api-foundry-query-engine 0.8.30__tar.gz → 0.8.32__tar.gz

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.30
+Version: 0.8.32
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry
@@ -18,3 +18,4 @@ Requires-Dist: fixture-foundry>=0.1.0; extra == 'dev'
 Requires-Dist: isort>=5.12.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: simple-oauth-server; extra == 'dev'

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/adapters/adapter.py

@@ -68,6 +68,6 @@ class Adapter(metaclass=abc.ABCMeta):
         operation = self.unmarshal(event)
 
         result = self.service.execute(operation)
-        log.debug(f"adapter result: {result}")
+        log.debug("adapter result: %s", result)
 
         return self.marshal(result)

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/adapters/case_change_adapter.py

@@ -30,7 +30,7 @@ class CaseChangeAdapter(Adapter):
             or self.__check_camel_case(operation.store_params)
             or self.__check_camel_case(operation.query_params)
         )
-        log.info(f"camel_case: {self.camel_case}")
+        log.info("camel_case: %s", self.camel_case)
 
         if self.camel_case:
             return Operation(

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/adapters/gateway_adapter.py

@@ -65,38 +65,30 @@ class GatewayAdapter(Adapter):
         if body is not None and len(body) > 0:
             store_params = json.loads(body)
 
-        authorizer_info = event.get("requestContext", {}).get("authorizer", {})
-        claims = authorizer_info.get("claims", {})
-
-        # Decode JSON-encoded arrays from OAuth context
-        roles_raw = claims.get("roles", [])
-        if isinstance(roles_raw, str):
-            try:
-                roles = json.loads(roles_raw)
-            except (json.JSONDecodeError, TypeError):
-                roles = []
-        else:
-            roles = roles_raw if isinstance(roles_raw, list) else []
-
-        groups_raw = claims.get("groups", [])
-        if isinstance(groups_raw, str):
-            try:
-                groups = json.loads(groups_raw)
-            except (json.JSONDecodeError, TypeError):
-                groups = []
-        else:
-            groups = groups_raw if isinstance(groups_raw, list) else []
-
-        permissions_raw = claims.get("permissions", [])
-        if isinstance(permissions_raw, str):
-            try:
-                permissions = json.loads(permissions_raw)
-            except (json.JSONDecodeError, TypeError):
-                permissions = []
+        # Extract JWT claims from API Gateway event
+        claims = event.get("requestContext", {}).get("authorizer", {})
+
+        # Handle different authorizer types
+        if isinstance(claims, dict):
+            # TOKEN authorizer puts claims directly in authorizer object
+            if "sub" in claims or "iss" in claims:
+                # Already have JWT claims at top level
+                pass
+            elif "claims" in claims:
+                # Some configurations nest claims
+                claims = claims["claims"]
+            elif "iam" in claims:
+                # IAM authorizer fallback
+                claims = claims["iam"]
+            elif "lambda" in claims:
+                # Lambda authorizer fallback
+                claims = claims["lambda"]
+            else:
+                # Empty or unknown format
+                claims = {}
         else:
-            permissions = permissions_raw if isinstance(permissions_raw, list) else []
-
-        subject = claims.get("sub")
+            # Non-dict authorizer context
+            claims = {}
         scope_str = claims.get("scope")
 
         # Enforce OAuth scopes (simulating API Gateway authorizer behavior)
@@ -132,10 +124,6 @@ class GatewayAdapter(Adapter):
             store_params=store_params,
             query_params=query_params,
             metadata_params=metadata_params,
-            roles=roles,
-            groups=groups,
-            subject=subject,
-            permissions=permissions,
             claims=claims,
         )
 

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/adapters/security_adapter.py

@@ -99,8 +99,8 @@ class SecurityAdapter(Adapter):
         try:
             operation = self.unmarshal(event)
             result = self.service.execute(operation)
-            log.debug(f"adapter result: {result}")
+            log.debug("adapter result: %s", result)
             return self.marshal(result)
         except PermissionError as e:
-            log.error(f"Permission error: {e}")
+            log.error("Permission error: %s", e)
             return {"error": str(e), "status": "permission_denied"}

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/connectors/connection_factory.py

@@ -32,7 +32,7 @@ class ConnectionFactory:
         """
 
         # Get the secret name based on the engine and database from the secrets map
-        log.info(f"database: {database}")
+        log.info("database: %s", database)
         db_config = self.db_config_map.get(database)
         if not db_config:
             # Use config dict for secrets
@@ -40,7 +40,7 @@ class ConnectionFactory:
             if isinstance(secrets_map, str):
                 secrets_map = json.loads(secrets_map)
             secret_name = secrets_map.get(database)
-            log.debug(f"secret_name: {secret_name}")
+            log.debug("secret_name: %s", secret_name)
 
             if secret_name:
                 db_config = self.__get_secret(secret_name)
@@ -79,7 +79,7 @@ class ConnectionFactory:
         sts_client = boto3.client("sts", endpoint_url=endpoint_url)
 
         secret_account_id = self.config.get("SECRET_ACCOUNT_ID", None)
-        log.debug(f"secret_account_id: {secret_account_id}")
+        log.debug("secret_account_id: %s", secret_account_id)
 
         if secret_account_id:
             # If a secret account ID is provided, assume a role in that account
@@ -100,16 +100,16 @@ class ConnectionFactory:
             )
         else:
             # If no secret account ID is provided, use the default account
-            log.info(f"endpoint_url: {endpoint_url}")
+            log.info("endpoint_url: %s", endpoint_url)
             secretsmanager = boto3.client(
                 "secretsmanager",
                 endpoint_url=endpoint_url,
             )
 
         # Get the secret value from AWS Secrets Manager
-        log.info(f"db_secret_name: {db_secret_name}")
+        log.info("db_secret_name: %s", db_secret_name)
         db_secret = secretsmanager.get_secret_value(SecretId=db_secret_name)
-        log.debug(f"loading secret name: {db_secret}")
+        log.debug("loading secret name: %s", db_secret)
 
         # Return the parsed JSON secret string
         return json.loads(db_secret.get("SecretString"))

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/connectors/oracle_connector.py

@@ -15,7 +15,7 @@ class OracleConnnector(Connector):
     def execute(self, cursor, sql: str, parameters: dict):
         from oracledb import Error, IntegrityError, ProgrammingError
 
-        log.debug(f"sql: {sql}, parameters: {parameters}")
+        log.debug("sql: %s, parameters: %s", sql, parameters)
         try:
             cursor.execute(sql, parameters)
         except IntegrityError as err:

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/connectors/postgres_connection.py

@@ -27,7 +27,7 @@ class PostgresCursor(Cursor):
         """
         from psycopg2 import Error, IntegrityError, ProgrammingError
 
-        log.info(f"sql: {sql}")
+        log.info("sql: %s", sql)
 
         try:
             # Execute the SQL statement with parameters

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/dao/sql_custom_query_handler.py

@@ -39,7 +39,7 @@ class SQLCustomQueryHandler(SQLQueryHandler):
             self._selection_results = self.check_permissions(
                 "read", self.path_operation.permissions, self.path_operation.outputs
             )
-            log.debug(f"selection_results: {self._selection_results}")
+            log.debug("selection_results: %s", self._selection_results)
         return self._selection_results
 
     def _compile(self):

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/dao/sql_delete_query_handler.py

@@ -29,12 +29,28 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
         if not self.schema_object.permissions:
             return True
 
+        # Use the proper provider-action-role structure
+        provider_permissions = self.schema_object.permissions.get("default", {})
+        delete_permissions = provider_permissions.get("delete", {})
+
         for role in self.operation.roles:
-            role_permissions = self.schema_object.permissions.get(role, {})
-            log.info(f"role: {role}, role_permissions: {role_permissions}")
-            if len(role_permissions) == 0:
-                continue
-            allowed = role_permissions.get("delete", False)
+            role_permissions = delete_permissions.get(role)
+            log.info("role: %s, role_permissions: %s", role, role_permissions)
+
+            # If no permissions found for role, check wildcard "*"
+            if role_permissions is None:
+                role_permissions = delete_permissions.get("*")
+                log.info("Fallback to wildcard role '*': %s", role_permissions)
+                if role_permissions is None:
+                    continue
+
+            # Handle both boolean and object permission formats
+            if isinstance(role_permissions, bool):
+                allowed = role_permissions
+            else:
+                # For complex permission objects, existence means allowed
+                allowed = True
+
             if allowed:
                 return True
 

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/dao/sql_insert_query_handler.py

@@ -78,7 +78,7 @@ class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
             for k, v in self.schema_object.properties.items()
             if k in allowed_property_names
         }
-        log.info(f"allowed properties: {allowed_properties}")
+        log.info("allowed properties: %s", allowed_properties)
 
         import json
 

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/dao/sql_query_handler.py

@@ -187,29 +187,77 @@ class SQLQueryHandler:
             return properties
 
         allowed_properties = {}
+        log.info(
+            "Input properties keys: %s",
+            list(properties.keys()) if properties else "None",
+        )
+        log.info("Operation roles: %s", self.operation.roles)
+
+        # Permissions structure: {provider: {action: {role: rule}}}
+        # Use 'default' as the standard provider
+        provider_permissions = permissions.get("default", {})
+        action_permissions = provider_permissions.get(permission_type, {})
+
+        log.info(
+            "Extracted action permissions for %s: %s",
+            permission_type,
+            action_permissions,
+        )
 
         for role in self.operation.roles:
-            role_permissions = permissions.get(role, {})
-            log.info(f"role: {role}, role_permissions: {role_permissions}")
-            if len(role_permissions) == 0:
-                continue
-
-            # Extract permission patterns for this role
-            read_perm = role_permissions.get("read", "")
-            write_perm = role_permissions.get("write", "")
-            read_pattern = self._extract_permission_pattern(read_perm)
-            write_pattern = self._extract_permission_pattern(write_perm)
-
-            for prop_name, property in properties.items():
-                log.info(f"prop_name: {prop_name}, property: {property}")
-                if permission_type == "read" and re.match(read_pattern, prop_name):
-                    allowed_properties[prop_name] = property
-                if permission_type == "write" and re.match(write_pattern, prop_name):
-                    allowed_properties[prop_name] = property
-
-        log.info(f"allowed_properties: {allowed_properties}")
+            role_permissions = action_permissions.get(role, {})
+            log.info("role: %s, role_permissions: %s", role, role_permissions)
+
+            # If no permissions found for specific role, check wildcard "*"
+            if not role_permissions:
+                role_permissions = action_permissions.get("*", {})
+                log.info("Fallback to wildcard role '*': %s", role_permissions)
+                if not role_permissions:
+                    continue
+
+            # Extract permission pattern from the rule
+            regex_pattern = self._extract_permission_pattern(role_permissions)
+
+            if regex_pattern:
+                # Use efficient regex dictionary filtering
+                role_allowed = self._filter_properties_by_regex(
+                    properties, regex_pattern
+                )
+                log.info(
+                    "role: %s, pattern: %s, matched: %s",
+                    role,
+                    regex_pattern,
+                    list(role_allowed.keys()),
+                )
+
+                # Merge with existing allowed properties
+                allowed_properties.update(role_allowed)
+
+        log.info("allowed_properties: %s", allowed_properties)
         return allowed_properties
 
+    def _filter_properties_by_regex(
+        self, properties: Dict[str, SchemaObjectProperty], regex_pattern: str
+    ) -> Dict[str, SchemaObjectProperty]:
+        """Filter dictionary properties using a regex pattern.
+
+        Args:
+            properties: Dictionary of property name -> SchemaObjectProperty
+            regex_pattern: Regex pattern to match property names
+
+        Returns:
+            Dict[str, SchemaObjectProperty]: Filtered properties dict
+        """
+        if not regex_pattern:
+            return {}
+
+        try:
+            compiled_regex = re.compile(regex_pattern)
+            return {k: v for k, v in properties.items() if compiled_regex.match(k)}
+        except re.error as e:
+            log.warning("Invalid regex pattern '%s': %s", regex_pattern, e)
+            return {}
+
     def _extract_permission_pattern(self, permission_rule) -> str:
         """Extract the regex pattern from a permission rule.
 
@@ -381,7 +429,7 @@ class SQLSchemaQueryHandler(SQLQueryHandler):
         """
         log.info("selection_result")
         if not hasattr(self, "__selection_results"):
-            log.info(f"prefix_map: {self.prefix_map}")
+            log.info("prefix_map: %s", self.prefix_map)
             filters = self.operation.metadata_params.get("_properties", ".*").split()
             allowed_properties = self.check_permissions(
                 "read", self.schema_object.permissions, self.schema_object.properties

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/lambda_handler.py

@@ -1,12 +1,15 @@
 import json
 import logging
 import os
-from typing import Optional, Mapping, Any
+from typing import Mapping, Any
 
 from api_foundry_query_engine.utils.api_model import set_api_model
 from api_foundry_query_engine.utils.app_exception import ApplicationException
 from api_foundry_query_engine.adapters.gateway_adapter import GatewayAdapter
+from api_foundry_query_engine.utils.token_decoder import token_decoder
+from api_foundry_query_engine.utils.claims_check import claims_check
 
+logging.basicConfig(level=os.getenv("LOG_LEVEL", "INFO"))
 log = logging.getLogger(__name__)
 
 
@@ -44,15 +47,13 @@ class QueryEngine:
             }
 
 
-engine_config: Optional[Mapping[str, str]] = None
-query_engine: Optional[QueryEngine] = None
-
-
+@token_decoder()
+@claims_check()
 def handler(event, _):
     if not hasattr(handler, "engine_config"):
         log.info("Loading engine config from environment variables")
         handler.engine_config = os.environ
-        log.info(f"engine_config: {handler.engine_config}")
+        log.info("engine_config: %s", handler.engine_config)
 
     if not hasattr(handler, "query_engine"):
         set_api_model(handler.engine_config)

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/operation.py

@@ -1,5 +1,9 @@
 from typing import Any, Dict, List, Optional
 
+from api_foundry_query_engine.utils.logger import logger
+
+logger = logger(__name__)
+
 
 class Operation:
     """
@@ -35,11 +39,6 @@ class Operation:
         query_params: Optional[Dict[str, Any]] = None,
         store_params: Optional[Dict[str, Any]] = None,
         metadata_params: Optional[Dict[str, Any]] = None,
-        roles: Optional[List[str]] = None,
-        scope: Optional[Dict[str, Any]] = None,
-        groups: Optional[List[str]] = None,
-        permissions: Optional[List[str]] = None,
-        subject: Optional[str] = None,
         claims: Optional[Dict[str, Any]] = None,
     ):
         """
@@ -76,12 +75,30 @@ class Operation:
         self.metadata_params = metadata_params or {}
 
         # Roles defining the context in which the operation is allowed.
-        self.scope = scope or {}
-        self.roles = roles or []
-        self.groups = groups or []
-        self.permissions = permissions or []
-
-        self.subject = subject
-        # Full set of claims (when available). Used for row-level filters
-        # like where: "id = ${claims.sub}".
-        self.claims = claims or ({"sub": subject} if subject is not None else {})
+        self.claims = claims or {}
+
+        # Log the operation for debugging and audit purposes
+        logger.info(
+            "Operation created: entity=%s, action=%s, "
+            "query_params=%s, store_params=%s, "
+            "metadata_params=%s, claims=%s",
+            self.entity,
+            self.action,
+            self.query_params,
+            self.store_params,
+            self.metadata_params,
+            self.claims,
+        )
+
+    @property
+    def roles(self) -> List[str]:
+        """Get the roles from claims."""
+        return self.claims.get("roles", []) if self.claims else []
+
+    def subject(self) -> Optional[str]:
+        """Get the subject from claims."""
+        return self.claims.get("sub") if self.claims else None
+
+    def groups(self) -> List[str]:
+        """Get the groups from claims."""
+        return self.claims.get("groups", []) if self.claims else []

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/services/service.py

@@ -8,7 +8,9 @@ log = logger(__name__)
 
 
 class Service:
-    def __init__(self, config: dict = {}):
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
         self.config = config
 
     def execute(self, operation: Operation) -> list[dict]:
@@ -16,7 +18,9 @@ class Service:
 
 
 class ServiceAdapter(Service):
-    def __init__(self, config: dict = {}):
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
         super().__init__(config)
 
     def execute(self, operation: Operation) -> list[dict]:
@@ -24,7 +28,9 @@ class ServiceAdapter(Service):
 
 
 class MutationPublisher(ServiceAdapter):
-    def __init__(self, config: dict = {}):
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
         super().__init__(config)
 
     def execute(self, operation):
@@ -34,7 +40,7 @@ class MutationPublisher(ServiceAdapter):
 
     def publish_notification(self, operation):
         topic_arn = self.config.get("BROADCAST_TOPIC", None)
-        log.debug(f"Topic ARN: {topic_arn}")
+        log.debug("Topic ARN: %s", topic_arn)
 
         if topic_arn is not None:
             log.debug("Sending message")
@@ -46,7 +52,7 @@ class MutationPublisher(ServiceAdapter):
             }
 
             message_str = json.dumps({"default": json.dumps(message)})
-            log.debug(f"message_str: {message_str}")
+            log.debug("message_str: %s", message_str)
             hash_object = hashlib.sha256(message_str.encode("utf-8"))
             hex_dig = hash_object.hexdigest()
 
@@ -57,7 +63,7 @@ class MutationPublisher(ServiceAdapter):
                 MessageGroupId=operation.api_name,
                 Message=message_str,
             )
-            log.info(f"publish msg id {msg_id}")
+            log.info("publish msg id %s", msg_id)
 
     def __client(self, client_type):
         import boto3

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/services/transactional_service.py

@@ -45,8 +45,8 @@ class TransactionalService(ServiceAdapter):
                 return [result]
             return result
         except Exception as error:
-            log.error(f"transaction exception: {error}")
-            log.error(f"traceback: {traceback.format_exc()}")
+            log.error("transaction exception: %s", error)
+            log.error("traceback: %s", traceback.format_exc())
             raise error
         finally:
             connection.close()

{api_foundry_query_engine-0.8.30 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/utils/api_model.py

@@ -289,7 +289,7 @@ class APIModel:
     """Class to load and expose the API configuration as objects."""
 
     def __init__(self, config: Dict[str, Any]):
-        print("building api_model")
+        log.info("building api_model")
         self.schema_objects = {
             name: SchemaObject(schema_data)
             for name, schema_data in config.get("schema_objects", {}).items()
@@ -323,4 +323,4 @@ def set_api_model(engine_config: Mapping[str, str]):
                 os.environ.get("API_SPEC", "/var/task/api_spec.yaml"), "r"
             ) as file:
                 api_model = APIModel(yaml.safe_load(file))
-        log.info(f"Loaded API model: {api_model}")
+        log.info("Loaded API model: %s", api_model)