api-foundry-query-engine 0.8.49__tar.gz → 0.8.51__tar.gz

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.49
+Version: 0.8.51
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

api_foundry_query_engine-0.8.51/api_foundry_query_engine/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.51"

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/api_foundry_query_engine/dao/sql_insert_query_handler.py

@@ -70,7 +70,7 @@ class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
         # Get columns to return - use read permissions if available,
         # otherwise fall back to primary key
         returning_clause = self._get_returning_clause()
-        
+
         if not self.concurrency_property:
             return (
                 f"INSERT INTO {self.table_expression}{self.insert_values} "
@@ -100,9 +100,7 @@ class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
 
         if allowed_properties:
             # Return all accessible columns
-            columns = [
-                prop.column_name for prop in allowed_properties.values()
-            ]
+            columns = [prop.column_name for prop in allowed_properties.values()]
             return f"RETURNING {', '.join(columns)}"
 
         # Fallback to primary key if no permissions

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/api_foundry_query_engine/dao/sql_restore_query_handler.py

@@ -172,8 +172,7 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
         if not self.check_permission():
             raise ApplicationException(
                 403,
-                f"Subject is not allowed to restore "
-                f"{self.schema_object.api_name}",
+                f"Subject is not allowed to restore " f"{self.schema_object.api_name}",
             )
 
         if not self.schema_object.has_soft_delete_support():

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/api_foundry_query_engine/dao/sql_select_query_handler.py

@@ -11,6 +11,7 @@ from api_foundry_query_engine.utils.api_model import SchemaObjectProperty
 
 log = logging.getLogger(__name__)
 
+
 class SQLSelectSchemaQueryHandler(SQLSchemaQueryHandler):
     def _soft_delete_where_clause(self) -> str:
         """

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/api_foundry_query_engine/dao/sql_subselect_query_handler.py

@@ -55,7 +55,7 @@ class SQLSubselectSchemaQueryHandler(SQLSelectSchemaQueryHandler):
         parent_alias = self.parent_generator.prefix_map[
             str(self.parent_generator.schema_object.api_name)
         ]
-        
+
         sql = (
             f"SELECT {self.select_list} "
             + f"FROM {self.relation.child_schema_object.qualified_name} "

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/api_foundry_query_engine/lambda_handler.py

@@ -48,7 +48,7 @@ class QueryEngine:
 
 
 @token_decoder()
-@claims_check()
+@claims_check(validate_path_scope=False)
 def handler(event, _):
     if not hasattr(handler, "engine_config"):
         log.info("Loading engine config from environment variables")

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/api_foundry_query_engine/utils/claims_check.py

@@ -418,16 +418,15 @@ def _extract_entity_from_path(event: Dict[str, Any]) -> Optional[str]:
     # Remove leading slash and split by slash
     path_parts = path.lstrip("/").split("/")
 
-    # Skip API prefixes and return the last non-parameter part
-    # For paths like "/chinook-api/album" or "/api/v1/customer/123"
-    for part in reversed(path_parts):
-        if part and not part.startswith("{") and not part.isdigit():
-            return part
-
-    # If no suitable part found, return the last non-parameter part
-    for part in reversed(path_parts):
-        if part and not part.startswith("{"):
-            return part
+    # Find the first non-parameter part (entity is typically first)
+    # For paths like "/comment/123" or "/comment/123/version/1"
+    # Skip common API prefixes like "api", "v1", etc.
+    api_prefixes = {"api", "v1", "v2", "v3"}
+    for part in path_parts:
+        if part and not part.startswith("{") and part not in api_prefixes:
+            # Skip numeric IDs and known path keywords
+            if not part.isdigit() and part not in {"version", "batch"}:
+                return part
 
     return None
 

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/api_foundry_query_engine/utils/token_decoder.py

@@ -53,14 +53,10 @@ class LambdaTokenValidator:
             import boto3
 
             self.lambda_client = boto3.client("lambda")
-            log.debug(
-                "Lambda client initialized for validator: %s", lambda_arn
-            )
+            log.debug("Lambda client initialized for validator: %s", lambda_arn)
         except ImportError:
             log.error("boto3 not available for Lambda token validation")
-            raise ImportError(
-                "boto3 is required for Lambda token validation"
-            )
+            raise ImportError("boto3 is required for Lambda token validation")
 
     def validate(
         self, token: str, method_arn: str = "arn:aws:execute-api:*:*:*"
@@ -110,9 +106,7 @@ class LambdaTokenValidator:
                 log.warning("Authorizer returned no context/claims")
                 raise ValueError("Authorizer returned no context/claims")
 
-            log.debug(
-                "Token validated successfully, claims extracted from context"
-            )
+            log.debug("Token validated successfully, claims extracted from context")
             return context
 
         except Exception as e:
@@ -177,9 +171,7 @@ def token_decoder(
 
     # Validate configuration at decorator time
     config_anonymous_role = anonymous_role or os.getenv("ANONYMOUS_ROLE")
-    config_lambda_arn = lambda_validator_arn or os.getenv(
-        "TOKEN_VALIDATOR_LAMBDA_ARN"
-    )
+    config_lambda_arn = lambda_validator_arn or os.getenv("TOKEN_VALIDATOR_LAMBDA_ARN")
 
     # If no config provided, allow for runtime configuration
     if (
@@ -206,9 +198,7 @@ def token_decoder(
 
             # Check if authorizer already exists (gateway validated)
             if event.get("requestContext", {}).get("authorizer"):
-                log.debug(
-                    "Authorizer already exists, skipping JWT processing"
-                )
+                log.debug("Authorizer already exists, skipping JWT processing")
                 return handler(event, context)
 
             # Determine configuration sources
@@ -216,26 +206,20 @@ def token_decoder(
                 "TOKEN_VALIDATOR_LAMBDA_ARN"
             )
             config_jwks_url = (
-                jwks_url
-                or f"{os.getenv('JWKS_HOST')}/.well-known/jwks.json"
+                jwks_url or f"{os.getenv('JWKS_HOST')}/.well-known/jwks.json"
                 if os.getenv("JWKS_HOST")
                 else None
             )
             config_issuer = issuer or os.getenv("JWT_ISSUER")
             config_audience = (
-                audience
-                or os.getenv("JWT_ALLOWED_AUDIENCES", "").split(",")
+                audience or os.getenv("JWT_ALLOWED_AUDIENCES", "").split(",")
                 if os.getenv("JWT_ALLOWED_AUDIENCES")
                 else []
             )
             config_algorithms = algorithms or ["RS256"]
-            config_anonymous_role = anonymous_role or os.getenv(
-                "ANONYMOUS_ROLE"
-            )
+            config_anonymous_role = anonymous_role or os.getenv("ANONYMOUS_ROLE")
             log.debug("anonymous_role parameter: %s", anonymous_role)
-            log.debug(
-                "ANONYMOUS_ROLE env: %s", os.getenv("ANONYMOUS_ROLE", "")
-            )
+            log.debug("ANONYMOUS_ROLE env: %s", os.getenv("ANONYMOUS_ROLE", ""))
             log.debug("config_anonymous_role: %s", config_anonymous_role)
             log.debug("config_lambda_arn: %s", config_lambda_arn)
 
@@ -243,9 +227,7 @@ def token_decoder(
             if not config_lambda_arn and not config_jwks_url:
                 log.debug("No validation method configured")
                 if config_anonymous_role:
-                    log.debug(
-                        "Using anonymous role: %s", config_anonymous_role
-                    )
+                    log.debug("Using anonymous role: %s", config_anonymous_role)
                     if "requestContext" not in event:
                         event["requestContext"] = {}
                     event["requestContext"]["authorizer"] = {
@@ -304,10 +286,7 @@ def token_decoder(
 
                     if auth_header:
                         auth_parts = auth_header.split(" ")
-                        if (
-                            len(auth_parts) == 2
-                            and auth_parts[0].lower() == "bearer"
-                        ):
+                        if len(auth_parts) == 2 and auth_parts[0].lower() == "bearer":
                             token = auth_parts[1]
                             log.debug("Token extracted, length: %d", len(token))
                 except Exception:
@@ -319,9 +298,7 @@ def token_decoder(
                 if token and wrapper._lambda_validator:
                     try:
                         log.debug("Attempting Lambda validation")
-                        decoded_token = wrapper._lambda_validator.validate(
-                            token
-                        )
+                        decoded_token = wrapper._lambda_validator.validate(token)
                         log.debug("Lambda validation successful")
                     except Exception as e:
                         log.warning("Lambda validation failed: %s", e)
@@ -331,9 +308,7 @@ def token_decoder(
                 if token and not decoded_token and wrapper._jwt_decoder:
                     try:
                         log.debug("Attempting JWKS validation")
-                        decoded_token = wrapper._jwt_decoder.decode_token(
-                            token
-                        )
+                        decoded_token = wrapper._jwt_decoder.decode_token(token)
                         log.debug("JWKS validation successful")
                     except Exception as e:
                         log.warning("JWKS validation failed: %s", e)
@@ -345,24 +320,18 @@ def token_decoder(
                             "Using anonymous role: %s",
                             wrapper._anonymous_role,
                         )
-                        decoded_token = {
-                            "roles": [wrapper._anonymous_role]
-                        }
+                        decoded_token = {"roles": [wrapper._anonymous_role]}
                     else:
                         log.error("No valid token and no anonymous access")
                         return {
                             "statusCode": 401,
                             "headers": {"Content-Type": "application/json"},
-                            "body": json.dumps(
-                                {"error": "Unauthorized"}
-                            ),
+                            "body": json.dumps({"error": "Unauthorized"}),
                         }
 
                 log.debug(
                     "JWT token result: %s",
-                    json.dumps(decoded_token, default=str)
-                    if decoded_token
-                    else "None",
+                    json.dumps(decoded_token, default=str) if decoded_token else "None",
                 )
 
                 # Populate requestContext

{api_foundry_query_engine-0.8.49 → api_foundry_query_engine-0.8.51}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "api-foundry-query-engine"
-dynamic = ["version"] 
+dynamic = ["version"]
 authors = [
     { name="Daniel Repik", email="danrepik@icloud.com" },
 ]

api_foundry_query_engine-0.8.49/api_foundry_query_engine/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.8.49"