aws-python-helper 1.9.3__tar.gz → 1.11.0__tar.gz

{aws_python_helper-1.9.3 → aws_python_helper-1.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.9.3
+Version: 1.11.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.9.3 → aws_python_helper-1.11.0}/aws_python_helper/api/base.py

@@ -4,7 +4,7 @@ API Base Class - Base class for all REST APIs
 
 from abc import ABC, abstractmethod
 import logging
-from typing import Dict, Any, Optional, List
+from typing import Dict, Any, Optional, List, Tuple
 from ..database.mongo_manager import MongoManager
 from ..database.database_proxy import DatabaseProxy
 from ..database.external_mongo_manager import ExternalMongoManager
@@ -12,6 +12,18 @@ from ..database.external_database_proxy import ExternalDatabaseProxy
 from ..context.session import get_session
 
 
+def _positive(value: Any) -> Optional[int]:
+    """Un entero positivo de la query, o None si no lo es.
+
+    Llega como texto desde la URL, y puede llegar cualquier cosa.
+    """
+    try:
+        number = int(value)
+    except (TypeError, ValueError):
+        return None
+    return number if number > 0 else None
+
+
 class API(ABC):
     """
     Base class for all REST APIs
@@ -186,20 +198,82 @@ class API(ABC):
         """
         return self._is_authenticated
     
+    # Lo que una página puede pedir. El máximo no es una opinión: es lo que una
+    # respuesta de lambda aguanta sin que el navegador se atragante.
+    DEFAULT_PAGE_SIZE = 50
+    MAX_PAGE_SIZE = 200
+
+    def page_bounds(self) -> Tuple[int, int]:
+        """Qué pedazo pidieron, acotado a algo que se pueda servir.
+
+        Sale de `page` y `size` de la query, que llegan como texto. Un valor que
+        no es un número, o que no tiene sentido, cae al default en vez de fallar:
+        un listado que devuelve 400 porque alguien escribió `page=abc` en la URL
+        es un listado roto por nada.
+        """
+        page = max(1, _positive(self.data.get('page')) or 1)
+        size = _positive(self.data.get('size')) or self.DEFAULT_PAGE_SIZE
+        size = min(self.MAX_PAGE_SIZE, max(1, size))
+        return (page - 1) * size, size
+
+    def paged(
+        self, items: List[Any], total: int, key: str = 'items'
+    ) -> Dict[str, Any]:
+        """The body of a paged listing.
+
+        The total travels with the page because without it a panel cannot draw a
+        paginator, and whoever is looking cannot tell ten of twelve from ten of a
+        million.
+
+        `key` names the list so an endpoint can keep answering `users` or
+        `regions` instead of a generic `items`; what a listing is called is part
+        of how it reads.
+        """
+        _, size = self.page_bounds()
+        page = max(1, _positive(self.data.get('page')) or 1)
+        return {
+            key: items,
+            'page': page,
+            'size': size,
+            'total': total,
+            'pages': (total + size - 1) // size if size else 0,
+        }
+
     async def granted_permissions(self):
         """Which permissions the caller holds, or None when this API does not know.
 
-        Override it to turn on permission checking for a service. Where the list
-        comes from is the service's business: its own database, a map cached from
-        core, whatever fits.
+        By default they come from the token: core signs them in, so a service
+        authorizes on its own without asking anybody. That is the whole point —
+        a service that had to call core on every request would put core back in
+        the read path of the entire platform.
+
+        Override it where the list comes from somewhere else. Core does: it holds
+        the roles, so it reads them rather than trusting a claim it just signed.
 
         Returning None with AUTHORIZATION=permission is refused, not waved
         through. An endpoint that cannot say what its caller may do has to be a
         closed door: the alternative is that forgetting to wire this up leaves it
         open to anyone holding a token, which is the failure this whole mechanism
         exists to prevent.
+
+        A token with no `permissions` claim yields an empty list, not None: it is
+        a caller who may do nothing, which is different from an endpoint that
+        cannot tell.
         """
-        return None
+        auth = self.auth_data or {}
+
+        # La marca de dev y el token maestro responden por todo: son la forma de
+        # entrar cuando una configuración de permisos quedó mal.
+        if auth.get('is_bypass') or (auth.get('user') or {}).get('is_dev') is True:
+            from ..permissions import ALL
+            return [ALL]
+
+        claims = auth.get('token_data')
+        if not isinstance(claims, dict):
+            return None
+
+        granted = claims.get('permissions')
+        return list(granted) if isinstance(granted, list) else []
 
     @property
     def service_code(self) -> str:

{aws_python_helper-1.9.3 → aws_python_helper-1.11.0}/aws_python_helper/invoker/api_client.py

@@ -1,4 +1,3 @@
-import json
 import logging
 import os
 from typing import Any, Dict, Optional
@@ -13,26 +12,58 @@ _AUTH_HEADER = "Authorization"
 _BEARER_PREFIX = "Bearer"
 
 
-def _resolve_service_url(service_name: str) -> str:
-    raw = os.getenv("MICROSERVICE_URLS", "")
-    if not raw:
+CORE = "core"
+
+# Lo que este contenedor ya averiguó. Vive lo que vive la lambda, que es lo que
+# se quiere: un servicio redesplegado con otra URL se conoce en el próximo
+# arranque en frío, no dentro de horas.
+_RESOLVED: Dict[str, str] = {}
+
+
+def _core_url() -> str:
+    """Dónde está core. Es lo único que un servicio necesita saber de memoria.
+
+    Todo lo demás se lo pregunta a core, que lleva el registro de quién existe y
+    dónde responde. Una sola variable por servicio en vez de un mapa que había
+    que escribir en el secret de cada uno y mantener sincronizado a mano.
+    """
+    url = (os.getenv("CORE_API_URL") or "").rstrip("/")
+    if not url:
         raise ServiceNotConfiguredError(
-            "MICROSERVICE_URLS environment variable is not set"
+            "CORE_API_URL is not set: this service cannot reach core, and core is "
+            "where it learns about everything else."
         )
-    try:
-        urls = json.loads(raw)
-    except json.JSONDecodeError as exc:
-        raise ServiceNotConfiguredError(
-            "MICROSERVICE_URLS is not valid JSON"
-        ) from exc
+    return url
 
-    url = urls.get(service_name)
+
+async def resolve_service_url(service_name: str) -> str:
+    """La dirección de un servicio, según el registro de core."""
+    if service_name == CORE:
+        return _core_url()
+
+    if service_name in _RESOLVED:
+        return _RESOLVED[service_name]
+
+    token = _resolve_token()
+    headers = {_AUTH_HEADER: f"{_BEARER_PREFIX} {token}"} if token else {}
+
+    async with httpx.AsyncClient(timeout=10) as client:
+        response = await client.get(f"{_core_url()}/services", headers=headers)
+        response.raise_for_status()
+        services = (response.json() or {}).get("services") or []
+
+    for service in services:
+        if service.get("api_url"):
+            _RESOLVED[service["code"]] = service["api_url"].rstrip("/")
+
+    url = _RESOLVED.get(service_name)
     if not url:
-        available = ", ".join(urls.keys()) or "none"
+        known = ", ".join(sorted(_RESOLVED)) or "none"
         raise ServiceNotConfiguredError(
-            f"Service '{service_name}' not found in MICROSERVICE_URLS. Available: {available}"
+            f"Core does not know a service called '{service_name}'. Registered: {known}. "
+            "A service appears here when it deploys."
         )
-    return url.rstrip("/")
+    return url
 
 
 def _resolve_token() -> Optional[str]:
@@ -61,8 +92,8 @@ class ApiClient:
         client = ApiClient("dockets", headers={"constitution-state": "CT"})
 
     Environment variables:
-        MICROSERVICE_URLS     JSON map of service name → base URL
-                              e.g. {"dockets": "https://api.example.com/"}
+        CORE_API_URL          Where core answers. The only address a service
+                              holds; everything else it asks core for.
         INTER_SERVICE_TOKEN   Bearer token for service-to-service calls
         AUTH_BYPASS_TOKEN     Fallback if INTER_SERVICE_TOKEN is not set
     """
@@ -73,7 +104,8 @@ class ApiClient:
         headers: Optional[Dict[str, str]] = None,
         timeout: int = 30,
     ):
-        self._base_url = _resolve_service_url(service_name)
+        self._service_name = service_name
+        self._base_url: Optional[str] = None
         self._timeout = timeout
         self._headers = self._build_default_headers(headers or {})
         self.logger = logging.getLogger(self.__class__.__name__)
@@ -86,7 +118,15 @@ class ApiClient:
         headers.update(extra)
         return headers
 
-    def _url(self, path: str) -> str:
+    async def _url(self, path: str) -> str:
+        """La URL completa, resolviendo el servicio la primera vez que hace falta.
+
+        Se resuelve al usarse y no al construirse porque preguntarle a core es
+        una llamada de red, y un constructor que hace una llamada de red no se
+        puede usar en ningún lado sin pensarlo.
+        """
+        if self._base_url is None:
+            self._base_url = await resolve_service_url(self._service_name)
         return f"{self._base_url}/{path.lstrip('/')}"
 
     async def get(self, path: str, params: Optional[Dict] = None) -> Any:
@@ -120,7 +160,7 @@ class ApiClient:
         params: Optional[Dict] = None,
         body: Optional[Dict] = None,
     ) -> Any:
-        url = self._url(path)
+        url = await self._url(path)
         try:
             async with httpx.AsyncClient(timeout=self._timeout) as client:
                 response = await client.request(

{aws_python_helper-1.9.3 → aws_python_helper-1.11.0}/aws_python_helper/repository/base.py

@@ -263,6 +263,40 @@ class Repository(ABC):
 
         return self._collection_cache[key]
 
+    async def page(
+        self,
+        query: Optional[Dict[str, Any]] = None,
+        *,
+        sort: Optional[List[tuple]] = None,
+        skip: int = 0,
+        limit: int = 50,
+        projection: Optional[Dict[str, Any]] = None,
+    ) -> Tuple[List[Dict[str, Any]], int]:
+        """A page of this collection and how many there are in total.
+
+        The count is a separate query and not a `$facet`: counting a filtered
+        million is expensive, and putting it in the same pipeline makes the page
+        wait for the count.
+
+        With no filter the total is **estimated**, which reads collection
+        metadata instead of the documents. Over a large collection that is the
+        difference between instant and a second full read, and the number is only
+        there to draw a paginator — nobody needs to know there are exactly
+        1,221,736 rather than about that.
+        """
+        query = query or {}
+        cursor = self.collection.find(query, projection)
+        if sort:
+            cursor = cursor.sort(sort)
+        items = await cursor.skip(skip).limit(limit).to_list(length=limit)
+
+        total = (
+            await self.collection.count_documents(query)
+            if query
+            else await self.collection.estimated_document_count()
+        )
+        return items, total
+
     async def ensure_indexes(self, database_name: Optional[str] = None):
         """
         Creates all indexes defined in the `indexes` property, blocking until done.

{aws_python_helper-1.9.3 → aws_python_helper-1.11.0}/aws_python_helper.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.9.3
+Version: 1.11.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.9.3 → aws_python_helper-1.11.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aws-python-helper"
-version = "1.9.3"
+version = "1.11.0"
 description = "AWS Python Helper Framework"
 readme = "README.md"
 requires-python = ">=3.9"