aws-python-helper 1.0.3__tar.gz → 1.2.0__tar.gz

{aws_python_helper-1.0.3 → aws_python_helper-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.0.3
+Version: 1.2.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT
@@ -17,6 +17,8 @@ Requires-Dist: motor==3.3.2
 Requires-Dist: pymongo==4.6.1
 Requires-Dist: pydantic>=2.0
 Requires-Dist: httpx>=0.27.0
+Provides-Extra: jwt
+Requires-Dist: PyJWT[crypto]>=2.9.0; extra == "jwt"
 
 # AWS Python Framework
 

{aws_python_helper-1.0.3 → aws_python_helper-1.2.0}/aws_python_helper/api/auth_validators.py

@@ -141,3 +141,112 @@ class TokenValidator(AuthValidator):
             'token_data': token_doc,
             'is_bypass': False
         }
+
+
+class JWTValidator(AuthValidator):
+    """
+    Validates RS256 JWTs issued by constitution-core.
+
+    Stateless: the signature and the claims are enough, so no database is
+    touched. That is what lets any microservice authenticate a request without
+    calling the issuer.
+
+    Environment:
+        JWT_PUBLIC_KEY: RSA public key in PEM, raw or base64-encoded.
+        JWT_ISSUER: expected `iss`. Defaults to 'constitution-core'.
+        JWT_AUDIENCE: expected `aud`. Only verified when set.
+        AUTH_BYPASS_TOKEN: still honoured, same as TokenValidator.
+    """
+
+    _public_key_cache: Optional[str] = None
+
+    @classmethod
+    def _public_key(cls) -> str:
+        """The configured public key, decoded once per container."""
+        if cls._public_key_cache:
+            return cls._public_key_cache
+
+        raw = os.getenv('JWT_PUBLIC_KEY')
+        if not raw:
+            raise ValueError(
+                "JWT_PUBLIC_KEY environment variable not set. "
+                "Required when AUTH_STRATEGY=jwt."
+            )
+
+        key = raw.strip()
+        if not key.startswith('-----BEGIN'):
+            # PEMs are multi-line, so they travel base64-encoded in env vars.
+            import base64
+            key = base64.b64decode(key).decode('utf-8')
+
+        cls._public_key_cache = key
+        return key
+
+    async def validate_token(self, token: str) -> Dict[str, Any]:
+        bypass_token = os.getenv('AUTH_BYPASS_TOKEN')
+        if bypass_token and token == bypass_token:
+            logger.info("Bypass token used - skipping JWT validation")
+            return {
+                'user_id': 'bypass',
+                'user': {
+                    'email': 'bypass@system',
+                    'role': 'admin',
+                    'name': 'Bypass User',
+                    '_id': 'bypass'
+                },
+                'is_bypass': True,
+                'token_data': None
+            }
+
+        try:
+            import jwt
+        except ImportError as exc:
+            raise RuntimeError(
+                "PyJWT is required for AUTH_STRATEGY=jwt. Install aws-python-helper[jwt]."
+            ) from exc
+
+        audience = os.getenv('JWT_AUDIENCE')
+        try:
+            claims = jwt.decode(
+                token,
+                self._public_key(),
+                algorithms=['RS256'],
+                issuer=os.getenv('JWT_ISSUER', 'constitution-core'),
+                audience=audience,
+                options={'verify_aud': bool(audience)},
+            )
+        except jwt.ExpiredSignatureError:
+            logger.warning("JWT expired")
+            raise UnauthorizedError("Token has expired")
+        except jwt.InvalidTokenError as exc:
+            logger.warning("JWT rejected: %s", exc)
+            raise UnauthorizedError("Invalid token")
+
+        if not claims.get('sub'):
+            raise UnauthorizedError("Invalid token")
+
+        # Same shape TokenValidator returns, so nothing downstream changes.
+        return {
+            'user_id': str(claims['sub']),
+            'user': {
+                '_id': claims['sub'],
+                'email': claims.get('email'),
+                'name': claims.get('name', ''),
+                'role': claims.get('role', 'user'),
+                **(claims.get('extra') or {}),
+            },
+            'token_data': claims,
+            'is_bypass': False,
+        }
+
+
+def get_auth_validator() -> AuthValidator:
+    """The validator this service is configured to use.
+
+    AUTH_STRATEGY=jwt switches to stateless validation. Anything else keeps the
+    database lookup, so a service only migrates when its environment says so.
+    """
+    strategy = (os.getenv('AUTH_STRATEGY') or 'db').strip().lower()
+    if strategy == 'jwt':
+        return JWTValidator()
+    return TokenValidator()

{aws_python_helper-1.0.3 → aws_python_helper-1.2.0}/aws_python_helper/api/dispatcher.py

@@ -11,7 +11,7 @@ from .fetcher import Fetcher
 from .base import API
 from .exceptions import UnauthorizedError, ForbiddenError, AuthenticationError
 from .auth_middleware import AuthMiddleware
-from .auth_validators import TokenValidator
+from .auth_validators import get_auth_validator
 from ..context.session import get_session
 from ..context.state_validator import StateValidator, InvalidStateError
 
@@ -240,8 +240,8 @@ class Dispatcher:
         """
         Execute authentication middleware
         
-        Uses TokenValidator to validate tokens against AUTH_BYPASS_TOKEN
-        or MongoDB database.
+        The validator is chosen by AUTH_STRATEGY: stateless JWT, or the
+        database lookup used so far.
         
         Args:
             api: API instance to inject authentication data into
@@ -249,8 +249,8 @@ class Dispatcher:
         Raises:
             UnauthorizedError: If authentication fails
         """
-        # Use unified token validator
-        validator = TokenValidator()
+        # Strategy comes from configuration, per service
+        validator = get_auth_validator()
         
         # Create middleware and authenticate
         middleware = AuthMiddleware(validator)

{aws_python_helper-1.0.3 → aws_python_helper-1.2.0}/aws_python_helper/api/fetcher.py

@@ -91,7 +91,7 @@ class Fetcher:
     
     def _looks_like_id(self, part: str) -> bool:
         """
-        Check if a URL part looks like an ID (numeric or UUID format)
+        Check if a URL part looks like an ID (numeric, ObjectId or UUID format)
         
         Args:
             part: URL part to check
@@ -105,6 +105,15 @@ class Fetcher:
         # Check if it's numeric
         if part.isdigit():
             return True
+
+        # ObjectId de MongoDB: 24 caracteres hexadecimales. Sin esto, un
+        # PATCH /users/<oid> busca un directorio con el id como nombre.
+        if len(part) == 24:
+            try:
+                int(part, 16)
+                return True
+            except ValueError:
+                pass
         
         # Check if it's a UUID format (8-4-4-4-12 hex digits)
         if len(part) == 36 and part.count('-') == 4:

{aws_python_helper-1.0.3 → aws_python_helper-1.2.0}/aws_python_helper/model_query/base.py

@@ -40,7 +40,7 @@ Response (via Lambda base run()):
     {"success": True, "data": [...]}
 """
 
-from typing import Any, List, Optional
+from typing import Any, Dict, List, Optional, Union
 from bson import ObjectId
 from pydantic import BaseModel, ConfigDict, model_validator
 
@@ -111,6 +111,36 @@ class _ModelQuerySchema(BaseModel):
         return self
 
 
+def _enforce_exclusions(
+    fields: Optional[dict], excluded: List[str]
+) -> dict:
+    """The projection the owner allows, whatever the caller asked for.
+
+    Mongo reads a projection as inclusive or exclusive, never both, so the
+    forbidden fields are dropped from an inclusive one and added to an exclusive
+    one. `_id` is ignored when deciding which it is: it may appear in either.
+    """
+    projection = dict(fields or {})
+    if not excluded:
+        return projection
+
+    inclusive = any(value for key, value in projection.items() if key != "_id")
+    if not inclusive:
+        for name in excluded:
+            projection[name] = 0
+        return projection
+
+    for name in excluded:
+        projection.pop(name, None)
+
+    # Pedir sólo el campo prohibido dejaría la proyección vacía, y una
+    # proyección vacía en Mongo devuelve el documento entero: exactamente lo
+    # contrario de lo buscado. Sin nada legítimo que pedir, sólo el id.
+    if not any(value for key, value in projection.items() if key != "_id"):
+        return {"_id": 1}
+    return projection
+
+
 class ModelQueryLambda(Lambda):
     """
     Base class for cross-service MongoDB query Lambdas.
@@ -120,19 +150,35 @@ class ModelQueryLambda(Lambda):
     """
 
     @property
-    def allowed_collections(self) -> List[str]:
+    def allowed_collections(self) -> Union[List[str], Dict[str, dict]]:
         """
         Whitelist of collection names this Lambda is allowed to query.
 
         Must be overridden — an empty list rejects all requests.
 
-        Example:
+        A list exposes each collection whole:
+
             @property
             def allowed_collections(self):
                 return ["dockets", "tax_sales"]
+
+        A dict lets the owner keep fields in, whatever the caller projects. This
+        is not `fields`: that one is the caller saying what it wants, this one is
+        the owner saying what never leaves.
+
+            @property
+            def allowed_collections(self):
+                return {"dockets": {}, "users": {"exclude": ["password"]}}
         """
         return []
 
+    def excluded_fields(self, collection: str) -> List[str]:
+        """Fields this collection never returns. Empty for list-style whitelists."""
+        allowed = self.allowed_collections
+        if not isinstance(allowed, dict):
+            return []
+        return list((allowed.get(collection) or {}).get("exclude") or [])
+
     @property
     def schema(self):
         return _ModelQuerySchema
@@ -151,6 +197,16 @@ class ModelQueryLambda(Lambda):
                 f"Collection '{collection}' is not allowed. Allowed: {allowed}"
             )
 
+        # Una pipeline puede renombrar un campo antes de que lo quitemos
+        # ($addFields, $replaceRoot, $lookup), así que no hay forma honesta de
+        # garantizar la exclusión sobre ella. Un $unset final daría una falsa
+        # sensación de seguridad, que es peor que no tener la función.
+        if self.excluded_fields(collection) and self.data.get("pipeline") is not None:
+            raise ValueError(
+                f"Collection '{collection}' hides fields, so it cannot be queried "
+                f"with a pipeline. Use 'filter' instead."
+            )
+
     async def process(self) -> Any:
         collection_name: str = self.data["collection"]
         database: str = self.data.get("database") or self.session.state
@@ -167,7 +223,10 @@ class ModelQueryLambda(Lambda):
             limit: int = self.data.get("limit") or 0
             skip: int = self.data.get("skip") or 0
 
-            cursor = collection.find(mongo_filter, fields or {})
+            projection = _enforce_exclusions(
+                fields, self.excluded_fields(collection_name)
+            )
+            cursor = collection.find(mongo_filter, projection)
 
             if skip:
                 cursor = cursor.skip(skip)

{aws_python_helper-1.0.3 → aws_python_helper-1.2.0}/aws_python_helper.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.0.3
+Version: 1.2.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT
@@ -17,6 +17,8 @@ Requires-Dist: motor==3.3.2
 Requires-Dist: pymongo==4.6.1
 Requires-Dist: pydantic>=2.0
 Requires-Dist: httpx>=0.27.0
+Provides-Extra: jwt
+Requires-Dist: PyJWT[crypto]>=2.9.0; extra == "jwt"
 
 # AWS Python Framework
 

{aws_python_helper-1.0.3 → aws_python_helper-1.2.0}/aws_python_helper.egg-info/requires.txt

@@ -2,3 +2,6 @@ motor==3.3.2
 pymongo==4.6.1
 pydantic>=2.0
 httpx>=0.27.0
+
+[jwt]
+PyJWT[crypto]>=2.9.0

{aws_python_helper-1.0.3 → aws_python_helper-1.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aws-python-helper"
-version = "1.0.3"
+version = "1.2.0"
 description = "AWS Python Helper Framework"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -31,6 +31,10 @@ keywords = [
     "aws", "python", "framework", "helper", "mongodb", "sqs", "sns", "fargate", "lambda"
 ]
 
+# Only needed by services running AUTH_STRATEGY=jwt.
+[project.optional-dependencies]
+jwt = ["PyJWT[crypto]>=2.9.0"]
+
 [project.urls]
 "Homepage" = "https://github.com/fabiae/aws-python-framework"
 "Source Code" = "https://github.com/fabiae/aws-python-framework"