api-foundry-query-engine 0.8.31__tar.gz → 0.8.32__tar.gz

{api_foundry_query_engine-0.8.31 → api_foundry_query_engine-0.8.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.31
+Version: 0.8.32
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

{api_foundry_query_engine-0.8.31 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/dao/sql_delete_query_handler.py

@@ -29,12 +29,28 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
         if not self.schema_object.permissions:
             return True
 
+        # Use the proper provider-action-role structure
+        provider_permissions = self.schema_object.permissions.get("default", {})
+        delete_permissions = provider_permissions.get("delete", {})
+
         for role in self.operation.roles:
-            role_permissions = self.schema_object.permissions.get(role, {})
+            role_permissions = delete_permissions.get(role)
             log.info("role: %s, role_permissions: %s", role, role_permissions)
-            if len(role_permissions) == 0:
-                continue
-            allowed = role_permissions.get("delete", False)
+
+            # If no permissions found for role, check wildcard "*"
+            if role_permissions is None:
+                role_permissions = delete_permissions.get("*")
+                log.info("Fallback to wildcard role '*': %s", role_permissions)
+                if role_permissions is None:
+                    continue
+
+            # Handle both boolean and object permission formats
+            if isinstance(role_permissions, bool):
+                allowed = role_permissions
+            else:
+                # For complex permission objects, existence means allowed
+                allowed = True
+
             if allowed:
                 return True
 

{api_foundry_query_engine-0.8.31 → api_foundry_query_engine-0.8.32}/api_foundry_query_engine/dao/sql_query_handler.py

@@ -193,28 +193,71 @@ class SQLQueryHandler:
         )
         log.info("Operation roles: %s", self.operation.roles)
 
+        # Permissions structure: {provider: {action: {role: rule}}}
+        # Use 'default' as the standard provider
+        provider_permissions = permissions.get("default", {})
+        action_permissions = provider_permissions.get(permission_type, {})
+
+        log.info(
+            "Extracted action permissions for %s: %s",
+            permission_type,
+            action_permissions,
+        )
+
         for role in self.operation.roles:
-            role_permissions = permissions.get(role, {})
+            role_permissions = action_permissions.get(role, {})
             log.info("role: %s, role_permissions: %s", role, role_permissions)
-            if len(role_permissions) == 0:
-                continue
-
-            # Extract permission patterns for this role
-            read_perm = role_permissions.get("read", "")
-            write_perm = role_permissions.get("write", "")
-            read_pattern = self._extract_permission_pattern(read_perm)
-            write_pattern = self._extract_permission_pattern(write_perm)
-
-            for prop_name, property in properties.items():
-                log.info("prop_name: %s, property: %s", prop_name, property)
-                if permission_type == "read" and re.match(read_pattern, prop_name):
-                    allowed_properties[prop_name] = property
-                if permission_type == "write" and re.match(write_pattern, prop_name):
-                    allowed_properties[prop_name] = property
+
+            # If no permissions found for specific role, check wildcard "*"
+            if not role_permissions:
+                role_permissions = action_permissions.get("*", {})
+                log.info("Fallback to wildcard role '*': %s", role_permissions)
+                if not role_permissions:
+                    continue
+
+            # Extract permission pattern from the rule
+            regex_pattern = self._extract_permission_pattern(role_permissions)
+
+            if regex_pattern:
+                # Use efficient regex dictionary filtering
+                role_allowed = self._filter_properties_by_regex(
+                    properties, regex_pattern
+                )
+                log.info(
+                    "role: %s, pattern: %s, matched: %s",
+                    role,
+                    regex_pattern,
+                    list(role_allowed.keys()),
+                )
+
+                # Merge with existing allowed properties
+                allowed_properties.update(role_allowed)
 
         log.info("allowed_properties: %s", allowed_properties)
         return allowed_properties
 
+    def _filter_properties_by_regex(
+        self, properties: Dict[str, SchemaObjectProperty], regex_pattern: str
+    ) -> Dict[str, SchemaObjectProperty]:
+        """Filter dictionary properties using a regex pattern.
+
+        Args:
+            properties: Dictionary of property name -> SchemaObjectProperty
+            regex_pattern: Regex pattern to match property names
+
+        Returns:
+            Dict[str, SchemaObjectProperty]: Filtered properties dict
+        """
+        if not regex_pattern:
+            return {}
+
+        try:
+            compiled_regex = re.compile(regex_pattern)
+            return {k: v for k, v in properties.items() if compiled_regex.match(k)}
+        except re.error as e:
+            log.warning("Invalid regex pattern '%s': %s", regex_pattern, e)
+            return {}
+
     def _extract_permission_pattern(self, permission_rule) -> str:
         """Extract the regex pattern from a permission rule.
 

{api_foundry_query_engine-0.8.31 → api_foundry_query_engine-0.8.32}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "api-foundry-query-engine"
-version = "0.8.31"
+version = "0.8.32"
 authors = [
     { name="Daniel Repik", email="danrepik@icloud.com" },
 ]
@@ -89,4 +89,4 @@ build = "mkdocs build --clean --strict"
 serve = "mkdocs serve --dev-addr localhost:8000"
 
 [tool.hatch.publish.index]
-disable = ["test"]  # Disable test index by default for safety
+disable = true  # Disable publishing by default for safety