api-foundry-query-engine 0.8.74__tar.gz → 0.8.77__tar.gz

{api_foundry_query_engine-0.8.74 → api_foundry_query_engine-0.8.77}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.74
+Version: 0.8.77
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

api_foundry_query_engine-0.8.77/api_foundry_query_engine/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.77"

{api_foundry_query_engine-0.8.74 → api_foundry_query_engine-0.8.77}/api_foundry_query_engine/connectors/connection_factory.py

@@ -35,17 +35,27 @@ class ConnectionFactory:
         log.info("database: %s", database)
         db_config = self.db_config_map.get(database)
         if not db_config:
-            # Use config dict for secrets
-            secrets_map = self.config.get("SECRETS", {})
-            if isinstance(secrets_map, str):
-                secrets_map = json.loads(secrets_map)
-            secret_name = secrets_map.get(database)
-            log.debug("secret_name: %s", secret_name)
-
-            if secret_name:
-                db_config = self.__get_secret(secret_name)
+            # A <DATABASE>_DSN config value (e.g. CONTRACT_DB_DSN) skips
+            # Secrets Manager entirely. This matters for a Lambda that's
+            # VPC-attached for private database access but has no route
+            # to the Secrets Manager API (no NAT gateway, no interface
+            # endpoint) -- the SECRETS/get_secret_value path would just
+            # hang. PostgresConnection already accepts a raw "dsn" key.
+            dsn = self.config.get(f"{database.upper()}_DSN")
+            if dsn:
+                db_config = {"engine": self.config.get(f"{database.upper()}_ENGINE", "postgres"), "dsn": dsn}
             else:
-                raise ValueError(f"Secret not found for database: {database}")
+                # Use config dict for secrets
+                secrets_map = self.config.get("SECRETS", {})
+                if isinstance(secrets_map, str):
+                    secrets_map = json.loads(secrets_map)
+                secret_name = secrets_map.get(database)
+                log.debug("secret_name: %s", secret_name)
+
+                if secret_name:
+                    db_config = self.__get_secret(secret_name)
+                else:
+                    raise ValueError(f"Secret not found for database: {database}")
 
         engine = db_config.get("engine")
         if not engine:

{api_foundry_query_engine-0.8.74 → api_foundry_query_engine-0.8.77}/api_foundry_query_engine/dao/sql_query_handler.py

@@ -208,7 +208,24 @@ class SQLQueryHandler:
             action_permissions,
         )
 
+        # A `public` rule means "world-readable regardless of who's
+        # calling" -- apply it unconditionally rather than only when the
+        # caller's own role list happens to literally contain the string
+        # "public" (which previously only happened by accident, via the
+        # anonymous-role fallback for token-less requests; an
+        # authenticated caller hitting a nominally-public resource would
+        # otherwise be filtered down to zero properties).
+        public_permissions = action_permissions.get("public", {})
+        if public_permissions:
+            regex_pattern = self._extract_permission_pattern(public_permissions)
+            if regex_pattern:
+                public_allowed = self._filter_properties_by_regex(properties, regex_pattern)
+                log.info("public rule, pattern: %s, matched: %s", regex_pattern, list(public_allowed.keys()))
+                allowed_properties.update(public_allowed)
+
         for role in self.operation.roles:
+            if role == "public":
+                continue  # already applied unconditionally above
             role_permissions = action_permissions.get(role, {})
             log.info("role: %s, role_permissions: %s", role, role_permissions)
 
@@ -359,7 +376,7 @@ class SQLQueryHandler:
             ]
             sql = f"{column} {'NOT ' if operand == 'not-in' else ''}IN ({', '.join(assignments)})"  # noqa E501
         elif operand in ["like", "not-like"]:
-            sql = f"{column} {'NOT ' if operand == 'not-like' else ''}LIKE {self.placeholder(property, str(placeholder_name))}"
+            sql = f"{column} {'NOT ' if operand == 'not-like' else ''}LIKE {self.placeholder(property, str(placeholder_name))}"  # noqa E501
         else:
             sql = f"{column} {operand} {self.placeholder(property, str(placeholder_name))}"
         return sql

{api_foundry_query_engine-0.8.74 → api_foundry_query_engine-0.8.77}/api_foundry_query_engine/operation.py

@@ -1,3 +1,4 @@
+import json
 from typing import Any, Dict, List, Optional
 
 from api_foundry_query_engine.utils.logger import logger
@@ -95,8 +96,43 @@ class Operation:
 
     @property
     def roles(self) -> List[str]:
-        """Get the roles from claims."""
-        return self.claims.get("roles", []) if self.claims else []
+        """Get the roles from claims.
+
+        Falls back to a singular `role` claim plus `groups` when the
+        plural `roles` key itself isn't present -- some authorizers (e.g.
+        a custom Lambda TOKEN authorizer following AWS's own convention
+        of a `role` string and a `groups` list) never populate `roles`,
+        which previously made every such caller look role-less even with
+        a perfectly valid, correctly-scoped token. `groups` may arrive as
+        a real list or, when it passed through an API Gateway authorizer
+        context (whose values must be strings), a JSON-encoded string.
+        """
+        if not self.claims:
+            return []
+        roles = self.claims.get("roles")
+        if roles:
+            return list(roles) if isinstance(roles, list) else [str(roles)]
+
+        fallback: List[str] = []
+        role = self.claims.get("role")
+        if role:
+            fallback.append(str(role))
+
+        groups_raw = self.claims.get("groups")
+        groups: List[str] = []
+        if isinstance(groups_raw, str) and groups_raw.strip():
+            try:
+                parsed = json.loads(groups_raw)
+                groups = [str(item) for item in parsed] if isinstance(parsed, list) else [groups_raw]
+            except (TypeError, ValueError):
+                groups = [groups_raw]
+        elif isinstance(groups_raw, list):
+            groups = [str(item) for item in groups_raw]
+
+        for group in groups:
+            if group not in fallback:
+                fallback.append(group)
+        return fallback
 
     def subject(self) -> Optional[str]:
         """Get the subject from claims."""

{api_foundry_query_engine-0.8.74 → api_foundry_query_engine-0.8.77}/api_foundry_query_engine/utils/token_decoder.py

@@ -33,9 +33,7 @@ def _log_jwt_configuration():
     log.debug("=== JWT Configuration Debug ===")
     log.debug("JWKS_HOST: %s", os.getenv("JWKS_HOST", "NOT_SET"))
     log.debug("JWT_ISSUER: %s", os.getenv("JWT_ISSUER", "NOT_SET"))
-    log.debug(
-        "JWT_ALLOWED_AUDIENCES: %s", os.getenv("JWT_ALLOWED_AUDIENCES", "NOT_SET")
-    )
+    log.debug("JWT_ALLOWED_AUDIENCES: %s", os.getenv("JWT_ALLOWED_AUDIENCES", "NOT_SET"))
     log.debug("ANONYMOUS_ROLE: %s", os.getenv("ANONYMOUS_ROLE", "NOT_SET"))
     log.debug(
         "TOKEN_VALIDATOR_LAMBDA_ARN: %s",
@@ -65,9 +63,7 @@ class LambdaTokenValidator:
             log.error("boto3 not available for Lambda token validation")
             raise ImportError("boto3 is required for Lambda token validation")
 
-    def validate(
-        self, token: str, method_arn: str = "arn:aws:execute-api:*:*:*"
-    ) -> Dict[str, Any]:
+    def validate(self, token: str, method_arn: str = "arn:aws:execute-api:*:*:*") -> Dict[str, Any]:
         """
         Invoke AWS Lambda TOKEN authorizer.
 
@@ -129,11 +125,7 @@ def _extract_event_entity_and_action(event: Dict[str, Any]) -> tuple[Optional[st
     resource = event.get("resource") or event.get("path") or ""
     parts = [p for p in str(resource).split("/") if p]
     api_prefixes = {"api", "v1", "v2", "v3"}
-    literal_parts = [
-        p
-        for p in parts
-        if p not in api_prefixes and not (p.startswith("{") and p.endswith("}"))
-    ]
+    literal_parts = [p for p in parts if p not in api_prefixes and not (p.startswith("{") and p.endswith("}"))]
     entity = "_".join(literal_parts) if literal_parts else None
     method = str(event.get("httpMethod", "")).upper()
     action = METHOD_TO_ACTION.get(method, "read")
@@ -194,9 +186,7 @@ def _route_explicitly_allows_role(event: Dict[str, Any], role: Optional[str]) ->
 
     _, action = _extract_event_entity_and_action(event)
     permissions = _normalize_permissions(_get_route_permissions(event))
-    action_permissions = permissions.get("default", {}).get(
-        _normalize_permission_action(action), {}
-    )
+    action_permissions = permissions.get("default", {}).get(_normalize_permission_action(action), {})
     return role in action_permissions
 
 
@@ -260,12 +250,7 @@ def token_decoder(
     config_lambda_arn = lambda_validator_arn or os.getenv("TOKEN_VALIDATOR_LAMBDA_ARN")
 
     # If no config provided, allow for runtime configuration
-    if (
-        not config_anonymous_role
-        and not jwks_url
-        and not os.getenv("JWKS_HOST")
-        and not config_lambda_arn
-    ):
+    if not config_anonymous_role and not jwks_url and not os.getenv("JWKS_HOST") and not config_lambda_arn:
         pass
 
     def decorator(handler: Callable) -> Callable:
@@ -288,13 +273,9 @@ def token_decoder(
                 return handler(event, context)
 
             # Determine configuration sources
-            config_lambda_arn = lambda_validator_arn or os.getenv(
-                "TOKEN_VALIDATOR_LAMBDA_ARN"
-            )
+            config_lambda_arn = lambda_validator_arn or os.getenv("TOKEN_VALIDATOR_LAMBDA_ARN")
             config_jwks_url = (
-                jwks_url or f"{os.getenv('JWKS_HOST')}/.well-known/jwks.json"
-                if os.getenv("JWKS_HOST")
-                else None
+                jwks_url or f"{os.getenv('JWKS_HOST')}/.well-known/jwks.json" if os.getenv("JWKS_HOST") else None
             )
             config_issuer = issuer or os.getenv("JWT_ISSUER")
             config_audience = (
@@ -321,14 +302,10 @@ def token_decoder(
                 and os.getenv("SKIP_CLAIMS_CHECK", "").lower() == "true"
                 and _route_explicitly_allows_role(event, config_anonymous_role)
             ):
-                log.debug(
-                    "SKIP_CLAIMS_CHECK enabled; using anonymous role without inline token validation"
-                )
+                log.debug("SKIP_CLAIMS_CHECK enabled; using anonymous role without inline token validation")
                 if "requestContext" not in event:
                     event["requestContext"] = {}
-                event["requestContext"]["authorizer"] = {
-                    "roles": [config_anonymous_role]
-                }
+                event["requestContext"]["authorizer"] = {"roles": [config_anonymous_role]}
                 return handler(event, context)
 
             # Skip all validation if no method configured
@@ -338,13 +315,9 @@ def token_decoder(
                     log.debug("Using anonymous role: %s", config_anonymous_role)
                     if "requestContext" not in event:
                         event["requestContext"] = {}
-                    event["requestContext"]["authorizer"] = {
-                        "roles": [config_anonymous_role]
-                    }
+                    event["requestContext"]["authorizer"] = {"roles": [config_anonymous_role]}
                 elif config_anonymous_role:
-                    log.error(
-                        "Anonymous role configured but route does not explicitly allow it"
-                    )
+                    log.error("Anonymous role configured but route does not explicitly allow it")
                     return {
                         "statusCode": 401,
                         "headers": {"Content-Type": "application/json"},
@@ -365,9 +338,7 @@ def token_decoder(
                             "Configuring Lambda validator: %s",
                             config_lambda_arn,
                         )
-                        wrapper._lambda_validator = LambdaTokenValidator(
-                            config_lambda_arn
-                        )
+                        wrapper._lambda_validator = LambdaTokenValidator(config_lambda_arn)
                     else:
                         wrapper._lambda_validator = None
 
@@ -380,9 +351,7 @@ def token_decoder(
                         wrapper._jwt_decoder = JWTDecoder(
                             jwks_url=config_jwks_url,
                             issuer=config_issuer,
-                            allowed_audiences=set(config_audience)
-                            if config_audience
-                            else None,
+                            allowed_audiences=set(config_audience) if config_audience else None,
                             algorithms=config_algorithms,
                             anonymous_role=config_anonymous_role,
                         )
@@ -498,9 +467,7 @@ class JWTDecoder:
         if jwks_url:
             self.public_key = self.fetch_public_key_from_jwks(jwks_url)
             if not self.public_key:
-                raise ValueError(
-                    f"Failed to fetch public key from JWKS URL: {jwks_url}"
-                )
+                raise ValueError(f"Failed to fetch public key from JWKS URL: {jwks_url}")
         else:
             self.public_key = None
 
@@ -510,9 +477,7 @@ class JWTDecoder:
             self.algorithms,
         )
 
-    def fetch_public_key_from_jwks(
-        self, jwks_url: str, kid: Optional[str] = None
-    ) -> Optional[str]:
+    def fetch_public_key_from_jwks(self, jwks_url: str, kid: Optional[str] = None) -> Optional[str]:
         """
         Fetch the public key from a JWKS endpoint.
 
@@ -555,9 +520,7 @@ class JWTDecoder:
                     log.warning("Key ID %s not found, using first key", kid)
             if not key:
                 key = keys[0]
-                log.debug(
-                    "Using first available key with kid: %s", key.get("kid", "unknown")
-                )
+                log.debug("Using first available key with kid: %s", key.get("kid", "unknown"))
             # Convert JWK to PEM (requires cryptography)
 
             def b64url_decode(val):
@@ -583,15 +546,11 @@ class JWTDecoder:
             if token:
                 return self.decode_token(token)
             elif self.anonymous_role:
-                log.debug(
-                    "No token found, using anonymous role: %s", self.anonymous_role
-                )
+                log.debug("No token found, using anonymous role: %s", self.anonymous_role)
                 return {"roles": [self.anonymous_role]}
             else:
                 log.error("No token found and no anonymous role configured")
-                raise ValueError(
-                    "Authentication required: no token provided and no anonymous access configured"
-                )
+                raise ValueError("Authentication required: no token provided and no anonymous access configured")
         except ValueError as e:
             if self.anonymous_role and "No authorization header" in str(e):
                 log.debug("Token parsing failed, using anonymous role: %s", str(e))
@@ -618,11 +577,7 @@ class JWTDecoder:
         auth_token_parts = auth_header.split(" ")
         log.debug("Authorization header parts: %d", len(auth_token_parts))
 
-        if (
-            len(auth_token_parts) != 2
-            or auth_token_parts[0].lower() != "bearer"
-            or not auth_token_parts[1]
-        ):
+        if len(auth_token_parts) != 2 or auth_token_parts[0].lower() != "bearer" or not auth_token_parts[1]:
             log.error("Invalid authorization header format")
             raise ValueError("Invalid AuthorizationToken.")
 
@@ -682,9 +637,7 @@ class JWTDecoder:
             log.debug("Token audience claim: %s", token_aud)
 
             # Normalize token audience to a list for comparison
-            token_auds = (
-                [token_aud] if isinstance(token_aud, str) else list(token_aud or [])
-            )
+            token_auds = [token_aud] if isinstance(token_aud, str) else list(token_aud or [])
             token_auds = [str(a).strip() for a in token_auds if str(a).strip()]
             log.debug("Normalized token audiences: %s", token_auds)
 

api_foundry_query_engine-0.8.74/api_foundry_query_engine/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.8.74"