api-foundry-query-engine 0.8.68__tar.gz → 0.8.70__tar.gz

{api_foundry_query_engine-0.8.68 → api_foundry_query_engine-0.8.70}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.68
+Version: 0.8.70
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

api_foundry_query_engine-0.8.70/api_foundry_query_engine/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.70"

{api_foundry_query_engine-0.8.68 → api_foundry_query_engine-0.8.70}/api_foundry_query_engine/connectors/postgres_connection.py

@@ -32,12 +32,17 @@ class PostgresCursor(Cursor):
         try:
             # Execute the SQL statement with parameters
             self.__cursor.execute(sql, params)
+            selected_columns = set(selection_results)
+            column_names = [desc[0] for desc in (self.__cursor.description or ())]
             result = []
             for record in self.__cursor:
-                # Convert record tuple to dictionary using selection_results
-                result.append(
-                    {col: value for col, value in zip(selection_results, record)}
-                )
+                # Use cursor metadata so SQL aliases define the output mapping.
+                row = {
+                    col: value
+                    for col, value in zip(column_names, record)
+                    if col in selected_columns
+                }
+                result.append(row)
 
             return result
         except IntegrityError as err:

{api_foundry_query_engine-0.8.68 → api_foundry_query_engine-0.8.70}/api_foundry_query_engine/dao/sql_insert_query_handler.py

@@ -59,7 +59,7 @@ class SQLInsertSchemaQueryHandler(SQLSchemaQueryHandler):
             )
             # Combine both (union of read and write)
             combined = {**read_props, **write_props}
-            filters = self.operation.metadata_params.get("_properties", ".*").split()
+            filters = self.tokenize_selector_filters(self.operation.metadata_params.get("_properties", ".*"))
             self._insert_selection_results = self.filter_and_prefix_keys(filters, combined)
         return self._insert_selection_results
 

{api_foundry_query_engine-0.8.68 → api_foundry_query_engine-0.8.70}/api_foundry_query_engine/dao/sql_query_handler.py

@@ -97,12 +97,15 @@ RELATIONAL_TYPES = {
     "lt": "<",
     "le": "<=",
     "eq": "=",
+    "ne": "<>",
     "ge": ">=",
     "gt": ">",
     "in": "in",
     "not-in": "not-in",
     "between": "between",
     "not-between": "not-between",
+    "like": "like",
+    "not-like": "not-like",
 }
 
 
@@ -355,6 +358,8 @@ class SQLQueryHandler:
                 self.placeholder(property, f"{placeholder_name}_{index}") for index, _ in enumerate(value_set)
             ]
             sql = f"{column} {'NOT ' if operand == 'not-in' else ''}IN ({', '.join(assignments)})"  # noqa E501
+        elif operand in ["like", "not-like"]:
+            sql = f"{column} {'NOT ' if operand == 'not-like' else ''}LIKE {self.placeholder(property, str(placeholder_name))}"
         else:
             sql = f"{column} {operand} {self.placeholder(property, str(placeholder_name))}"
         return sql
@@ -385,11 +390,16 @@ class SQLQueryHandler:
             for index, item in enumerate(value_set):
                 item_name = f"{placeholder_name}_{index}"
                 placeholders[item_name] = property.convert_to_db_value(item)
+        elif operand in ["like", "not-like"]:
+            placeholders = {placeholder_name: self._normalize_like_pattern(value_str)}
         else:
             placeholders = {placeholder_name: property.convert_to_db_value(value_str)}
 
         return placeholders
 
+    def _normalize_like_pattern(self, value: str) -> str:
+        return value.replace("*", "%").replace("?", "_")
+
     def search_value_assignment(
         self, property: SchemaObjectProperty, value, prefix: Optional[str] = None
     ) -> tuple[str, dict]:
@@ -508,13 +518,70 @@ class SQLSchemaQueryHandler(SQLQueryHandler):
         log.info("selection_result")
         if not hasattr(self, "__selection_results"):
             log.info("prefix_map: %s", self.prefix_map)
-            filters = self.operation.metadata_params.get("_properties", ".*").split()
+            filters = self.tokenize_selector_filters(self.operation.metadata_params.get("_properties", ".*"))
             allowed_properties = self.check_permissions(
                 "read", self.schema_object.permissions, self.schema_object.properties
             )
             self.__selection_results = self.filter_and_prefix_keys(filters, allowed_properties)
         return self.__selection_results
 
+    @staticmethod
+    def tokenize_selector_filters(filter_str: str) -> List[str]:
+        """Split selector strings on commas or whitespace outside regex groups.
+
+        This preserves commas used inside regex syntax such as `{1,3}` or `[a,b]`
+        while allowing callers to pass selectors as either space-delimited,
+        comma-delimited, or mixed.
+        """
+        if not filter_str:
+            return []
+
+        filters: List[str] = []
+        current: List[str] = []
+        bracket_depth = 0
+        brace_depth = 0
+        paren_depth = 0
+        escaped = False
+
+        for char in filter_str:
+            if escaped:
+                current.append(char)
+                escaped = False
+                continue
+
+            if char == "\\":
+                current.append(char)
+                escaped = True
+                continue
+
+            if char == "[":
+                bracket_depth += 1
+            elif char == "]" and bracket_depth > 0:
+                bracket_depth -= 1
+            elif char == "{":
+                brace_depth += 1
+            elif char == "}" and brace_depth > 0:
+                brace_depth -= 1
+            elif char == "(":
+                paren_depth += 1
+            elif char == ")" and paren_depth > 0:
+                paren_depth -= 1
+
+            if char in {",", " ", "\t", "\n", "\r"} and not (bracket_depth or brace_depth or paren_depth):
+                token = "".join(current).strip()
+                if token:
+                    filters.append(token)
+                current = []
+                continue
+
+            current.append(char)
+
+        token = "".join(current).strip()
+        if token:
+            filters.append(token)
+
+        return filters
+
     def _has_soft_delete_conflicts(self) -> Dict[str, bool]:
         """
         Detect conflicts between query parameters and soft delete exclusions.
@@ -626,7 +693,7 @@ class SQLSchemaQueryHandler(SQLQueryHandler):
             if (
                 self.operation.action != "read"
                 and isinstance(value, str)
-                and re.match(r"^(lt|le|eq|ne|gt|ge|in|not-in|between|not-between)::(.+)$", value)
+                and re.match(r"^(lt|le|eq|ne|gt|ge|in|not-in|between|not-between|like|not-like)::(.+)$", value)
                 and self.schema_object.concurrency_property
             ):
                 raise ApplicationException(

{api_foundry_query_engine-0.8.68 → api_foundry_query_engine-0.8.70}/api_foundry_query_engine/dao/sql_select_query_handler.py

@@ -303,7 +303,7 @@ class SQLSelectSchemaQueryHandler(SQLSchemaQueryHandler):
     def get_regex_map(self, filter_str: str) -> dict:
         result = {}
 
-        for flt in filter_str.split():
+        for flt in self.tokenize_selector_filters(filter_str):
             parts = flt.split(":")
             entity = parts[0] if len(parts) > 1 else self.schema_object.api_name
             expression = parts[-1]

{api_foundry_query_engine-0.8.68 → api_foundry_query_engine-0.8.70}/api_foundry_query_engine/utils/token_decoder.py

@@ -20,6 +20,13 @@ __all__ = ["token_decoder"]
 
 log = logging.getLogger(__name__)
 
+METHOD_TO_ACTION = {
+    "GET": "read",
+    "POST": "create",
+    "PUT": "update",
+    "DELETE": "delete",
+}
+
 
 def _log_jwt_configuration():
     """Log current JWT configuration for debugging."""
@@ -114,6 +121,87 @@ class LambdaTokenValidator:
             raise ValueError(f"Token validation failed: {str(e)}")
 
 
+def _normalize_permission_action(action: str) -> str:
+    return "write" if action in ("create", "update") else action
+
+
+def _extract_event_entity_and_action(event: Dict[str, Any]) -> tuple[Optional[str], str]:
+    resource = event.get("resource") or event.get("path") or ""
+    parts = [p for p in str(resource).split("/") if p]
+    api_prefixes = {"api", "v1", "v2", "v3"}
+    literal_parts = [
+        p
+        for p in parts
+        if p not in api_prefixes and not (p.startswith("{") and p.endswith("}"))
+    ]
+    entity = "_".join(literal_parts) if literal_parts else None
+    method = str(event.get("httpMethod", "")).upper()
+    action = METHOD_TO_ACTION.get(method, "read")
+    return entity, action
+
+
+def _normalize_permissions(permissions: Optional[dict]) -> dict:
+    if not permissions or not isinstance(permissions, dict):
+        return {}
+
+    if "default" in permissions:
+        return permissions
+
+    normalized = {"default": {"read": {}, "write": {}, "delete": {}}}
+    for role, actions in permissions.items():
+        if not isinstance(actions, dict):
+            continue
+        for action, rule in actions.items():
+            normalized_action = _normalize_permission_action(action)
+            if normalized_action in normalized["default"]:
+                normalized["default"][normalized_action][role] = rule
+    return normalized
+
+
+def _get_route_permissions(event: Dict[str, Any]) -> dict:
+    from api_foundry_query_engine.utils import api_model as api_model_module
+    from api_foundry_query_engine.utils.api_model import (
+        get_path_operation,
+        get_schema_object,
+        set_api_model,
+    )
+
+    if api_model_module.api_model is None:
+        if not os.getenv("API_SPEC"):
+            return {}
+        try:
+            set_api_model(os.environ)
+        except Exception as exc:
+            log.warning("Failed to load API model for anonymous-route check: %s", exc)
+            return {}
+
+    entity, action = _extract_event_entity_and_action(event)
+    if not entity:
+        return {}
+
+    path_operation = get_path_operation(entity, action)
+    if path_operation:
+        return path_operation.permissions or {}
+
+    schema_object = get_schema_object(entity)
+    if schema_object:
+        return schema_object.permissions or {}
+
+    return {}
+
+
+def _route_explicitly_allows_role(event: Dict[str, Any], role: Optional[str]) -> bool:
+    if not role:
+        return False
+
+    _, action = _extract_event_entity_and_action(event)
+    permissions = _normalize_permissions(_get_route_permissions(event))
+    action_permissions = permissions.get("default", {}).get(
+        _normalize_permission_action(action), {}
+    )
+    return role in action_permissions
+
+
 def token_decoder(
     jwks_url: Optional[str] = None,
     audience: Optional[str] = None,
@@ -223,16 +311,47 @@ def token_decoder(
             log.debug("config_anonymous_role: %s", config_anonymous_role)
             log.debug("config_lambda_arn: %s", config_lambda_arn)
 
+            # Some API Gateway routes are intentionally public but still receive
+            # browser Authorization headers from the SPA. In Lambda proxy mode
+            # those public routes do not have requestContext.authorizer populated,
+            # and invoking a Lambda TOKEN validator from a VPC-backed API Lambda
+            # can hang until the API timeout. When anonymous access is explicitly
+            # enabled and claims checks are disabled, treat the request as public
+            # unless API Gateway already supplied verified claims above.
+            if (
+                config_anonymous_role
+                and os.getenv("SKIP_CLAIMS_CHECK", "").lower() == "true"
+                and _route_explicitly_allows_role(event, config_anonymous_role)
+            ):
+                log.debug(
+                    "SKIP_CLAIMS_CHECK enabled; using anonymous role without inline token validation"
+                )
+                if "requestContext" not in event:
+                    event["requestContext"] = {}
+                event["requestContext"]["authorizer"] = {
+                    "roles": [config_anonymous_role]
+                }
+                return handler(event, context)
+
             # Skip all validation if no method configured
             if not config_lambda_arn and not config_jwks_url:
                 log.debug("No validation method configured")
-                if config_anonymous_role:
+                if _route_explicitly_allows_role(event, config_anonymous_role):
                     log.debug("Using anonymous role: %s", config_anonymous_role)
                     if "requestContext" not in event:
                         event["requestContext"] = {}
                     event["requestContext"]["authorizer"] = {
                         "roles": [config_anonymous_role]
                     }
+                elif config_anonymous_role:
+                    log.error(
+                        "Anonymous role configured but route does not explicitly allow it"
+                    )
+                    return {
+                        "statusCode": 401,
+                        "headers": {"Content-Type": "application/json"},
+                        "body": json.dumps({"error": "Unauthorized"}),
+                    }
                 return handler(event, context)
 
             try:
@@ -315,7 +434,7 @@ def token_decoder(
 
                 # Fall back to anonymous if configured
                 if not decoded_token:
-                    if wrapper._anonymous_role:
+                    if _route_explicitly_allows_role(event, wrapper._anonymous_role):
                         log.debug(
                             "Using anonymous role: %s",
                             wrapper._anonymous_role,

api_foundry_query_engine-0.8.68/api_foundry_query_engine/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.8.68"