aws-lambda-powertools 3.34.0__tar.gz → 3.35.0__tar.gz

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: aws_lambda_powertools
-Version: 3.34.0
+Version: 3.35.0
 Summary: Powertools for AWS Lambda (Python) is a developer toolkit to implement Serverless best practices and increase developer velocity.
 License: MIT
 Keywords: aws_lambda_powertools,aws,tracing,logging,lambda,powertools,feature_flags,idempotency,middleware

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/event_handler/api_gateway.py

@@ -3035,21 +3035,18 @@ class ApiGatewayResolver(BaseRouter):
             An optional prefix to be added to the originally defined rule
         """
 
-        # Add reference to parent ApiGatewayResolver to support use cases where people subclass it to add custom logic
-        router.api_resolver = self
-
         logger.debug("Merging App context with Router context")
         self.context.update(**router.context)
 
+        # Delegate request state to the resolver after preserving the router context.
+        router.api_resolver = self
+
         logger.debug("Appending Router middlewares into App middlewares.")
         self._router_middlewares = self._router_middlewares + router._router_middlewares
 
         logger.debug("Appending Router exception_handler into App exception_handler.")
         self.exception_handler_manager.update_exception_handlers(router._exception_handlers)
 
-        # use pointer to allow context clearance after event is processed e.g., resolve(evt, ctx)
-        router.context = self.context
-
         # Iterate through the routes defined in the router to configure and apply middlewares for each route
         for route, func in router._routes.items():
             new_route = route
@@ -3112,9 +3109,48 @@ class Router(BaseRouter):
         self._routes: dict[tuple, Callable] = {}
         self._routes_with_middleware: dict[tuple, list[Callable]] = {}
         self.api_resolver: BaseRouter | None = None
-        self.context = {}  # early init as customers might add context before event resolution
+        self._context: dict = {}  # early init as customers might add context before event resolution
         self._exception_handlers: dict[type, Callable] = {}
 
+    @property
+    def current_event(self) -> BaseProxyEvent:
+        if self.api_resolver is not None:
+            return self.api_resolver.current_event
+        return BaseRouter.current_event
+
+    @current_event.setter
+    def current_event(self, value: BaseProxyEvent) -> None:
+        if self.api_resolver is not None:
+            self.api_resolver.current_event = value
+        else:
+            BaseRouter.current_event = value
+
+    @property
+    def lambda_context(self) -> LambdaContext:
+        if self.api_resolver is not None:
+            return self.api_resolver.lambda_context
+        return BaseRouter.lambda_context
+
+    @lambda_context.setter
+    def lambda_context(self, value: LambdaContext) -> None:
+        if self.api_resolver is not None:
+            self.api_resolver.lambda_context = value
+        else:
+            BaseRouter.lambda_context = value
+
+    @property
+    def context(self) -> dict:
+        if self.api_resolver is not None:
+            return self.api_resolver.context
+        return self._context
+
+    @context.setter
+    def context(self, value: dict) -> None:
+        if self.api_resolver is not None:
+            self.api_resolver.context = value
+        else:
+            self._context = value
+
     def route(
         self,
         rule: str,

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/event_handler/http_resolver.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import base64
+from contextvars import ContextVar
+from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Any, Callable
 from urllib.parse import parse_qs
 
@@ -13,6 +15,8 @@ from aws_lambda_powertools.shared.headers_serializer import BaseHeadersSerialize
 from aws_lambda_powertools.utilities.data_classes.common import BaseProxyEvent
 
 if TYPE_CHECKING:
+    from collections.abc import Mapping, MutableMapping
+
     from aws_lambda_powertools.shared.cookies import Cookie
 
 
@@ -95,7 +99,7 @@ class HttpProxyEvent(BaseProxyEvent):
         return instance
 
     @classmethod
-    def from_asgi(cls, scope: dict[str, Any], body: bytes | None = None) -> HttpProxyEvent:
+    def from_asgi(cls, scope: Mapping[str, Any], body: bytes | None = None) -> HttpProxyEvent:
         """
         Create an HttpProxyEvent from an ASGI scope dict.
 
@@ -159,6 +163,14 @@ class MockLambdaContext:
         return 300000  # 5 minutes
 
 
+@dataclass
+class _RequestState:
+    event: BaseProxyEvent | None = None
+    lambda_context: Any = None
+    context: dict = field(default_factory=dict)
+    processed_stack_frames: list[str] = field(default_factory=list)
+
+
 class HttpResolverLocal(ApiGatewayResolver):
     """
     ASGI-compatible HTTP resolver.
@@ -204,6 +216,8 @@ class HttpResolverLocal(ApiGatewayResolver):
         strip_prefixes: list[str | Any] | None = None,
         enable_validation: bool = False,
     ):
+        self._startup_state = _RequestState()
+        self._request_state: ContextVar[_RequestState | None] = ContextVar("local_http_request", default=None)
         super().__init__(
             proxy_type=ProxyEventType.APIGatewayProxyEvent,  # Use REST API format internally
             cors=cors,
@@ -212,7 +226,46 @@ class HttpResolverLocal(ApiGatewayResolver):
             strip_prefixes=strip_prefixes,
             enable_validation=enable_validation,
         )
-        self._is_async_mode = False
+
+    @property
+    def _state(self) -> _RequestState:
+        return self._request_state.get() or self._startup_state
+
+    # Powertools declares these as mutable attributes. Properties preserve that
+    # interface while directing each task to its own state. asyncio.to_thread
+    # propagates the ContextVar, so middleware sees the same request dictionary.
+    @property
+    def current_event(self) -> BaseProxyEvent:
+        # Preserve the inherited synchronous resolve() path outside ASGI calls.
+        return self._state.event or BaseRouter.current_event
+
+    @current_event.setter
+    def current_event(self, value: BaseProxyEvent) -> None:
+        self._state.event = value
+
+    @property
+    def lambda_context(self) -> Any:
+        return self._state.lambda_context or BaseRouter.lambda_context
+
+    @lambda_context.setter
+    def lambda_context(self, value: Any) -> None:
+        self._state.lambda_context = value
+
+    @property
+    def context(self) -> dict:
+        return self._state.context
+
+    @context.setter
+    def context(self, value: dict) -> None:
+        self._state.context = value
+
+    @property
+    def processed_stack_frames(self) -> list[str]:
+        return self._state.processed_stack_frames
+
+    @processed_stack_frames.setter
+    def processed_stack_frames(self, value: list[str]) -> None:
+        self._state.processed_stack_frames = value
 
     def _to_proxy_event(self, event: dict) -> BaseProxyEvent:
         """Convert event dict to HttpProxyEvent."""
@@ -234,7 +287,7 @@ class HttpResolverLocal(ApiGatewayResolver):
         response_builder = await super()._resolve_async()
         return response_builder.build(self.current_event, self._cors)
 
-    async def asgi_handler(self, scope: dict, receive: Callable, send: Callable) -> None:
+    async def asgi_handler(self, scope: MutableMapping[str, Any], receive: Callable, send: Callable) -> None:
         """
         ASGI interface - allows running with uvicorn/hypercorn/etc.
 
@@ -274,25 +327,27 @@ class HttpResolverLocal(ApiGatewayResolver):
         # Create mock Lambda context
         context: Any = MockLambdaContext()
 
-        # Set up resolver state (similar to resolve())
-        BaseRouter.current_event = self._to_proxy_event(event._data)
-        BaseRouter.lambda_context = context
-
-        self._is_async_mode = True
-
+        # Never write BaseRouter's class attributes: another ASGI request may
+        # enter while validation or the handler is awaiting I/O.
+        state = _RequestState(
+            event=self._to_proxy_event(event._data),
+            lambda_context=context,
+            context=self._startup_state.context.copy(),
+        )
+        token = self._request_state.set(state)
         try:
-            # Use async resolve
             response = await self._resolve_async()
         finally:
-            self._is_async_mode = False
-            self.clear_context()
+            # Reset only this task's binding. Middleware threads may still be
+            # unwinding after cancellation and retain their request's state.
+            self._request_state.reset(token)
 
         # Send HTTP response
         await self._send_response(send, response)
 
     async def __call__(  # type: ignore[override]
         self,
-        scope: dict,
+        scope: MutableMapping[str, Any],
         receive: Callable,
         send: Callable,
     ) -> None:

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/event_handler/openapi/schema_generator.py

@@ -538,7 +538,7 @@ def _resolve_response_payload(
     model_payload_typed = cast(OpenAPIResponseContentModel, payload)
     return_field = next(
         filter(
-            lambda model: model.type_ is model_payload_typed["model"],
+            lambda model: model.type_ == model_payload_typed["model"],
             dependant.response_extra_models,
         ),
     )

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/metrics/metrics.py

@@ -174,7 +174,6 @@ class Metrics:
         )
 
     def set_default_dimensions(self, **dimensions) -> None:
-        self.provider.set_default_dimensions(**dimensions)
         """Persist dimensions across Lambda invocations
 
         Parameters
@@ -195,9 +194,7 @@ class Metrics:
             def lambda_handler():
                 return True
         """
-        for name, value in dimensions.items():
-            self.add_dimension(name, value)
-
+        self.provider.set_default_dimensions(**dimensions)
         self.default_dimensions.update(**dimensions)
 
     def clear_default_dimensions(self) -> None:

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/metrics/provider/cloudwatch_emf/cloudwatch.py

@@ -87,7 +87,7 @@ class AmazonCloudWatchEMFProvider(BaseProvider):
     ):
         self.metric_set = metric_set if metric_set is not None else {}
         self.dimension_set = dimension_set if dimension_set is not None else {}
-        self.default_dimensions = default_dimensions or {}
+        self.default_dimensions = default_dimensions if default_dimensions is not None else {}
         self.namespace = resolve_env_var_choice(choice=namespace, env=os.getenv(constants.METRICS_NAMESPACE_ENV))
         self.service = resolve_env_var_choice(choice=service, env=os.getenv(constants.SERVICE_NAME_ENV))
         self.function_name = function_name
@@ -317,7 +317,7 @@ class AmazonCloudWatchEMFProvider(BaseProvider):
             )
             return
 
-        if name in self.dimension_set or name in self.default_dimensions:
+        if name in self.dimension_set and self.dimension_set[name] != value:
             warnings.warn(
                 f"Dimension '{name}' has already been added. The previous value will be overwritten.",
                 category=PowertoolsUserWarning,

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/shared/version.py

@@ -1,3 +1,3 @@
 """Exposes version constant to avoid circular dependencies."""
 
-VERSION = "3.34.0"
+VERSION = "3.35.0"

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/batch/exceptions.py

@@ -6,9 +6,9 @@ from __future__ import annotations
 
 import traceback
 from types import TracebackType
-from typing import Optional, Tuple, Type
+from typing import Tuple, Type
 
-ExceptionInfo = Tuple[Optional[Type[BaseException]], Optional[BaseException], Optional[TracebackType]]
+ExceptionInfo = Tuple[Type[BaseException] | None, BaseException | None, TracebackType | None]
 
 
 class BaseBatchProcessingError(Exception):

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/batch/types.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import sys
-from typing import Optional, Type, TypedDict, Union
+from typing import Type, TypedDict, Union
 
 has_pydantic = "pydantic" in sys.modules
 
@@ -14,15 +14,16 @@ if has_pydantic:  # pragma: no cover
     )
     from aws_lambda_powertools.utilities.parser.models.kafka import KafkaRecordModel
 
-    BatchTypeModels = Optional[
+    BatchTypeModels = (
         Union[
             Type[SqsRecordModel],
             Type[DynamoDBStreamRecordModel],
             Type[KinesisDataStreamRecordModel],
             Type[KafkaRecordModel],
         ]
-    ]
-    BatchSqsTypeModel = Optional[Type[SqsRecordModel]]
+        | None
+    )
+    BatchSqsTypeModel = Type[SqsRecordModel] | None
 else:  # pragma: no cover
     BatchTypeModels = "BatchTypeModels"  # type: ignore
     BatchSqsTypeModel = "BatchSqsTypeModel"  # type: ignore

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/data_classes/api_gateway_authorizer_event.py

@@ -520,8 +520,11 @@ class APIGatewayAuthorizerResponse:
         """Adds a route to the internal lists of allowed or denied routes. Each object in
         the internal list contains a resource ARN and a condition statement. The condition
         statement can be null."""
-        if http_method != "*" and http_method not in HttpVerb.__members__:
-            allowed_values = [verb.value for verb in HttpVerb]
+        allowed_values = [verb.value for verb in HttpVerb]
+        if http_method in HttpVerb.__members__:
+            http_method = HttpVerb[http_method].value
+
+        if http_method not in allowed_values:
             raise ValueError(f"Invalid HTTP verb: '{http_method}'. Use either '{allowed_values}'")
 
         if not self._resource_pattern.match(resource):

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/data_masking/base.py

@@ -16,11 +16,11 @@ from typing import TYPE_CHECKING, Any
 from jsonpath_ng.ext import parse
 
 from aws_lambda_powertools.utilities.data_masking.exceptions import (
+    DataMaskingError,
     DataMaskingFieldNotFoundError,
     DataMaskingUnsupportedTypeError,
 )
 from aws_lambda_powertools.utilities.data_masking.provider import BaseProvider
-from aws_lambda_powertools.warnings import PowertoolsUserWarning
 
 if TYPE_CHECKING:
     from collections.abc import Callable, Mapping, Sequence
@@ -395,10 +395,10 @@ class DataMasking:
             if not result_parse:
                 if self.raise_on_missing_field:
                     # If the data for the field is not found, raise an exception.
-                    raise DataMaskingFieldNotFoundError(f"Field or expression {field_parse} not found in {data_parsed}")
+                    raise DataMaskingFieldNotFoundError(f"Field or expression {field_parse} not found")
                 else:
                     # If the data for the field is not found, warning.
-                    warnings.warn(f"Field or expression {field_parse} not found in {data_parsed}", stacklevel=2)
+                    warnings.warn(f"Field or expression {field_parse} not found", stacklevel=2)
 
             # For in-place updates, json_parse accepts a callback function
             # that receives 3 args: field_value, fields, field_name
@@ -427,31 +427,30 @@ class DataMasking:
         for path, rule in masking_rules.items():
             try:
                 jsonpath_expr = parse(f"$.{path}")
-                matches = jsonpath_expr.find(result)
+            except Exception as exc:
+                raise DataMaskingError(f"Invalid masking path: {path}") from exc
 
-                if not matches:
-                    warnings.warn(f"No matches found for path: {path}", stacklevel=2)
-                    continue
+            matches = jsonpath_expr.find(result)
+            if not matches:
+                if self.raise_on_missing_field:
+                    raise DataMaskingFieldNotFoundError(f"Field or expression {path} not found")
 
-                for match in matches:
-                    try:
-                        value = match.value
-                        if value is not None:
-                            masked_value = self.provider.erase(str(value), **rule)
-                            match.full_path.update(result, masked_value)
-
-                    except Exception as e:
-                        warnings.warn(
-                            f"Error masking value for path {path}: {str(e)}",
-                            category=PowertoolsUserWarning,
-                            stacklevel=2,
-                        )
-                        continue
-
-            except Exception as e:
-                warnings.warn(f"Error processing path {path}: {str(e)}", category=PowertoolsUserWarning, stacklevel=2)
+                warnings.warn(f"No matches found for path: {path}", stacklevel=2)
                 continue
 
+            for match in matches:
+                value = match.value
+                if value is None:
+                    continue
+
+                try:
+                    masked_value = self.provider.erase(str(value), **rule)
+                    match.full_path.update(result, masked_value)
+                except DataMaskingError:
+                    raise
+                except Exception as exc:
+                    raise DataMaskingError(f"Failed to mask field at path: {path}") from exc
+
         return result
 
     def _mask_nested_field(self, data: dict, field_path: str, mask_function):

aws_lambda_powertools-3.35.0/aws_lambda_powertools/utilities/data_masking/exceptions.py

@@ -0,0 +1,40 @@
+class DataMaskingError(Exception):
+    """
+    Base exception for data masking failures.
+    """
+
+
+class DataMaskingUnsupportedTypeError(DataMaskingError):
+    """
+    UnsupportedType Error
+    """
+
+
+class DataMaskingDecryptKeyError(DataMaskingError):
+    """
+    Decrypting with an invalid AWS KMS Key ARN.
+    """
+
+
+class DataMaskingEncryptKeyError(DataMaskingError):
+    """
+    Encrypting with an invalid AWS KMS Key ARN.
+    """
+
+
+class DataMaskingDecryptValueError(DataMaskingError):
+    """
+    Decrypting an invalid field.
+    """
+
+
+class DataMaskingContextMismatchError(DataMaskingError):
+    """
+    Decrypting with the incorrect encryption context.
+    """
+
+
+class DataMaskingFieldNotFoundError(DataMaskingError):
+    """
+    Field not found.
+    """

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/data_masking/provider/base.py

@@ -6,6 +6,7 @@ import re
 from typing import TYPE_CHECKING, Any
 
 from aws_lambda_powertools.utilities.data_masking.constants import DATA_MASKING_STRING
+from aws_lambda_powertools.utilities.data_masking.exceptions import DataMaskingError
 
 if TYPE_CHECKING:
     from collections.abc import Callable
@@ -183,8 +184,8 @@ class BaseProvider:
             if regex_pattern not in _regex_cache:
                 _regex_cache[regex_pattern] = re.compile(regex_pattern)
             return _regex_cache[regex_pattern].sub(mask_format, data)
-        except re.error:
-            return data
+        except re.error as exc:
+            raise DataMaskingError("Invalid regex pattern") from exc
 
     def _custom_erase(self, data: str) -> str:
         if not data:

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/feature_flags/appconfig.py

@@ -86,6 +86,10 @@ class AppConfigStore(StoreProvider):
             boto3_client=boto3_client,
             boto3_session=boto3_session,
         )
+        # Memoised envelope extraction: (raw document, extracted config). The Parameters cache hands back the
+        # same raw dict until expiry, so we can reuse the extracted result rather than re-running the JMESPath
+        # query and producing a new object on every call.
+        self._last_extracted: tuple[dict[str, Any], dict[str, Any]] | None = None
 
         # Override the user agent to use "feature_flags" instead of "parameters"
         self._register_feature_flags_user_agent()
@@ -140,11 +144,17 @@ class AppConfigStore(StoreProvider):
         config = self.get_raw_configuration
 
         if self.envelope:
+            if self._last_extracted is not None and self._last_extracted[0] is config:
+                self.logger.debug("Envelope enabled; reusing previously extracted config for cached document")
+                return self._last_extracted[1]
+
             self.logger.debug("Envelope enabled; extracting data from config", extra={"envelope": self.envelope})
-            config = jmespath_utils.query(
+            extracted = jmespath_utils.query(
                 data=config,
                 envelope=self.envelope,
                 jmespath_options=self.jmespath_options,
             )
+            self._last_extracted = (config, extracted)
+            return extracted
 
         return config

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/feature_flags/comparators.py

@@ -55,10 +55,15 @@ def compare_time_range(context_value: Any, condition_value: dict) -> bool:
     start_time = current_time.replace(hour=int(start_hour), minute=int(start_min))
     end_time = current_time.replace(hour=int(end_hour), minute=int(end_min))
 
-    if int(end_hour) < int(start_hour):
+    # Compare full minutes-since-midnight so that ranges within the same hour (e.g. 23:30 -> 23:00)
+    # are correctly detected as crossing midnight.
+    start_minutes = int(start_hour) * 60 + int(start_min)
+    end_minutes = int(end_hour) * 60 + int(end_min)
+
+    if end_minutes < start_minutes:
         # In normal circumstances, we need to assert **both** conditions
         """
-        # When the end hour is smaller than start hour, it means we are crossing a day's boundary.
+        # When the end time is earlier than start time, it means we are crossing a day's boundary.
         # In this case we need to assert that current_time is **either** on one side or the other side of the boundary
         #
         # ┌─────┐                                    ┌─────┐                                  ┌─────┐

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/feature_flags/constants.py

@@ -9,5 +9,5 @@ CONDITION_VALUE = "value"
 CONDITION_ACTION = "action"
 FEATURE_DEFAULT_VAL_TYPE_KEY = "boolean_type"
 TIME_RANGE_FORMAT = "%H:%M"  # hour:min 24 hours clock
-TIME_RANGE_PATTERN = re.compile(r"2[0-3]:[0-5]\d|[0-1]\d:[0-5]\d")  # 24 hour clock
+TIME_RANGE_PATTERN = re.compile(r"(?:2[0-3]|[01]\d):[0-5]\d")  # 24 hour clock, exactly HH:MM
 HOUR_MIN_SEPARATOR = ":"

{aws_lambda_powertools-3.34.0 → aws_lambda_powertools-3.35.0}/aws_lambda_powertools/utilities/feature_flags/feature_flags.py

@@ -81,11 +81,30 @@ class FeatureFlags:
         self.store = store
         self.logger = logger or logging.getLogger(__name__)
         self._exception_handlers: dict[Exception, Callable] = {}
+        # Last document that passed schema validation. We keep a strong reference so its id() can't be
+        # recycled by a different object, which lets us safely skip re-validation on store cache hits.
+        self._last_validated_config: dict | None = None
 
-    def _match_by_action(self, action: str, condition_value: Any, context_value: Any) -> bool:
+    def _match_by_action(
+        self,
+        action: str,
+        condition_value: Any,
+        context_value: Any,
+        context_key_present: bool = True,
+    ) -> bool:
         try:
             func = RULE_ACTION_MAPPING.get(action, lambda a, b: False)
-            return func(context_value, condition_value)
+            matched = func(context_value, condition_value)
+
+            if not context_key_present:
+                # A key absent from the context never satisfies a condition. Without this, `None` would be
+                # compared as a regular value and negative actions (NOT_EQUALS, NOT_IN, ...) would match.
+                # We still run the comparator first so that any exception it raises (e.g. ANY_IN_VALUE on a
+                # non-list) reaches registered validation exception handlers exactly as it did before.
+                self.logger.debug(f"context key not present, condition does not match: action={action}")
+                return False
+
+            return matched
         except Exception as exc:
             self.logger.debug(f"caught exception while matching action: action={action}, exception={str(exc)}")
 
@@ -115,9 +134,10 @@ class FeatureFlags:
             return False
 
         for condition in conditions:
-            context_value = context.get(condition.get(schema.CONDITION_KEY, ""))
+            cond_key = condition.get(schema.CONDITION_KEY, "")
             cond_action = condition.get(schema.CONDITION_ACTION, "")
             cond_value = condition.get(schema.CONDITION_VALUE)
+            context_key_present = True
 
             # time based rule actions have no user context. the context is the condition key
             if cond_action in (
@@ -125,9 +145,17 @@ class FeatureFlags:
                 schema.RuleAction.SCHEDULE_BETWEEN_DATETIME_RANGE.value,
                 schema.RuleAction.SCHEDULE_BETWEEN_DAYS_OF_WEEK.value,
             ):
-                context_value = condition.get(schema.CONDITION_KEY)  # e.g., CURRENT_TIME
-
-            if not self._match_by_action(action=cond_action, condition_value=cond_value, context_value=context_value):
+                context_value = cond_key  # e.g., CURRENT_TIME
+            else:
+                context_key_present = cond_key in context
+                context_value = context.get(cond_key)
+
+            if not self._match_by_action(
+                action=cond_action,
+                condition_value=cond_value,
+                context_value=context_value,
+                context_key_present=context_key_present,
+            ):
                 self.logger.debug(
                     f"rule did not match action, rule_name={rule_name}, rule_value={rule_match_value}, "
                     f"name={feature_name}, context_value={str(context_value)} ",
@@ -210,8 +238,17 @@ class FeatureFlags:
         # parse result conf as JSON, keep in cache for max age defined in store
         self.logger.debug(f"Fetching schema from registered store, store={self.store}")
         config: dict = self.store.get_configuration()
+
+        # Stores that serve from cache (e.g. AppConfigStore via Parameters) return the same dict object until
+        # expiry, so identity is a reliable signal that we've already validated this exact document.
+        # A store that applies an envelope returns a fresh object each time and will still be validated.
+        if config is self._last_validated_config:
+            self.logger.debug("Schema already validated, skipping validation")
+            return config
+
         validator = schema.SchemaValidator(schema=config, logger=self.logger)
         validator.validate()
+        self._last_validated_config = config
 
         return config