api-foundry-query-engine 0.8.57__tar.gz → 0.8.59__tar.gz

{api_foundry_query_engine-0.8.57 → api_foundry_query_engine-0.8.59}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.57
+Version: 0.8.59
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

api_foundry_query_engine-0.8.59/api_foundry_query_engine/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.59"

{api_foundry_query_engine-0.8.57 → api_foundry_query_engine-0.8.59}/api_foundry_query_engine/adapters/gateway_adapter.py

@@ -4,7 +4,6 @@ from typing import Any, Dict, List, Optional, Tuple
 
 from api_foundry_query_engine.adapters.adapter import Adapter
 from api_foundry_query_engine.operation import Operation
-from api_foundry_query_engine.utils.app_exception import ApplicationException
 
 log = logging.getLogger(__name__)
 
@@ -40,12 +39,12 @@ class GatewayAdapter(Adapter):
         - tuple: Tuple containing data, query and metadata parameters.
         """
         resource = event.get("resource")
-        if resource is not None and "/" in resource:
+        if resource:
             parts = [p for p in resource.split("/") if p]  # Remove empty strings
             # Skip common API prefixes like "api", "v1", "v2", etc.
             api_prefixes = {"api", "v1", "v2", "v3"}
-            filtered_parts = [p for p in parts if p not in api_prefixes and not p.startswith("{")]
-            entity = filtered_parts[0] if filtered_parts else None
+            literal_parts = [p for p in parts if p not in api_prefixes and not p.startswith("{")]
+            entity = "_".join(literal_parts) if literal_parts else None
         else:
             entity = None
 
@@ -57,14 +56,15 @@ class GatewayAdapter(Adapter):
 
         # Handle different authorizer types
         if isinstance(claims, dict):
-            # Parse JSON-stringified fields (roles, permissions) from token validator
-            for key in ['roles', 'permissions']:
+            # Parse JSON-stringified fields (roles, permissions)
+            # from token validator
+            for key in ["roles", "permissions"]:
                 if key in claims and isinstance(claims[key], str):
                     try:
                         claims[key] = json.loads(claims[key])
                     except (json.JSONDecodeError, ValueError):
                         pass  # Keep as string if not valid JSON
-            
+
             # TOKEN authorizer puts claims directly in authorizer object
             if "sub" in claims or "iss" in claims or "roles" in claims:
                 # Already have JWT claims at top level
@@ -103,19 +103,18 @@ class GatewayAdapter(Adapter):
         if path_parameters is not None:
             event_params.update(path_parameters)
 
-        queryStringParameters = self._convert_parameters(
-            event.get("queryStringParameters")
-        )
-        if queryStringParameters is not None:
-            event_params.update(queryStringParameters)
-
+        query_string_parameters = self._convert_parameters(event.get("queryStringParameters"))
+        if query_string_parameters is not None:
+            event_params.update(query_string_parameters)
         query_params, metadata_params = self.split_params(event_params)
+        log.info("Unmarshalled query parameters: %s", query_params)
+        log.info("Unmarshalled metadata parameters: %s", metadata_params)
 
         store_params = {}
         body = event.get("body")
         if body is not None and len(body) > 0:
             store_params = json.loads(body)
-\
+
         return Operation(
             entity=entity,
             action=action,
@@ -125,9 +124,7 @@ class GatewayAdapter(Adapter):
             claims=claims,
         )
 
-    def _convert_parameters(
-        self, parameters: Optional[Dict[str, Any]]
-    ) -> Optional[Dict[str, Any]]:
+    def _convert_parameters(self, parameters: Optional[Dict[str, Any]]) -> Optional[Dict[str, Any]]:
         """
         Convert parameters to appropriate types.
 
@@ -151,9 +148,7 @@ class GatewayAdapter(Adapter):
                     result[parameter] = value
         return result
 
-    def split_params(
-        self, parameters: Dict[str, Any]
-    ) -> Tuple[Dict[str, Any], Dict[str, Any]]:
+    def split_params(self, parameters: Dict[str, Any]) -> Tuple[Dict[str, Any], Dict[str, Any]]:
         """
         Split a dictionary into two dictionaries based on keys.
 
@@ -174,8 +169,8 @@ class GatewayAdapter(Adapter):
             else:
                 query_params[key] = value
 
-        log.info(f"split_params input: {parameters}")
-        log.info(f"query_params: {query_params}")
-        log.info(f"metadata_params: {metadata_params}")
+        log.info("split_params input: %s", parameters)
+        log.info("query_params: %s", query_params)
+        log.info("metadata_params: %s", metadata_params)
 
         return query_params, metadata_params

{api_foundry_query_engine-0.8.57 → api_foundry_query_engine-0.8.59}/api_foundry_query_engine/lambda_handler.py

@@ -48,7 +48,7 @@ class QueryEngine:
 
 
 @token_decoder()
-@claims_check(validate_path_scope=False)
+@claims_check(validate_path_scope=False, validate_scope_format=False)
 def handler(event, _):
     if not hasattr(handler, "engine_config"):
         log.info("Loading engine config from environment variables")

{api_foundry_query_engine-0.8.57 → api_foundry_query_engine-0.8.59}/api_foundry_query_engine/utils/claims_check.py

@@ -83,17 +83,13 @@ def claims_check(
                 config_require_authentication = require_authentication or os.getenv(
                     "REQUIRE_AUTHENTICATION", ""
                 ).lower() in ("true", "1", "yes")
-                log.debug(
-                    "config_require_authentication: %s", config_require_authentication
-                )
+                log.debug("config_require_authentication: %s", config_require_authentication)
 
                 # Extract claims from the event (set by token_decoder)
                 claims = _extract_claims(event)
                 if not claims:
                     if config_require_authentication:
-                        raise ApplicationException(
-                            status_code=401, message="No authentication claims found"
-                        )
+                        raise ApplicationException(status_code=401, message="No authentication claims found")
                 else:
                     log.debug("Found claims: %s", list(claims.keys()))
 
@@ -111,9 +107,7 @@ def claims_check(
 
                     # Check specific scopes if required
                     if required_scopes:
-                        _validate_required_scopes(
-                            claims, required_scopes, event, operation_type, entity_name
-                        )
+                        _validate_required_scopes(claims, required_scopes, event, operation_type, entity_name)
 
                     # Check specific permissions if required
                     if required_permissions:
@@ -157,9 +151,7 @@ def _extract_claims(event: Dict[str, Any]) -> Optional[Dict[str, Any]]:
 
         # Check direct authorizer context (most common for TOKEN authorizer)
         claim_keys = ["sub", "scope", "permissions", "roles"]
-        if isinstance(authorizer, dict) and any(
-            key in authorizer for key in claim_keys
-        ):
+        if isinstance(authorizer, dict) and any(key in authorizer for key in claim_keys):
             log.debug("Found claims in requestContext.authorizer")
             return authorizer
 
@@ -202,12 +194,12 @@ def _validate_scope_format(claims: Dict[str, Any]) -> None:
     elif not isinstance(scopes, list):
         scopes = []
 
-    # Allow empty scopes if permissions exist
+    # Scopes and permissions are now optional - they may be present but are not required
+    # The x-af-permissions in the API spec handles role-based access control
     permissions = claims.get("permissions", [])
     if not scopes and not permissions:
-        raise ApplicationException(
-            status_code=403, message="No scopes or permissions found in token"
-        )
+        log.debug("No scopes or permissions found in token - relying on role-based permissions")
+        return
 
     # Validate scope format: should be operation:resource or operation:*
     for scope in scopes:
@@ -238,9 +230,7 @@ def _validate_min_scope_level(claims: Dict[str, Any], min_level: str) -> None:
             user_max_level = max(user_max_level, scope_value)
 
     if user_max_level < min_level_value:
-        raise ApplicationException(
-            status_code=403, message=f"Insufficient scope level. Required: {min_level}"
-        )
+        raise ApplicationException(status_code=403, message=f"Insufficient scope level. Required: {min_level}")
 
 
 def _validate_path_scope(
@@ -293,8 +283,7 @@ def _validate_path_scope(
     if not has_scope and not has_permission:
         raise ApplicationException(
             status_code=403,
-            message=f"Access denied. Required scope: {required_scope} "
-            f"or permission: {required_permission}",
+            message=f"Access denied. Required scope: {required_scope} " f"or permission: {required_permission}",
         )
 
     log.debug("Path scope validation passed for %s", required_scope)
@@ -321,14 +310,10 @@ def _validate_required_scopes(
     # Check each required scope
     for required_scope in required_scopes:
         if not _scope_matches(user_scopes, required_scope, operation, entity):
-            raise ApplicationException(
-                status_code=403, message=f"Required scope not found: {required_scope}"
-            )
+            raise ApplicationException(status_code=403, message=f"Required scope not found: {required_scope}")
 
 
-def _validate_required_permissions(
-    claims: Dict[str, Any], required_permissions: list
-) -> None:
+def _validate_required_permissions(claims: Dict[str, Any], required_permissions: list) -> None:
     """Validate that user has required permissions."""
     user_permissions = claims.get("permissions", [])
     if isinstance(user_permissions, str):
@@ -418,22 +403,30 @@ def _extract_entity_from_path(event: Dict[str, Any]) -> Optional[str]:
     # Remove leading slash and split by slash
     path_parts = path.lstrip("/").split("/")
 
-    # Find the first non-parameter part (entity is typically first)
+    # Find literal path parts (ignoring params and common prefixes)
     # For paths like "/comment/123" or "/comment/123/version/1"
-    # Skip common API prefixes like "api", "v1", etc.
     api_prefixes = {"api", "v1", "v2", "v3"}
+    literal_parts = []
     for part in path_parts:
-        if part and not part.startswith("{") and part not in api_prefixes:
-            # Skip numeric IDs and known path keywords
-            if not part.isdigit() and part not in {"version", "batch"}:
-                return part
+        if not part or part.startswith("{"):
+            continue
+        if part in api_prefixes:
+            continue
+        # Skip numeric IDs and known path keywords
+        if part.isdigit() or part in {"version", "batch"}:
+            continue
+        literal_parts.append(part)
+
+    if not literal_parts:
+        return None
+
+    if len(literal_parts) == 1:
+        return literal_parts[0]
 
-    return None
+    return "_".join(literal_parts)
 
 
-def _scope_matches(
-    user_scopes: list, required_scope: str, operation: str, entity: str
-) -> bool:
+def _scope_matches(user_scopes: list, required_scope: str, operation: str, entity: str) -> bool:
     """Check if user scopes match the required scope."""
     _ = entity  # Silence unused warning
     # Check for exact match

{api_foundry_query_engine-0.8.57 → api_foundry_query_engine-0.8.59}/pyproject.toml

@@ -90,3 +90,10 @@ serve = "mkdocs serve --dev-addr localhost:8000"
 
 [tool.hatch.publish.index]
 disable = true  # Disable publishing by default for safety
+
+# Linting / formatting configuration
+[tool.ruff]
+line-length = 120
+
+[tool.black]
+line-length = 120

api_foundry_query_engine-0.8.57/api_foundry_query_engine/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.8.57"