api-foundry-query-engine 0.8.73__tar.gz → 0.8.74__tar.gz

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.74}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.73
+Version: 0.8.74
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

api_foundry_query_engine-0.8.74/api_foundry_query_engine/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.74"

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.74}/api_foundry_query_engine/dao/batch_operation_handler.py

@@ -19,7 +19,13 @@ log = logger(__name__)
 class BatchOperationHandler:
     """Handles execution of batch operations with dependencies."""
 
-    def __init__(self, batch_request: Dict[str, Any], connection, engine: str):
+    def __init__(
+        self,
+        batch_request: Dict[str, Any],
+        connection,
+        engine: str,
+        claims: Optional[Dict[str, Any]] = None,
+    ):
         """
         Initialize the batch operation handler.
 
@@ -27,11 +33,16 @@ class BatchOperationHandler:
             batch_request: Batch request with 'operations' and 'options'
             connection: Database connection for executing operations
             engine: Database engine type (postgres, mysql, etc.)
+            claims: The authenticated caller's claims (roles, sub, etc.),
+                applied to every sub-operation in the batch. This must come
+                from the token-validated top-level request, never from the
+                batch request body.
         """
         self.operations = batch_request.get("operations", [])
         self.options = batch_request.get("options", {})
         self.connection = connection
         self.engine = engine
+        self.claims = claims or {}
         self.results: Dict[str, Dict[str, Any]] = {}
         self.failed_operations: List[str] = []
 
@@ -45,15 +56,12 @@ class BatchOperationHandler:
     def _validate_batch_request(self):
         """Validate the batch request structure."""
         if not self.operations:
-            raise ApplicationException(
-                400, "Batch request must contain at least one operation"
-            )
+            raise ApplicationException(400, "Batch request must contain at least one operation")
 
         if len(self.operations) > 100:
             raise ApplicationException(
                 400,
-                f"Batch size exceeds maximum (100). "
-                f"Requested: {len(self.operations)}",
+                f"Batch size exceeds maximum (100). " f"Requested: {len(self.operations)}",
             )
 
         # Auto-generate IDs for operations that don't have them
@@ -88,6 +96,18 @@ class BatchOperationHandler:
                     f"Operation '{op['id']}' has invalid action " f"'{op['action']}'",
                 )
 
+            # Sub-operations always run with the authenticated caller's
+            # claims (see __init__). A client-supplied 'claims' field would
+            # let a request forge its own roles/subject/tenant for a
+            # sub-operation, so reject it outright rather than silently
+            # ignoring it.
+            if "claims" in op:
+                raise ApplicationException(
+                    400,
+                    f"Operation '{op['id']}' must not specify 'claims'; "
+                    "the authenticated caller's claims are always used",
+                )
+
     def execute(self) -> Dict[str, Any]:
         """
         Execute all operations in dependency order.
@@ -238,27 +258,20 @@ class BatchOperationHandler:
 
         # Resolve references in parameters
         ref_resolver = ReferenceResolver(self.results)
-        query_params = ref_resolver.resolve_parameters(
-            op_def.get("query_params", {}), op_id
-        )
-        store_params = ref_resolver.resolve_parameters(
-            op_def.get("store_params", {}), op_id
-        )
-        metadata_params = ref_resolver.resolve_parameters(
-            op_def.get("metadata_params", {}), op_id
-        )
-
-        # Get claims from operation or use empty dict
-        claims = op_def.get("claims", {})
+        query_params = ref_resolver.resolve_parameters(op_def.get("query_params", {}), op_id)
+        store_params = ref_resolver.resolve_parameters(op_def.get("store_params", {}), op_id)
+        metadata_params = ref_resolver.resolve_parameters(op_def.get("metadata_params", {}), op_id)
 
-        # Create Operation object
+        # Create Operation object. Always use the authenticated batch
+        # caller's claims (self.claims) - never anything from the request
+        # body - so a sub-operation cannot run with forged roles/subject.
         operation = Operation(
             entity=op_def["entity"],
             action=op_def["action"],
             query_params=query_params,
             store_params=store_params,
             metadata_params=metadata_params,
-            claims=claims,
+            claims=dict(self.claims),
         )
 
         log.debug(

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.74}/api_foundry_query_engine/dao/operation_dao.py

@@ -53,44 +53,26 @@ class OperationDAO(DAO):
     @property
     def query_handler(self) -> SQLQueryHandler:
         if not hasattr(self, "_query_handler"):
-            path_operation = get_path_operation(
-                self.operation.entity, self.operation.action
-            )
+            path_operation = get_path_operation(self.operation.entity, self.operation.action)
             if path_operation:
-                self._query_handler = SQLCustomQueryHandler(
-                    self.operation, path_operation, self.engine
-                )
+                self._query_handler = SQLCustomQueryHandler(self.operation, path_operation, self.engine)
                 return self._query_handler
 
             schema_object = get_schema_object(self.operation.entity)
             if not schema_object:
-                raise ApplicationException(
-                    500, f"Unknown operation: {self.operation.entity}"
-                )
+                raise ApplicationException(500, f"Unknown operation: {self.operation.entity}")
             if self.operation.action == "read":
-                self._query_handler = SQLSelectSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLSelectSchemaQueryHandler(self.operation, schema_object, self.engine)
             elif self.operation.action == "create":
-                self._query_handler = SQLInsertSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLInsertSchemaQueryHandler(self.operation, schema_object, self.engine)
             elif self.operation.action == "update":
-                self._query_handler = SQLUpdateSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLUpdateSchemaQueryHandler(self.operation, schema_object, self.engine)
             elif self.operation.action == "delete":
-                self._query_handler = SQLDeleteSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLDeleteSchemaQueryHandler(self.operation, schema_object, self.engine)
             elif self.operation.action == "restore":
-                self._query_handler = SQLRestoreSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLRestoreSchemaQueryHandler(self.operation, schema_object, self.engine)
             else:
-                raise ApplicationException(
-                    400, f"Invalid operation action: {self.operation.action}"
-                )
+                raise ApplicationException(400, f"Invalid operation action: {self.operation.action}")
         return self._query_handler
 
     def execute(self, connector, operation=None) -> Union[list[dict], dict]:
@@ -118,8 +100,11 @@ class OperationDAO(DAO):
             # Extract batch request from store_params
             batch_request = op.store_params
 
-            # Execute batch
-            handler = BatchOperationHandler(batch_request, connector, self.engine)
+            # Execute batch. The authenticated caller's claims (op.claims)
+            # are passed explicitly so every sub-operation runs with the
+            # real caller's identity/roles, never anything from the batch
+            # request body.
+            handler = BatchOperationHandler(batch_request, connector, self.engine, claims=op.claims)
             return handler.execute()
 
         # Standard operation handling
@@ -147,9 +132,7 @@ class OperationDAO(DAO):
                 continue
 
             child_set = self.__fetch_record_set(
-                SQLSubselectSchemaQueryHandler(
-                    self.operation, relation, self.query_handler  # type: ignore
-                ),
+                SQLSubselectSchemaQueryHandler(self.operation, relation, self.query_handler),  # type: ignore
                 cursor,
             )
             if len(child_set) == 0:
@@ -168,16 +151,12 @@ class OperationDAO(DAO):
                 if parent:
                     parent[name].append(child)
 
-    def __fetch_record_set(
-        self, query_handler: SQLQueryHandler, cursor: Cursor
-    ) -> list[dict]:
+    def __fetch_record_set(self, query_handler: SQLQueryHandler, cursor: Cursor) -> list[dict]:
         sql = query_handler.sql
         if not sql:
             return []
 
-        record_set = cursor.execute(
-            sql, query_handler.placeholders, query_handler.selection_results
-        )
+        record_set = cursor.execute(sql, query_handler.placeholders, query_handler.selection_results)
         result = []
         for record in record_set:
             object = query_handler.marshal_record(record)

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.74}/api_foundry_query_engine/dao/sql_delete_query_handler.py

@@ -1,3 +1,5 @@
+import re
+from typing import Match
 from api_foundry_query_engine.dao.sql_query_handler import SQLSchemaQueryHandler
 from api_foundry_query_engine.operation import Operation
 from api_foundry_query_engine.utils.app_exception import ApplicationException
@@ -8,11 +10,83 @@ log = logger(__name__)
 
 
 class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
-    def __init__(
-        self, operation: Operation, schema_object: SchemaObject, engine: str
-    ) -> None:
+    def __init__(self, operation: Operation, schema_object: SchemaObject, engine: str) -> None:
         super().__init__(operation, schema_object, engine)
 
+    def _template_where(self, expr: str) -> str:
+        """Template substitution for WHERE clause expressions with claim values."""
+        if not expr:
+            return expr
+
+        def _quote(val: object) -> str:
+            if val is None:
+                return "NULL"
+            if isinstance(val, (int, float)):
+                return str(val)
+            s = str(val).replace("'", "''")
+            return f"'{s}'"
+
+        def _replace(m: Match[str]) -> str:
+            key = m.group(1)
+            return _quote(self.extract_injected_value(f"claim:{key}"))
+
+        return re.sub(r"\$\{claims\.([A-Za-z0-9_]+)\}", _replace, expr)
+
+    def _row_where_clause(self) -> str:
+        """
+        Generate row-level WHERE clause based on delete permissions, so a
+        role's delete grant is scoped to the rows the permission model
+        allows (e.g. tenant/ownership), the same way select and update
+        already are.
+        """
+        perms = getattr(self.schema_object, "permissions", None) or {}
+        if "default" in perms:
+            provider = perms.get("default", {}) or {}
+            delete_map = provider.get("delete", {}) or {}
+            role_permissions = perms.get("default", {})
+        else:
+            delete_map = {}
+            role_permissions = perms
+            for role, role_perms in perms.items():
+                if isinstance(role_perms, dict):
+                    delete_map[role] = role_perms.get("delete")
+
+        filters = []
+        for role in self.operation.roles or []:
+            role_where = None
+            if isinstance(role_permissions.get(role), dict):
+                role_where = role_permissions[role].get("where")
+
+            operation_where = None
+            rule = delete_map.get(role)
+            if isinstance(rule, dict):
+                operation_where = rule.get("where")
+
+            where_clause = operation_where if operation_where else role_where
+
+            if isinstance(where_clause, str) and where_clause.strip():
+                filters.append(self._template_where(where_clause))
+
+        if not filters:
+            return ""
+        return "(" + ") OR (".join(filters) + ")"
+
+    @property
+    def search_condition(self) -> str:
+        """
+        Add permission-based row-level WHERE clause on top of the base
+        query-param search condition, matching SQLUpdateSchemaQueryHandler.
+        """
+        base_condition = super().search_condition
+        row_filter = self._row_where_clause()
+
+        if base_condition and row_filter:
+            return f"{base_condition} AND ({row_filter})"
+        elif row_filter:
+            return f" WHERE ({row_filter})"
+        else:
+            return base_condition
+
     def check_permission(self) -> bool:
         """
         Checks the user's permissions for the specified permission type.
@@ -108,9 +182,7 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
     @property
     def sql(self) -> str:
         if not self.check_permission():
-            raise ApplicationException(
-                403, f"Subject is not allowed to delete {self.schema_object.api_name}"
-            )
+            raise ApplicationException(403, f"Subject is not allowed to delete {self.schema_object.api_name}")
 
         concurrency_property = self.schema_object.concurrency_property
         if concurrency_property:
@@ -139,7 +211,4 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
             )
         else:
             # Fall back to hard delete for tables without soft delete support
-            return (
-                f"DELETE FROM {self.table_expression}{self.search_condition} "
-                + f"RETURNING {self.select_list}"
-            )
+            return f"DELETE FROM {self.table_expression}{self.search_condition} " + f"RETURNING {self.select_list}"

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.74}/api_foundry_query_engine/dao/sql_restore_query_handler.py

@@ -1,3 +1,5 @@
+import re
+from typing import Match
 from api_foundry_query_engine.dao.sql_query_handler import (
     SQLSchemaQueryHandler,
 )
@@ -12,9 +14,7 @@ log = logger(__name__)
 class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
     """Handler for restoring soft-deleted records."""
 
-    def __init__(
-        self, operation: Operation, schema_object: SchemaObject, engine: str
-    ) -> None:
+    def __init__(self, operation: Operation, schema_object: SchemaObject, engine: str) -> None:
         super().__init__(operation, schema_object, engine)
 
     def check_permission(self) -> bool:
@@ -42,9 +42,7 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
 
             # If still not found, check wildcard "*"
             if role_permissions is None:
-                role_permissions = restore_permissions.get(
-                    "*"
-                ) or write_permissions.get("*")
+                role_permissions = restore_permissions.get("*") or write_permissions.get("*")
                 log.info("Fallback to wildcard role '*': %s", role_permissions)
                 if role_permissions is None:
                     continue
@@ -61,6 +59,67 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
 
         return False
 
+    def _template_where(self, expr: str) -> str:
+        """Template substitution for WHERE clause expressions with claim values."""
+        if not expr:
+            return expr
+
+        def _quote(val: object) -> str:
+            if val is None:
+                return "NULL"
+            if isinstance(val, (int, float)):
+                return str(val)
+            s = str(val).replace("'", "''")
+            return f"'{s}'"
+
+        def _replace(m: Match[str]) -> str:
+            key = m.group(1)
+            return _quote(self.extract_injected_value(f"claim:{key}"))
+
+        return re.sub(r"\$\{claims\.([A-Za-z0-9_]+)\}", _replace, expr)
+
+    def _row_where_clause(self) -> str:
+        """
+        Generate row-level WHERE clause based on restore permissions
+        (falling back to write permissions, matching check_permission's own
+        restore->write fallback), so a role's restore grant is scoped to
+        the rows the permission model allows.
+        """
+        perms = getattr(self.schema_object, "permissions", None) or {}
+        if "default" in perms:
+            provider = perms.get("default", {}) or {}
+            restore_map = provider.get("restore", {}) or {}
+            write_map = provider.get("write", {}) or {}
+            role_permissions = perms.get("default", {})
+        else:
+            restore_map = {}
+            write_map = {}
+            role_permissions = perms
+            for role, role_perms in perms.items():
+                if isinstance(role_perms, dict):
+                    restore_map[role] = role_perms.get("restore")
+                    write_map[role] = role_perms.get("write")
+
+        filters = []
+        for role in self.operation.roles or []:
+            role_where = None
+            if isinstance(role_permissions.get(role), dict):
+                role_where = role_permissions[role].get("where")
+
+            operation_where = None
+            rule = restore_map.get(role) or write_map.get(role)
+            if isinstance(rule, dict):
+                operation_where = rule.get("where")
+
+            where_clause = operation_where if operation_where else role_where
+
+            if isinstance(where_clause, str) and where_clause.strip():
+                filters.append(self._template_where(where_clause))
+
+        if not filters:
+            return ""
+        return "(" + ") OR (".join(filters) + ")"
+
     def _get_restore_update_values(self) -> str:
         """Generate SET clause for restore operation."""
         self.store_placeholders = {}
@@ -114,14 +173,10 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
 
         for name, value in self.operation.query_params.items():
             if "." in name:
-                raise ApplicationException(
-                    400, "Selection on relations is not supported"
-                )
+                raise ApplicationException(400, "Selection on relations is not supported")
             prop = self.schema_object.properties.get(name)
             if not prop:
-                raise ApplicationException(
-                    500, f"Search condition column not found {name}"
-                )
+                raise ApplicationException(500, f"Search condition column not found {name}")
 
             assignment, holders = self.search_value_assignment(prop, value)
             conditions.append(assignment)
@@ -132,6 +187,12 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
         if soft_delete_conditions:
             conditions.append(f"({soft_delete_conditions})")
 
+        # Add row-level permission filter, scoping which rows a role may
+        # restore (e.g. tenant/ownership), matching update/delete.
+        row_filter = self._row_where_clause()
+        if row_filter:
+            conditions.append(f"({row_filter})")
+
         return f" WHERE {' AND '.join(conditions)}" if conditions else ""
 
     def _get_soft_delete_restore_conditions(self) -> str:
@@ -157,8 +218,7 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
                 if excluded_values:
                     # For restore, we want records that ARE in the excluded values
                     formatted_values = ", ".join(
-                        f"'{val}'" if isinstance(val, str) else str(val)
-                        for val in excluded_values
+                        f"'{val}'" if isinstance(val, str) else str(val) for val in excluded_values
                     )
                     conditions.append(f"{column_name} IN ({formatted_values})")
 
@@ -177,17 +237,13 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
         if not self.schema_object.has_soft_delete_support():
             raise ApplicationException(
                 400,
-                f"Schema object {self.schema_object.api_name} does not support "
-                + "soft delete operations",
+                f"Schema object {self.schema_object.api_name} does not support " + "soft delete operations",
             )
 
         update_clause = self._get_restore_update_values()
         if not update_clause:
-            raise ApplicationException(
-                400, f"No restore fields available for {self.schema_object.api_name}"
-            )
+            raise ApplicationException(400, f"No restore fields available for {self.schema_object.api_name}")
 
         return (
-            f"UPDATE {self.table_expression}{update_clause}"
-            + f"{self.search_condition} RETURNING {self.select_list}"
+            f"UPDATE {self.table_expression}{update_clause}" + f"{self.search_condition} RETURNING {self.select_list}"
         )

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.74}/api_foundry_query_engine/dao/sql_subselect_query_handler.py

@@ -15,9 +15,7 @@ class SQLSubselectSchemaQueryHandler(SQLSelectSchemaQueryHandler):
         relation: SchemaObjectAssociation,
         parent_generator: SQLSchemaQueryHandler,
     ) -> None:
-        super().__init__(
-            operation, relation.child_schema_object, parent_generator.engine
-        )
+        super().__init__(operation, relation.child_schema_object, parent_generator.engine)
         self.relation = relation
         self.parent_generator = parent_generator
 
@@ -32,11 +30,20 @@ class SQLSubselectSchemaQueryHandler(SQLSelectSchemaQueryHandler):
 
             schema_object = self.relation.child_schema_object
 
-            # Filter and prefix keys for the current entity and regular expressions
-            filtered_keys = self.filter_and_prefix_keys(
-                reg_exs, schema_object.properties
+            # Enforce read permissions on the associated entity's
+            # properties the same way the top-level select handler does.
+            # Without this, a property restricted at the top level (e.g.
+            # a field limited to a privileged role) would leak through
+            # when fetched as a nested one-to-many association.
+            allowed_properties = self.check_permissions(
+                "read",
+                schema_object.permissions,
+                schema_object.properties,
             )
 
+            # Filter and prefix keys for the current entity and regular expressions
+            filtered_keys = self.filter_and_prefix_keys(reg_exs, allowed_properties)
+
             # Extend the result map with the filtered keys
             result.update(filtered_keys)
 
@@ -51,9 +58,7 @@ class SQLSubselectSchemaQueryHandler(SQLSelectSchemaQueryHandler):
         if len(self.select_list_columns) == 1:  # then it only contains the key
             return None
 
-        parent_prefix = self.parent_generator.prefix_map[
-            str(self.parent_generator.schema_object.api_name)
-        ]
+        parent_prefix = self.parent_generator.prefix_map[str(self.parent_generator.schema_object.api_name)]
         sql = (
             f"SELECT {self.select_list} "
             + f"FROM {self.relation.child_schema_object.qualified_name} "

api_foundry_query_engine-0.8.73/api_foundry_query_engine/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.8.73"

api_foundry_query_engine-0.8.73/api_foundry_query_engine/adapters/case_change_adapter.py

@@ -1,79 +0,0 @@
-from humps import camelize, decamelize
-
-from api_foundry_query_engine.adapters.adapter import Adapter
-from api_foundry_query_engine.utils.logger import logger
-from api_foundry_query_engine.operation import Operation
-
-log = logger(__name__)
-
-
-class CaseChangeAdapter(Adapter):
-    """
-    Handles changing case from snake to camel and back
-    """
-
-    def unmarshal(self, event) -> Operation:
-        """
-        Unmarshal the event in a tuple for processing
-
-        Parameters:
-        - event (dict): Lambda event object.
-
-        Returns:
-        - tuple: Tuple containing entity operation, store_params, query_params and metadata params.
-        """
-        operation = super().unmarshal(event)
-
-        # determine case
-        self.camel_case = (
-            operation.metadata_params.get("_case", "snake") == "camel"
-            or self.__check_camel_case(operation.store_params)
-            or self.__check_camel_case(operation.query_params)
-        )
-        log.info("camel_case: %s", self.camel_case)
-
-        if self.camel_case:
-            return Operation(
-                path=operation.entity,
-                action=operation.action,
-                store_params=decamelize(operation.store_params),
-                query_params=decamelize(operation.query_params),
-                metadata_params=operation.metadata_params,
-            )
-
-        return operation
-
-    def marshal(self, result: list[dict]):
-        """
-        Marshal the result into a event response
-
-        Parameters:
-        - result (list): the data set to return in the response
-
-        Returns:
-        - the event response
-        """
-        super().marshal(result)
-
-        if not self.camel_case:
-            return result
-
-        converted_result = []
-        for item in result:
-            converted_result.append(camelize(item))
-
-        # convert back to camel case if needed
-        return converted_result
-
-    def __check_camel_case(self, params: dict) -> bool:
-        if params is not None:
-            # check the keys for an upper case character
-            for param in params:
-                if (
-                    param != param.lower()
-                    and param != param.upper()
-                    and "_" not in param
-                ):
-                    return True
-
-        return False

api_foundry_query_engine-0.8.73/api_foundry_query_engine/adapters/security_adapter.py

@@ -1,106 +0,0 @@
-from typing import Optional
-
-from api_foundry_query_engine.operation import Operation
-from api_foundry_query_engine.services.service import Service
-from api_foundry_query_engine.adapters.adapter import Adapter
-from api_foundry_query_engine.utils.logger import logger
-
-log = logger(__name__)
-
-
-class SecurityAdapter(Adapter):
-    def __init__(self, service: Optional[Service] = None, permissions: dict = None):
-        """
-        Initialize SecurityAdapter with a service and permissions.
-
-        Parameters:
-        - service (Service): The service used to process operations.
-        - permissions (dict): A dictionary containing the user's permissions,
-                              structured as:
-                              {
-                                  "read": ["field1", "field2", ...],
-                                  "write": ["field3", "field4", ...]
-                              }
-        """
-        super().__init__(service)
-        self.permissions = permissions or {"read": [], "write": []}
-
-    def unmarshal(self, event) -> Operation:
-        """
-        Unmarshal the event into an Operation object after validating query and store params.
-
-        Parameters:
-        - event (dict): Lambda event object.
-
-        Returns:
-        - Operation: The validated operation.
-        """
-        entity = event.get("entity")
-        action = event.get("action")
-        query_params = event.get("query_params", {})
-        store_params = event.get("store_params", {})
-
-        # Validate read permissions for query_params
-        invalid_query_params = [
-            key for key in query_params if key not in self.permissions["read"]
-        ]
-        if invalid_query_params:
-            raise PermissionError(
-                f"Query parameters not permitted: {invalid_query_params}"
-            )
-
-        # Validate write permissions for store_params
-        invalid_store_params = [
-            key for key in store_params if key not in self.permissions["write"]
-        ]
-        if invalid_store_params:
-            raise PermissionError(
-                f"Store parameters not permitted: {invalid_store_params}"
-            )
-
-        return Operation(
-            entity=entity,
-            action=action,
-            query_params=query_params,
-            store_params=store_params,
-        )
-
-    def marshal(self, result: list[dict]):
-        """
-        Filter the result based on read permissions before returning.
-
-        Parameters:
-        - result (list[dict]): The data set to return in the response.
-
-        Returns:
-        - list[dict]: Filtered response with only permitted fields.
-        """
-        filtered_result = []
-        for record in result:
-            filtered_record = {
-                key: value
-                for key, value in record.items()
-                if key in self.permissions["read"]
-            }
-            filtered_result.append(filtered_record)
-
-        return filtered_result
-
-    def process_event(self, event):
-        """
-        Process Lambda event using a domain function.
-
-        Parameters:
-        - event (dict): Lambda event object.
-
-        Returns:
-        - any: Result of the domain function.
-        """
-        try:
-            operation = self.unmarshal(event)
-            result = self.service.execute(operation)
-            log.debug("adapter result: %s", result)
-            return self.marshal(result)
-        except PermissionError as e:
-            log.error("Permission error: %s", e)
-            return {"error": str(e), "status": "permission_denied"}

api_foundry_query_engine-0.8.73/api_foundry_query_engine/connectors/oracle_connector.py

@@ -1,29 +0,0 @@
-from api_foundry_query_engine.utils.logger import logger
-from api_foundry_query_engine.utils.app_exception import ApplicationException
-from api_foundry_query_engine.connectors.connection import Connector
-
-log = logger(__name__)
-
-
-class OracleConnnector(Connector):
-    def __init__(self, db_secret_name: str) -> None:
-        super().__init__(db_secret_name)
-
-    def close(self):
-        pass
-
-    def execute(self, cursor, sql: str, parameters: dict):
-        from oracledb import Error, IntegrityError, ProgrammingError
-
-        log.debug("sql: %s, parameters: %s", sql, parameters)
-        try:
-            cursor.execute(sql, parameters)
-        except IntegrityError as err:
-            (error,) = err.args
-            raise ApplicationException(409, error.message)
-        except ProgrammingError as err:
-            (error,) = err.args
-            raise ApplicationException(400, error.message)
-        except Error as err:
-            (error,) = err.args
-            raise ApplicationException(500, error.message)