api-foundry-query-engine 0.8.39__py3-none-any.whl

api_foundry_query_engine/dao/sql_update_query_handler.py

@@ -0,0 +1,198 @@
+import re
+from typing import Match
+from api_foundry_query_engine.dao.sql_query_handler import SQLSchemaQueryHandler
+from api_foundry_query_engine.operation import Operation
+from api_foundry_query_engine.utils.app_exception import ApplicationException
+from api_foundry_query_engine.utils.api_model import SchemaObject
+
+
+class SQLUpdateSchemaQueryHandler(SQLSchemaQueryHandler):
+    def __init__(
+        self, operation: Operation, schema_object: SchemaObject, engine: str
+    ) -> None:
+        super().__init__(operation, schema_object, engine)
+
+    def _template_where(self, expr: str) -> str:
+        """Template substitution for WHERE clause expressions with claim values."""
+        if not expr:
+            return expr
+
+        def _quote(val: object) -> str:
+            if val is None:
+                return "NULL"
+            if isinstance(val, (int, float)):
+                return str(val)
+            s = str(val).replace("'", "''")
+            return f"'{s}'"
+
+        def _replace(m: Match[str]) -> str:
+            key = m.group(1)
+            claims = self.operation.claims or {}
+            return _quote(claims.get(key))
+
+        return re.sub(r"\$\{claims\.([A-Za-z0-9_]+)\}", _replace, expr)
+
+    def _row_where_clause(self) -> str:
+        """
+        Generate row-level WHERE clause based on write permissions.
+        Only applies to UPDATE operations, not CREATE.
+        """
+        perms = getattr(self.schema_object, "permissions", None) or {}
+        # provider-first default
+        if "default" in perms:
+            provider = perms.get("default", {}) or {}
+            write_map = provider.get("write", {}) or {}
+            role_permissions = perms.get("default", {})
+        else:
+            # legacy role-first -> synthesize write map
+            write_map = {}
+            role_permissions = perms
+            for role, role_perms in perms.items():
+                if isinstance(role_perms, dict):
+                    write_map[role] = role_perms.get("write")
+
+        filters = []
+        for role in self.operation.roles or []:
+            # Check for role-level WHERE clause (hybrid approach)
+            role_where = None
+            if isinstance(role_permissions.get(role), dict):
+                role_where = role_permissions[role].get("where")
+
+            # Check for operation-level WHERE clause
+            operation_where = None
+            rule = write_map.get(role)
+            if isinstance(rule, dict):
+                operation_where = rule.get("where")
+
+            # Operation-level takes precedence, fallback to role-level
+            where_clause = operation_where if operation_where else role_where
+
+            if isinstance(where_clause, str) and where_clause.strip():
+                filters.append(self._template_where(where_clause))
+
+        if not filters:
+            return ""
+        return "(" + ") OR (".join(filters) + ")"
+
+    @property
+    def sql(self) -> str:
+        concurrency_property = self.schema_object.concurrency_property
+        if not concurrency_property:
+            return (
+                f"UPDATE {self.table_expression}{self.update_values}"
+                + f"{self.search_condition} RETURNING {self.select_list}"
+            )
+
+        if not self.operation.query_params.get(concurrency_property.api_name):
+            raise ApplicationException(
+                400,
+                "Missing required concurrency management property.  "
+                + f"schema_object: {self.schema_object.api_name}, "
+                + f"property: {concurrency_property.api_name}",
+            )
+        if self.operation.store_params.get(concurrency_property.api_name):
+            raise ApplicationException(
+                400,
+                "For updating concurrency managed schema objects the current version "
+                + " may not be supplied as a storage parameter.  "
+                + f"schema_object: {self.schema_object.api_name}, "
+                + f"property: {concurrency_property.api_name}",
+            )
+
+        return f"UPDATE {self.table_expression}{self.update_values}, {concurrency_property.column_name} = {self.concurrency_generator(concurrency_property)} {self.search_condition} RETURNING {self.select_list}"  # noqa E501
+
+    @property
+    def update_values(self) -> str:
+        allowed_property_names = self.check_permissions(
+            "write", self.schema_object.permissions, self.schema_object.properties
+        )
+        allowed_properties = {
+            k: v
+            for k, v in self.schema_object.properties.items()
+            if k in allowed_property_names
+        }
+        self.store_placeholders = {}
+        columns = []
+        invalid_columns = []
+
+        import json
+
+        # First, validate that user is not trying to set injected properties
+        for property_name, property in self.schema_object.properties.items():
+            if property.inject_value and property_name in self.operation.store_params:
+                raise ApplicationException(
+                    403,
+                    f"Property '{property_name}' is auto-injected and "
+                    + "cannot be set manually",
+                )
+
+        for name, value in self.operation.store_params.items():
+            property = allowed_properties.get(name, None)
+            if property is None:
+                invalid_columns.append(name)
+                continue
+
+            placeholder = (
+                str(property.api_name) if property.api_name is not None else name
+            )
+            column_name = property.column_name
+
+            columns.append(f"{column_name} = {self.placeholder(property, placeholder)}")
+            # Serialize embedded objects to JSON
+            if property.api_type == "object":
+                self.store_placeholders[placeholder] = json.dumps(value)
+            else:
+                self.store_placeholders[placeholder] = property.convert_to_db_value(
+                    value
+                )
+
+        # Inject values from claims/timestamps/etc for properties with
+        # x-af-inject-value on UPDATE
+        for property_name, property in self.schema_object.properties.items():
+            if property.inject_value and "update" in property.inject_on:
+                injected_value = self.extract_injected_value(property.inject_value)
+                if injected_value is not None:
+                    placeholder_key = f"__inject_{property_name}"
+                    column_name = property.column_name
+                    columns.append(
+                        f"{column_name} = {self.placeholder(property, placeholder_key)}"
+                    )
+                    self.store_placeholders[
+                        placeholder_key
+                    ] = property.convert_to_db_value(injected_value)
+                elif property.required:
+                    raise ApplicationException(
+                        400,
+                        f"Required injected property '{property_name}' "
+                        + f"could not be populated from '{property.inject_value}'",
+                    )
+
+        if invalid_columns:
+            raise ApplicationException(
+                403,
+                f"Subject does not have permission to update properties: "
+                f"{invalid_columns}",
+            )
+        return f" SET {', '.join(columns)}"
+
+    @property
+    def search_condition(self) -> str:
+        """
+        Override to add permission-based WHERE clause for UPDATE operations.
+        """
+        # Get the base search condition from parent class
+        base_condition = super().search_condition
+
+        # Get row-level permission filters
+        row_filter = self._row_where_clause()
+
+        # If we have both, combine them
+        if base_condition and row_filter:
+            # base_condition already has " WHERE ", so add AND
+            return f"{base_condition} AND ({row_filter})"
+        elif row_filter:
+            # Only row filter, add WHERE prefix
+            return f" WHERE ({row_filter})"
+        else:
+            # Only base condition or neither
+            return base_condition

api_foundry_query_engine/lambda_handler.py

@@ -0,0 +1,63 @@
+import json
+import logging
+import os
+from typing import Mapping, Any
+
+from api_foundry_query_engine.utils.api_model import set_api_model
+from api_foundry_query_engine.utils.app_exception import ApplicationException
+from api_foundry_query_engine.adapters.gateway_adapter import GatewayAdapter
+from api_foundry_query_engine.utils.token_decoder import token_decoder
+from api_foundry_query_engine.utils.claims_check import claims_check
+
+logging.basicConfig(level=os.getenv("LOG_LEVEL", "INFO"))
+log = logging.getLogger(__name__)
+
+
+class QueryEngine:
+    def __init__(self, config: Mapping[str, str]):
+        self.adapter = GatewayAdapter(config)
+
+    def handler(self, event) -> dict[str, Any]:
+        log.debug("event: %s", event)
+        try:
+            response = self.adapter.process_event(event)
+
+            # Ensure the response conforms to API Gateway requirements
+            return {
+                "isBase64Encoded": False,
+                "statusCode": 200,
+                "headers": {"Content-Type": "application/json"},
+                "body": json.dumps(response),
+            }
+        except ApplicationException as e:
+            log.error("exception: %s", e, exc_info=True)
+            return {
+                "isBase64Encoded": False,
+                "statusCode": e.status_code,
+                "headers": {"Content-Type": "application/json"},
+                "body": json.dumps({"message": "exception: %s" % e}),
+            }
+        except RuntimeError as e:
+            log.error("runtime error: %s", e, exc_info=True)
+            return {
+                "isBase64Encoded": False,
+                "statusCode": 500,
+                "headers": {"Content-Type": "application/json"},
+                "body": json.dumps({"message": f"runtime error: {e}"}),
+            }
+
+
+@token_decoder()
+@claims_check()
+def handler(event, _):
+    if not hasattr(handler, "engine_config"):
+        log.info("Loading engine config from environment variables")
+        handler.engine_config = os.environ
+        log.info("engine_config: %s", handler.engine_config)
+
+    if not hasattr(handler, "query_engine"):
+        set_api_model(handler.engine_config)
+        log.info("Creating QueryEngine instance")
+        handler.query_engine = QueryEngine(handler.engine_config)
+
+    return handler.query_engine.handler(event)

api_foundry_query_engine/operation.py

@@ -0,0 +1,104 @@
+from typing import Any, Dict, List, Optional
+
+from api_foundry_query_engine.utils.logger import logger
+
+logger = logger(__name__)
+
+
+class Operation:
+    """
+    Represents an action to be performed on an entity.
+
+    The `Operation` class encapsulates the details required
+    to execute an operation on a given entity, including
+    query parameters for selecting records, parameters for
+    storing or updating values, metadata for operational
+    instructions, and roles defining the contexts in which
+    the operation can be performed.
+
+    Attributes:
+        entity (str): The name of the resource or object being
+            targeted (e.g., "User", "Order").
+        action (str): The type of action being performed
+            (e.g., "create", "read", "update", "delete").
+        query_params (dict): Parameters used to filter or select
+            the records affected by the operation.
+        store_params (dict): Parameters that define the values to
+            be stored or updated for the selected records.
+        metadata_params (dict): Additional instructions for the
+            operation, such as sorting or pagination.
+        roles (dict): Defines the roles under which the operation
+            is allowed to be performed.
+    """
+
+    def __init__(
+        self,
+        *,
+        entity: str,
+        action: str,
+        query_params: Optional[Dict[str, Any]] = None,
+        store_params: Optional[Dict[str, Any]] = None,
+        metadata_params: Optional[Dict[str, Any]] = None,
+        claims: Optional[Dict[str, Any]] = None,
+    ):
+        """
+        Initializes the Operation instance.
+
+        Args:
+            entity (str): The name of the entity to perform the operation on.
+            action (str): The action to perform on the entity.
+            query_params (dict, optional): Parameters for selecting
+                affected records (default: {}).
+            store_params (dict, optional): Parameters defining new or
+                updated values (default: {}).
+            metadata_params (dict, optional): Metadata for the
+                operation, such as sorting or pagination (default: {}).
+            roles (dict, optional): Defines the roles allowed to
+                perform the operation (default: {}).
+        """
+        # The target entity for the operation (e.g., "User", "Order").
+        self.entity = entity
+
+        # The type of action to perform (e.g., "create",
+        # "read", "update", "delete").
+        self.action = action
+
+        # Query parameters to filter or identify the affected records.
+        self.query_params = query_params or {}
+
+        # Parameters defining the values to be stored or updated
+        # for the operation.
+        self.store_params = store_params or {}
+
+        # Metadata for operational instructions like sorting,
+        # limiting, or offsetting results.
+        self.metadata_params = metadata_params or {}
+
+        # Roles defining the context in which the operation is allowed.
+        self.claims = claims or {}
+
+        # Log the operation for debugging and audit purposes
+        logger.info(
+            "Operation created: entity=%s, action=%s, "
+            "query_params=%s, store_params=%s, "
+            "metadata_params=%s, claims=%s",
+            self.entity,
+            self.action,
+            self.query_params,
+            self.store_params,
+            self.metadata_params,
+            self.claims,
+        )
+
+    @property
+    def roles(self) -> List[str]:
+        """Get the roles from claims."""
+        return self.claims.get("roles", []) if self.claims else []
+
+    def subject(self) -> Optional[str]:
+        """Get the subject from claims."""
+        return self.claims.get("sub") if self.claims else None
+
+    def groups(self) -> List[str]:
+        """Get the groups from claims."""
+        return self.claims.get("groups", []) if self.claims else []

api_foundry_query_engine/services/service.py

@@ -0,0 +1,75 @@
+import hashlib
+import json
+
+from api_foundry_query_engine.utils.logger import logger
+from api_foundry_query_engine.operation import Operation
+
+log = logger(__name__)
+
+
+class Service:
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
+        self.config = config
+
+    def execute(self, operation: Operation) -> list[dict]:
+        raise NotImplementedError
+
+
+class ServiceAdapter(Service):
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
+        super().__init__(config)
+
+    def execute(self, operation: Operation) -> list[dict]:
+        return super().execute(operation)
+
+
+class MutationPublisher(ServiceAdapter):
+    def __init__(self, config: dict = None):
+        if not config:
+            config = {}
+        super().__init__(config)
+
+    def execute(self, operation):
+        result = super().execute(operation)
+        self.publish_notification(operation)
+        return result
+
+    def publish_notification(self, operation):
+        topic_arn = self.config.get("BROADCAST_TOPIC", None)
+        log.debug("Topic ARN: %s", topic_arn)
+
+        if topic_arn is not None:
+            log.debug("Sending message")
+            message = {
+                "entity": operation.api_name,
+                "action": operation.action,
+                "store_params": operation.store_params,
+                "query_params": operation.query_params,
+            }
+
+            message_str = json.dumps({"default": json.dumps(message)})
+            log.debug("message_str: %s", message_str)
+            hash_object = hashlib.sha256(message_str.encode("utf-8"))
+            hex_dig = hash_object.hexdigest()
+
+            msg_id = self.__client("sns").publish(
+                TopicArn=topic_arn,
+                MessageStructure="json",
+                MessageDeduplicationId=hex_dig,
+                MessageGroupId=operation.api_name,
+                Message=message_str,
+            )
+            log.info("publish msg id %s", msg_id)
+
+    def __client(self, client_type):
+        import boto3
+
+        region = self.config.get("AWS_REGION", "us-east-1")
+        session = boto3.Session()
+        if session:
+            return session.client(client_type, region_name=region)
+        return boto3.client(client_type, region_name=region)

api_foundry_query_engine/services/transactional_service.py

@@ -0,0 +1,52 @@
+import traceback
+from typing import Mapping
+
+from api_foundry_query_engine.utils.logger import logger
+from api_foundry_query_engine.utils.app_exception import ApplicationException
+from api_foundry_query_engine.operation import Operation
+from api_foundry_query_engine.services.service import ServiceAdapter
+from api_foundry_query_engine.connectors.connection_factory import ConnectionFactory
+from api_foundry_query_engine.dao.operation_dao import OperationDAO
+from api_foundry_query_engine.utils.api_model import (
+    get_path_operation,
+    get_schema_object,
+)
+
+log = logger(__name__)
+
+
+class TransactionalService(ServiceAdapter):
+    def __init__(self, config: Mapping[str, str]):
+        super().__init__()
+        self.config = config
+        self.connection_factory = ConnectionFactory(config)
+
+    def execute(self, operation: Operation) -> list[dict]:
+        path_operation = get_path_operation(operation.entity, operation.action)
+        if path_operation:
+            database = path_operation.database
+        else:
+            schema_object = get_schema_object(operation.entity)
+            if schema_object:
+                database = schema_object.database
+            else:
+                raise ApplicationException(
+                    500, f"Unknown operation: {operation.entity}"
+                )
+
+        # Pass config to connection_factory if needed (future extension)
+        connection = self.connection_factory.get_connection(database)
+
+        try:
+            result = OperationDAO(operation, connection.engine()).execute(connection)
+            if operation.action != "read":
+                connection.commit()
+            if isinstance(result, dict):
+                return [result]
+            return result
+        except Exception as error:
+            log.error("transaction exception: %s", error)
+            log.error("traceback: %s", traceback.format_exc())
+            raise error
+        finally:
+            connection.close()