api-foundry-query-engine 0.8.30__tar.gz → 0.8.31__tar.gz

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.30
+Version: 0.8.31
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry
@@ -18,3 +18,4 @@ Requires-Dist: fixture-foundry>=0.1.0; extra == 'dev'
 Requires-Dist: isort>=5.12.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: simple-oauth-server; extra == 'dev'

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/adapters/adapter.py

@@ -68,6 +68,6 @@ class Adapter(metaclass=abc.ABCMeta):
         operation = self.unmarshal(event)
 
         result = self.service.execute(operation)
-        log.debug(f"adapter result: {result}")
+        log.debug("adapter result: %s", result)
 
         return self.marshal(result)

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/adapters/case_change_adapter.py

@@ -30,7 +30,7 @@ class CaseChangeAdapter(Adapter):
             or self.__check_camel_case(operation.store_params)
             or self.__check_camel_case(operation.query_params)
         )
-        log.info(f"camel_case: {self.camel_case}")
+        log.info("camel_case: %s", self.camel_case)
 
         if self.camel_case:
             return Operation(

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/adapters/gateway_adapter.py

@@ -65,38 +65,30 @@ class GatewayAdapter(Adapter):
         if body is not None and len(body) > 0:
             store_params = json.loads(body)
 
-        authorizer_info = event.get("requestContext", {}).get("authorizer", {})
-        claims = authorizer_info.get("claims", {})
-
-        # Decode JSON-encoded arrays from OAuth context
-        roles_raw = claims.get("roles", [])
-        if isinstance(roles_raw, str):
-            try:
-                roles = json.loads(roles_raw)
-            except (json.JSONDecodeError, TypeError):
-                roles = []
-        else:
-            roles = roles_raw if isinstance(roles_raw, list) else []
-
-        groups_raw = claims.get("groups", [])
-        if isinstance(groups_raw, str):
-            try:
-                groups = json.loads(groups_raw)
-            except (json.JSONDecodeError, TypeError):
-                groups = []
-        else:
-            groups = groups_raw if isinstance(groups_raw, list) else []
-
-        permissions_raw = claims.get("permissions", [])
-        if isinstance(permissions_raw, str):
-            try:
-                permissions = json.loads(permissions_raw)
-            except (json.JSONDecodeError, TypeError):
-                permissions = []
+        # Extract JWT claims from API Gateway event
+        claims = event.get("requestContext", {}).get("authorizer", {})
+
+        # Handle different authorizer types
+        if isinstance(claims, dict):
+            # TOKEN authorizer puts claims directly in authorizer object
+            if "sub" in claims or "iss" in claims:
+                # Already have JWT claims at top level
+                pass
+            elif "claims" in claims:
+                # Some configurations nest claims
+                claims = claims["claims"]
+            elif "iam" in claims:
+                # IAM authorizer fallback
+                claims = claims["iam"]
+            elif "lambda" in claims:
+                # Lambda authorizer fallback
+                claims = claims["lambda"]
+            else:
+                # Empty or unknown format
+                claims = {}
         else:
-            permissions = permissions_raw if isinstance(permissions_raw, list) else []
-
-        subject = claims.get("sub")
+            # Non-dict authorizer context
+            claims = {}
         scope_str = claims.get("scope")
 
         # Enforce OAuth scopes (simulating API Gateway authorizer behavior)
@@ -132,10 +124,6 @@ class GatewayAdapter(Adapter):
             store_params=store_params,
             query_params=query_params,
             metadata_params=metadata_params,
-            roles=roles,
-            groups=groups,
-            subject=subject,
-            permissions=permissions,
             claims=claims,
         )
 

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/adapters/security_adapter.py

@@ -99,8 +99,8 @@ class SecurityAdapter(Adapter):
         try:
             operation = self.unmarshal(event)
             result = self.service.execute(operation)
-            log.debug(f"adapter result: {result}")
+            log.debug("adapter result: %s", result)
             return self.marshal(result)
         except PermissionError as e:
-            log.error(f"Permission error: {e}")
+            log.error("Permission error: %s", e)
             return {"error": str(e), "status": "permission_denied"}

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/connectors/connection_factory.py

@@ -32,7 +32,7 @@ class ConnectionFactory:
         """
 
         # Get the secret name based on the engine and database from the secrets map
-        log.info(f"database: {database}")
+        log.info("database: %s", database)
         db_config = self.db_config_map.get(database)
         if not db_config:
             # Use config dict for secrets
@@ -40,7 +40,7 @@ class ConnectionFactory:
             if isinstance(secrets_map, str):
                 secrets_map = json.loads(secrets_map)
             secret_name = secrets_map.get(database)
-            log.debug(f"secret_name: {secret_name}")
+            log.debug("secret_name: %s", secret_name)
 
             if secret_name:
                 db_config = self.__get_secret(secret_name)
@@ -79,7 +79,7 @@ class ConnectionFactory:
         sts_client = boto3.client("sts", endpoint_url=endpoint_url)
 
         secret_account_id = self.config.get("SECRET_ACCOUNT_ID", None)
-        log.debug(f"secret_account_id: {secret_account_id}")
+        log.debug("secret_account_id: %s", secret_account_id)
 
         if secret_account_id:
             # If a secret account ID is provided, assume a role in that account
@@ -100,16 +100,16 @@ class ConnectionFactory:
             )
         else:
             # If no secret account ID is provided, use the default account
-            log.info(f"endpoint_url: {endpoint_url}")
+            log.info("endpoint_url: %s", endpoint_url)
             secretsmanager = boto3.client(
                 "secretsmanager",
                 endpoint_url=endpoint_url,
             )
 
         # Get the secret value from AWS Secrets Manager
-        log.info(f"db_secret_name: {db_secret_name}")
+        log.info("db_secret_name: %s", db_secret_name)
         db_secret = secretsmanager.get_secret_value(SecretId=db_secret_name)
-        log.debug(f"loading secret name: {db_secret}")
+        log.debug("loading secret name: %s", db_secret)
 
         # Return the parsed JSON secret string
         return json.loads(db_secret.get("SecretString"))

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/connectors/oracle_connector.py

@@ -15,7 +15,7 @@ class OracleConnnector(Connector):
     def execute(self, cursor, sql: str, parameters: dict):
         from oracledb import Error, IntegrityError, ProgrammingError
 
-        log.debug(f"sql: {sql}, parameters: {parameters}")
+        log.debug("sql: %s, parameters: %s", sql, parameters)
         try:
             cursor.execute(sql, parameters)
         except IntegrityError as err:

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/connectors/postgres_connection.py

@@ -27,7 +27,7 @@ class PostgresCursor(Cursor):
         """
         from psycopg2 import Error, IntegrityError, ProgrammingError
 
-        log.info(f"sql: {sql}")
+        log.info("sql: %s", sql)
 
         try:
             # Execute the SQL statement with parameters

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/dao/sql_custom_query_handler.py

@@ -39,7 +39,7 @@ class SQLCustomQueryHandler(SQLQueryHandler):
             self._selection_results = self.check_permissions(
                 "read", self.path_operation.permissions, self.path_operation.outputs
             )
-            log.debug(f"selection_results: {self._selection_results}")
+            log.debug("selection_results: %s", self._selection_results)
         return self._selection_results
 
     def _compile(self):

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/dao/sql_delete_query_handler.py

@@ -31,7 +31,7 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
 
         for role in self.operation.roles:
             role_permissions = self.schema_object.permissions.get(role, {})
-            log.info(f"role: {role}, role_permissions: {role_permissions}")
+            log.info("role: %s, role_permissions: %s", role, role_permissions)
             if len(role_permissions) == 0:
                 continue
             allowed = role_permissions.get("delete", False)

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/dao/sql_insert_query_handler.py

@@ -78,7 +78,7 @@ class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
             for k, v in self.schema_object.properties.items()
             if k in allowed_property_names
         }
-        log.info(f"allowed properties: {allowed_properties}")
+        log.info("allowed properties: %s", allowed_properties)
 
         import json
 

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/dao/sql_query_handler.py

@@ -187,10 +187,15 @@ class SQLQueryHandler:
             return properties
 
         allowed_properties = {}
+        log.info(
+            "Input properties keys: %s",
+            list(properties.keys()) if properties else "None",
+        )
+        log.info("Operation roles: %s", self.operation.roles)
 
         for role in self.operation.roles:
             role_permissions = permissions.get(role, {})
-            log.info(f"role: {role}, role_permissions: {role_permissions}")
+            log.info("role: %s, role_permissions: %s", role, role_permissions)
             if len(role_permissions) == 0:
                 continue
 
@@ -201,13 +206,13 @@ class SQLQueryHandler:
             write_pattern = self._extract_permission_pattern(write_perm)
 
             for prop_name, property in properties.items():
-                log.info(f"prop_name: {prop_name}, property: {property}")
+                log.info("prop_name: %s, property: %s", prop_name, property)
                 if permission_type == "read" and re.match(read_pattern, prop_name):
                     allowed_properties[prop_name] = property
                 if permission_type == "write" and re.match(write_pattern, prop_name):
                     allowed_properties[prop_name] = property
 
-        log.info(f"allowed_properties: {allowed_properties}")
+        log.info("allowed_properties: %s", allowed_properties)
         return allowed_properties
 
     def _extract_permission_pattern(self, permission_rule) -> str:
@@ -381,7 +386,7 @@ class SQLSchemaQueryHandler(SQLQueryHandler):
         """
         log.info("selection_result")
         if not hasattr(self, "__selection_results"):
-            log.info(f"prefix_map: {self.prefix_map}")
+            log.info("prefix_map: %s", self.prefix_map)
             filters = self.operation.metadata_params.get("_properties", ".*").split()
             allowed_properties = self.check_permissions(
                 "read", self.schema_object.permissions, self.schema_object.properties

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/lambda_handler.py

@@ -1,12 +1,15 @@
 import json
 import logging
 import os
-from typing import Optional, Mapping, Any
+from typing import Mapping, Any
 
 from api_foundry_query_engine.utils.api_model import set_api_model
 from api_foundry_query_engine.utils.app_exception import ApplicationException
 from api_foundry_query_engine.adapters.gateway_adapter import GatewayAdapter
+from api_foundry_query_engine.utils.token_decoder import token_decoder
+from api_foundry_query_engine.utils.claims_check import claims_check
 
+logging.basicConfig(level=os.getenv("LOG_LEVEL", "INFO"))
 log = logging.getLogger(__name__)
 
 
@@ -44,15 +47,13 @@ class QueryEngine:
             }
 
 
-engine_config: Optional[Mapping[str, str]] = None
-query_engine: Optional[QueryEngine] = None
-
-
+@token_decoder()
+@claims_check()
 def handler(event, _):
     if not hasattr(handler, "engine_config"):
         log.info("Loading engine config from environment variables")
         handler.engine_config = os.environ
-        log.info(f"engine_config: {handler.engine_config}")
+        log.info("engine_config: %s", handler.engine_config)
 
     if not hasattr(handler, "query_engine"):
         set_api_model(handler.engine_config)

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/operation.py

@@ -1,5 +1,9 @@
 from typing import Any, Dict, List, Optional
 
+from api_foundry_query_engine.utils.logger import logger
+
+logger = logger(__name__)
+
 
 class Operation:
     """
@@ -35,11 +39,6 @@ class Operation:
         query_params: Optional[Dict[str, Any]] = None,
         store_params: Optional[Dict[str, Any]] = None,
         metadata_params: Optional[Dict[str, Any]] = None,
-        roles: Optional[List[str]] = None,
-        scope: Optional[Dict[str, Any]] = None,
-        groups: Optional[List[str]] = None,
-        permissions: Optional[List[str]] = None,
-        subject: Optional[str] = None,
         claims: Optional[Dict[str, Any]] = None,
     ):
         """
@@ -76,12 +75,30 @@ class Operation:
         self.metadata_params = metadata_params or {}
 
         # Roles defining the context in which the operation is allowed.
-        self.scope = scope or {}
-        self.roles = roles or []
-        self.groups = groups or []
-        self.permissions = permissions or []
-
-        self.subject = subject
-        # Full set of claims (when available). Used for row-level filters
-        # like where: "id = ${claims.sub}".
-        self.claims = claims or ({"sub": subject} if subject is not None else {})
+        self.claims = claims or {}
+
+        # Log the operation for debugging and audit purposes
+        logger.info(
+            "Operation created: entity=%s, action=%s, "
+            "query_params=%s, store_params=%s, "
+            "metadata_params=%s, claims=%s",
+            self.entity,
+            self.action,
+            self.query_params,
+            self.store_params,
+            self.metadata_params,
+            self.claims,
+        )
+
+    @property
+    def roles(self) -> List[str]:
+        """Get the roles from claims."""
+        return self.claims.get("roles", []) if self.claims else []
+
+    def subject(self) -> Optional[str]:
+        """Get the subject from claims."""
+        return self.claims.get("sub") if self.claims else None
+
+    def groups(self) -> List[str]:
+        """Get the groups from claims."""
+        return self.claims.get("groups", []) if self.claims else []

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/services/service.py

@@ -8,7 +8,9 @@ log = logger(__name__)
 
 
 class Service:
-    def __init__(self, config: dict = {}):
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
         self.config = config
 
     def execute(self, operation: Operation) -> list[dict]:
@@ -16,7 +18,9 @@ class Service:
 
 
 class ServiceAdapter(Service):
-    def __init__(self, config: dict = {}):
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
         super().__init__(config)
 
     def execute(self, operation: Operation) -> list[dict]:
@@ -24,7 +28,9 @@ class ServiceAdapter(Service):
 
 
 class MutationPublisher(ServiceAdapter):
-    def __init__(self, config: dict = {}):
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
         super().__init__(config)
 
     def execute(self, operation):
@@ -34,7 +40,7 @@ class MutationPublisher(ServiceAdapter):
 
     def publish_notification(self, operation):
         topic_arn = self.config.get("BROADCAST_TOPIC", None)
-        log.debug(f"Topic ARN: {topic_arn}")
+        log.debug("Topic ARN: %s", topic_arn)
 
         if topic_arn is not None:
             log.debug("Sending message")
@@ -46,7 +52,7 @@ class MutationPublisher(ServiceAdapter):
             }
 
             message_str = json.dumps({"default": json.dumps(message)})
-            log.debug(f"message_str: {message_str}")
+            log.debug("message_str: %s", message_str)
             hash_object = hashlib.sha256(message_str.encode("utf-8"))
             hex_dig = hash_object.hexdigest()
 
@@ -57,7 +63,7 @@ class MutationPublisher(ServiceAdapter):
                 MessageGroupId=operation.api_name,
                 Message=message_str,
             )
-            log.info(f"publish msg id {msg_id}")
+            log.info("publish msg id %s", msg_id)
 
     def __client(self, client_type):
         import boto3

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/services/transactional_service.py

@@ -45,8 +45,8 @@ class TransactionalService(ServiceAdapter):
                 return [result]
             return result
         except Exception as error:
-            log.error(f"transaction exception: {error}")
-            log.error(f"traceback: {traceback.format_exc()}")
+            log.error("transaction exception: %s", error)
+            log.error("traceback: %s", traceback.format_exc())
             raise error
         finally:
             connection.close()

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.31}/api_foundry_query_engine/utils/api_model.py

@@ -289,7 +289,7 @@ class APIModel:
     """Class to load and expose the API configuration as objects."""
 
     def __init__(self, config: Dict[str, Any]):
-        print("building api_model")
+        log.info("building api_model")
         self.schema_objects = {
             name: SchemaObject(schema_data)
             for name, schema_data in config.get("schema_objects", {}).items()
@@ -323,4 +323,4 @@ def set_api_model(engine_config: Mapping[str, str]):
                 os.environ.get("API_SPEC", "/var/task/api_spec.yaml"), "r"
             ) as file:
                 api_model = APIModel(yaml.safe_load(file))
-        log.info(f"Loaded API model: {api_model}")
+        log.info("Loaded API model: %s", api_model)