aws-elasticache-integration-client 0.0.2rc1__tar.gz

aws_elasticache_integration_client-0.0.2rc1/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

aws_elasticache_integration_client-0.0.2rc1/MANIFEST.in

@@ -0,0 +1,2 @@
+# The tests need fixtures the sdist does not carry (tests/mock.py), so leave them out.
+prune tests

aws_elasticache_integration_client-0.0.2rc1/PKG-INFO

@@ -0,0 +1,264 @@
+Metadata-Version: 2.4
+Name: aws-elasticache-integration-client
+Version: 0.0.2rc1
+Summary: ElastiCache Integrations for AWS SDK for Python (Boto3) DynamoDB clients.
+License: Apache-2.0
+Project-URL: Repository, https://github.com/awslabs/aws-elasticache-integration-client
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3<2,>=1.43
+Requires-Dist: botocore<2,>=1.43
+Requires-Dist: cel-python>=0.1
+Requires-Dist: developer-toolkit-elasticache<2,>=1.1
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Requires-Dist: pytest-cov>=4; extra == "test"
+Requires-Dist: cryptography>=42; extra == "test"
+Requires-Dist: packaging>=24; extra == "test"
+Provides-Extra: dev
+Requires-Dist: ruff==0.17.3; extra == "dev"
+Requires-Dist: mypy==2.4.1; extra == "dev"
+Requires-Dist: build==1.6.1; extra == "dev"
+Requires-Dist: twine==7.0.0; extra == "dev"
+Dynamic: license-file
+
+# ElastiCacheIntegrations (Python client)
+
+
+## Install & test
+
+```bash
+cd python
+pip install -e '.[test]'   # runtime deps plus pytest and TLS test fixtures
+python -m pytest           # see tests/README.md for details
+pip install -e '.[dev]'    # pinned ruff, mypy, build, twine
+ruff format --check . && ruff check . && mypy
+```
+
+Runtime requires Python ≥ 3.10. See [`tests/README.md`](tests/README.md) for the test layout and
+how to run the unit vs. end-to-end tests.
+
+## Releases
+
+Python publication is driven by annotated Git tags. Stable releases use
+`vMAJOR.MINOR.PATCH`; release candidates use `vMAJOR.MINOR.PATCH-rc.N`, which maps to the
+PEP 440 version `MAJOR.MINOR.PATCHrcN`. A release tag applies to every language client: Node,
+Python, and Java release together.
+
+The tag is the release version source of truth. The `Python Release` workflow
+converts it to PEP 440 form and stamps `pyproject.toml` only in its temporary
+checkout, leaving the checked-in version at its local development baseline. It
+runs the reusable Python CI workflow, builds one wheel and one source
+distribution, and smoke tests the wheel on Python 3.10, 3.12, and 3.14 before
+waiting for approval from the protected `release` environment and publishing
+with PyPI trusted publishing and attestations. The workflow verifies the
+published version and attaches the distributions plus `python-SHA256SUMS` to
+the matching GitHub Release.
+
+The PyPI distribution name is `aws-elasticache-integration-client`, and the import package is
+`aws_elasticache_integration_client`. The PyPI project must
+configure `.github/workflows/python-release.yml` as its trusted publisher for the `release`
+environment. No PyPI token is used by the workflow. A manual workflow run performs the same test,
+packaging, artifact validation, and wheel smoke stages for an optional version
+without entering the release environment or publishing to PyPI.
+
+## Current state
+
+The library delivers the happy path: intercept → serialize → `aws.config` handshake →
+`aws.request` → return the cached response over a real TLS RESP3 connection, with
+session-level IAM auth. The transport runs on a **pure-Python RESP3 connector**
+(`ElastiCacheIntegrationsConnector`) — no Glide or other native dependency.
+Its per-request timeout defaults to 5000 ms and can be changed with the
+`cache_request_timeout` field (see below).
+
+Cache requests may complete out of order when the cache returns a request ID and later delivers
+the result in a `aws.response` RESP3 push. Deferred requests do not block later FIFO replies. If a
+deferred request times out, only that request is abandoned, and a late push for its ID is dropped.
+A timeout while a request is still FIFO-correlated closes the connection to prevent reply
+misrouting. A RESP3 push with an unrecognized kind is treated as protocol corruption and closes
+the connection. One connection sends at most 100 requests awaiting replies at once. Additional
+callers wait for a slot within their `cache_request_timeout` instead of failing at the concurrency
+boundary. Queue admission uses at most 75% of that timeout, reserving 25% to send and receive a
+reply. If that budget is exhausted, the request is not sent to the cache and continues to origin
+regardless of operation idempotency.
+
+## Installing into a client
+
+`install()` takes a boto3 client the application already built, so the client keeps its own
+profile, `botocore.config.Config`, endpoint and everything else, and its region and credentials
+are the ones the cache is authenticated with.
+
+```python
+import boto3
+import aws_elasticache_integration_client
+
+ddb = boto3.client("dynamodb", region_name="us-east-1")
+
+aws_elasticache_integration_client.install(
+    client=ddb, endpoint="my-cache:6379", cache_name="my-cache"
+)
+
+ddb.get_item(TableName="my-table", Key={"id": {"S": "1"}})  # unchanged
+```
+
+| Argument | Default | Meaning |
+|---|---|---|
+| `client` | required | The boto3 client to route through the cache. |
+| `endpoint` | required | Cache endpoint as `host:port`. |
+| `cache_name` | required | The ElastiCache Serverless cache name. |
+| `user_id` | `default.iam-user` | ElastiCache IAM user id. |
+| `verify` | `True` | Verify the cache's TLS certificate. `False` is for self-signed test rigs only. |
+| `ca_certs` | `None` | CA bundle for the cache's certificate, instead of the system trust store. |
+| `client_configuration` | all defaults | See [Configuration](#configuration). |
+
+Everything above describes the connection to the **cache**, which the boto3 client knows nothing
+about. TLS to AWS, and everything else about reaching the service, stays the client's own
+configuration.
+
+Closing the client disconnects the cache first, then closes the client as usual. A client can
+have the cache installed once; a second `install()` on the same client raises
+`ElastiCacheIntegrationsConfigError`.
+
+## Configuration
+
+Optional ElastiCacheIntegrations settings go in one `aws_elasticache_integration_client.ElastiCacheIntegrationsClientConfiguration`, passed as
+`client_configuration`. Every field has a default, so set only what you change. Cache policy
+settings are sent to the cache through `aws.config`.
+
+```python
+aws_elasticache_integration_client.install(
+    client=ddb,
+    endpoint="my-cache:6379",
+    cache_name="my-cache",
+    client_configuration=aws_elasticache_integration_client.ElastiCacheIntegrationsClientConfiguration(
+        cache_request_timeout=2000,
+        connection_timeout=5000,
+        fallback_duration=60,
+        cache_policy_overrides={"cached_tables": ["Users", "Sessions"]},
+        iam_token_refresh_delay=300,
+    ),
+)
+```
+
+| Field | Default | Meaning |
+|---|---|---|
+| `cache_request_timeout` | 5000 ms | How long to wait for each ElastiCacheIntegrations request's reply. |
+| `connection_timeout` | 5000 ms | How long to try at startup, and how long a request waits for reconnection after a connection is lost. |
+| `fallback_duration` | `None` (indefinite) | How long requests may go to the origin service while there is no cache connection (see below). |
+| `cache_policy_overrides` | `None` | Settings that change what ElastiCacheIntegrations caches: `cached_tables` and `cached_operations` allowlists, and the cache entry lifetimes. See below. |
+| `cache_policy_timeout` | 3600 s | How long ElastiCacheIntegrations may use a cache policy without confirmation from the cache. |
+| `iam_token_refresh_delay` | 300 s | When the IAM toolkit signs a replacement token in the background. |
+
+Building `ElastiCacheIntegrationsClientConfiguration` raises `ElastiCacheIntegrationsConfigError` for a value that is not usable.
+
+### Cache policy overrides
+
+`cached_tables` and `cached_operations` are **allowlists**, and they intersect: only those
+operations, on only those tables. Each one empty or absent means everything, so the example
+above caches `Users` and `Sessions` and nothing else. There is no exclude form — to keep one
+table out of the cache, name the tables that should be in it.
+
+Lifetimes are set per category (`item_ttl`, `item_negative_ttl`, `query_ttl`, `scan_ttl`),
+connection-wide at the top level or per table under `table_overrides`; a `table_overrides`
+entry is settings only and never puts a table in scope.
+
+```python
+cache_policy_overrides = {
+    "cached_tables": ["Users", "Sessions"],
+    "cached_operations": ["GetItem", "Query"],
+    "item_ttl": 500,
+    "item_negative_ttl": 0,  # do not cache "this item does not exist"
+    "table_overrides": {"Users": {"item_ttl": 60}},
+}
+```
+
+A value the cache does not allow is refused at connect time with
+`ElastiCacheIntegrationsOverridesRejected`, rather than being quietly adjusted. A field name
+the cache does not recognise is **ignored**, so a typo fails silently — the names above are
+the whole set.
+
+## IAM authentication
+
+IAM token generation and refresh come from the Amazon ElastiCache developer toolkit, the
+[`developer-toolkit-elasticache`](https://pypi.org/project/developer-toolkit-elasticache/) package on PyPI.
+The toolkit validates and lowercases cache names and user IDs, re-reads the credentials for
+every newly signed token, and owns the SigV4 signing contract. ElastiCacheIntegrations sends the bearer token
+only in the TLS-protected `HELLO 3 AUTH` exchange; origin request signing remains owned by boto3.
+
+The credentials are the ones behind the boto3 client, so the cache is authenticated as the same
+principal as the requests, and rotation (SSO, assume-role, container, instance metadata) keeps
+working because the credentials object refreshes itself. A client built with
+`signature_version=UNSIGNED` carries none and is rejected.
+
+`install()` creates a toolkit token manager. It caches the current token, signs a
+replacement in the background after 300 seconds by default, and force-refreshes when a live
+connection explicitly rejects the cached token. Set `iam_token_refresh_delay` to customize that
+background signing point through `ElastiCacheIntegrationsClientConfiguration`; it must be greater than 0 and less
+than 880 seconds, preserving the toolkit's 20-second safety margin on the 15-minute token.
+
+Independently, ElastiCacheIntegrations sends `AUTH` on the live connection every 15 minutes to refresh the proxy's
+forward-access session. A rejected background `AUTH` leaves the existing connection alive on its
+previous authentication and is retried with backoff. Only a timeout or unexpected reply closes the
+connection for FIFO safety. Closing the boto3 client stops both ElastiCacheIntegrations re-authentication and the
+toolkit's token refresh.
+
+## Reconnection and fallback
+
+A lost connection is rebuilt in the background and retried until it succeeds. Right after the
+loss, a request waits up to `connection_timeout` for the new connection. If the connection is not
+back by then, the AWS SDK sends the request to the origin service using the application's own
+credentials. The same timeout bounds startup; client creation fails if no connection is ready.
+
+How long requests may fall back, counted from the end of `connection_timeout`, is controlled by
+`fallback_duration`:
+
+| `fallback_duration` | Behavior |
+|---|---|
+| `None` (default), or negative | Serve from the origin service indefinitely, so a cache outage never becomes an application outage. |
+| `N > 0` | Serve from the origin service for N seconds, then raise `ElastiCacheIntegrationsCacheUnavailable`. |
+| `0` | Never fall back — wait up to `connection_timeout` for a connection, then raise `ElastiCacheIntegrationsCacheUnavailable`. |
+
+The window is **per outage, not a total budget**: `fallback_duration=60` allows 60 seconds of
+fallback each time the connection is lost, and a connection that keeps flapping gets a fresh 60
+seconds after every successful reconnect.
+
+`aws_elasticache_integration_client.ElastiCacheIntegrationsCacheUnavailable` subclasses botocore's `ConnectionClosedError`, so it is retryable and
+an application's existing `except botocore...` blocks already catch it. Retryable cuts both ways:
+under the SDK's default retry mode a raised request is retried, which is usually what you want — a
+retry after backoff can land once the connection is back. With `fallback_duration=0`, a routed
+request waits only for the part of `connection_timeout` left in the current outage. Later retries in
+the same outage do not restart that wait.
+
+When there is no live cache connection, the request has not been sent and can safely pass through
+for any operation while the fallback window remains open. After a request is sent, origin fallback
+is allowed only when the connection drops and the operation is in the shared replay-safe catalog.
+While the connection remains healthy, `ORIGIN_ERROR` becomes a botocore-retryable error only for a
+cataloged operation. `AUTH_ERROR` closes the stale connection and passes the rejected
+request through while reconnection obtains fresh authentication. With `fallback_duration=0`, the
+rejected request raises `ElastiCacheIntegrationsCacheUnavailable` at once instead. Other RESP
+errors, malformed replies, and failures for non-idempotent operations propagate without origin
+fallback.
+
+## Cache policy timeout
+
+ElastiCacheIntegrations automatically confirms the resolved cache policy in the background through `aws.config`.
+A new policy replaces the current one. An unchanged reply confirms that the current policy is still
+valid. Both replies restart the timeout.
+
+If confirmation fails, ElastiCacheIntegrations keeps using the last confirmed policy. That tolerance is bounded by
+`cache_policy_timeout`, one hour by default. After the timeout, the next failed confirmation drops
+the connection so a replacement can fetch a current policy. Requests follow the `fallback_duration`
+rules while the connection is being replaced.
+
+## Next steps:
+
+- **Observability.** Reconnection and config staleness are logged but emit no metrics, so under the
+  default `fallback_duration` a cache outage has no symptom other than the origin service's bill.
+- **Detecting a silently dead peer.** A peer that vanishes without closing the socket is noticed only
+  when the next request times out. Closing that gap needs a periodic health check.
+- **IAM authentication validation.** Exercise the toolkit-backed flow against a real IAM-enabled
+  cache in addition to the hermetic mock-cache coverage.
+- **Public TTL / NTTL controls.** TTL/NTTL policy is resolved server-side from the
+  `aws.config` overrides; the public API does not expose per-table or per-request TTL
+  overrides yet.