation.metadata_params:
-            self._selection_results = {
-                "count": SchemaObjectProperty( {
-                    "api_name": "count",
-                    "api_type": "integer",
-                    "column_name": "count(*)",
-                    "column_type": "integer"
-                } )
-            }
-            return self._selection_results
-
-        filter_str = self.operation.metadata_params.get("properties", ".*")
-        self._selection_results = {}
-
-        for relation, reg_exs in self.get_regex_map(filter_str).items():
-            # Extract the schema object for the current entity
-            relation_property = self.schema_object.relations.get(relation)
-
-            if relation_property:
-                if relation_property.type == "array":
-                    continue
-
-                # Use a default value if relation_property is None
-                schema_object = relation_property.child_schema_object
-            else:
-                schema_object = self.schema_object
+    @property
+    def selection_results(self) -> dict:
+        if not hasattr(self, "_selection_results"):
+            self._selection_results = {}
+            if "count" in self.operation.metadata_params:
+                self._selection_results = {
+                    "count": SchemaObjectProperty(
+                        {
+                            "api_name": "count",
+                            "api_type": "integer",
+                            "column_name": "count(*)",
+                            "column_type": "integer",
+                        }
+                    )
+                }
+                return self._selection_results
 
-            if relation not in self.prefix_map:
-                raise ApplicationException(
-                    400,
-                    "Bad object association: "
-                    + schema_object.api_name
-                    + " does not have a "
-                    + relation
-                    + " property",
+            filter_str = self.operation.metadata_params.get("properties", ".*")
+
+            for relation, reg_exs in self.get_regex_map(filter_str).items():
+                # Extract the schema object for the current entity
+                relation_property = self.schema_object.relations.get(relation)
+
+                if relation_property:
+                    if relation_property.type == "array":
+                        continue
+
+                    # Use a default value if relation_property is None
+                    schema_object = relation_property.child_schema_object
+                else:
+                    schema_object = self.schema_object
+
+                if relation not in self.prefix_map:
+                    raise ApplicationException(
+                        400,
+                        "Bad object association: "
+                        + schema_object.api_name
+                        + " does not have a "
+                        + relation
+                        + " property",
+                    )
+                # Filter and prefix keys for the current entity
+                # and regular expressions
+                allowed_properties = self.check_permissions(
+                    "read", schema_object.permissions, schema_object.properties
+                )
+                filtered_keys = self.filter_and_prefix_keys(
+                    reg_exs, allowed_properties, self.prefix_map[relation]
                 )
-            # Filter and prefix keys for the current entity
-            # and regular expressions
-            filtered_keys = self.filter_and_prefix_keys(
-                reg_exs, schema_object.properties, self.prefix_map[relation]
-            )
 
-            # Extend the result map with the filtered keys
-            self._selection_results.update(filtered_keys)
+                # Extend the result map with the filtered keys
+                self._selection_results.update(filtered_keys)
 
+            if len(self._selection_results) == 0:
+                raise ApplicationException(
+                    402,
+                    "After applying permissions there are no properties returned in response",
+                )
         return self._selection_results
 
     def get_regex_map(self, filter_str: str) -> dict[str, list]:
@@ -190,7 +199,11 @@ class SQLSelectSchemaQueryHandler(SQLSchemaQueryHandler):
         for name, value in record.items():
             property = self.selection_results[name]
             parts = name.split(".")
-            component = parts[0] if len(parts) > 1 else self.prefix_map[self.schema_object.api_name]
+            component = (
+                parts[0]
+                if len(parts) > 1
+                else self.prefix_map[self.schema_object.api_name]
+            )
             object = object_set.get(component, {})
             if not object:
                 object_set[component] = object

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/dao/sql_subselect_query_handler.py

@@ -1,7 +1,9 @@
 from typing import Optional
 
 from api_foundry_query_engine.dao.sql_query_handler import SQLSchemaQueryHandler
-from api_foundry_query_engine.dao.sql_select_query_handler import SQLSelectSchemaQueryHandler
+from api_foundry_query_engine.dao.sql_select_query_handler import (
+    SQLSelectSchemaQueryHandler,
+)
 from api_foundry_query_engine.operation import Operation
 from api_foundry_query_engine.utils.api_model import SchemaObjectAssociation
 
@@ -19,8 +21,9 @@ class SQLSubselectSchemaQueryHandler(SQLSelectSchemaQueryHandler):
         self.relation = relation
         self.parent_generator = parent_generator
 
-    def selection_result_map(self) -> dict:
-        filter_str = self.operation.metadata_params.get("properties", "")
+    @property
+    def selection_results(self) -> dict:
+        filter_str = self.operation.metadata_params.get("properties", ".*")
         result = {self.relation.child_property: self.relation.child_property}
 
         for relation_name, reg_exs in self.get_regex_map(filter_str).items():

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/dao/sql_update_query_handler.py

@@ -39,21 +39,32 @@ class SQLUpdateSchemaQueryHandler(SQLSchemaQueryHandler):
 
     @property
     def update_values(self) -> str:
+        allowed_properties = self.check_permissions(
+            "write", self.schema_object.permissions, self.schema_object.properties
+        )
         self.store_placeholders = {}
         columns = []
+        invalid_columns = []
 
         for name, value in self.operation.store_params.items():
-            try:
-                property = self.schema_object.properties[name]
-            except KeyError:
-                raise ApplicationException(
-                    400, f"Search condition column not found {name}"
-                )
+            if name not in allowed_properties:
+                invalid_columns.append(name)
+            else:
+                property = allowed_properties.get(name, None)
 
-            placeholder = property.api_name
-            column_name = property.column_name
+                placeholder = property.api_name
+                column_name = property.column_name
 
-            columns.append(f"{column_name} = {self.placeholder(property, placeholder)}")
-            self.store_placeholders[placeholder] = property.convert_to_db_value(value)
+                columns.append(
+                    f"{column_name} = {self.placeholder(property, placeholder)}"
+                )
+                self.store_placeholders[placeholder] = property.convert_to_db_value(
+                    value
+                )
 
+        if invalid_columns:
+            raise ApplicationException(
+                402,
+                f"Subject does not have permission to update properties: {invalid_columns}",
+            )
         return f" SET {', '.join(columns)}"

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/lambda_handler.py

@@ -41,4 +41,3 @@ def handler(event, _):
             "headers": {"Content-Type": "application/json"},
             "body": json.dumps({"message": f"exception: {e}"}),
         }
-    

api_foundry_query_engine-0.0.6/api_foundry_query_engine/operation.py

@@ -0,0 +1,59 @@
+class Operation:
+    """
+    Represents an action to be performed on an entity.
+
+    The `Operation` class encapsulates the details required to execute an operation
+    on a given entity, including query parameters for selecting records, parameters
+    for storing or updating values, metadata for operational instructions, and
+    roles defining the contexts in which the operation can be performed.
+
+    Attributes:
+        entity (str): The name of the resource or object being targeted (e.g., "User", "Order").
+        action (str): The type of action being performed (e.g., "create", "read", "update", "delete").
+        query_params (dict): Parameters used to filter or select the records affected by the operation.
+        store_params (dict): Parameters that define the values to be stored or updated for the selected records.
+        metadata_params (dict): Additional instructions for the operation, such as sorting or pagination.
+        roles (dict): Defines the roles under which the operation is allowed to be performed.
+    """
+
+    def __init__(
+        self,
+        *,
+        entity: str,
+        action: str,
+        query_params: dict = {},
+        store_params: dict = {},
+        metadata_params: dict = {},
+        roles: dict = {},
+        subject: str = None,
+    ):
+        """
+        Initializes the Operation instance.
+
+        Args:
+            entity (str): The name of the entity to perform the operation on.
+            action (str): The action to perform on the entity.
+            query_params (dict, optional): Parameters for selecting affected records (default: {}).
+            store_params (dict, optional): Parameters defining new or updated values (default: {}).
+            metadata_params (dict, optional): Metadata for the operation, such as sorting or pagination (default: {}).
+            roles (dict, optional): Defines the roles allowed to perform the operation (default: {}).
+        """
+        # The target entity for the operation (e.g., "User", "Order").
+        self.entity = entity
+
+        # The type of action to perform (e.g., "create", "read", "update", "delete").
+        self.action = action
+
+        # Query parameters to filter or identify the affected records.
+        self.query_params = query_params
+
+        # Parameters defining the values to be stored or updated for the operation.
+        self.store_params = store_params
+
+        # Metadata for operational instructions like sorting, limiting, or offsetting results.
+        self.metadata_params = metadata_params
+
+        # Roles defining the context in which the operation is allowed.
+        self.roles = roles
+
+        self.subject = subject

api_foundry_query_engine-0.0.6/api_foundry_query_engine/services/security_service.py

@@ -0,0 +1,105 @@
+from api_foundry_query_engine.utils.logger import logger
+from api_foundry_query_engine.operation import Operation
+from api_foundry_query_engine.services.service import ServiceAdapter
+
+log = logger(__name__)
+
+
+class SecurityService(ServiceAdapter):
+    def execute(self, operation: Operation) -> list[dict]:
+        """
+        Execute the operation after validating security instructions.
+
+        Parameters:
+        - operation (Operation): The operation to execute.
+
+        Returns:
+        - list[dict]: The result of the operation, filtered based on security rules.
+        """
+        log.debug(f"Executing operation: {operation}")
+
+        # Resolve the schema or path operation to retrieve the `security` attribute
+        schema_or_path = self.schema_or_path_resolver(
+            operation.entity, operation.action
+        )
+        if not schema_or_path or "security" not in schema_or_path:
+            raise ValueError(
+                f"No security instructions found for entity {operation.entity}"
+            )
+
+        security_rules = schema_or_path["security"]
+
+        # Validate query and store parameters
+        self._validate_query_params(operation.query_params, security_rules)
+        self._validate_store_params(operation.store_params, security_rules)
+
+        # Execute the next service
+        result = self.next_service.execute(operation)
+
+        # Filter the result based on security rules
+        filtered_result = self._filter_result(result, security_rules)
+        return filtered_result
+
+    def _validate_query_params(self, query_params: dict, security_rules: dict):
+        """
+        Validate query parameters against read permissions.
+
+        Parameters:
+        - query_params (dict): Query parameters to validate.
+        - security_rules (dict): Security rules for validation.
+
+        Raises:
+        - PermissionError: If a query parameter violates read permissions.
+        """
+        read_permissions = security_rules.get("read", [])
+        invalid_params = [
+            key
+            for key in query_params
+            if key not in read_permissions and read_permissions != ["*"]
+        ]
+        if invalid_params:
+            raise PermissionError(f"Query parameters not permitted: {invalid_params}")
+
+    def _validate_store_params(self, store_params: dict, security_rules: dict):
+        """
+        Validate store parameters against write permissions.
+
+        Parameters:
+        - store_params (dict): Store parameters to validate.
+        - security_rules (dict): Security rules for validation.
+
+        Raises:
+        - PermissionError: If a store parameter violates write permissions.
+        """
+        write_permissions = security_rules.get("write", [])
+        invalid_params = [
+            key
+            for key in store_params
+            if key not in write_permissions and write_permissions != ["*"]
+        ]
+        if invalid_params:
+            raise PermissionError(f"Store parameters not permitted: {invalid_params}")
+
+    def _filter_result(self, result: list[dict], security_rules: dict) -> list[dict]:
+        """
+        Filter the result based on read permissions.
+
+        Parameters:
+        - result (list[dict]): The original result set.
+        - security_rules (dict): Security rules for filtering.
+
+        Returns:
+        - list[dict]: The filtered result set.
+        """
+        read_permissions = security_rules.get("read", [])
+        if read_permissions == ["*"]:
+            return result  # No filtering needed
+
+        filtered_result = []
+        for record in result:
+            filtered_record = {
+                key: value for key, value in record.items() if key in read_permissions
+            }
+            filtered_result.append(filtered_record)
+
+        return filtered_result

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/services/transactional_service.py

@@ -6,7 +6,10 @@ from api_foundry_query_engine.operation import Operation
 from api_foundry_query_engine.services.service import ServiceAdapter
 from api_foundry_query_engine.connectors.connection_factory import connection_factory
 from api_foundry_query_engine.dao.operation_dao import OperationDAO
-from api_foundry_query_engine.utils.api_model import get_path_operation, get_schema_object
+from api_foundry_query_engine.utils.api_model import (
+    get_path_operation,
+    get_schema_object,
+)
 
 log = logger(__name__)
 
@@ -21,7 +24,9 @@ class TransactionalService(ServiceAdapter):
             if schema_object:
                 database = schema_object.database
             else:
-                raise ApplicationException(500, f"Unknown operation: {operation.entity}")
+                raise ApplicationException(
+                    500, f"Unknown operation: {operation.entity}"
+                )
 
         connection = connection_factory.get_connection(database)
 

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/api_foundry_query_engine/utils/api_model.py

@@ -1,4 +1,3 @@
-
 import yaml
 
 from datetime import datetime
@@ -29,7 +28,7 @@ class SchemaObjectProperty:
 
     def __repr__(self):
         return f"SchemaObjectProperty(api_name={self.api_name}, column_name={self.column_name}, type={self.type})"
-    
+
     def convert_to_db_value(self, value: str) -> Optional[Any]:
         if value is None:
             return None
@@ -63,7 +62,6 @@ class SchemaObjectProperty:
         return conversion_func(value)
 
 
-
 class SchemaObjectAssociation:
     """Represents an association (relationship) between schema objects."""
 
@@ -77,21 +75,32 @@ class SchemaObjectAssociation:
 
     @property
     def child_property(self) -> str:
-        return self._child_property if self._child_property else get_schema_object(self.schema_name).primary_key.column_name
+        return (
+            self._child_property
+            if self._child_property
+            else get_schema_object(self.schema_name).primary_key.column_name
+        )
 
     @property
     def parent_property(self) -> str:
-        return self._parent_property if self._parent_property else get_schema_object(self.parent_schema).primary_key.column_name
+        return (
+            self._parent_property
+            if self._parent_property
+            else get_schema_object(self.parent_schema).primary_key.column_name
+        )
 
     def __repr__(self):
-        return f"SchemaObjectAssociation(name={self.api_name}, child_property={self._child_property}, parent_property={self.parent_property})"
+        return (
+            f"SchemaObjectAssociation(name={self.api_name}, "
+            + f"child_property={self._child_property}, "
+            + f"parent_property={self.parent_property})"
+        )
 
     @property
     def child_schema_object(self) -> "SchemaObject":
         return get_schema_object(self.schema_name)
 
 
-
 class SchemaObject:
     """Represents a schema object in the API configuration."""
 
@@ -113,6 +122,7 @@ class SchemaObject:
             else None
         )
         self._primary_key = data.get("primary_key")
+        self.permissions = data.get("permissions")
 
     def __repr__(self):
         return f"SchemaObject(table_name={self.table_name}, primary_key={self.primary_key})"
@@ -121,6 +131,7 @@ class SchemaObject:
     def primary_key(self):
         return self.properties.get(self._primary_key)
 
+
 class PathOperation:
     """Represents a path operation in the API configuration."""
 
@@ -137,6 +148,7 @@ class PathOperation:
             name: SchemaObjectProperty(output_data)
             for name, output_data in data.get("outputs", {}).items()
         }
+        self.permissions = data.get("security")
 
     def __repr__(self):
         return f"PathOperation(entity={self.entity}, method={self.method})"
@@ -145,12 +157,14 @@ class PathOperation:
 schema_objects = None
 path_operations = None
 
+
 def get_schema_object(name: str) -> Optional[SchemaObject]:
     """Returns a schema object by name."""
     global schema_objects
     return schema_objects.get(name)
 
-def get_path_operation(path: str, method:str) -> Optional[PathOperation]:
+
+def get_path_operation(path: str, method: str) -> Optional[PathOperation]:
     """Returns a path operation by name."""
     log.info(f"path: {path}, method: {method}")
     global path_operations
@@ -174,10 +188,12 @@ class APIModel:
         }
 
     def __repr__(self):
-        return f"APIModel(schema_objects={list(self.schema_objects.keys())}, path_operations={list(self.path_operations.keys())})"
+        return (
+            f"APIModel(schema_objects={list(self.schema_objects.keys())}, "
+            + f"path_operations={list(self.path_operations.keys())})"
+        )
 
 
 def load_api(filename: str):
     with open(filename, "r") as file:
         APIModel(yaml.safe_load(file))
-

{api_foundry_query_engine-0.0.4 → api_foundry_query_engine-0.0.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "api-foundry-query-engine"
-version = "0.0.4"
+version = "0.0.6"
 authors = [
     { name="Daniel Repik", email="danrepik@icloud.com" },
 ]
@@ -37,4 +37,3 @@ markers = [
     "unit: marks tests as unit tests that do not require a database",
     "integration: marks tests that operate on a real database",
 ]
-

api_foundry_query_engine-0.0.4/api_foundry_query_engine/operation.py

@@ -1,15 +0,0 @@
-class Operation:
-    def __init__(
-        self,
-        *,
-        entity: str,
-        action: str,
-        query_params={},
-        store_params={},
-        metadata_params={},
-    ):
-        self.entity = entity
-        self.action = action
-        self.query_params = query_params
-        self.store_params = store_params
-        self.metadata_params = metadata_params