aws-python-helper 1.6.0__tar.gz → 1.7.0__tar.gz

{aws_python_helper-1.6.0 → aws_python_helper-1.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.6.0
+Version: 1.7.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.6.0 → aws_python_helper-1.7.0}/aws_python_helper/api/base.py

@@ -288,6 +288,27 @@ class API(ABC):
             'headers': self._response_headers
         }
     
+    @property
+    def public(self) -> bool:
+        """
+        Whether this endpoint answers without a token.
+
+        Declared here, next to the code, so the permission catalog can leave it
+        out: a permission for something nobody needs permission for is noise in
+        every role screen, and an administrator ticking it would be granting
+        nothing.
+
+        This does not make an endpoint public — terraform does, by leaving
+        `authorization` unset on its lambda. This says so, so the rest of the
+        framework can act on it.
+
+            class AuthLoginAPI(API):
+                @property
+                def public(self):
+                    return True
+        """
+        return False
+
     @property
     def schema(self):
         """

{aws_python_helper-1.6.0 → aws_python_helper-1.7.0}/aws_python_helper/api/fetcher.py

@@ -7,6 +7,34 @@ import importlib.util
 from pathlib import Path
 from typing import List
 
+def load_controller_class(file_path: str):
+    """The API class a controller file defines.
+
+    Shared so the permission catalog asks the class the same questions the
+    dispatcher does — a second way of finding it would answer differently the
+    day one of them changes.
+    """
+    spec = importlib.util.spec_from_file_location("api_module", file_path)
+    if not spec or not spec.loader:
+        raise ImportError(f"Could not load module spec from: {file_path}")
+
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+
+    for item_name in dir(module):
+        item = getattr(module, item_name)
+        if (isinstance(item, type) and
+                hasattr(item, 'process') and
+                item.__name__ not in ['API', 'ABC'] and
+                item.__module__ == module.__name__):
+            return item
+
+    raise ValueError(
+        f"No API class found in {file_path}\n"
+        f"Make sure your file exports a class that inherits from API"
+    )
+
+
 class Fetcher:
     """
     Dynamically load API controllers
@@ -187,30 +215,7 @@ class Fetcher:
                 f"Expected file for endpoint '{self.endpoint}' with method '{self.method}'"
             )
         
-        # Load module dynamically
-        spec = importlib.util.spec_from_file_location("api_module", file_path)
-        if not spec or not spec.loader:
-            raise ImportError(f"Could not load module spec from: {file_path}")
-        
-        module = importlib.util.module_from_spec(spec)
-        spec.loader.exec_module(module)
-        
-        # Search for a class that inherits from API
-        controller_class = None
-        for item_name in dir(module):
-            item = getattr(module, item_name)
-            if (isinstance(item, type) and
-                hasattr(item, 'process') and
-                item.__name__ not in ['API', 'ABC'] and
-                item.__module__ == module.__name__):
-                controller_class = item
-                break
-        
-        if not controller_class:
-            raise ValueError(
-                f"No API class found in {file_path}\n"
-                f"Make sure your file exports a class that inherits from API"
-            )
+        controller_class = load_controller_class(file_path)
         
         # Cache the class (not the instance)
         self._cache[file_path] = controller_class

{aws_python_helper-1.6.0 → aws_python_helper-1.7.0}/aws_python_helper/permissions/catalog.py

@@ -12,10 +12,14 @@ otherwise silently stop matching in the other, and an access check that never
 matches fails open or shut without anyone noticing.
 """
 
+import logging
 import os
+import re
 from typing import Dict, List
 
-from ..api.fetcher import Fetcher
+from ..api.fetcher import Fetcher, load_controller_class
+
+logger = logging.getLogger(__name__)
 
 # Cómo se llama el archivo según el método. `list` y `get` son ambos GET: uno
 # responde la colección, el otro un elemento.
@@ -46,6 +50,10 @@ def discover(api_root: str, service: str) -> List[Dict[str, str]]:
             if extension != ".py" or stem not in FILE_METHODS:
                 continue
 
+            controller = _controller(os.path.join(current, filename))
+            if controller and getattr(controller(), "public", False):
+                continue
+
             relative = os.path.relpath(current, api_root)
             parts = [] if relative == "." else relative.split(os.sep)
             path = "/" + "/".join(parts)
@@ -62,11 +70,40 @@ def discover(api_root: str, service: str) -> List[Dict[str, str]]:
                 "method": method,
                 "path": path,
                 "scope": "item" if stem == "get" else "collection",
+                "name": _readable(controller),
             })
 
     return sorted(found, key=lambda item: item["code"])
 
 
+def _controller(file_path: str):
+    """The controller class, or None if it cannot be read.
+
+    None errs towards listing the endpoint. A permission that appears for a
+    public endpoint is noise; one that disappears for a protected endpoint
+    leaves the check with nothing to match and locks everybody out of it.
+    """
+    try:
+        return load_controller_class(file_path)
+    except Exception as exc:
+        logger.warning("Could not read %s, listing it anyway: %s", file_path, exc)
+        return None
+
+
+def _readable(controller) -> str:
+    """The class name as words: `UsersInviteAPI` -> `Users Invite`.
+
+    A panel showing raw paths makes people read routing to answer "what does
+    this let someone do". The class already names the thing; this only spaces it
+    out. Empty when the class could not be read, so the panel falls back to the
+    path rather than inventing a name.
+    """
+    if controller is None:
+        return ""
+    name = re.sub(r"(API|Api)$", "", controller.__name__)
+    return re.sub(r"(?<=[a-z0-9])(?=[A-Z])", " ", name).strip()
+
+
 def service_wildcard(service: str) -> str:
     return f"{service}:*"
 

{aws_python_helper-1.6.0 → aws_python_helper-1.7.0}/aws_python_helper.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.6.0
+Version: 1.7.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.6.0 → aws_python_helper-1.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aws-python-helper"
-version = "1.6.0"
+version = "1.7.0"
 description = "AWS Python Helper Framework"
 readme = "README.md"
 requires-python = ">=3.9"