api-foundry-query-engine 0.8.83__tar.gz → 0.8.84__tar.gz

{api_foundry_query_engine-0.8.83 → api_foundry_query_engine-0.8.84}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: api-foundry-query-engine
-Version: 0.8.83
+Version: 0.8.84
 Summary: The AWS lambda service handler use by the `api_foundry` project is a powerful tool designed to automate the deployment of REST APIs on AWS using Lambda services to access and interact with relational databases (RDBMS). This project leverages the OpenAPI specification to define and manage the APIs
 Project-URL: Documentation, https://github.com/DanRepik/api-foundry
 Project-URL: Source, https://github.com/DanRepik/api-foundry

api_foundry_query_engine-0.8.84/api_foundry_query_engine/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.84"

{api_foundry_query_engine-0.8.83 → api_foundry_query_engine-0.8.84}/api_foundry_query_engine/utils/logger.py

@@ -1,14 +1,36 @@
 import logging
 import os
 
-# Configuring the logging module with basic settings, including format and log level,
-# where the log level is obtained from the environment variable LOGGING_LEVEL
-# with a default of DEBUG, and force=True to ensure the configuration is applied immediately.
+# The root log level comes from LOGGING_LEVEL, defaulting to INFO. force=True
+# so the configuration applies even when the Lambda runtime has already
+# installed a handler.
+DEFAULT_LOGGING_LEVEL = "INFO"
+
+# At DEBUG, botocore logs every request it signs: the headers, including the
+# caller's x-amz-security-token, and the body -- which for the RDS Data API
+# carries every SQL parameter. These loggers are therefore held at WARNING
+# whatever LOGGING_LEVEL is, unless AWS_SDK_LOGGING_LEVEL explicitly says
+# otherwise.
+AWS_SDK_LOGGERS = ("boto3", "botocore", "s3transfer", "urllib3")
+DEFAULT_AWS_SDK_LOGGING_LEVEL = "WARNING"
+
+
+def _logging_level() -> str:
+    return os.getenv("LOGGING_LEVEL", DEFAULT_LOGGING_LEVEL).upper()
+
+
+def _quiet_aws_sdk_loggers() -> None:
+    level = os.getenv("AWS_SDK_LOGGING_LEVEL", DEFAULT_AWS_SDK_LOGGING_LEVEL).upper()
+    for name in AWS_SDK_LOGGERS:
+        logging.getLogger(name).setLevel(level)
+
+
 logging.basicConfig(
     format="%(name)s:%(lineno)s - %(levelname)s - %(message)s",
-    level=os.getenv("LOGGING_LEVEL", "DEBUG").upper(),
+    level=_logging_level(),
     force=True,
 )
+_quiet_aws_sdk_loggers()
 
 WARN = logging.WARN
 INFO = logging.INFO
@@ -26,14 +48,9 @@ def logger(name=None):
         logging.Logger: Logger object with the specified name or the root logger.
 
     """
-    # Retrieving the logging level from the environment variable LOGGING_LEVEL
-    # with a default of DEBUG, and converting it to uppercase
-    loggingLevel = os.getenv("LOGGING_LEVEL", "DEBUG").upper()
-
-    # Setting the logging level for the root logger to the obtained logging level
-    logging.getLogger().setLevel(loggingLevel)
-
-    # Returning a logger object with the specified name or the root logger
+    # Re-applied on every call: LOGGING_LEVEL may have changed since import.
+    logging.getLogger().setLevel(_logging_level())
+    _quiet_aws_sdk_loggers()
     return logging.getLogger(name)
 
 

{api_foundry_query_engine-0.8.83 → api_foundry_query_engine-0.8.84}/api_foundry_query_engine/utils/token_decoder.py

@@ -43,6 +43,27 @@ def _log_jwt_configuration():
     log.debug("===============================")
 
 
+# Headers never written to the log, even at DEBUG: bearer tokens, session
+# cookies and API keys are credentials, not diagnostics.
+_REDACTED_HEADERS = frozenset({"authorization", "cookie", "x-api-key"})
+
+
+def _redacted_event(event: Dict[str, Any]) -> Dict[str, Any]:
+    """A copy of `event` safe to log: credential headers masked in both
+    `headers` and `multiValueHeaders`, matched case-insensitively."""
+    if not isinstance(event, dict):
+        return event
+    redacted = dict(event)
+    for key in ("headers", "multiValueHeaders"):
+        headers = event.get(key)
+        if isinstance(headers, dict):
+            redacted[key] = {
+                name: ("[REDACTED]" if str(name).lower() in _REDACTED_HEADERS else value)
+                for name, value in headers.items()
+            }
+    return redacted
+
+
 class LambdaTokenValidator:
     """Validates tokens by invoking an AWS Lambda TOKEN authorizer."""
 
@@ -265,7 +286,8 @@ def token_decoder(
             if log.isEnabledFor(logging.DEBUG):
                 _log_jwt_configuration()
 
-            log.debug("Event structure: %s", json.dumps(event, default=str))
+            if log.isEnabledFor(logging.DEBUG):
+                log.debug("Event structure: %s", json.dumps(_redacted_event(event), default=str))
 
             # Check if authorizer already exists (gateway validated)
             if event.get("requestContext", {}).get("authorizer"):

api_foundry_query_engine-0.8.83/api_foundry_query_engine/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.8.83"