aws-python-helper 1.6.0__tar.gz → 1.7.1__tar.gz

{aws_python_helper-1.6.0 → aws_python_helper-1.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.6.0
+Version: 1.7.1
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.6.0 → aws_python_helper-1.7.1}/aws_python_helper/api/base.py

@@ -203,10 +203,14 @@ class API(ABC):
 
     @property
     def service_code(self) -> str:
-        """Names this service inside a permission, as in `core:GET /users`."""
-        import os
+        """Names this service inside a permission, as in `core:GET /users`.
 
-        return os.getenv('SERVICE_CODE', os.getenv('NAMESPACE', 'service'))
+        Resolved by the same function the catalog uses, so the name a permission
+        is stored under and the name it is demanded by cannot drift.
+        """
+        from ..permissions import service_code
+
+        return service_code()
 
     @property
     def auth_data(self) -> Optional[Dict[str, Any]]:
@@ -288,6 +292,27 @@ class API(ABC):
             'headers': self._response_headers
         }
     
+    @property
+    def public(self) -> bool:
+        """
+        Whether this endpoint answers without a token.
+
+        Declared here, next to the code, so the permission catalog can leave it
+        out: a permission for something nobody needs permission for is noise in
+        every role screen, and an administrator ticking it would be granting
+        nothing.
+
+        This does not make an endpoint public — terraform does, by leaving
+        `authorization` unset on its lambda. This says so, so the rest of the
+        framework can act on it.
+
+            class AuthLoginAPI(API):
+                @property
+                def public(self):
+                    return True
+        """
+        return False
+
     @property
     def schema(self):
         """

{aws_python_helper-1.6.0 → aws_python_helper-1.7.1}/aws_python_helper/api/fetcher.py

@@ -7,6 +7,34 @@ import importlib.util
 from pathlib import Path
 from typing import List
 
+def load_controller_class(file_path: str):
+    """The API class a controller file defines.
+
+    Shared so the permission catalog asks the class the same questions the
+    dispatcher does — a second way of finding it would answer differently the
+    day one of them changes.
+    """
+    spec = importlib.util.spec_from_file_location("api_module", file_path)
+    if not spec or not spec.loader:
+        raise ImportError(f"Could not load module spec from: {file_path}")
+
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+
+    for item_name in dir(module):
+        item = getattr(module, item_name)
+        if (isinstance(item, type) and
+                hasattr(item, 'process') and
+                item.__name__ not in ['API', 'ABC'] and
+                item.__module__ == module.__name__):
+            return item
+
+    raise ValueError(
+        f"No API class found in {file_path}\n"
+        f"Make sure your file exports a class that inherits from API"
+    )
+
+
 class Fetcher:
     """
     Dynamically load API controllers
@@ -187,30 +215,7 @@ class Fetcher:
                 f"Expected file for endpoint '{self.endpoint}' with method '{self.method}'"
             )
         
-        # Load module dynamically
-        spec = importlib.util.spec_from_file_location("api_module", file_path)
-        if not spec or not spec.loader:
-            raise ImportError(f"Could not load module spec from: {file_path}")
-        
-        module = importlib.util.module_from_spec(spec)
-        spec.loader.exec_module(module)
-        
-        # Search for a class that inherits from API
-        controller_class = None
-        for item_name in dir(module):
-            item = getattr(module, item_name)
-            if (isinstance(item, type) and
-                hasattr(item, 'process') and
-                item.__name__ not in ['API', 'ABC'] and
-                item.__module__ == module.__name__):
-                controller_class = item
-                break
-        
-        if not controller_class:
-            raise ValueError(
-                f"No API class found in {file_path}\n"
-                f"Make sure your file exports a class that inherits from API"
-            )
+        controller_class = load_controller_class(file_path)
         
         # Cache the class (not the instance)
         self._cache[file_path] = controller_class

{aws_python_helper-1.6.0 → aws_python_helper-1.7.1}/aws_python_helper/permissions/__init__.py

@@ -1,9 +1,10 @@
-from .catalog import ALL, allows, discover, required_for, service_wildcard
+from .catalog import ALL, allows, discover, required_for, service_code, service_wildcard
 
 __all__ = [
     "ALL",
     "allows",
     "discover",
     "required_for",
+    "service_code",
     "service_wildcard",
 ]

{aws_python_helper-1.6.0 → aws_python_helper-1.7.1}/aws_python_helper/permissions/catalog.py

@@ -12,10 +12,14 @@ otherwise silently stop matching in the other, and an access check that never
 matches fails open or shut without anyone noticing.
 """
 
+import logging
 import os
+import re
 from typing import Dict, List
 
-from ..api.fetcher import Fetcher
+from ..api.fetcher import Fetcher, load_controller_class
+
+logger = logging.getLogger(__name__)
 
 # Cómo se llama el archivo según el método. `list` y `get` son ambos GET: uno
 # responde la colección, el otro un elemento.
@@ -31,6 +35,19 @@ FILE_METHODS = {
 ALL = "*"
 
 
+def service_code() -> str:
+    """The name this service takes inside a permission code, as in `core:GET /users`.
+
+    One function on purpose. Publishing the catalog and checking a permission are
+    two different places, and if each resolves the name its own way one stores
+    `core:GET /users` while the other demands `constitution-core:GET /users`.
+    Nothing reports that: every role with explicit permissions just gets 403 on
+    everything, and a role holding `*` keeps working, so it looks like a problem
+    with the role.
+    """
+    return os.getenv("SERVICE_CODE") or os.getenv("NAMESPACE") or "service"
+
+
 def discover(api_root: str, service: str) -> List[Dict[str, str]]:
     """Every endpoint this service answers, as permission records.
 
@@ -46,6 +63,10 @@ def discover(api_root: str, service: str) -> List[Dict[str, str]]:
             if extension != ".py" or stem not in FILE_METHODS:
                 continue
 
+            controller = _controller(os.path.join(current, filename))
+            if controller and getattr(controller(), "public", False):
+                continue
+
             relative = os.path.relpath(current, api_root)
             parts = [] if relative == "." else relative.split(os.sep)
             path = "/" + "/".join(parts)
@@ -62,11 +83,40 @@ def discover(api_root: str, service: str) -> List[Dict[str, str]]:
                 "method": method,
                 "path": path,
                 "scope": "item" if stem == "get" else "collection",
+                "name": _readable(controller),
             })
 
     return sorted(found, key=lambda item: item["code"])
 
 
+def _controller(file_path: str):
+    """The controller class, or None if it cannot be read.
+
+    None errs towards listing the endpoint. A permission that appears for a
+    public endpoint is noise; one that disappears for a protected endpoint
+    leaves the check with nothing to match and locks everybody out of it.
+    """
+    try:
+        return load_controller_class(file_path)
+    except Exception as exc:
+        logger.warning("Could not read %s, listing it anyway: %s", file_path, exc)
+        return None
+
+
+def _readable(controller) -> str:
+    """The class name as words: `UsersInviteAPI` -> `Users Invite`.
+
+    A panel showing raw paths makes people read routing to answer "what does
+    this let someone do". The class already names the thing; this only spaces it
+    out. Empty when the class could not be read, so the panel falls back to the
+    path rather than inventing a name.
+    """
+    if controller is None:
+        return ""
+    name = re.sub(r"(API|Api)$", "", controller.__name__)
+    return re.sub(r"(?<=[a-z0-9])(?=[A-Z])", " ", name).strip()
+
+
 def service_wildcard(service: str) -> str:
     return f"{service}:*"
 

{aws_python_helper-1.6.0 → aws_python_helper-1.7.1}/aws_python_helper.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.6.0
+Version: 1.7.1
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.6.0 → aws_python_helper-1.7.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aws-python-helper"
-version = "1.6.0"
+version = "1.7.1"
 description = "AWS Python Helper Framework"
 readme = "README.md"
 requires-python = ">=3.9"