api-foundry-query-engine 0.8.73__tar.gz → 0.8.75__tar.gz

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.73
+Version: 0.8.75
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

api_foundry_query_engine-0.8.75/api_foundry_query_engine/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.75"

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/api_foundry_query_engine/dao/batch_operation_handler.py

@@ -19,7 +19,13 @@ log = logger(__name__)
 class BatchOperationHandler:
     """Handles execution of batch operations with dependencies."""
 
-    def __init__(self, batch_request: Dict[str, Any], connection, engine: str):
+    def __init__(
+        self,
+        batch_request: Dict[str, Any],
+        connection,
+        engine: str,
+        claims: Optional[Dict[str, Any]] = None,
+    ):
         """
         Initialize the batch operation handler.
 
@@ -27,11 +33,16 @@ class BatchOperationHandler:
             batch_request: Batch request with 'operations' and 'options'
             connection: Database connection for executing operations
             engine: Database engine type (postgres, mysql, etc.)
+            claims: The authenticated caller's claims (roles, sub, etc.),
+                applied to every sub-operation in the batch. This must come
+                from the token-validated top-level request, never from the
+                batch request body.
         """
         self.operations = batch_request.get("operations", [])
         self.options = batch_request.get("options", {})
         self.connection = connection
         self.engine = engine
+        self.claims = claims or {}
         self.results: Dict[str, Dict[str, Any]] = {}
         self.failed_operations: List[str] = []
 
@@ -45,15 +56,12 @@ class BatchOperationHandler:
     def _validate_batch_request(self):
         """Validate the batch request structure."""
         if not self.operations:
-            raise ApplicationException(
-                400, "Batch request must contain at least one operation"
-            )
+            raise ApplicationException(400, "Batch request must contain at least one operation")
 
         if len(self.operations) > 100:
             raise ApplicationException(
                 400,
-                f"Batch size exceeds maximum (100). "
-                f"Requested: {len(self.operations)}",
+                f"Batch size exceeds maximum (100). " f"Requested: {len(self.operations)}",
             )
 
         # Auto-generate IDs for operations that don't have them
@@ -88,6 +96,18 @@ class BatchOperationHandler:
                     f"Operation '{op['id']}' has invalid action " f"'{op['action']}'",
                 )
 
+            # Sub-operations always run with the authenticated caller's
+            # claims (see __init__). A client-supplied 'claims' field would
+            # let a request forge its own roles/subject/tenant for a
+            # sub-operation, so reject it outright rather than silently
+            # ignoring it.
+            if "claims" in op:
+                raise ApplicationException(
+                    400,
+                    f"Operation '{op['id']}' must not specify 'claims'; "
+                    "the authenticated caller's claims are always used",
+                )
+
     def execute(self) -> Dict[str, Any]:
         """
         Execute all operations in dependency order.
@@ -238,27 +258,20 @@ class BatchOperationHandler:
 
         # Resolve references in parameters
         ref_resolver = ReferenceResolver(self.results)
-        query_params = ref_resolver.resolve_parameters(
-            op_def.get("query_params", {}), op_id
-        )
-        store_params = ref_resolver.resolve_parameters(
-            op_def.get("store_params", {}), op_id
-        )
-        metadata_params = ref_resolver.resolve_parameters(
-            op_def.get("metadata_params", {}), op_id
-        )
-
-        # Get claims from operation or use empty dict
-        claims = op_def.get("claims", {})
+        query_params = ref_resolver.resolve_parameters(op_def.get("query_params", {}), op_id)
+        store_params = ref_resolver.resolve_parameters(op_def.get("store_params", {}), op_id)
+        metadata_params = ref_resolver.resolve_parameters(op_def.get("metadata_params", {}), op_id)
 
-        # Create Operation object
+        # Create Operation object. Always use the authenticated batch
+        # caller's claims (self.claims) - never anything from the request
+        # body - so a sub-operation cannot run with forged roles/subject.
         operation = Operation(
             entity=op_def["entity"],
             action=op_def["action"],
             query_params=query_params,
             store_params=store_params,
             metadata_params=metadata_params,
-            claims=claims,
+            claims=dict(self.claims),
         )
 
         log.debug(

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/api_foundry_query_engine/dao/operation_dao.py

@@ -53,44 +53,26 @@ class OperationDAO(DAO):
     @property
     def query_handler(self) -> SQLQueryHandler:
         if not hasattr(self, "_query_handler"):
-            path_operation = get_path_operation(
-                self.operation.entity, self.operation.action
-            )
+            path_operation = get_path_operation(self.operation.entity, self.operation.action)
             if path_operation:
-                self._query_handler = SQLCustomQueryHandler(
-                    self.operation, path_operation, self.engine
-                )
+                self._query_handler = SQLCustomQueryHandler(self.operation, path_operation, self.engine)
                 return self._query_handler
 
             schema_object = get_schema_object(self.operation.entity)
             if not schema_object:
-                raise ApplicationException(
-                    500, f"Unknown operation: {self.operation.entity}"
-                )
+                raise ApplicationException(500, f"Unknown operation: {self.operation.entity}")
             if self.operation.action == "read":
-                self._query_handler = SQLSelectSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLSelectSchemaQueryHandler(self.operation, schema_object, self.engine)
             elif self.operation.action == "create":
-                self._query_handler = SQLInsertSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLInsertSchemaQueryHandler(self.operation, schema_object, self.engine)
             elif self.operation.action == "update":
-                self._query_handler = SQLUpdateSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLUpdateSchemaQueryHandler(self.operation, schema_object, self.engine)
             elif self.operation.action == "delete":
-                self._query_handler = SQLDeleteSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLDeleteSchemaQueryHandler(self.operation, schema_object, self.engine)
             elif self.operation.action == "restore":
-                self._query_handler = SQLRestoreSchemaQueryHandler(
-                    self.operation, schema_object, self.engine
-                )
+                self._query_handler = SQLRestoreSchemaQueryHandler(self.operation, schema_object, self.engine)
             else:
-                raise ApplicationException(
-                    400, f"Invalid operation action: {self.operation.action}"
-                )
+                raise ApplicationException(400, f"Invalid operation action: {self.operation.action}")
         return self._query_handler
 
     def execute(self, connector, operation=None) -> Union[list[dict], dict]:
@@ -118,8 +100,11 @@ class OperationDAO(DAO):
             # Extract batch request from store_params
             batch_request = op.store_params
 
-            # Execute batch
-            handler = BatchOperationHandler(batch_request, connector, self.engine)
+            # Execute batch. The authenticated caller's claims (op.claims)
+            # are passed explicitly so every sub-operation runs with the
+            # real caller's identity/roles, never anything from the batch
+            # request body.
+            handler = BatchOperationHandler(batch_request, connector, self.engine, claims=op.claims)
             return handler.execute()
 
         # Standard operation handling
@@ -147,9 +132,7 @@ class OperationDAO(DAO):
                 continue
 
             child_set = self.__fetch_record_set(
-                SQLSubselectSchemaQueryHandler(
-                    self.operation, relation, self.query_handler  # type: ignore
-                ),
+                SQLSubselectSchemaQueryHandler(self.operation, relation, self.query_handler),  # type: ignore
                 cursor,
             )
             if len(child_set) == 0:
@@ -168,16 +151,12 @@ class OperationDAO(DAO):
                 if parent:
                     parent[name].append(child)
 
-    def __fetch_record_set(
-        self, query_handler: SQLQueryHandler, cursor: Cursor
-    ) -> list[dict]:
+    def __fetch_record_set(self, query_handler: SQLQueryHandler, cursor: Cursor) -> list[dict]:
         sql = query_handler.sql
         if not sql:
             return []
 
-        record_set = cursor.execute(
-            sql, query_handler.placeholders, query_handler.selection_results
-        )
+        record_set = cursor.execute(sql, query_handler.placeholders, query_handler.selection_results)
         result = []
         for record in record_set:
             object = query_handler.marshal_record(record)

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/api_foundry_query_engine/dao/sql_delete_query_handler.py

@@ -1,3 +1,5 @@
+import re
+from typing import Match
 from api_foundry_query_engine.dao.sql_query_handler import SQLSchemaQueryHandler
 from api_foundry_query_engine.operation import Operation
 from api_foundry_query_engine.utils.app_exception import ApplicationException
@@ -8,11 +10,83 @@ log = logger(__name__)
 
 
 class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
-    def __init__(
-        self, operation: Operation, schema_object: SchemaObject, engine: str
-    ) -> None:
+    def __init__(self, operation: Operation, schema_object: SchemaObject, engine: str) -> None:
         super().__init__(operation, schema_object, engine)
 
+    def _template_where(self, expr: str) -> str:
+        """Template substitution for WHERE clause expressions with claim values."""
+        if not expr:
+            return expr
+
+        def _quote(val: object) -> str:
+            if val is None:
+                return "NULL"
+            if isinstance(val, (int, float)):
+                return str(val)
+            s = str(val).replace("'", "''")
+            return f"'{s}'"
+
+        def _replace(m: Match[str]) -> str:
+            key = m.group(1)
+            return _quote(self.extract_injected_value(f"claim:{key}"))
+
+        return re.sub(r"\$\{claims\.([A-Za-z0-9_]+)\}", _replace, expr)
+
+    def _row_where_clause(self) -> str:
+        """
+        Generate row-level WHERE clause based on delete permissions, so a
+        role's delete grant is scoped to the rows the permission model
+        allows (e.g. tenant/ownership), the same way select and update
+        already are.
+        """
+        perms = getattr(self.schema_object, "permissions", None) or {}
+        if "default" in perms:
+            provider = perms.get("default", {}) or {}
+            delete_map = provider.get("delete", {}) or {}
+            role_permissions = perms.get("default", {})
+        else:
+            delete_map = {}
+            role_permissions = perms
+            for role, role_perms in perms.items():
+                if isinstance(role_perms, dict):
+                    delete_map[role] = role_perms.get("delete")
+
+        filters = []
+        for role in self.operation.roles or []:
+            role_where = None
+            if isinstance(role_permissions.get(role), dict):
+                role_where = role_permissions[role].get("where")
+
+            operation_where = None
+            rule = delete_map.get(role)
+            if isinstance(rule, dict):
+                operation_where = rule.get("where")
+
+            where_clause = operation_where if operation_where else role_where
+
+            if isinstance(where_clause, str) and where_clause.strip():
+                filters.append(self._template_where(where_clause))
+
+        if not filters:
+            return ""
+        return "(" + ") OR (".join(filters) + ")"
+
+    @property
+    def search_condition(self) -> str:
+        """
+        Add permission-based row-level WHERE clause on top of the base
+        query-param search condition, matching SQLUpdateSchemaQueryHandler.
+        """
+        base_condition = super().search_condition
+        row_filter = self._row_where_clause()
+
+        if base_condition and row_filter:
+            return f"{base_condition} AND ({row_filter})"
+        elif row_filter:
+            return f" WHERE ({row_filter})"
+        else:
+            return base_condition
+
     def check_permission(self) -> bool:
         """
         Checks the user's permissions for the specified permission type.
@@ -108,9 +182,7 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
     @property
     def sql(self) -> str:
         if not self.check_permission():
-            raise ApplicationException(
-                403, f"Subject is not allowed to delete {self.schema_object.api_name}"
-            )
+            raise ApplicationException(403, f"Subject is not allowed to delete {self.schema_object.api_name}")
 
         concurrency_property = self.schema_object.concurrency_property
         if concurrency_property:
@@ -139,7 +211,4 @@ class SQLDeleteSchemaQueryHandler(SQLSchemaQueryHandler):
             )
         else:
             # Fall back to hard delete for tables without soft delete support
-            return (
-                f"DELETE FROM {self.table_expression}{self.search_condition} "
-                + f"RETURNING {self.select_list}"
-            )
+            return f"DELETE FROM {self.table_expression}{self.search_condition} " + f"RETURNING {self.select_list}"

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/api_foundry_query_engine/dao/sql_query_handler.py

@@ -208,7 +208,24 @@ class SQLQueryHandler:
             action_permissions,
         )
 
+        # A `public` rule means "world-readable regardless of who's
+        # calling" -- apply it unconditionally rather than only when the
+        # caller's own role list happens to literally contain the string
+        # "public" (which previously only happened by accident, via the
+        # anonymous-role fallback for token-less requests; an
+        # authenticated caller hitting a nominally-public resource would
+        # otherwise be filtered down to zero properties).
+        public_permissions = action_permissions.get("public", {})
+        if public_permissions:
+            regex_pattern = self._extract_permission_pattern(public_permissions)
+            if regex_pattern:
+                public_allowed = self._filter_properties_by_regex(properties, regex_pattern)
+                log.info("public rule, pattern: %s, matched: %s", regex_pattern, list(public_allowed.keys()))
+                allowed_properties.update(public_allowed)
+
         for role in self.operation.roles:
+            if role == "public":
+                continue  # already applied unconditionally above
             role_permissions = action_permissions.get(role, {})
             log.info("role: %s, role_permissions: %s", role, role_permissions)
 

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/api_foundry_query_engine/dao/sql_restore_query_handler.py

@@ -1,3 +1,5 @@
+import re
+from typing import Match
 from api_foundry_query_engine.dao.sql_query_handler import (
     SQLSchemaQueryHandler,
 )
@@ -12,9 +14,7 @@ log = logger(__name__)
 class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
     """Handler for restoring soft-deleted records."""
 
-    def __init__(
-        self, operation: Operation, schema_object: SchemaObject, engine: str
-    ) -> None:
+    def __init__(self, operation: Operation, schema_object: SchemaObject, engine: str) -> None:
         super().__init__(operation, schema_object, engine)
 
     def check_permission(self) -> bool:
@@ -42,9 +42,7 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
 
             # If still not found, check wildcard "*"
             if role_permissions is None:
-                role_permissions = restore_permissions.get(
-                    "*"
-                ) or write_permissions.get("*")
+                role_permissions = restore_permissions.get("*") or write_permissions.get("*")
                 log.info("Fallback to wildcard role '*': %s", role_permissions)
                 if role_permissions is None:
                     continue
@@ -61,6 +59,67 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
 
         return False
 
+    def _template_where(self, expr: str) -> str:
+        """Template substitution for WHERE clause expressions with claim values."""
+        if not expr:
+            return expr
+
+        def _quote(val: object) -> str:
+            if val is None:
+                return "NULL"
+            if isinstance(val, (int, float)):
+                return str(val)
+            s = str(val).replace("'", "''")
+            return f"'{s}'"
+
+        def _replace(m: Match[str]) -> str:
+            key = m.group(1)
+            return _quote(self.extract_injected_value(f"claim:{key}"))
+
+        return re.sub(r"\$\{claims\.([A-Za-z0-9_]+)\}", _replace, expr)
+
+    def _row_where_clause(self) -> str:
+        """
+        Generate row-level WHERE clause based on restore permissions
+        (falling back to write permissions, matching check_permission's own
+        restore->write fallback), so a role's restore grant is scoped to
+        the rows the permission model allows.
+        """
+        perms = getattr(self.schema_object, "permissions", None) or {}
+        if "default" in perms:
+            provider = perms.get("default", {}) or {}
+            restore_map = provider.get("restore", {}) or {}
+            write_map = provider.get("write", {}) or {}
+            role_permissions = perms.get("default", {})
+        else:
+            restore_map = {}
+            write_map = {}
+            role_permissions = perms
+            for role, role_perms in perms.items():
+                if isinstance(role_perms, dict):
+                    restore_map[role] = role_perms.get("restore")
+                    write_map[role] = role_perms.get("write")
+
+        filters = []
+        for role in self.operation.roles or []:
+            role_where = None
+            if isinstance(role_permissions.get(role), dict):
+                role_where = role_permissions[role].get("where")
+
+            operation_where = None
+            rule = restore_map.get(role) or write_map.get(role)
+            if isinstance(rule, dict):
+                operation_where = rule.get("where")
+
+            where_clause = operation_where if operation_where else role_where
+
+            if isinstance(where_clause, str) and where_clause.strip():
+                filters.append(self._template_where(where_clause))
+
+        if not filters:
+            return ""
+        return "(" + ") OR (".join(filters) + ")"
+
     def _get_restore_update_values(self) -> str:
         """Generate SET clause for restore operation."""
         self.store_placeholders = {}
@@ -114,14 +173,10 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
 
         for name, value in self.operation.query_params.items():
             if "." in name:
-                raise ApplicationException(
-                    400, "Selection on relations is not supported"
-                )
+                raise ApplicationException(400, "Selection on relations is not supported")
             prop = self.schema_object.properties.get(name)
             if not prop:
-                raise ApplicationException(
-                    500, f"Search condition column not found {name}"
-                )
+                raise ApplicationException(500, f"Search condition column not found {name}")
 
             assignment, holders = self.search_value_assignment(prop, value)
             conditions.append(assignment)
@@ -132,6 +187,12 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
         if soft_delete_conditions:
             conditions.append(f"({soft_delete_conditions})")
 
+        # Add row-level permission filter, scoping which rows a role may
+        # restore (e.g. tenant/ownership), matching update/delete.
+        row_filter = self._row_where_clause()
+        if row_filter:
+            conditions.append(f"({row_filter})")
+
         return f" WHERE {' AND '.join(conditions)}" if conditions else ""
 
     def _get_soft_delete_restore_conditions(self) -> str:
@@ -157,8 +218,7 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
                 if excluded_values:
                     # For restore, we want records that ARE in the excluded values
                     formatted_values = ", ".join(
-                        f"'{val}'" if isinstance(val, str) else str(val)
-                        for val in excluded_values
+                        f"'{val}'" if isinstance(val, str) else str(val) for val in excluded_values
                     )
                     conditions.append(f"{column_name} IN ({formatted_values})")
 
@@ -177,17 +237,13 @@ class SQLRestoreSchemaQueryHandler(SQLSchemaQueryHandler):
         if not self.schema_object.has_soft_delete_support():
             raise ApplicationException(
                 400,
-                f"Schema object {self.schema_object.api_name} does not support "
-                + "soft delete operations",
+                f"Schema object {self.schema_object.api_name} does not support " + "soft delete operations",
             )
 
         update_clause = self._get_restore_update_values()
         if not update_clause:
-            raise ApplicationException(
-                400, f"No restore fields available for {self.schema_object.api_name}"
-            )
+            raise ApplicationException(400, f"No restore fields available for {self.schema_object.api_name}")
 
         return (
-            f"UPDATE {self.table_expression}{update_clause}"
-            + f"{self.search_condition} RETURNING {self.select_list}"
+            f"UPDATE {self.table_expression}{update_clause}" + f"{self.search_condition} RETURNING {self.select_list}"
         )

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/api_foundry_query_engine/dao/sql_subselect_query_handler.py

@@ -15,9 +15,7 @@ class SQLSubselectSchemaQueryHandler(SQLSelectSchemaQueryHandler):
         relation: SchemaObjectAssociation,
         parent_generator: SQLSchemaQueryHandler,
     ) -> None:
-        super().__init__(
-            operation, relation.child_schema_object, parent_generator.engine
-        )
+        super().__init__(operation, relation.child_schema_object, parent_generator.engine)
         self.relation = relation
         self.parent_generator = parent_generator
 
@@ -32,11 +30,20 @@ class SQLSubselectSchemaQueryHandler(SQLSelectSchemaQueryHandler):
 
             schema_object = self.relation.child_schema_object
 
-            # Filter and prefix keys for the current entity and regular expressions
-            filtered_keys = self.filter_and_prefix_keys(
-                reg_exs, schema_object.properties
+            # Enforce read permissions on the associated entity's
+            # properties the same way the top-level select handler does.
+            # Without this, a property restricted at the top level (e.g.
+            # a field limited to a privileged role) would leak through
+            # when fetched as a nested one-to-many association.
+            allowed_properties = self.check_permissions(
+                "read",
+                schema_object.permissions,
+                schema_object.properties,
             )
 
+            # Filter and prefix keys for the current entity and regular expressions
+            filtered_keys = self.filter_and_prefix_keys(reg_exs, allowed_properties)
+
             # Extend the result map with the filtered keys
             result.update(filtered_keys)
 
@@ -51,9 +58,7 @@ class SQLSubselectSchemaQueryHandler(SQLSelectSchemaQueryHandler):
         if len(self.select_list_columns) == 1:  # then it only contains the key
             return None
 
-        parent_prefix = self.parent_generator.prefix_map[
-            str(self.parent_generator.schema_object.api_name)
-        ]
+        parent_prefix = self.parent_generator.prefix_map[str(self.parent_generator.schema_object.api_name)]
         sql = (
             f"SELECT {self.select_list} "
             + f"FROM {self.relation.child_schema_object.qualified_name} "

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/api_foundry_query_engine/operation.py

@@ -1,3 +1,4 @@
+import json
 from typing import Any, Dict, List, Optional
 
 from api_foundry_query_engine.utils.logger import logger
@@ -95,8 +96,43 @@ class Operation:
 
     @property
     def roles(self) -> List[str]:
-        """Get the roles from claims."""
-        return self.claims.get("roles", []) if self.claims else []
+        """Get the roles from claims.
+
+        Falls back to a singular `role` claim plus `groups` when the
+        plural `roles` key itself isn't present -- some authorizers (e.g.
+        a custom Lambda TOKEN authorizer following AWS's own convention
+        of a `role` string and a `groups` list) never populate `roles`,
+        which previously made every such caller look role-less even with
+        a perfectly valid, correctly-scoped token. `groups` may arrive as
+        a real list or, when it passed through an API Gateway authorizer
+        context (whose values must be strings), a JSON-encoded string.
+        """
+        if not self.claims:
+            return []
+        roles = self.claims.get("roles")
+        if roles:
+            return list(roles) if isinstance(roles, list) else [str(roles)]
+
+        fallback: List[str] = []
+        role = self.claims.get("role")
+        if role:
+            fallback.append(str(role))
+
+        groups_raw = self.claims.get("groups")
+        groups: List[str] = []
+        if isinstance(groups_raw, str) and groups_raw.strip():
+            try:
+                parsed = json.loads(groups_raw)
+                groups = [str(item) for item in parsed] if isinstance(parsed, list) else [groups_raw]
+            except (TypeError, ValueError):
+                groups = [groups_raw]
+        elif isinstance(groups_raw, list):
+            groups = [str(item) for item in groups_raw]
+
+        for group in groups:
+            if group not in fallback:
+                fallback.append(group)
+        return fallback
 
     def subject(self) -> Optional[str]:
         """Get the subject from claims."""

{api_foundry_query_engine-0.8.73 → api_foundry_query_engine-0.8.75}/api_foundry_query_engine/utils/token_decoder.py

@@ -33,9 +33,7 @@ def _log_jwt_configuration():
     log.debug("=== JWT Configuration Debug ===")
     log.debug("JWKS_HOST: %s", os.getenv("JWKS_HOST", "NOT_SET"))
     log.debug("JWT_ISSUER: %s", os.getenv("JWT_ISSUER", "NOT_SET"))
-    log.debug(
-        "JWT_ALLOWED_AUDIENCES: %s", os.getenv("JWT_ALLOWED_AUDIENCES", "NOT_SET")
-    )
+    log.debug("JWT_ALLOWED_AUDIENCES: %s", os.getenv("JWT_ALLOWED_AUDIENCES", "NOT_SET"))
     log.debug("ANONYMOUS_ROLE: %s", os.getenv("ANONYMOUS_ROLE", "NOT_SET"))
     log.debug(
         "TOKEN_VALIDATOR_LAMBDA_ARN: %s",
@@ -65,9 +63,7 @@ class LambdaTokenValidator:
             log.error("boto3 not available for Lambda token validation")
             raise ImportError("boto3 is required for Lambda token validation")
 
-    def validate(
-        self, token: str, method_arn: str = "arn:aws:execute-api:*:*:*"
-    ) -> Dict[str, Any]:
+    def validate(self, token: str, method_arn: str = "arn:aws:execute-api:*:*:*") -> Dict[str, Any]:
         """
         Invoke AWS Lambda TOKEN authorizer.
 
@@ -129,11 +125,7 @@ def _extract_event_entity_and_action(event: Dict[str, Any]) -> tuple[Optional[st
     resource = event.get("resource") or event.get("path") or ""
     parts = [p for p in str(resource).split("/") if p]
     api_prefixes = {"api", "v1", "v2", "v3"}
-    literal_parts = [
-        p
-        for p in parts
-        if p not in api_prefixes and not (p.startswith("{") and p.endswith("}"))
-    ]
+    literal_parts = [p for p in parts if p not in api_prefixes and not (p.startswith("{") and p.endswith("}"))]
     entity = "_".join(literal_parts) if literal_parts else None
     method = str(event.get("httpMethod", "")).upper()
     action = METHOD_TO_ACTION.get(method, "read")
@@ -194,9 +186,7 @@ def _route_explicitly_allows_role(event: Dict[str, Any], role: Optional[str]) ->
 
     _, action = _extract_event_entity_and_action(event)
     permissions = _normalize_permissions(_get_route_permissions(event))
-    action_permissions = permissions.get("default", {}).get(
-        _normalize_permission_action(action), {}
-    )
+    action_permissions = permissions.get("default", {}).get(_normalize_permission_action(action), {})
     return role in action_permissions
 
 
@@ -260,12 +250,7 @@ def token_decoder(
     config_lambda_arn = lambda_validator_arn or os.getenv("TOKEN_VALIDATOR_LAMBDA_ARN")
 
     # If no config provided, allow for runtime configuration
-    if (
-        not config_anonymous_role
-        and not jwks_url
-        and not os.getenv("JWKS_HOST")
-        and not config_lambda_arn
-    ):
+    if not config_anonymous_role and not jwks_url and not os.getenv("JWKS_HOST") and not config_lambda_arn:
         pass
 
     def decorator(handler: Callable) -> Callable:
@@ -288,13 +273,9 @@ def token_decoder(
                 return handler(event, context)
 
             # Determine configuration sources
-            config_lambda_arn = lambda_validator_arn or os.getenv(
-                "TOKEN_VALIDATOR_LAMBDA_ARN"
-            )
+            config_lambda_arn = lambda_validator_arn or os.getenv("TOKEN_VALIDATOR_LAMBDA_ARN")
             config_jwks_url = (
-                jwks_url or f"{os.getenv('JWKS_HOST')}/.well-known/jwks.json"
-                if os.getenv("JWKS_HOST")
-                else None
+                jwks_url or f"{os.getenv('JWKS_HOST')}/.well-known/jwks.json" if os.getenv("JWKS_HOST") else None
             )
             config_issuer = issuer or os.getenv("JWT_ISSUER")
             config_audience = (
@@ -321,14 +302,10 @@ def token_decoder(
                 and os.getenv("SKIP_CLAIMS_CHECK", "").lower() == "true"
                 and _route_explicitly_allows_role(event, config_anonymous_role)
             ):
-                log.debug(
-                    "SKIP_CLAIMS_CHECK enabled; using anonymous role without inline token validation"
-                )
+                log.debug("SKIP_CLAIMS_CHECK enabled; using anonymous role without inline token validation")
                 if "requestContext" not in event:
                     event["requestContext"] = {}
-                event["requestContext"]["authorizer"] = {
-                    "roles": [config_anonymous_role]
-                }
+                event["requestContext"]["authorizer"] = {"roles": [config_anonymous_role]}
                 return handler(event, context)
 
             # Skip all validation if no method configured
@@ -338,13 +315,9 @@ def token_decoder(
                     log.debug("Using anonymous role: %s", config_anonymous_role)
                     if "requestContext" not in event:
                         event["requestContext"] = {}
-                    event["requestContext"]["authorizer"] = {
-                        "roles": [config_anonymous_role]
-                    }
+                    event["requestContext"]["authorizer"] = {"roles": [config_anonymous_role]}
                 elif config_anonymous_role:
-                    log.error(
-                        "Anonymous role configured but route does not explicitly allow it"
-                    )
+                    log.error("Anonymous role configured but route does not explicitly allow it")
                     return {
                         "statusCode": 401,
                         "headers": {"Content-Type": "application/json"},
@@ -365,9 +338,7 @@ def token_decoder(
                             "Configuring Lambda validator: %s",
                             config_lambda_arn,
                         )
-                        wrapper._lambda_validator = LambdaTokenValidator(
-                            config_lambda_arn
-                        )
+                        wrapper._lambda_validator = LambdaTokenValidator(config_lambda_arn)
                     else:
                         wrapper._lambda_validator = None
 
@@ -380,9 +351,7 @@ def token_decoder(
                         wrapper._jwt_decoder = JWTDecoder(
                             jwks_url=config_jwks_url,
                             issuer=config_issuer,
-                            allowed_audiences=set(config_audience)
-                            if config_audience
-                            else None,
+                            allowed_audiences=set(config_audience) if config_audience else None,
                             algorithms=config_algorithms,
                             anonymous_role=config_anonymous_role,
                         )
@@ -498,9 +467,7 @@ class JWTDecoder:
         if jwks_url:
             self.public_key = self.fetch_public_key_from_jwks(jwks_url)
             if not self.public_key:
-                raise ValueError(
-                    f"Failed to fetch public key from JWKS URL: {jwks_url}"
-                )
+                raise ValueError(f"Failed to fetch public key from JWKS URL: {jwks_url}")
         else:
             self.public_key = None
 
@@ -510,9 +477,7 @@ class JWTDecoder:
             self.algorithms,
         )
 
-    def fetch_public_key_from_jwks(
-        self, jwks_url: str, kid: Optional[str] = None
-    ) -> Optional[str]:
+    def fetch_public_key_from_jwks(self, jwks_url: str, kid: Optional[str] = None) -> Optional[str]:
         """
         Fetch the public key from a JWKS endpoint.
 
@@ -555,9 +520,7 @@ class JWTDecoder:
                     log.warning("Key ID %s not found, using first key", kid)
             if not key:
                 key = keys[0]
-                log.debug(
-                    "Using first available key with kid: %s", key.get("kid", "unknown")
-                )
+                log.debug("Using first available key with kid: %s", key.get("kid", "unknown"))
             # Convert JWK to PEM (requires cryptography)
 
             def b64url_decode(val):
@@ -583,15 +546,11 @@ class JWTDecoder:
             if token:
                 return self.decode_token(token)
             elif self.anonymous_role:
-                log.debug(
-                    "No token found, using anonymous role: %s", self.anonymous_role
-                )
+                log.debug("No token found, using anonymous role: %s", self.anonymous_role)
                 return {"roles": [self.anonymous_role]}
             else:
                 log.error("No token found and no anonymous role configured")
-                raise ValueError(
-                    "Authentication required: no token provided and no anonymous access configured"
-                )
+                raise ValueError("Authentication required: no token provided and no anonymous access configured")
         except ValueError as e:
             if self.anonymous_role and "No authorization header" in str(e):
                 log.debug("Token parsing failed, using anonymous role: %s", str(e))
@@ -618,11 +577,7 @@ class JWTDecoder:
         auth_token_parts = auth_header.split(" ")
         log.debug("Authorization header parts: %d", len(auth_token_parts))
 
-        if (
-            len(auth_token_parts) != 2
-            or auth_token_parts[0].lower() != "bearer"
-            or not auth_token_parts[1]
-        ):
+        if len(auth_token_parts) != 2 or auth_token_parts[0].lower() != "bearer" or not auth_token_parts[1]:
             log.error("Invalid authorization header format")
             raise ValueError("Invalid AuthorizationToken.")
 
@@ -682,9 +637,7 @@ class JWTDecoder:
             log.debug("Token audience claim: %s", token_aud)
 
             # Normalize token audience to a list for comparison
-            token_auds = (
-                [token_aud] if isinstance(token_aud, str) else list(token_aud or [])
-            )
+            token_auds = [token_aud] if isinstance(token_aud, str) else list(token_aud or [])
             token_auds = [str(a).strip() for a in token_auds if str(a).strip()]
             log.debug("Normalized token audiences: %s", token_auds)
 

api_foundry_query_engine-0.8.73/api_foundry_query_engine/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.8.73"

api_foundry_query_engine-0.8.73/api_foundry_query_engine/adapters/case_change_adapter.py

@@ -1,79 +0,0 @@
-from humps import camelize, decamelize
-
-from api_foundry_query_engine.adapters.adapter import Adapter
-from api_foundry_query_engine.utils.logger import logger
-from api_foundry_query_engine.operation import Operation
-
-log = logger(__name__)
-
-
-class CaseChangeAdapter(Adapter):
-    """
-    Handles changing case from snake to camel and back
-    """
-
-    def unmarshal(self, event) -> Operation:
-        """
-        Unmarshal the event in a tuple for processing
-
-        Parameters:
-        - event (dict): Lambda event object.
-
-        Returns:
-        - tuple: Tuple containing entity operation, store_params, query_params and metadata params.
-        """
-        operation = super().unmarshal(event)
-
-        # determine case
-        self.camel_case = (
-            operation.metadata_params.get("_case", "snake") == "camel"
-            or self.__check_camel_case(operation.store_params)
-            or self.__check_camel_case(operation.query_params)
-        )
-        log.info("camel_case: %s", self.camel_case)
-
-        if self.camel_case:
-            return Operation(
-                path=operation.entity,
-                action=operation.action,
-                store_params=decamelize(operation.store_params),
-                query_params=decamelize(operation.query_params),
-                metadata_params=operation.metadata_params,
-            )
-
-        return operation
-
-    def marshal(self, result: list[dict]):
-        """
-        Marshal the result into a event response
-
-        Parameters:
-        - result (list): the data set to return in the response
-
-        Returns:
-        - the event response
-        """
-        super().marshal(result)
-
-        if not self.camel_case:
-            return result
-
-        converted_result = []
-        for item in result:
-            converted_result.append(camelize(item))
-
-        # convert back to camel case if needed
-        return converted_result
-
-    def __check_camel_case(self, params: dict) -> bool:
-        if params is not None:
-            # check the keys for an upper case character
-            for param in params:
-                if (
-                    param != param.lower()
-                    and param != param.upper()
-                    and "_" not in param
-                ):
-                    return True
-
-        return False

api_foundry_query_engine-0.8.73/api_foundry_query_engine/adapters/security_adapter.py

@@ -1,106 +0,0 @@
-from typing import Optional
-
-from api_foundry_query_engine.operation import Operation
-from api_foundry_query_engine.services.service import Service
-from api_foundry_query_engine.adapters.adapter import Adapter
-from api_foundry_query_engine.utils.logger import logger
-
-log = logger(__name__)
-
-
-class SecurityAdapter(Adapter):
-    def __init__(self, service: Optional[Service] = None, permissions: dict = None):
-        """
-        Initialize SecurityAdapter with a service and permissions.
-
-        Parameters:
-        - service (Service): The service used to process operations.
-        - permissions (dict): A dictionary containing the user's permissions,
-                              structured as:
-                              {
-                                  "read": ["field1", "field2", ...],
-                                  "write": ["field3", "field4", ...]
-                              }
-        """
-        super().__init__(service)
-        self.permissions = permissions or {"read": [], "write": []}
-
-    def unmarshal(self, event) -> Operation:
-        """
-        Unmarshal the event into an Operation object after validating query and store params.
-
-        Parameters:
-        - event (dict): Lambda event object.
-
-        Returns:
-        - Operation: The validated operation.
-        """
-        entity = event.get("entity")
-        action = event.get("action")
-        query_params = event.get("query_params", {})
-        store_params = event.get("store_params", {})
-
-        # Validate read permissions for query_params
-        invalid_query_params = [
-            key for key in query_params if key not in self.permissions["read"]
-        ]
-        if invalid_query_params:
-            raise PermissionError(
-                f"Query parameters not permitted: {invalid_query_params}"
-            )
-
-        # Validate write permissions for store_params
-        invalid_store_params = [
-            key for key in store_params if key not in self.permissions["write"]
-        ]
-        if invalid_store_params:
-            raise PermissionError(
-                f"Store parameters not permitted: {invalid_store_params}"
-            )
-
-        return Operation(
-            entity=entity,
-            action=action,
-            query_params=query_params,
-            store_params=store_params,
-        )
-
-    def marshal(self, result: list[dict]):
-        """
-        Filter the result based on read permissions before returning.
-
-        Parameters:
-        - result (list[dict]): The data set to return in the response.
-
-        Returns:
-        - list[dict]: Filtered response with only permitted fields.
-        """
-        filtered_result = []
-        for record in result:
-            filtered_record = {
-                key: value
-                for key, value in record.items()
-                if key in self.permissions["read"]
-            }
-            filtered_result.append(filtered_record)
-
-        return filtered_result
-
-    def process_event(self, event):
-        """
-        Process Lambda event using a domain function.
-
-        Parameters:
-        - event (dict): Lambda event object.
-
-        Returns:
-        - any: Result of the domain function.
-        """
-        try:
-            operation = self.unmarshal(event)
-            result = self.service.execute(operation)
-            log.debug("adapter result: %s", result)
-            return self.marshal(result)
-        except PermissionError as e:
-            log.error("Permission error: %s", e)
-            return {"error": str(e), "status": "permission_denied"}

api_foundry_query_engine-0.8.73/api_foundry_query_engine/connectors/oracle_connector.py

@@ -1,29 +0,0 @@
-from api_foundry_query_engine.utils.logger import logger
-from api_foundry_query_engine.utils.app_exception import ApplicationException
-from api_foundry_query_engine.connectors.connection import Connector
-
-log = logger(__name__)
-
-
-class OracleConnnector(Connector):
-    def __init__(self, db_secret_name: str) -> None:
-        super().__init__(db_secret_name)
-
-    def close(self):
-        pass
-
-    def execute(self, cursor, sql: str, parameters: dict):
-        from oracledb import Error, IntegrityError, ProgrammingError
-
-        log.debug("sql: %s, parameters: %s", sql, parameters)
-        try:
-            cursor.execute(sql, parameters)
-        except IntegrityError as err:
-            (error,) = err.args
-            raise ApplicationException(409, error.message)
-        except ProgrammingError as err:
-            (error,) = err.args
-            raise ApplicationException(400, error.message)
-        except Error as err:
-            (error,) = err.args
-            raise ApplicationException(500, error.message)