api-foundry-query-engine 0.8.35__tar.gz → 0.8.37__tar.gz

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.35
+Version: 0.8.37
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/api_foundry_query_engine/connectors/postgres_connection.py

@@ -69,18 +69,18 @@ class PostgresCursor(Cursor):
 class PostgresConnection(Connection):
     """
     PostgreSQL database connection wrapper.
-    
+
     Supports two configuration formats:
     1. DSN-based (preferred for testing with fixture_foundry):
        {"dsn": "postgresql://user:pass@host:port/dbname"}
-    
+
     2. Individual parameters (for production AWS Secrets Manager):
        {"host": "...", "port": 5432, "database": "...", "username": "...", "password": "..."}
-    
+
     The get_connection() method prioritizes DSN if present, otherwise builds connection
     from individual parameters.
     """
-    
+
     def __init__(self, db_config: dict) -> None:
         super().__init__(db_config)
         self.__connection = self.get_connection()

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/api_foundry_query_engine/dao/sql_delete_query_handler.py

@@ -110,7 +110,7 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
     def sql(self) -> str:
         if not self.check_permission():
             raise ApplicationException(
-                402, f"Subject is not allowed to delete {self.schema_object.api_name}"
+                403, f"Subject is not allowed to delete {self.schema_object.api_name}"
             )
 
         concurrency_property = self.schema_object.concurrency_property

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/api_foundry_query_engine/dao/sql_insert_query_handler.py

@@ -106,7 +106,7 @@ class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
                     raise ApplicationException(400, f"Invalid property: {name}")
                 else:
                     raise ApplicationException(
-                        402,
+                        403,
                         f"Subject is not allowed to create with property: {parts[0]}",
                     )
 

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/api_foundry_query_engine/dao/sql_restore_query_handler.py

@@ -171,8 +171,9 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
     def sql(self) -> str:
         if not self.check_permission():
             raise ApplicationException(
-                402,
-                "Subject is not allowed to restore " + f"{self.schema_object.api_name}",
+                403,
+                f"Subject is not allowed to restore "
+                f"{self.schema_object.api_name}",
             )
 
         if not self.schema_object.has_soft_delete_support():

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/api_foundry_query_engine/dao/sql_select_query_handler.py

@@ -283,7 +283,7 @@ class SQLSelectSchemaQueryHandler(SQLSchemaQueryHandler):
 
             if len(self._selection_results) == 0:
                 raise ApplicationException(
-                    402,
+                    403,
                     (
                         "After applying permissions there are no properties "
                         "returned in response"

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/api_foundry_query_engine/dao/sql_update_query_handler.py

@@ -169,8 +169,9 @@ class SQLUpdateSchemaQueryHandler(SQLSchemaQueryHandler):
 
         if invalid_columns:
             raise ApplicationException(
-                402,
-                f"Subject does not have permission to update properties: {invalid_columns}",
+                403,
+                f"Subject does not have permission to update properties: "
+                f"{invalid_columns}",
             )
         return f" SET {', '.join(columns)}"
 

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/api_foundry_query_engine/utils/token_decoder.py

@@ -30,68 +30,173 @@ def _log_jwt_configuration():
         "JWT_ALLOWED_AUDIENCES: %s", os.getenv("JWT_ALLOWED_AUDIENCES", "NOT_SET")
     )
     log.debug("ANONYMOUS_ROLE: %s", os.getenv("ANONYMOUS_ROLE", "NOT_SET"))
+    log.debug(
+        "TOKEN_VALIDATOR_LAMBDA_ARN: %s",
+        os.getenv("TOKEN_VALIDATOR_LAMBDA_ARN", "NOT_SET"),
+    )
     log.debug("Logging level: %s", logging.getLogger().getEffectiveLevel())
     log.debug("===============================")
 
 
+class LambdaTokenValidator:
+    """Validates tokens by invoking an AWS Lambda TOKEN authorizer."""
+
+    def __init__(self, lambda_arn: str):
+        """
+        Initialize Lambda token validator.
+
+        Args:
+            lambda_arn: ARN or name of the Lambda authorizer function
+        """
+        self.lambda_arn = lambda_arn
+        try:
+            import boto3
+
+            self.lambda_client = boto3.client("lambda")
+            log.debug(
+                "Lambda client initialized for validator: %s", lambda_arn
+            )
+        except ImportError:
+            log.error("boto3 not available for Lambda token validation")
+            raise ImportError(
+                "boto3 is required for Lambda token validation"
+            )
+
+    def validate(
+        self, token: str, method_arn: str = "arn:aws:execute-api:*:*:*"
+    ) -> Dict[str, Any]:
+        """
+        Invoke AWS Lambda TOKEN authorizer.
+
+        Args:
+            token: JWT token (without "Bearer " prefix)
+            method_arn: Method ARN for resource-based policies
+
+        Returns:
+            Claims dict (extracted from context field)
+
+        Raises:
+            ValueError: If validation fails
+        """
+        log.debug("Invoking Lambda authorizer: %s", self.lambda_arn)
+
+        payload = {
+            "type": "TOKEN",
+            "authorizationToken": f"Bearer {token}",
+            "methodArn": method_arn,
+        }
+
+        try:
+            response = self.lambda_client.invoke(
+                FunctionName=self.lambda_arn,
+                InvocationType="RequestResponse",
+                Payload=json.dumps(payload),
+            )
+
+            result = json.loads(response["Payload"].read())
+            log.debug("Lambda authorizer response received")
+
+            # Check for Lambda errors
+            if "FunctionError" in response:
+                error_msg = result.get("errorMessage", "Unknown error")
+                log.error("Lambda authorizer error: %s", error_msg)
+                raise ValueError(f"Token validation failed: {error_msg}")
+
+            # Extract context (claims) from authorizer response
+            # AWS API Gateway places the 'context' object into
+            # requestContext.authorizer
+            context = result.get("context", {})
+            if not context:
+                log.warning("Authorizer returned no context/claims")
+                raise ValueError("Authorizer returned no context/claims")
+
+            log.debug(
+                "Token validated successfully, claims extracted from context"
+            )
+            return context
+
+        except Exception as e:
+            log.error("Lambda authorizer invocation failed: %s", e)
+            raise ValueError(f"Token validation failed: {str(e)}")
+
+
 def token_decoder(
     jwks_url: Optional[str] = None,
     audience: Optional[str] = None,
     issuer: Optional[str] = None,
     algorithms: Optional[list[str]] = None,
     anonymous_role: Optional[str] = None,
+    lambda_validator_arn: Optional[str] = None,
 ):
     """
     JWT token decoder decorator for AWS Lambda handlers.
 
     This filter extracts JWT tokens from the Authorization header, validates
-    them, and passes the decoded token as a keyword argument to the handler
-    function.
+    them using JWKS, Lambda authorizer, or falls back to anonymous access.
+
+    Validation priority:
+    1. Check if requestContext.authorizer exists (gateway validated)
+    2. Try Lambda validation if TOKEN_VALIDATOR_LAMBDA_ARN is set
+    3. Try JWKS validation if JWKS_HOST is set
+    4. Fall back to anonymous role if ANONYMOUS_ROLE is set
+    5. Reject with error
 
     Args:
-        jwks_url: URL to fetch JWKS from (e.g., "https://oauth.local/.well-known/jwks.json")
+        jwks_url: URL to fetch JWKS from
         audience: Expected audience claim (or list of audiences)
         issuer: Expected issuer claim
         algorithms: List of allowed algorithms (defaults to ["RS256"])
-        anonymous_role: Role to assign to anonymous (unauthenticated) requests.
-                       If not set and no token is provided, request is rejected.
-                       Set via environment variable ANONYMOUS_ROLE or parameter.
+        anonymous_role: Role to assign to anonymous requests.
+                       Set via ANONYMOUS_ROLE environment variable.
+        lambda_validator_arn: ARN of Lambda TOKEN authorizer function.
+                             Set via TOKEN_VALIDATOR_LAMBDA_ARN env var.
 
     Returns:
-        Decorated handler function that processes JWT tokens before execution
+        Decorated handler function that processes JWT tokens
 
     Example:
-        # Secured endpoint - requires valid JWT token
+        # JWKS validation
         @token_decoder(
-            jwks_url="https://your-oauth-server/.well-known/jwks.json",
+            jwks_url="https://oauth.local/.well-known/jwks.json",
             audience="test-api",
             issuer="https://oauth.local/",
-            algorithms=["RS256"]
         )
-        def secured_handler(event, context):
-            # Claims available in event['requestContext']['authorizer']
-            return {'statusCode': 200, 'body': 'Secured endpoint'}
+        def handler(event, context):
+            return {'statusCode': 200, 'body': 'Secured'}
 
-        # Public endpoint - allows anonymous with 'public' role
+        # Lambda authorizer validation
+        @token_decoder()  # Uses TOKEN_VALIDATOR_LAMBDA_ARN env var
+        def handler(event, context):
+            return {'statusCode': 200, 'body': 'Secured'}
+
+        # Public endpoint
         @token_decoder(anonymous_role="public")
-        def public_handler(event, context):
-            # Works without Authorization header, roles=["public"]
-            return {'statusCode': 200, 'body': 'Public endpoint'}
+        def handler(event, context):
+            return {'statusCode': 200, 'body': 'Public'}
     """
 
     # Validate configuration at decorator time
     config_anonymous_role = anonymous_role or os.getenv("ANONYMOUS_ROLE")
-    
-    # If no anonymous role is configured and no JWKS host, check if we're in test mode
-    if not config_anonymous_role and not jwks_url and not os.getenv("JWKS_HOST"):
-        # Allow decorator to be applied without config for testing
-        # Actual validation will happen at runtime when handler is called
+    config_lambda_arn = lambda_validator_arn or os.getenv(
+        "TOKEN_VALIDATOR_LAMBDA_ARN"
+    )
+
+    # If no config provided, allow for runtime configuration
+    if (
+        not config_anonymous_role
+        and not jwks_url
+        and not os.getenv("JWKS_HOST")
+        and not config_lambda_arn
+    ):
         pass
 
     def decorator(handler: Callable) -> Callable:
         @functools.wraps(handler)
         def wrapper(event: dict, context: Any) -> dict:
-            log.debug("JWT token decoder starting for function: %s", handler.__name__)
+            log.debug(
+                "JWT token decoder starting for function: %s",
+                handler.__name__,
+            )
 
             # Log configuration for debugging
             if log.isEnabledFor(logging.DEBUG):
@@ -99,68 +204,168 @@ def token_decoder(
 
             log.debug("Event structure: %s", json.dumps(event, default=str))
 
-            # Determine configuration source
+            # Check if authorizer already exists (gateway validated)
+            if event.get("requestContext", {}).get("authorizer"):
+                log.debug(
+                    "Authorizer already exists, skipping JWT processing"
+                )
+                return handler(event, context)
+
+            # Determine configuration sources
+            config_lambda_arn = lambda_validator_arn or os.getenv(
+                "TOKEN_VALIDATOR_LAMBDA_ARN"
+            )
             config_jwks_url = (
-                jwks_url or f"{os.getenv('JWKS_HOST')}/.well-known/jwks.json"
+                jwks_url
+                or f"{os.getenv('JWKS_HOST')}/.well-known/jwks.json"
                 if os.getenv("JWKS_HOST")
                 else None
             )
             config_issuer = issuer or os.getenv("JWT_ISSUER")
             config_audience = (
-                audience or os.getenv("JWT_ALLOWED_AUDIENCES", "").split(",")
+                audience
+                or os.getenv("JWT_ALLOWED_AUDIENCES", "").split(",")
                 if os.getenv("JWT_ALLOWED_AUDIENCES")
                 else []
             )
             config_algorithms = algorithms or ["RS256"]
-            config_anonymous_role = anonymous_role or os.getenv("ANONYMOUS_ROLE")
+            config_anonymous_role = anonymous_role or os.getenv(
+                "ANONYMOUS_ROLE"
+            )
             log.debug("anonymous_role parameter: %s", anonymous_role)
-            log.debug("ANONYMOUS_ROLE env: %s", os.getenv("ANONYMOUS_ROLE", ""))
+            log.debug(
+                "ANONYMOUS_ROLE env: %s", os.getenv("ANONYMOUS_ROLE", "")
+            )
             log.debug("config_anonymous_role: %s", config_anonymous_role)
+            log.debug("config_lambda_arn: %s", config_lambda_arn)
 
-            # Skip JWT decoding if no JWKS URL is configured
-            if not config_jwks_url:
-                log.debug("No JWKS URL configured, skipping JWT decoding")
+            # Skip all validation if no method configured
+            if not config_lambda_arn and not config_jwks_url:
+                log.debug("No validation method configured")
+                if config_anonymous_role:
+                    log.debug(
+                        "Using anonymous role: %s", config_anonymous_role
+                    )
+                    if "requestContext" not in event:
+                        event["requestContext"] = {}
+                    event["requestContext"]["authorizer"] = {
+                        "roles": [config_anonymous_role]
+                    }
                 return handler(event, context)
 
             try:
                 log.debug("Processing JWT token extraction and validation")
 
-                # Check if authorizer already exists (preserve context)
-                if event.get("requestContext", {}).get("authorizer"):
-                    log.debug("Authorizer already exists, skipping JWT processing")
-                    return handler(event, context)
-
-                # Set up a singleton JWTDecoder instance
+                # Set up validation instances
                 if not hasattr(wrapper, "_jwt_decoder"):
-                    log.debug("Creating new JWTDecoder instance")
-                    log.debug(
-                        "JWT config - URL: %s, issuer: %s, aud: %s, alg: %s",
-                        config_jwks_url,
-                        config_issuer,
-                        config_audience,
-                        config_algorithms,
+                    log.debug("Creating validator instances")
+
+                    # Lambda validator takes priority
+                    if config_lambda_arn:
+                        log.debug(
+                            "Configuring Lambda validator: %s",
+                            config_lambda_arn,
+                        )
+                        wrapper._lambda_validator = LambdaTokenValidator(
+                            config_lambda_arn
+                        )
+                    else:
+                        wrapper._lambda_validator = None
+
+                    # JWKS validator as fallback
+                    if config_jwks_url:
+                        log.debug(
+                            "Configuring JWKS validator: %s",
+                            config_jwks_url,
+                        )
+                        wrapper._jwt_decoder = JWTDecoder(
+                            jwks_url=config_jwks_url,
+                            issuer=config_issuer,
+                            allowed_audiences=set(config_audience)
+                            if config_audience
+                            else None,
+                            algorithms=config_algorithms,
+                            anonymous_role=config_anonymous_role,
+                        )
+                    else:
+                        wrapper._jwt_decoder = None
+
+                    wrapper._anonymous_role = config_anonymous_role
+
+                log.debug("Parsing token from event")
+                token = None
+                try:
+                    # Extract token
+                    auth_header = (
+                        event.get("authorizationToken")
+                        or event.get("headers", {}).get("Authorization")
+                        or event.get("headers", {}).get("authorization")
                     )
-                    wrapper._jwt_decoder = JWTDecoder(
-                        jwks_url=config_jwks_url,
-                        issuer=config_issuer,
-                        allowed_audiences=set(config_audience)
-                        if config_audience
-                        else None,
-                        algorithms=config_algorithms,
-                        anonymous_role=config_anonymous_role,
-                    )
-                else:
-                    log.debug("Using existing JWTDecoder instance")
-                jwt_decoder = wrapper._jwt_decoder
 
-                log.debug("Decoding JWT token")
-                decoded_token = jwt_decoder.decode(event)
+                    if auth_header:
+                        auth_parts = auth_header.split(" ")
+                        if (
+                            len(auth_parts) == 2
+                            and auth_parts[0].lower() == "bearer"
+                        ):
+                            token = auth_parts[1]
+                            log.debug("Token extracted, length: %d", len(token))
+                except Exception:
+                    log.debug("Token extraction failed")
+
+                decoded_token = None
+
+                # Try Lambda validator first
+                if token and wrapper._lambda_validator:
+                    try:
+                        log.debug("Attempting Lambda validation")
+                        decoded_token = wrapper._lambda_validator.validate(
+                            token
+                        )
+                        log.debug("Lambda validation successful")
+                    except Exception as e:
+                        log.warning("Lambda validation failed: %s", e)
+                        # Fall through to JWKS
+
+                # Try JWKS validator if Lambda failed or unavailable
+                if token and not decoded_token and wrapper._jwt_decoder:
+                    try:
+                        log.debug("Attempting JWKS validation")
+                        decoded_token = wrapper._jwt_decoder.decode_token(
+                            token
+                        )
+                        log.debug("JWKS validation successful")
+                    except Exception as e:
+                        log.warning("JWKS validation failed: %s", e)
+
+                # Fall back to anonymous if configured
+                if not decoded_token:
+                    if wrapper._anonymous_role:
+                        log.debug(
+                            "Using anonymous role: %s",
+                            wrapper._anonymous_role,
+                        )
+                        decoded_token = {
+                            "roles": [wrapper._anonymous_role]
+                        }
+                    else:
+                        log.error("No valid token and no anonymous access")
+                        return {
+                            "statusCode": 401,
+                            "headers": {"Content-Type": "application/json"},
+                            "body": json.dumps(
+                                {"error": "Unauthorized"}
+                            ),
+                        }
 
                 log.debug(
                     "JWT token result: %s",
-                    json.dumps(decoded_token, default=str) if decoded_token else "None",
+                    json.dumps(decoded_token, default=str)
+                    if decoded_token
+                    else "None",
                 )
-                # Populate requestContext for Lambda handler compatibility
+
+                # Populate requestContext
                 if "requestContext" not in event:
                     event["requestContext"] = {}
                 if "authorizer" not in event["requestContext"]:
@@ -193,22 +398,26 @@ class JWTDecoder:
     ):
         log.debug(
             "Initializing JWTDecoder with jwks_url: %s, issuer: %s, anonymous_role: %s",
-            jwks_url, issuer, anonymous_role
+            jwks_url,
+            issuer,
+            anonymous_role,
         )
         self.jwks_url = jwks_url
         self.issuer = issuer
         self.allowed_audiences = allowed_audiences or set()
         self.algorithms = algorithms or ["RS256"]
         self.anonymous_role = anonymous_role
-        
+
         # Fetch public key only if JWKS URL is provided
         if jwks_url:
             self.public_key = self.fetch_public_key_from_jwks(jwks_url)
             if not self.public_key:
-                raise ValueError(f"Failed to fetch public key from JWKS URL: {jwks_url}")
+                raise ValueError(
+                    f"Failed to fetch public key from JWKS URL: {jwks_url}"
+                )
         else:
             self.public_key = None
-            
+
         log.debug(
             "JWTDecoder initialized with %d allowed audiences, algorithms: %s",
             len(self.allowed_audiences),
@@ -288,11 +497,15 @@ class JWTDecoder:
             if token:
                 return self.decode_token(token)
             elif self.anonymous_role:
-                log.debug("No token found, using anonymous role: %s", self.anonymous_role)
+                log.debug(
+                    "No token found, using anonymous role: %s", self.anonymous_role
+                )
                 return {"roles": [self.anonymous_role]}
             else:
                 log.error("No token found and no anonymous role configured")
-                raise ValueError("Authentication required: no token provided and no anonymous access configured")
+                raise ValueError(
+                    "Authentication required: no token provided and no anonymous access configured"
+                )
         except ValueError as e:
             if self.anonymous_role and "No authorization header" in str(e):
                 log.debug("Token parsing failed, using anonymous role: %s", str(e))
@@ -334,7 +547,7 @@ class JWTDecoder:
     def decode_token(self, token: str) -> Dict[str, Any]:
         """Validate and decode the JWT using the PEM public key."""
         log.debug("Starting JWT token validation and decoding")
-        
+
         if not self.public_key:
             raise ValueError("No public key available for token validation")
 

{api_foundry_query_engine-0.8.35 → api_foundry_query_engine-0.8.37}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "api-foundry-query-engine"
-version = "0.8.35"
+version = "0.8.37"
 authors = [
     { name="Daniel Repik", email="danrepik@icloud.com" },
 ]