api-foundry-query-engine 0.8.11__tar.gz → 0.8.30__tar.gz

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.11
+Version: 0.8.30
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.30}/api_foundry_query_engine/adapters/gateway_adapter.py

@@ -1,7 +1,9 @@
 import json
+from typing import Any, Dict, List, Optional, Tuple
 
 from api_foundry_query_engine.adapters.adapter import Adapter
 from api_foundry_query_engine.operation import Operation
+from api_foundry_query_engine.utils.app_exception import ApplicationException
 
 actions_map = {
     "GET": "read",
@@ -12,7 +14,7 @@ actions_map = {
 
 
 class GatewayAdapter(Adapter):
-    def marshal(self, result: list[dict]):
+    def marshal(self, result: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
         """
         Marshal the result into a event response
 
@@ -24,7 +26,7 @@ class GatewayAdapter(Adapter):
         """
         return super().marshal(result)
 
-    def unmarshal(self, event):
+    def unmarshal(self, event: Dict[str, Any]) -> Operation:
         """
         Get parameters from the Lambda event.
 
@@ -34,8 +36,15 @@ class GatewayAdapter(Adapter):
         Returns:
         - tuple: Tuple containing data, query and metadata parameters.
         """
-        entity = event.get("resource").split("/")[1]
-        action = actions_map.get(event.get("httpMethod").upper(), "read")
+        resource = event.get("resource")
+        if resource is not None and "/" in resource:
+            parts = resource.split("/")
+            entity = parts[1] if len(parts) > 1 else None
+        else:
+            entity = None
+
+        method = str(event.get("httpMethod", "")).upper()
+        action = actions_map.get(method, "read")
 
         event_params = {}
 
@@ -56,11 +65,66 @@ class GatewayAdapter(Adapter):
         if body is not None and len(body) > 0:
             store_params = json.loads(body)
 
-        roles = []
         authorizer_info = event.get("requestContext", {}).get("authorizer", {})
         claims = authorizer_info.get("claims", {})
-        roles = claims.get("roles", [])
-        subject = claims.get("subject")
+
+        # Decode JSON-encoded arrays from OAuth context
+        roles_raw = claims.get("roles", [])
+        if isinstance(roles_raw, str):
+            try:
+                roles = json.loads(roles_raw)
+            except (json.JSONDecodeError, TypeError):
+                roles = []
+        else:
+            roles = roles_raw if isinstance(roles_raw, list) else []
+
+        groups_raw = claims.get("groups", [])
+        if isinstance(groups_raw, str):
+            try:
+                groups = json.loads(groups_raw)
+            except (json.JSONDecodeError, TypeError):
+                groups = []
+        else:
+            groups = groups_raw if isinstance(groups_raw, list) else []
+
+        permissions_raw = claims.get("permissions", [])
+        if isinstance(permissions_raw, str):
+            try:
+                permissions = json.loads(permissions_raw)
+            except (json.JSONDecodeError, TypeError):
+                permissions = []
+        else:
+            permissions = permissions_raw if isinstance(permissions_raw, list) else []
+
+        subject = claims.get("sub")
+        scope_str = claims.get("scope")
+
+        # Enforce OAuth scopes (simulating API Gateway authorizer behavior)
+        # Required scope pattern: read|write|delete:<entity>
+        if entity and scope_str:
+            required_action = {
+                "GET": "read",
+                "POST": "write",
+                "PUT": "write",
+                "PATCH": "write",
+                "DELETE": "delete",
+            }.get(method, "read")
+            required_scope = f"{required_action}:{entity}"
+            token_scopes = set(str(scope_str).split())
+
+            def _has_scope(required: str) -> bool:
+                return (
+                    required in token_scopes
+                    or f"{required_action}:*" in token_scopes
+                    or "*" in token_scopes
+                    or "*:*" in token_scopes
+                )
+
+            if not _has_scope(required_scope):
+                raise ApplicationException(
+                    401,
+                    ("insufficient_scope: required_scope=" + required_scope),
+                )
 
         return Operation(
             entity=entity,
@@ -69,11 +133,15 @@ class GatewayAdapter(Adapter):
             query_params=query_params,
             metadata_params=metadata_params,
             roles=roles,
+            groups=groups,
             subject=subject,
+            permissions=permissions,
             claims=claims,
         )
 
-    def _convert_parameters(self, parameters):
+    def _convert_parameters(
+        self, parameters: Optional[Dict[str, Any]]
+    ) -> Optional[Dict[str, Any]]:
         """
         Convert parameters to appropriate types.
 
@@ -97,7 +165,9 @@ class GatewayAdapter(Adapter):
                     result[parameter] = value
         return result
 
-    def split_params(self, parameters: dict):
+    def split_params(
+        self, parameters: Dict[str, Any]
+    ) -> Tuple[Dict[str, Any], Dict[str, Any]]:
         """
         Split a dictionary into two dictionaries based on keys.
 

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.30}/api_foundry_query_engine/dao/sql_query_handler.py

@@ -193,20 +193,43 @@ class SQLQueryHandler:
             log.info(f"role: {role}, role_permissions: {role_permissions}")
             if len(role_permissions) == 0:
                 continue
+
+            # Extract permission patterns for this role
+            read_perm = role_permissions.get("read", "")
+            write_perm = role_permissions.get("write", "")
+            read_pattern = self._extract_permission_pattern(read_perm)
+            write_pattern = self._extract_permission_pattern(write_perm)
+
             for prop_name, property in properties.items():
                 log.info(f"prop_name: {prop_name}, property: {property}")
-                if permission_type == "read" and re.match(
-                    role_permissions.get("read", ""), prop_name
-                ):
+                if permission_type == "read" and re.match(read_pattern, prop_name):
                     allowed_properties[prop_name] = property
-                if permission_type == "write" and re.match(
-                    role_permissions.get("write", ""), prop_name
-                ):
+                if permission_type == "write" and re.match(write_pattern, prop_name):
                     allowed_properties[prop_name] = property
 
         log.info(f"allowed_properties: {allowed_properties}")
         return allowed_properties
 
+    def _extract_permission_pattern(self, permission_rule) -> str:
+        """Extract the regex pattern from a permission rule.
+
+        Args:
+            permission_rule: Can be a string (regex) or dict with
+                'properties'/'fields' key
+
+        Returns:
+            str: The regex pattern to match property names
+        """
+        if isinstance(permission_rule, str):
+            return permission_rule
+        elif isinstance(permission_rule, dict):
+            # Support both 'properties' (preferred) and 'fields' (legacy)
+            return permission_rule.get("properties") or permission_rule.get(
+                "fields", ""
+            )
+        else:
+            return ""
+
     @property
     def selection_results(self) -> Dict:
         raise NotImplementedError()

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.30}/api_foundry_query_engine/dao/sql_select_query_handler.py

@@ -33,20 +33,34 @@ class SQLSelectSchemaQueryHandler(SQLSchemaQueryHandler):
         if "default" in perms:
             provider = perms.get("default", {}) or {}
             read_map = provider.get("read", {}) or {}
+            role_permissions = perms.get("default", {})
         else:
             # legacy role-first -> synthesize read map
             read_map = {}
+            role_permissions = perms
             for role, role_perms in perms.items():
                 if isinstance(role_perms, dict):
                     read_map[role] = role_perms.get("read")
 
         filters = []
         for role in self.operation.roles or []:
+            # Check for role-level WHERE clause (hybrid approach)
+            role_where = None
+            if isinstance(role_permissions.get(role), dict):
+                role_where = role_permissions[role].get("where")
+
+            # Check for operation-level WHERE clause
+            operation_where = None
             rule = read_map.get(role)
             if isinstance(rule, dict):
-                where = rule.get("where")
-                if isinstance(where, str) and where.strip():
-                    filters.append(self._template_where(where))
+                operation_where = rule.get("where")
+
+            # Operation-level takes precedence, fallback to role-level
+            where_clause = operation_where if operation_where else role_where
+
+            if isinstance(where_clause, str) and where_clause.strip():
+                filters.append(self._template_where(where_clause))
+
         if not filters:
             return ""
         return "(" + ") OR (".join(filters) + ")"

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.30}/api_foundry_query_engine/lambda_handler.py

@@ -1,7 +1,7 @@
 import json
 import logging
 import os
-from typing import Optional, Mapping
+from typing import Optional, Mapping, Any
 
 from api_foundry_query_engine.utils.api_model import set_api_model
 from api_foundry_query_engine.utils.app_exception import ApplicationException
@@ -14,8 +14,8 @@ class QueryEngine:
     def __init__(self, config: Mapping[str, str]):
         self.adapter = GatewayAdapter(config)
 
-    def handler(self, event):
-        log.debug(f"event: {event}")
+    def handler(self, event) -> dict[str, Any]:
+        log.debug("event: %s", event)
         try:
             response = self.adapter.process_event(event)
 
@@ -27,20 +27,20 @@ class QueryEngine:
                 "body": json.dumps(response),
             }
         except ApplicationException as e:
-            log.error(f"exception: {e}", exc_info=True)
+            log.error("exception: %s", e, exc_info=True)
             return {
                 "isBase64Encoded": False,
                 "statusCode": e.status_code,
                 "headers": {"Content-Type": "application/json"},
-                "body": json.dumps({"message": f"exception: {e}"}),
+                "body": json.dumps({"message": "exception: %s" % e}),
             }
-        except Exception as e:
-            log.error(f"exception: {e}", exc_info=True)
+        except RuntimeError as e:
+            log.error("runtime error: %s", e, exc_info=True)
             return {
                 "isBase64Encoded": False,
                 "statusCode": 500,
                 "headers": {"Content-Type": "application/json"},
-                "body": json.dumps({"message": f"exception: {e}"}),
+                "body": json.dumps({"message": f"runtime error: {e}"}),
             }
 
 
@@ -49,16 +49,14 @@ query_engine: Optional[QueryEngine] = None
 
 
 def handler(event, _):
-    global engine_config, query_engine
-    log.info(f"engine_config: {engine_config}")
-    if engine_config is None:
+    if not hasattr(handler, "engine_config"):
         log.info("Loading engine config from environment variables")
-        engine_config = os.environ
-        log.info(f"engine_config: {engine_config}")
+        handler.engine_config = os.environ
+        log.info(f"engine_config: {handler.engine_config}")
 
-    if query_engine is None:
-        set_api_model(engine_config)
+    if not hasattr(handler, "query_engine"):
+        set_api_model(handler.engine_config)
         log.info("Creating QueryEngine instance")
-        query_engine = QueryEngine(engine_config)
+        handler.query_engine = QueryEngine(handler.engine_config)
 
-    return query_engine.handler(event)
+    return handler.query_engine.handler(event)

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.30}/api_foundry_query_engine/operation.py

@@ -1,4 +1,4 @@
-from typing import Any, Dict, Optional
+from typing import Any, Dict, List, Optional
 
 
 class Operation:
@@ -35,7 +35,10 @@ class Operation:
         query_params: Optional[Dict[str, Any]] = None,
         store_params: Optional[Dict[str, Any]] = None,
         metadata_params: Optional[Dict[str, Any]] = None,
-        roles: Optional[Dict[str, Any]] = None,
+        roles: Optional[List[str]] = None,
+        scope: Optional[Dict[str, Any]] = None,
+        groups: Optional[List[str]] = None,
+        permissions: Optional[List[str]] = None,
         subject: Optional[str] = None,
         claims: Optional[Dict[str, Any]] = None,
     ):
@@ -73,7 +76,10 @@ class Operation:
         self.metadata_params = metadata_params or {}
 
         # Roles defining the context in which the operation is allowed.
-        self.roles = roles or {}
+        self.scope = scope or {}
+        self.roles = roles or []
+        self.groups = groups or []
+        self.permissions = permissions or []
 
         self.subject = subject
         # Full set of claims (when available). Used for row-level filters

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.30}/api_foundry_query_engine/utils/api_model.py

@@ -49,38 +49,117 @@ class SchemaObjectProperty:
     def convert_to_db_value(self, value: str) -> Optional[Any]:
         if value is None:
             return None
-        conversion_mapping = {
-            "string": lambda x: x,
-            "number": float,
-            "float": float,
-            "integer": int,
-            "boolean": lambda x: x.lower() == "true",
-            "date": lambda x: datetime.strptime(x, "%Y-%m-%d").date() if x else None,
-            "date-time": lambda x: datetime.fromisoformat(x) if x else None,
-            "time": lambda x: datetime.strptime(x, "%H:%M:%S").time() if x else None,
-        }
-        conversion_func = conversion_mapping.get(
-            self.column_type if self.column_type is not None else "string", lambda x: x
-        )
-        return conversion_func(value)
+
+        column_type = self.column_type if self.column_type is not None else "string"
+
+        # Handle string types
+        if column_type in ["string", "varchar", "char", "text", "uuid"]:
+            return value
+
+        # Handle numeric types - float/double/numeric variations
+        elif column_type in ["number", "float", "double", "numeric", "decimal", "real"]:
+            return float(value)
+
+        # Handle boolean types - can map to boolean or integer columns
+        elif column_type == "boolean":
+            return value.lower() == "true"
+        elif (
+            column_type in ["int", "integer", "smallint", "bigint"]
+            and hasattr(self, "api_type")
+            and self.api_type == "boolean"
+        ):
+            # Boolean API type mapping to integer column type
+            return 1 if value.lower() == "true" else 0
+
+        # Handle integer types (after boolean check to avoid conflicts)
+        elif column_type in [
+            "integer",
+            "int",
+            "bigint",
+            "smallint",
+            "serial",
+            "bigserial",
+        ]:
+            return int(value)
+
+        # Handle date types
+        elif column_type == "date":
+            return datetime.strptime(value, "%Y-%m-%d").date() if value else None
+
+        # Handle datetime types - various column type names
+        elif column_type in ["date-time", "datetime", "timestamp", "timestamptz"]:
+            return datetime.fromisoformat(value) if value else None
+
+        # Handle time types
+        elif column_type in ["time", "timetz"]:
+            return datetime.strptime(value, "%H:%M:%S").time() if value else None
+
+        # Default to string conversion for unknown types
+        else:
+            return value
 
     def convert_to_api_value(self, value) -> Optional[Any]:
         if value is None:
             return None
-        conversion_mapping = {
-            "string": lambda x: x,
-            "number": float,
-            "float": float,
-            "integer": int,
-            "boolean": str,
-            "date": lambda x: x.date().isoformat() if x else None,
-            "date-time": lambda x: x.isoformat() if x else None,
-            "time": lambda x: x.time().isoformat() if x else None,
-        }
-        conversion_func = conversion_mapping.get(
-            self.api_type if self.api_type is not None else "string", lambda x: x
-        )
-        return conversion_func(value)
+
+        api_type = self.api_type if self.api_type is not None else "string"
+
+        # Handle string types (including UUID which is represented as string in API)
+        if api_type in ["string", "uuid"]:
+            return str(value) if value is not None else None
+
+        # Handle integer type
+        elif api_type == "integer":
+            return int(value) if value is not None else None
+
+        # Handle number and float types
+        elif api_type in ["number", "float"]:
+            return float(value) if value is not None else None
+
+        # Handle boolean type - convert any value to string representation
+        elif api_type == "boolean":
+            if isinstance(value, bool):
+                return str(value)
+            elif isinstance(value, int):
+                # Handle boolean stored as integer (0/1)
+                return "true" if value != 0 else "false"
+            elif isinstance(value, str):
+                return value.lower() in ["true", "1", "yes", "on"]
+            else:
+                return str(bool(value))
+
+        # Handle date type
+        elif api_type == "date":
+            if hasattr(value, "date"):
+                # If it's a datetime, extract the date part
+                return value.date().isoformat()
+            elif hasattr(value, "isoformat"):
+                # If it's already a date
+                return value.isoformat()
+            else:
+                return str(value)
+
+        # Handle datetime type
+        elif api_type == "date-time":
+            if hasattr(value, "isoformat"):
+                return value.isoformat()
+            else:
+                return str(value)
+
+        # Handle time type
+        elif api_type == "time":
+            if hasattr(value, "time"):
+                # If it's a datetime, extract the time part
+                return value.time().isoformat()
+            elif hasattr(value, "isoformat"):
+                # If it's already a time
+                return value.isoformat()
+            else:
+                return str(value)
+
+        # Default to string conversion for unknown types
+        else:
+            return str(value) if value is not None else None
 
 
 class SchemaObjectAssociation:

{api_foundry_query_engine-0.8.11 → api_foundry_query_engine-0.8.30}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "api-foundry-query-engine"
-version = "0.8.11"
+version = "0.8.30"
 authors = [
     { name="Daniel Repik", email="danrepik@icloud.com" },
 ]

api_foundry_query_engine-0.8.11/api_foundry_query_engine/connectors/athena_connector.py

@@ -1,120 +0,0 @@
-from api_foundry_query_engine.connectors.connection import Connection, Cursor
-from api_foundry_query_engine.utils.logger import logger
-import boto3
-import time
-
-# Initialize the logger
-log = logger(__name__)
-
-
-class AthenaCursor(Cursor):
-    def __init__(self, athena_client, db_config):
-        self.athena_client = athena_client
-        self.db_config = db_config
-
-    def execute(self, sql: str, parameters: dict, result_columns: list[str]) -> list:
-        """
-        Execute a SQL statement on the Athena database.
-
-        Parameters:
-        - sql (str): The SQL query to execute.
-        - parameters (dict): Parameters for the query (currently unused; substitute manually in the query).
-        - result_columns (list[str]): Column names for the results.
-
-        Returns:
-        - list[dict]: Query results as a list of dictionaries.
-        """
-        # Substitute parameters into the query manually (Athena doesn't support placeholders)
-        for key, value in parameters.items():
-            placeholder = f":{key}"
-            if isinstance(value, str):
-                value = f"'{value}'"  # Wrap strings in quotes
-            sql = sql.replace(placeholder, str(value))
-
-        log.info(f"Executing query: {sql}")
-
-        # Start the query execution
-        response = self.athena_client.start_query_execution(
-            QueryString=sql,
-            QueryExecutionContext={"Database": self.db_config["database"]},
-            ResultConfiguration={"OutputLocation": self.db_config["output_location"]},
-        )
-        query_execution_id = response["QueryExecutionId"]
-        log.info(f"Query execution started: {query_execution_id}")
-
-        # Wait for the query to complete
-        while True:
-            status_response = self.athena_client.get_query_execution(
-                QueryExecutionId=query_execution_id
-            )
-            status = status_response["QueryExecution"]["Status"]["State"]
-
-            if status in ["SUCCEEDED", "FAILED", "CANCELLED"]:
-                break
-            time.sleep(2)
-
-        if status == "FAILED":
-            raise Exception(
-                f"Query failed: {status_response['QueryExecution']['Status']['StateChangeReason']}"
-            )
-        elif status == "CANCELLED":
-            raise Exception("Query was cancelled.")
-
-        # Fetch results
-        results_response = self.athena_client.get_query_results(
-            QueryExecutionId=query_execution_id
-        )
-        rows = results_response["ResultSet"]["Rows"]
-
-        # Convert rows to dictionaries
-        result = []
-        for row in rows[1:]:  # Skip the first row (header row)
-            record = {
-                col: value.get("VarCharValue", None)
-                for col, value in zip(result_columns, row["Data"])
-            }
-            result.append(record)
-
-        return result
-
-    def close(self):
-        log.info("Closing Athena cursor (no persistent connection to close).")
-
-
-class AthenaConnection(Connection):
-    def __init__(self, db_config: dict) -> None:
-        """
-        Initialize the AthenaConnection with the given configuration.
-
-        Parameters:
-        - db_config (dict): A dictionary containing Athena connection configuration.
-          Required keys:
-            - 'region': AWS region of the Athena service.
-            - 'output_location': S3 bucket location for query results.
-            - 'database': Athena database name.
-        """
-        super().__init__(db_config)
-        self.athena_client = self.get_athena_client()
-
-    def engine(self) -> str:
-        return "athena"
-
-    def cursor(self) -> Cursor:
-        return AthenaCursor(self.athena_client, self.db_config)
-
-    def commit(self):
-        # Athena queries are read-only; no commit operation is required
-        log.info("Athena does not support transactions. Commit is a no-op.")
-
-    def close(self):
-        # Athena uses a stateless API, so there's nothing to close
-        log.info("Closing Athena connection (no persistent connection to close).")
-
-    def get_athena_client(self):
-        """
-        Get a Boto3 client for Athena.
-        """
-        region = self.db_config.get("region")
-        if not region:
-            raise ValueError("Athena configuration must include 'region'.")
-        return boto3.client("athena", region_name=region)

api_foundry_query_engine-0.8.11/api_foundry_query_engine/services/security_service.py

@@ -1,105 +0,0 @@
-from api_foundry_query_engine.utils.logger import logger
-from api_foundry_query_engine.operation import Operation
-from api_foundry_query_engine.services.service import ServiceAdapter
-
-log = logger(__name__)
-
-
-class SecurityService(ServiceAdapter):
-    def execute(self, operation: Operation) -> list[dict]:
-        """
-        Execute the operation after validating security instructions.
-
-        Parameters:
-        - operation (Operation): The operation to execute.
-
-        Returns:
-        - list[dict]: The result of the operation, filtered based on security rules.
-        """
-        log.debug(f"Executing operation: {operation}")
-
-        # Resolve the schema or path operation to retrieve the `security` attribute
-        schema_or_path = self.schema_or_path_resolver(
-            operation.entity, operation.action
-        )
-        if not schema_or_path or "security" not in schema_or_path:
-            raise ValueError(
-                f"No security instructions found for entity {operation.entity}"
-            )
-
-        security_rules = schema_or_path["security"]
-
-        # Validate query and store parameters
-        self._validate_query_params(operation.query_params, security_rules)
-        self._validate_store_params(operation.store_params, security_rules)
-
-        # Execute the next service
-        result = self.next_service.execute(operation)
-
-        # Filter the result based on security rules
-        filtered_result = self._filter_result(result, security_rules)
-        return filtered_result
-
-    def _validate_query_params(self, query_params: dict, security_rules: dict):
-        """
-        Validate query parameters against read permissions.
-
-        Parameters:
-        - query_params (dict): Query parameters to validate.
-        - security_rules (dict): Security rules for validation.
-
-        Raises:
-        - PermissionError: If a query parameter violates read permissions.
-        """
-        read_permissions = security_rules.get("read", [])
-        invalid_params = [
-            key
-            for key in query_params
-            if key not in read_permissions and read_permissions != ["*"]
-        ]
-        if invalid_params:
-            raise PermissionError(f"Query parameters not permitted: {invalid_params}")
-
-    def _validate_store_params(self, store_params: dict, security_rules: dict):
-        """
-        Validate store parameters against write permissions.
-
-        Parameters:
-        - store_params (dict): Store parameters to validate.
-        - security_rules (dict): Security rules for validation.
-
-        Raises:
-        - PermissionError: If a store parameter violates write permissions.
-        """
-        write_permissions = security_rules.get("write", [])
-        invalid_params = [
-            key
-            for key in store_params
-            if key not in write_permissions and write_permissions != ["*"]
-        ]
-        if invalid_params:
-            raise PermissionError(f"Store parameters not permitted: {invalid_params}")
-
-    def _filter_result(self, result: list[dict], security_rules: dict) -> list[dict]:
-        """
-        Filter the result based on read permissions.
-
-        Parameters:
-        - result (list[dict]): The original result set.
-        - security_rules (dict): Security rules for filtering.
-
-        Returns:
-        - list[dict]: The filtered result set.
-        """
-        read_permissions = security_rules.get("read", [])
-        if read_permissions == ["*"]:
-            return result  # No filtering needed
-
-        filtered_result = []
-        for record in result:
-            filtered_record = {
-                key: value for key, value in record.items() if key in read_permissions
-            }
-            filtered_result.append(filtered_record)
-
-        return filtered_result