aws-python-helper 1.7.0__tar.gz → 1.7.1__tar.gz

{aws_python_helper-1.7.0 → aws_python_helper-1.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.7.0
+Version: 1.7.1
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.7.0 → aws_python_helper-1.7.1}/aws_python_helper/api/base.py

@@ -203,10 +203,14 @@ class API(ABC):
 
     @property
     def service_code(self) -> str:
-        """Names this service inside a permission, as in `core:GET /users`."""
-        import os
+        """Names this service inside a permission, as in `core:GET /users`.
 
-        return os.getenv('SERVICE_CODE', os.getenv('NAMESPACE', 'service'))
+        Resolved by the same function the catalog uses, so the name a permission
+        is stored under and the name it is demanded by cannot drift.
+        """
+        from ..permissions import service_code
+
+        return service_code()
 
     @property
     def auth_data(self) -> Optional[Dict[str, Any]]:

{aws_python_helper-1.7.0 → aws_python_helper-1.7.1}/aws_python_helper/permissions/__init__.py

@@ -1,9 +1,10 @@
-from .catalog import ALL, allows, discover, required_for, service_wildcard
+from .catalog import ALL, allows, discover, required_for, service_code, service_wildcard
 
 __all__ = [
     "ALL",
     "allows",
     "discover",
     "required_for",
+    "service_code",
     "service_wildcard",
 ]

{aws_python_helper-1.7.0 → aws_python_helper-1.7.1}/aws_python_helper/permissions/catalog.py

@@ -35,6 +35,19 @@ FILE_METHODS = {
 ALL = "*"
 
 
+def service_code() -> str:
+    """The name this service takes inside a permission code, as in `core:GET /users`.
+
+    One function on purpose. Publishing the catalog and checking a permission are
+    two different places, and if each resolves the name its own way one stores
+    `core:GET /users` while the other demands `constitution-core:GET /users`.
+    Nothing reports that: every role with explicit permissions just gets 403 on
+    everything, and a role holding `*` keeps working, so it looks like a problem
+    with the role.
+    """
+    return os.getenv("SERVICE_CODE") or os.getenv("NAMESPACE") or "service"
+
+
 def discover(api_root: str, service: str) -> List[Dict[str, str]]:
     """Every endpoint this service answers, as permission records.
 

{aws_python_helper-1.7.0 → aws_python_helper-1.7.1}/aws_python_helper.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.7.0
+Version: 1.7.1
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.7.0 → aws_python_helper-1.7.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aws-python-helper"
-version = "1.7.0"
+version = "1.7.1"
 description = "AWS Python Helper Framework"
 readme = "README.md"
 requires-python = ">=3.9"