api-foundry-query-engine 0.8.11__tar.gz → 0.8.12__tar.gz

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.11
+Version: 0.8.12
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.12}/api_foundry_query_engine/adapters/gateway_adapter.py

@@ -1,7 +1,9 @@
 import json
+from typing import Any, Dict, List, Optional, Tuple
 
 from api_foundry_query_engine.adapters.adapter import Adapter
 from api_foundry_query_engine.operation import Operation
+from api_foundry_query_engine.utils.app_exception import ApplicationException
 
 actions_map = {
     "GET": "read",
@@ -12,7 +14,7 @@ actions_map = {
 
 
 class GatewayAdapter(Adapter):
-    def marshal(self, result: list[dict]):
+    def marshal(self, result: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
         """
         Marshal the result into a event response
 
@@ -24,7 +26,7 @@ class GatewayAdapter(Adapter):
         """
         return super().marshal(result)
 
-    def unmarshal(self, event):
+    def unmarshal(self, event: Dict[str, Any]) -> Operation:
         """
         Get parameters from the Lambda event.
 
@@ -34,8 +36,15 @@ class GatewayAdapter(Adapter):
         Returns:
         - tuple: Tuple containing data, query and metadata parameters.
         """
-        entity = event.get("resource").split("/")[1]
-        action = actions_map.get(event.get("httpMethod").upper(), "read")
+        resource = event.get("resource")
+        if resource is not None and "/" in resource:
+            parts = resource.split("/")
+            entity = parts[1] if len(parts) > 1 else None
+        else:
+            entity = None
+
+        method = str(event.get("httpMethod", "")).upper()
+        action = actions_map.get(method, "read")
 
         event_params = {}
 
@@ -56,11 +65,40 @@ class GatewayAdapter(Adapter):
         if body is not None and len(body) > 0:
             store_params = json.loads(body)
 
-        roles = []
         authorizer_info = event.get("requestContext", {}).get("authorizer", {})
         claims = authorizer_info.get("claims", {})
         roles = claims.get("roles", [])
-        subject = claims.get("subject")
+        groups = claims.get("groups", [])
+        subject = claims.get("sub")
+        permissions = claims.get("permissions", [])
+        scope_str = claims.get("scope")
+
+        # Enforce OAuth scopes (simulating API Gateway authorizer behavior)
+        # Required scope pattern: read|write|delete:<entity>
+        if entity and scope_str:
+            required_action = {
+                "GET": "read",
+                "POST": "write",
+                "PUT": "write",
+                "PATCH": "write",
+                "DELETE": "delete",
+            }.get(method, "read")
+            required_scope = f"{required_action}:{entity}"
+            token_scopes = set(str(scope_str).split())
+
+            def _has_scope(required: str) -> bool:
+                return (
+                    required in token_scopes
+                    or f"{required_action}:*" in token_scopes
+                    or "*" in token_scopes
+                    or "*:*" in token_scopes
+                )
+
+            if not _has_scope(required_scope):
+                raise ApplicationException(
+                    401,
+                    ("insufficient_scope: required_scope=" + required_scope),
+                )
 
         return Operation(
             entity=entity,
@@ -69,11 +107,15 @@ class GatewayAdapter(Adapter):
             query_params=query_params,
             metadata_params=metadata_params,
             roles=roles,
+            groups=groups,
             subject=subject,
+            permissions=permissions,
             claims=claims,
         )
 
-    def _convert_parameters(self, parameters):
+    def _convert_parameters(
+        self, parameters: Optional[Dict[str, Any]]
+    ) -> Optional[Dict[str, Any]]:
         """
         Convert parameters to appropriate types.
 
@@ -97,7 +139,9 @@ class GatewayAdapter(Adapter):
                     result[parameter] = value
         return result
 
-    def split_params(self, parameters: dict):
+    def split_params(
+        self, parameters: Dict[str, Any]
+    ) -> Tuple[Dict[str, Any], Dict[str, Any]]:
         """
         Split a dictionary into two dictionaries based on keys.
 

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.12}/api_foundry_query_engine/lambda_handler.py

@@ -1,7 +1,7 @@
 import json
 import logging
 import os
-from typing import Optional, Mapping
+from typing import Optional, Mapping, Any
 
 from api_foundry_query_engine.utils.api_model import set_api_model
 from api_foundry_query_engine.utils.app_exception import ApplicationException
@@ -14,8 +14,8 @@ class QueryEngine:
     def __init__(self, config: Mapping[str, str]):
         self.adapter = GatewayAdapter(config)
 
-    def handler(self, event):
-        log.debug(f"event: {event}")
+    def handler(self, event) -> dict[str, Any]:
+        log.debug("event: %s", event)
         try:
             response = self.adapter.process_event(event)
 
@@ -27,20 +27,20 @@ class QueryEngine:
                 "body": json.dumps(response),
             }
         except ApplicationException as e:
-            log.error(f"exception: {e}", exc_info=True)
+            log.error("exception: %s", e, exc_info=True)
             return {
                 "isBase64Encoded": False,
                 "statusCode": e.status_code,
                 "headers": {"Content-Type": "application/json"},
-                "body": json.dumps({"message": f"exception: {e}"}),
+                "body": json.dumps({"message": "exception: %s" % e}),
             }
-        except Exception as e:
-            log.error(f"exception: {e}", exc_info=True)
+        except RuntimeError as e:
+            log.error("runtime error: %s", e, exc_info=True)
             return {
                 "isBase64Encoded": False,
                 "statusCode": 500,
                 "headers": {"Content-Type": "application/json"},
-                "body": json.dumps({"message": f"exception: {e}"}),
+                "body": json.dumps({"message": f"runtime error: {e}"}),
             }
 
 
@@ -49,16 +49,14 @@ query_engine: Optional[QueryEngine] = None
 
 
 def handler(event, _):
-    global engine_config, query_engine
-    log.info(f"engine_config: {engine_config}")
-    if engine_config is None:
+    if not hasattr(handler, "engine_config"):
         log.info("Loading engine config from environment variables")
-        engine_config = os.environ
-        log.info(f"engine_config: {engine_config}")
+        handler.engine_config = os.environ
+        log.info(f"engine_config: {handler.engine_config}")
 
-    if query_engine is None:
-        set_api_model(engine_config)
+    if not hasattr(handler, "query_engine"):
+        set_api_model(handler.engine_config)
         log.info("Creating QueryEngine instance")
-        query_engine = QueryEngine(engine_config)
+        handler.query_engine = QueryEngine(handler.engine_config)
 
-    return query_engine.handler(event)
+    return handler.query_engine.handler(event)

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.12}/api_foundry_query_engine/operation.py

@@ -36,6 +36,9 @@ class Operation:
         store_params: Optional[Dict[str, Any]] = None,
         metadata_params: Optional[Dict[str, Any]] = None,
         roles: Optional[Dict[str, Any]] = None,
+        scope: Optional[Dict[str, Any]] = None,
+        groups: Optional[Dict[str, Any]] = None,
+        permissions: Optional[Dict[str, Any]] = None,
         subject: Optional[str] = None,
         claims: Optional[Dict[str, Any]] = None,
     ):
@@ -73,7 +76,10 @@ class Operation:
         self.metadata_params = metadata_params or {}
 
         # Roles defining the context in which the operation is allowed.
-        self.roles = roles or {}
+        self.scope = scope or {}
+        self.roles = roles or []
+        self.groups = groups or []
+        self.permissions = permissions or []
 
         self.subject = subject
         # Full set of claims (when available). Used for row-level filters

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "api-foundry-query-engine"
-version = "0.8.11"
+version = "0.8.12"
 authors = [
     { name="Daniel Repik", email="danrepik@icloud.com" },
 ]

api_foundry_query_engine-0.8.11/api_foundry_query_engine/connectors/athena_connector.py

@@ -1,120 +0,0 @@
-from api_foundry_query_engine.connectors.connection import Connection, Cursor
-from api_foundry_query_engine.utils.logger import logger
-import boto3
-import time
-
-# Initialize the logger
-log = logger(__name__)
-
-
-class AthenaCursor(Cursor):
-    def __init__(self, athena_client, db_config):
-        self.athena_client = athena_client
-        self.db_config = db_config
-
-    def execute(self, sql: str, parameters: dict, result_columns: list[str]) -> list:
-        """
-        Execute a SQL statement on the Athena database.
-
-        Parameters:
-        - sql (str): The SQL query to execute.
-        - parameters (dict): Parameters for the query (currently unused; substitute manually in the query).
-        - result_columns (list[str]): Column names for the results.
-
-        Returns:
-        - list[dict]: Query results as a list of dictionaries.
-        """
-        # Substitute parameters into the query manually (Athena doesn't support placeholders)
-        for key, value in parameters.items():
-            placeholder = f":{key}"
-            if isinstance(value, str):
-                value = f"'{value}'"  # Wrap strings in quotes
-            sql = sql.replace(placeholder, str(value))
-
-        log.info(f"Executing query: {sql}")
-
-        # Start the query execution
-        response = self.athena_client.start_query_execution(
-            QueryString=sql,
-            QueryExecutionContext={"Database": self.db_config["database"]},
-            ResultConfiguration={"OutputLocation": self.db_config["output_location"]},
-        )
-        query_execution_id = response["QueryExecutionId"]
-        log.info(f"Query execution started: {query_execution_id}")
-
-        # Wait for the query to complete
-        while True:
-            status_response = self.athena_client.get_query_execution(
-                QueryExecutionId=query_execution_id
-            )
-            status = status_response["QueryExecution"]["Status"]["State"]
-
-            if status in ["SUCCEEDED", "FAILED", "CANCELLED"]:
-                break
-            time.sleep(2)
-
-        if status == "FAILED":
-            raise Exception(
-                f"Query failed: {status_response['QueryExecution']['Status']['StateChangeReason']}"
-            )
-        elif status == "CANCELLED":
-            raise Exception("Query was cancelled.")
-
-        # Fetch results
-        results_response = self.athena_client.get_query_results(
-            QueryExecutionId=query_execution_id
-        )
-        rows = results_response["ResultSet"]["Rows"]
-
-        # Convert rows to dictionaries
-        result = []
-        for row in rows[1:]:  # Skip the first row (header row)
-            record = {
-                col: value.get("VarCharValue", None)
-                for col, value in zip(result_columns, row["Data"])
-            }
-            result.append(record)
-
-        return result
-
-    def close(self):
-        log.info("Closing Athena cursor (no persistent connection to close).")
-
-
-class AthenaConnection(Connection):
-    def __init__(self, db_config: dict) -> None:
-        """
-        Initialize the AthenaConnection with the given configuration.
-
-        Parameters:
-        - db_config (dict): A dictionary containing Athena connection configuration.
-          Required keys:
-            - 'region': AWS region of the Athena service.
-            - 'output_location': S3 bucket location for query results.
-            - 'database': Athena database name.
-        """
-        super().__init__(db_config)
-        self.athena_client = self.get_athena_client()
-
-    def engine(self) -> str:
-        return "athena"
-
-    def cursor(self) -> Cursor:
-        return AthenaCursor(self.athena_client, self.db_config)
-
-    def commit(self):
-        # Athena queries are read-only; no commit operation is required
-        log.info("Athena does not support transactions. Commit is a no-op.")
-
-    def close(self):
-        # Athena uses a stateless API, so there's nothing to close
-        log.info("Closing Athena connection (no persistent connection to close).")
-
-    def get_athena_client(self):
-        """
-        Get a Boto3 client for Athena.
-        """
-        region = self.db_config.get("region")
-        if not region:
-            raise ValueError("Athena configuration must include 'region'.")
-        return boto3.client("athena", region_name=region)

api_foundry_query_engine-0.8.11/api_foundry_query_engine/services/security_service.py

@@ -1,105 +0,0 @@
-from api_foundry_query_engine.utils.logger import logger
-from api_foundry_query_engine.operation import Operation
-from api_foundry_query_engine.services.service import ServiceAdapter
-
-log = logger(__name__)
-
-
-class SecurityService(ServiceAdapter):
-    def execute(self, operation: Operation) -> list[dict]:
-        """
-        Execute the operation after validating security instructions.
-
-        Parameters:
-        - operation (Operation): The operation to execute.
-
-        Returns:
-        - list[dict]: The result of the operation, filtered based on security rules.
-        """
-        log.debug(f"Executing operation: {operation}")
-
-        # Resolve the schema or path operation to retrieve the `security` attribute
-        schema_or_path = self.schema_or_path_resolver(
-            operation.entity, operation.action
-        )
-        if not schema_or_path or "security" not in schema_or_path:
-            raise ValueError(
-                f"No security instructions found for entity {operation.entity}"
-            )
-
-        security_rules = schema_or_path["security"]
-
-        # Validate query and store parameters
-        self._validate_query_params(operation.query_params, security_rules)
-        self._validate_store_params(operation.store_params, security_rules)
-
-        # Execute the next service
-        result = self.next_service.execute(operation)
-
-        # Filter the result based on security rules
-        filtered_result = self._filter_result(result, security_rules)
-        return filtered_result
-
-    def _validate_query_params(self, query_params: dict, security_rules: dict):
-        """
-        Validate query parameters against read permissions.
-
-        Parameters:
-        - query_params (dict): Query parameters to validate.
-        - security_rules (dict): Security rules for validation.
-
-        Raises:
-        - PermissionError: If a query parameter violates read permissions.
-        """
-        read_permissions = security_rules.get("read", [])
-        invalid_params = [
-            key
-            for key in query_params
-            if key not in read_permissions and read_permissions != ["*"]
-        ]
-        if invalid_params:
-            raise PermissionError(f"Query parameters not permitted: {invalid_params}")
-
-    def _validate_store_params(self, store_params: dict, security_rules: dict):
-        """
-        Validate store parameters against write permissions.
-
-        Parameters:
-        - store_params (dict): Store parameters to validate.
-        - security_rules (dict): Security rules for validation.
-
-        Raises:
-        - PermissionError: If a store parameter violates write permissions.
-        """
-        write_permissions = security_rules.get("write", [])
-        invalid_params = [
-            key
-            for key in store_params
-            if key not in write_permissions and write_permissions != ["*"]
-        ]
-        if invalid_params:
-            raise PermissionError(f"Store parameters not permitted: {invalid_params}")
-
-    def _filter_result(self, result: list[dict], security_rules: dict) -> list[dict]:
-        """
-        Filter the result based on read permissions.
-
-        Parameters:
-        - result (list[dict]): The original result set.
-        - security_rules (dict): Security rules for filtering.
-
-        Returns:
-        - list[dict]: The filtered result set.
-        """
-        read_permissions = security_rules.get("read", [])
-        if read_permissions == ["*"]:
-            return result  # No filtering needed
-
-        filtered_result = []
-        for record in result:
-            filtered_record = {
-                key: value for key, value in record.items() if key in read_permissions
-            }
-            filtered_result.append(filtered_record)
-
-        return filtered_result