aws-python-helper 1.11.0__tar.gz → 1.13.0__tar.gz

{aws_python_helper-1.11.0 → aws_python_helper-1.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.11.0
+Version: 1.13.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.11.0 → aws_python_helper-1.13.0}/aws_python_helper/api/auth_validators.py

@@ -13,6 +13,56 @@ from ..database.mongo_manager import MongoManager
 logger = logging.getLogger(__name__)
 
 
+def _machine_caller(token: str) -> Optional[Dict[str, Any]]:
+    """Quién es, cuando quien llama no es una persona.
+
+    Dos tokens distintos, porque son dos cosas distintas y confundirlas deja una
+    puerta abierta más ancha de lo que nadie quiso:
+
+    - `INTER_SERVICE_TOKEN` dice **"soy un microservicio de los nuestros"**. Es
+      lo que un servicio manda cuando le habla a otro. No es un usuario y no
+      tiene permisos de nadie: un endpoint que lo acepta lo dice explícitamente.
+    - `AUTH_BYPASS_TOKEN` es la **llave maestra**, la forma de entrar cuando una
+      configuración de permisos quedó mal. Abre todo, y por eso no debería ser la
+      que un servicio usa todos los días.
+
+    Devuelve None si el token no es ninguno de los dos, y entonces se valida como
+    lo que es: el token de una persona.
+    """
+    service_token = os.getenv('INTER_SERVICE_TOKEN')
+    if service_token and token == service_token:
+        logger.info("Inter-service token used")
+        return {
+            'user_id': 'service',
+            'user': {
+                '_id': 'service',
+                'email': 'service@system',
+                'name': 'Service',
+                'role': 'service',
+            },
+            'is_service': True,
+            'is_bypass': False,
+            'token_data': None,
+        }
+
+    bypass_token = os.getenv('AUTH_BYPASS_TOKEN')
+    if bypass_token and token == bypass_token:
+        logger.info("Bypass token used - skipping validation")
+        return {
+            'user_id': 'bypass',
+            'user': {
+                '_id': 'bypass',
+                'email': 'bypass@system',
+                'name': 'Bypass User',
+                'role': 'admin',
+            },
+            'is_bypass': True,
+            'token_data': None,
+        }
+
+    return None
+
+
 class AuthValidator(ABC):
     """
     Abstract base class for authentication validators
@@ -63,21 +113,11 @@ class TokenValidator(AuthValidator):
             UnauthorizedError: If token is invalid or expired
         """
         
-        # 1. Check bypass token first (for development/testing)
-        bypass_token = os.getenv('AUTH_BYPASS_TOKEN')
-        if bypass_token and token == bypass_token:
-            logger.info("Bypass token used - skipping DB validation")
-            return {
-                'user_id': 'bypass',
-                'user': {
-                    'email': 'bypass@system',
-                    'role': 'admin',
-                    'name': 'Bypass User',
-                    '_id': 'bypass'
-                },
-                'is_bypass': True,
-                'token_data': None
-            }
+        # 1. Quien llama puede no ser una persona: un servicio o la llave maestra.
+        caller = _machine_caller(token)
+        if caller:
+            return caller
+
         
         # 2. Get database name from environment
         db_name = os.getenv('AUTH_DB_NAME') or 'core'
@@ -183,20 +223,9 @@ class JWTValidator(AuthValidator):
         return key
 
     async def validate_token(self, token: str) -> Dict[str, Any]:
-        bypass_token = os.getenv('AUTH_BYPASS_TOKEN')
-        if bypass_token and token == bypass_token:
-            logger.info("Bypass token used - skipping JWT validation")
-            return {
-                'user_id': 'bypass',
-                'user': {
-                    'email': 'bypass@system',
-                    'role': 'admin',
-                    'name': 'Bypass User',
-                    '_id': 'bypass'
-                },
-                'is_bypass': True,
-                'token_data': None
-            }
+        caller = _machine_caller(token)
+        if caller:
+            return caller
 
         try:
             import jwt

{aws_python_helper-1.11.0 → aws_python_helper-1.13.0}/aws_python_helper/repository/audit.py

@@ -82,10 +82,13 @@ class InvalidStatusError(ValueError):
     """A status the repository does not declare."""
 
 
-def _check_status(value: Any, statuses: Optional[List[str]]) -> None:
+def _check_status(
+    value: Any, statuses: Optional[List[str]], field: str = STATUS
+) -> None:
     if statuses and value is not None and value not in statuses:
         raise InvalidStatusError(
-            f"'{value}' is not a valid status. Declared: {', '.join(statuses)}"
+            f"'{value}' is not a valid value for '{field}'. "
+            f"Declared: {', '.join(statuses)}"
         )
 
 
@@ -93,6 +96,7 @@ def stamp_new(
     document: Dict[str, Any],
     statuses: Optional[List[str]] = None,
     default_status: Optional[str] = None,
+    status_field: str = STATUS,
 ) -> Dict[str, Any]:
     """The framework fields on a document being created.
 
@@ -110,8 +114,8 @@ def stamp_new(
     document.setdefault(UPDATED_BY, who)
 
     if statuses:
-        document.setdefault(STATUS, default_status or statuses[0])
-        _check_status(document.get(STATUS), statuses)
+        document.setdefault(status_field, default_status or statuses[0])
+        _check_status(document.get(status_field), statuses, status_field)
     return document
 
 
@@ -146,6 +150,7 @@ def stamp_update(
     upsert: bool = False,
     statuses: Optional[List[str]] = None,
     default_status: Optional[str] = None,
+    status_field: str = STATUS,
 ) -> Union[Dict[str, Any], List[Dict[str, Any]]]:
     """The two 'updated' fields on a modification, and the 'created' ones on an upsert.
 
@@ -165,14 +170,14 @@ def stamp_update(
 
     # Un reemplazo entero —sin operadores— es un documento, no una modificación.
     if update and not any(key.startswith('$') for key in update):
-        return stamp_new(dict(update), statuses, default_status)
+        return stamp_new(dict(update), statuses, default_status, status_field)
 
     update = dict(update)
     if statuses:
         for operator in ('$set', '$setOnInsert'):
             section = update.get(operator)
-            if isinstance(section, dict) and STATUS in section:
-                _check_status(section[STATUS], statuses)
+            if isinstance(section, dict) and status_field in section:
+                _check_status(section[status_field], statuses, status_field)
 
     _merge_into_set(update, touched, '$set')
     if upsert:
@@ -180,7 +185,7 @@ def stamp_update(
         # inicial sólo en ese caso.
         born = {CREATED_AT: now, CREATED_BY: who}
         if statuses:
-            born[STATUS] = default_status or statuses[0]
+            born[status_field] = default_status or statuses[0]
         born = {
             key: value
             for key, value in born.items()
@@ -201,23 +206,27 @@ class AuditedCollection:
     than asking for the stamp explicitly.
     """
 
-    __slots__ = ('_collection', '_statuses', '_default_status')
+    __slots__ = ('_collection', '_statuses', '_default_status', '_status_field')
 
     def __init__(
         self,
         collection: Any,
         statuses: Optional[List[str]] = None,
         default_status: Optional[str] = None,
+        status_field: str = STATUS,
     ):
         object.__setattr__(self, '_collection', collection)
         object.__setattr__(self, '_statuses', statuses)
         object.__setattr__(self, '_default_status', default_status)
+        object.__setattr__(self, '_status_field', status_field)
 
     def _new(self, document: Dict[str, Any]) -> Dict[str, Any]:
-        return stamp_new(document, self._statuses, self._default_status)
+        return stamp_new(document, self._statuses, self._default_status, self._status_field)
 
     def _update(self, update: Any, upsert: bool) -> Any:
-        return stamp_update(update, upsert, self._statuses, self._default_status)
+        return stamp_update(
+            update, upsert, self._statuses, self._default_status, self._status_field
+        )
 
     def __getattr__(self, name: str) -> Any:
         return getattr(self._collection, name)

{aws_python_helper-1.11.0 → aws_python_helper-1.13.0}/aws_python_helper/repository/base.py

@@ -13,7 +13,7 @@ from typing import Any, Dict, List, Optional, Tuple
 from ..database.mongo_manager import MongoManager
 from ..database.external_mongo_manager import ExternalMongoManager
 from ..context.session import get_session
-from .audit import DEFAULT_STATUSES, AuditedCollection
+from .audit import DEFAULT_STATUSES, STATUS, AuditedCollection
 
 
 class Repository(ABC):
@@ -169,6 +169,26 @@ class Repository(ABC):
         """
         return list(DEFAULT_STATUSES)
 
+    @property
+    def status_field(self) -> str:
+        """Cómo se llama el campo que lleva el ciclo de vida del registro.
+
+        `status` por defecto. Se cambia cuando una colección ya usa ese nombre
+        para otra cosa y migrarla no vale la pena: los 1,2 millones de empresas
+        traen el estado del registro del estado en `status`, y 5,7 millones de
+        parcels podrían traer otro. Renombrar en la base es lo más limpio cuando
+        se puede; cuando no, se le dice al framework dónde escribir el suyo.
+
+            class ParcelRepository(Repository):
+                @property
+                def status_field(self):
+                    return "lifecycle_status"
+
+        Las dos cosas son independientes: `statuses` dice qué valores valen, esto
+        dice dónde se guardan.
+        """
+        return STATUS
+
     @property
     def default_status(self) -> Optional[str]:
         """What a record gets when nobody says otherwise. First of `statuses`."""
@@ -256,7 +276,9 @@ class Repository(ABC):
             collection = db[self.collection_name]
             # La envoltura completa las escrituras; todo lo demás pasa de largo.
             self._collection_cache[key] = (
-                AuditedCollection(collection, self.statuses, self.default_status)
+                AuditedCollection(
+                    collection, self.statuses, self.default_status, self.status_field
+                )
                 if self.audit
                 else collection
             )

{aws_python_helper-1.11.0 → aws_python_helper-1.13.0}/aws_python_helper.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.11.0
+Version: 1.13.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.11.0 → aws_python_helper-1.13.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aws-python-helper"
-version = "1.11.0"
+version = "1.13.0"
 description = "AWS Python Helper Framework"
 readme = "README.md"
 requires-python = ">=3.9"

{aws_python_helper-1.11.0 → aws_python_helper-1.13.0}/tests/test_audit_stamp.py

@@ -15,7 +15,7 @@ import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
 
-from aws_python_helper.repository.audit import stamp_update  # noqa: E402
+from aws_python_helper.repository.audit import stamp_new, stamp_update  # noqa: E402
 
 STATUSES = ["active", "inactive"]
 
@@ -82,6 +82,33 @@ result = stamp_update([{"$set": {"name": "ct"}}], upsert=True, statuses=STATUSES
 check("still a list", isinstance(result, list))
 check("stamp appended last", result[-1]["$set"].get("updated_at") is not None)
 
+print("\nthe lifecycle field can be called something else")
+result = stamp_new(
+    {"name": "x", "status": "FORFEITED"},
+    ["active", "inactive"],
+    "active",
+    status_field="lifecycle_status",
+)
+check("the collection's own status is untouched", result["status"] == "FORFEITED")
+check("the framework writes its own field", result["lifecycle_status"] == "active")
+
+result = stamp_update(
+    {"$set": {"name": "x"}},
+    upsert=True,
+    statuses=["active"],
+    default_status="active",
+    status_field="lifecycle_status",
+)
+check("and on an upsert it stamps that one", result["$setOnInsert"]["lifecycle_status"] == "active")
+check("with no path conflict", not conflicts(result))
+
+try:
+    stamp_new({"lifecycle_status": "made up"}, ["active"], status_field="lifecycle_status")
+    check("a value outside the vocabulary is refused", False)
+except ValueError as error:
+    check("a value outside the vocabulary is refused", "lifecycle_status" in str(error),
+          "and the message names the field")
+
 if failures:
     print(f"\n{len(failures)} failed: {failures}")
     raise SystemExit(1)