api-foundry-query-engine 0.8.33__tar.gz → 0.8.34__tar.gz

{api_foundry_query_engine-0.8.33 → api_foundry_query_engine-0.8.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.33
+Version: 0.8.34
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

{api_foundry_query_engine-0.8.33 → api_foundry_query_engine-0.8.34}/api_foundry_query_engine/dao/sql_update_query_handler.py

@@ -1,3 +1,5 @@
+import re
+from typing import Match
 from api_foundry_query_engine.dao.sql_query_handler import SQLSchemaQueryHandler
 from api_foundry_query_engine.operation import Operation
 from api_foundry_query_engine.utils.app_exception import ApplicationException
@@ -10,6 +12,68 @@ class SQLUpdateSchemaQueryHandler(SQLSchemaQueryHandler):
     ) -> None:
         super().__init__(operation, schema_object, engine)
 
+    def _template_where(self, expr: str) -> str:
+        """Template substitution for WHERE clause expressions with claim values."""
+        if not expr:
+            return expr
+
+        def _quote(val: object) -> str:
+            if val is None:
+                return "NULL"
+            if isinstance(val, (int, float)):
+                return str(val)
+            s = str(val).replace("'", "''")
+            return f"'{s}'"
+
+        def _replace(m: Match[str]) -> str:
+            key = m.group(1)
+            claims = self.operation.claims or {}
+            return _quote(claims.get(key))
+
+        return re.sub(r"\$\{claims\.([A-Za-z0-9_]+)\}", _replace, expr)
+
+    def _row_where_clause(self) -> str:
+        """
+        Generate row-level WHERE clause based on write permissions.
+        Only applies to UPDATE operations, not CREATE.
+        """
+        perms = getattr(self.schema_object, "permissions", None) or {}
+        # provider-first default
+        if "default" in perms:
+            provider = perms.get("default", {}) or {}
+            write_map = provider.get("write", {}) or {}
+            role_permissions = perms.get("default", {})
+        else:
+            # legacy role-first -> synthesize write map
+            write_map = {}
+            role_permissions = perms
+            for role, role_perms in perms.items():
+                if isinstance(role_perms, dict):
+                    write_map[role] = role_perms.get("write")
+
+        filters = []
+        for role in self.operation.roles or []:
+            # Check for role-level WHERE clause (hybrid approach)
+            role_where = None
+            if isinstance(role_permissions.get(role), dict):
+                role_where = role_permissions[role].get("where")
+
+            # Check for operation-level WHERE clause
+            operation_where = None
+            rule = write_map.get(role)
+            if isinstance(rule, dict):
+                operation_where = rule.get("where")
+
+            # Operation-level takes precedence, fallback to role-level
+            where_clause = operation_where if operation_where else role_where
+
+            if isinstance(where_clause, str) and where_clause.strip():
+                filters.append(self._template_where(where_clause))
+
+        if not filters:
+            return ""
+        return "(" + ") OR (".join(filters) + ")"
+
     @property
     def sql(self) -> str:
         concurrency_property = self.schema_object.concurrency_property
@@ -109,3 +173,25 @@ class SQLUpdateSchemaQueryHandler(SQLSchemaQueryHandler):
                 f"Subject does not have permission to update properties: {invalid_columns}",
             )
         return f" SET {', '.join(columns)}"
+
+    @property
+    def search_condition(self) -> str:
+        """
+        Override to add permission-based WHERE clause for UPDATE operations.
+        """
+        # Get the base search condition from parent class
+        base_condition = super().search_condition
+
+        # Get row-level permission filters
+        row_filter = self._row_where_clause()
+
+        # If we have both, combine them
+        if base_condition and row_filter:
+            # base_condition already has " WHERE ", so add AND
+            return f"{base_condition} AND ({row_filter})"
+        elif row_filter:
+            # Only row filter, add WHERE prefix
+            return f" WHERE ({row_filter})"
+        else:
+            # Only base condition or neither
+            return base_condition

{api_foundry_query_engine-0.8.33 → api_foundry_query_engine-0.8.34}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "api-foundry-query-engine"
-version = "0.8.33"
+version = "0.8.34"
 authors = [
     { name="Daniel Repik", email="danrepik@icloud.com" },
 ]