base-api-utils 1.1.117.dev3__tar.gz → 1.1.118__tar.gz

{base_api_utils-1.1.117.dev3/src/base_api_utils.egg-info → base_api_utils-1.1.118}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: base-api-utils
-Version: 1.1.117.dev3
+Version: 1.1.118
 Summary: Django Rest Framework micro services common utilities
 Author-email: Román Gutierrez <roman@tipit.net>, Sebastian Marcet <sebastian@tipit.net>
 Project-URL: Homepage, https://github.com/fntechgit/base-api-utils

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.118}/pyproject.toml

@@ -7,7 +7,7 @@ where = ["src"]
 
 [project]
 name = "base-api-utils"
-version = "1.1.117.dev3"
+version = "1.1.118"
 dependencies = [
     "boto3",
     "celery",

base_api_utils-1.1.118/src/base_api_utils/__init__.py

@@ -0,0 +1,14 @@
+__all__ = ["private_tasks_admin_patterns"]
+
+
+def __getattr__(name: str):
+    # Lazy import: loading private_tasks_admin_patterns eagerly chains through
+    # views → tasks_result_view → @extend_schema → DEFAULT_SCHEMA_CLASS,
+    # which causes a circular import when any consumer of this package is
+    # itself imported as DEFAULT_SCHEMA_CLASS (e.g. a custom AutoSchema
+    # subclass that inherits from base_api_utils.utils.CustomAutoSchema).
+    if name == "private_tasks_admin_patterns":
+        from .urls import private_tasks_admin_patterns
+
+        return private_tasks_admin_patterns
+    raise AttributeError(f"module 'base_api_utils' has no attribute {name!r}")

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.118}/src/base_api_utils/security/check_sponsor_user_permissions.py

@@ -1,13 +1,12 @@
 import logging
 import os
 
-from django.core.exceptions import PermissionDenied
 from django.utils.functional import wraps
 from django.utils.translation import gettext_lazy as _
 from rest_framework.exceptions import ValidationError, AuthenticationFailed
 
 from . import AccessTokenService
-from .shared import get_path, is_admin
+from .shared import get_path, is_admin, application_type_service
 from .user_permissions_service import UserPermissionsService
 
 
@@ -50,6 +49,10 @@ def check_sponsor_user_permissions():
             if is_admin(token_info):
                 return func(view, *args, **kwargs)
 
+            if 'application_type' in token_info and token_info['application_type'] == application_type_service:
+                logger.debug('authz groups are not evaluated for service-type applications')
+                return func(view, *args, **kwargs)
+
             path = get_path(request)
             method = str(request.method).lower()
             logger.debug(f'check_sponsor_user_permissions::decorator - checking permissions for {method} {path}')

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.118}/src/base_api_utils/security/oauth2_scope_required.py

@@ -55,7 +55,7 @@ def oauth2_scope_required():
 
             if is_empty(required_scope):
                 logger.warning('require scope is empty')
-                raise PermissionDenied(_("required scope not present."))
+                raise PermissionDenied(_("required scope not present at endpoint configuration."))
 
             if 'scope' in token_info:
                 current_scope = token_info['scope']
@@ -64,10 +64,17 @@ def oauth2_scope_required():
                 # check origins
                 # check scopes
 
-                if len(set.intersection(set(required_scope.split()), set(current_scope.split()))):
+                required_scopes_set = set(required_scope.split())
+                current_scopes_set = set(current_scope.split())
+
+                if set.intersection(required_scopes_set, current_scopes_set):
                     return func(view, token_info=token_info, *args, **kwargs)
 
-            logger.warning('oauth2_scope_required::decorator token scopes not present')
-            raise PermissionDenied(_("token scopes not present"))
+                missing_scopes = ' '.join(sorted(required_scopes_set - current_scopes_set))
+                logger.warning(f'oauth2_scope_required::decorator token scopes not present - missing: {missing_scopes}')
+                raise PermissionDenied(_(f"token scopes not present - missing: {missing_scopes}"))
+
+            logger.warning(f'oauth2_scope_required::decorator token has no scope - required: {required_scope}')
+            raise PermissionDenied(_(f"token scopes not present - required: {required_scope}"))
         return inner
     return decorator

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.118}/src/base_api_utils/serializers/v2/abstract_serializer.py

@@ -123,6 +123,7 @@ class AbstractSerializer:
             ctx["relations_tree"] = {k: {} for k in dr}
 
     def _filter_local_fields(self, fields):
+        fields = dict(fields)
         ctx = self._own_context
         ft = ctx.get("fields_tree")
         if ft is None or (isinstance(ft, dict) and len(ft) == 0):
@@ -133,6 +134,16 @@ class AbstractSerializer:
         # here and let the deeper constraints apply at child serializers.
         has_explicit_leaf = any(not subtree for subtree in ft.values())
         if not has_explicit_leaf:
+            af = self._merged_allowed_fields()
+            if af is not None:
+                allowed_keep = (
+                    set(af)
+                    | set(ctx.get("expand_tree", {}).keys())
+                    | set(ctx.get("relations_tree", {}).keys())
+                )
+                for k in list(fields.keys()):
+                    if k not in allowed_keep:
+                        fields.pop(k, None)
             return fields
         keep = (
             set(ft.keys())

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.118}/src/base_api_utils/services/amqp_service.py

@@ -194,18 +194,44 @@ class AMQPService(AbstractDomainEventsService):
                         logging.getLogger('api').error(f'Error closing connection: {close_error}')
 
     def subscribe(self):
-        try:
-            """Start listening messages from the queue."""
-            if not self.channel:
+        """Start listening for messages. Reconnects indefinitely on connection loss."""
+        if not self.queue_name:
+            raise ValueError('AMQPService::subscribe: queue_name is required')
+        attempt = 0
+        while True:
+            clean_return = False
+            try:
+                self.connection = None
+                self.channel = None
                 self._connect()
 
-            if self.queue_name:
                 self.channel.basic_consume(
                     queue=self.queue_name,
                     on_message_callback=self._callback
                 )
 
-            logging.getLogger('api').info("Waiting for messages...")
-            self.channel.start_consuming()
-        except Exception as e:
-            logging.getLogger('api').error(f'AMQPService::subscribe: Failed to subscribe to {self.queue_name}: {e}')
+                logging.getLogger('api').info("Waiting for messages...")
+                self.channel.start_consuming()
+
+                # start_consuming() returned — broker closed the connection (e.g. maintenance mode)
+                logging.getLogger('api').warning(
+                    f'AMQPService::subscribe: Connection to {self.queue_name} closed by broker, reconnecting...')
+                attempt = 0  # reset backoff after a successful session
+                clean_return = True
+            except Exception as e:
+                logging.getLogger('api').error(
+                    f'AMQPService::subscribe: Failed to subscribe to {self.queue_name}: {e}')
+            finally:
+                try:
+                    if self.connection and not self.connection.is_closed:
+                        self.connection.close()
+                except Exception as close_err:
+                    logging.getLogger('api').warning(
+                        f'AMQPService::subscribe: could not close connection: {close_err}')
+
+            delay = self._calculate_delay(attempt)
+            logging.getLogger('api').info(
+                f'AMQPService::subscribe: Reconnecting to {self.queue_name} in {delay:.2f}s...')
+            time.sleep(delay)
+            if not clean_return:
+                attempt += 1

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.118/src/base_api_utils.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: base-api-utils
-Version: 1.1.117.dev3
+Version: 1.1.118
 Summary: Django Rest Framework micro services common utilities
 Author-email: Román Gutierrez <roman@tipit.net>, Sebastian Marcet <sebastian@tipit.net>
 Project-URL: Homepage, https://github.com/fntechgit/base-api-utils

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.118}/src/base_api_utils.egg-info/SOURCES.txt

@@ -106,6 +106,9 @@ src/base_api_utils/views/base_view.py
 src/base_api_utils/views/parent_children_crud.py
 src/base_api_utils/views/root_entity_crud.py
 src/base_api_utils/views/tasks_result_view.py
+tests/test_amqp_service.py
+tests/test_check_sponsor_user_permissions.py
 tests/test_circuit_breaker.py
 tests/test_lazy_imports.py
+tests/test_oauth2_scope_required.py
 tests/test_v2_abstract_serializer.py

base_api_utils-1.1.118/tests/test_amqp_service.py

@@ -0,0 +1,218 @@
+import importlib.util
+import sys
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+
+# ── Pre-stub amqp_service.py's dependencies ────────────────────────────────────
+# Must happen at module level before _load_module executes the file.
+# Base classes must be real Python classes so AMQPService inherits correctly.
+
+class _AbstractDomainEventsService:
+    pass
+
+
+class _AbstractEventDispatcher:
+    pass
+
+
+class _AMQPConnectionError(Exception):
+    pass
+
+
+class _AMQPChannelError(Exception):
+    pass
+
+
+def _make_stub_module(**attrs):
+    m = MagicMock()
+    for k, v in attrs.items():
+        setattr(m, k, v)
+    return m
+
+
+_mock_pika_exc = _make_stub_module(
+    AMQPConnectionError=_AMQPConnectionError,
+    AMQPChannelError=_AMQPChannelError,
+)
+_mock_pika = _make_stub_module(exceptions=_mock_pika_exc)
+
+for _name, _mod in [
+    ("pika", _mock_pika),
+    ("pika.exceptions", _mock_pika_exc),
+    ("base_api_utils", MagicMock()),
+    ("base_api_utils.utils", MagicMock()),
+    ("base_api_utils.domain", MagicMock()),
+    ("base_api_utils.services", MagicMock()),
+    (
+        "base_api_utils.services.abstract_event_dispatcher",
+        _make_stub_module(AbstractEventDispatcher=_AbstractEventDispatcher),
+    ),
+    (
+        "base_api_utils.services.abstract_domain_events_service",
+        _make_stub_module(AbstractDomainEventsService=_AbstractDomainEventsService),
+    ),
+]:
+    sys.modules.setdefault(_name, _mod)
+
+
+def _load_module(name, file_path):
+    """Load a module directly from file path, bypassing package __init__.py."""
+    spec = importlib.util.spec_from_file_location(name, file_path)
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+_services_dir = (
+    Path(__file__).resolve().parent.parent / "src" / "base_api_utils" / "services"
+)
+_amqp_module = _load_module(
+    "base_api_utils.services.amqp_service",
+    _services_dir / "amqp_service.py",
+)
+AMQPService = _amqp_module.AMQPService
+
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+def _make_service(**kwargs):
+    defaults = dict(
+        exchange_name="test-exchange",
+        queue_name="test-queue",
+        rabbit_host="localhost",
+        rabbit_port=5672,
+        rabbit_username="guest",
+        rabbit_password="guest",
+        virtual_host="/",
+        exchange_type="direct",
+        routing_keys=["test.event"],
+        base_delay=1.0,
+        max_delay=60.0,
+        jitter=False,
+    )
+    defaults.update(kwargs)
+    return AMQPService(**defaults)
+
+
+# ── Tests ─────────────────────────────────────────────────────────────────────
+
+@pytest.mark.unit
+class TestAMQPServiceSubscribeReconnection:
+
+    def test_reconnects_when_broker_closes_connection(self):
+        """start_consuming() returning (e.g. maintenance-mode close) triggers reconnect."""
+        service = _make_service()
+        connect_calls = 0
+
+        def fake_connect():
+            nonlocal connect_calls
+            connect_calls += 1
+            mock_conn = MagicMock(is_closed=True)
+            mock_ch = MagicMock()
+            # Second call raises to break the infinite loop
+            if connect_calls >= 2:
+                mock_ch.start_consuming.side_effect = KeyboardInterrupt
+            service.connection = mock_conn
+            service.channel = mock_ch
+
+        with patch.object(service, "_connect", side_effect=fake_connect), \
+             patch("base_api_utils.services.amqp_service.time.sleep"):
+            with pytest.raises(KeyboardInterrupt):
+                service.subscribe()
+
+        assert connect_calls == 2
+
+    def test_reconnects_after_connection_exception(self):
+        """An exception during _connect triggers a retry after delay."""
+        service = _make_service()
+        connect_attempts = 0
+
+        def failing_connect():
+            nonlocal connect_attempts
+            connect_attempts += 1
+            if connect_attempts > 2:
+                raise KeyboardInterrupt
+            raise ConnectionError("broker unavailable")
+
+        with patch.object(service, "_connect", side_effect=failing_connect), \
+             patch("base_api_utils.services.amqp_service.time.sleep") as mock_sleep:
+            with pytest.raises(KeyboardInterrupt):
+                service.subscribe()
+
+        assert connect_attempts == 3
+        assert mock_sleep.call_count == 2
+
+    def test_resets_backoff_after_successful_session(self):
+        """After start_consuming returns cleanly, backoff resets to base_delay."""
+        service = _make_service(base_delay=1.0, max_delay=60.0, jitter=False)
+        connect_calls = 0
+
+        def fake_connect():
+            nonlocal connect_calls
+            connect_calls += 1
+            if connect_calls == 1:
+                mock_ch = MagicMock()
+                mock_ch.start_consuming.return_value = None  # returns cleanly
+                service.connection = MagicMock(is_closed=True)
+                service.channel = mock_ch
+            elif connect_calls == 2:
+                raise ConnectionError("first failure after clean session")
+            else:
+                raise KeyboardInterrupt
+
+        with patch.object(service, "_connect", side_effect=fake_connect), \
+             patch("base_api_utils.services.amqp_service.time.sleep") as mock_sleep:
+            with pytest.raises(KeyboardInterrupt):
+                service.subscribe()
+
+        # Clean session resets attempt to 0; the first failure after it must use base_delay, not 2×
+        delays = [c.args[0] for c in mock_sleep.call_args_list]
+        assert delays == pytest.approx([1.0, 1.0])
+
+    def test_cleans_up_open_connection_on_error(self):
+        """An open connection is closed in the finally block after an error."""
+        service = _make_service()
+        mock_conn = MagicMock(is_closed=False)
+
+        def fake_connect():
+            service.connection = mock_conn
+            mock_ch = MagicMock()
+            mock_ch.start_consuming.side_effect = KeyboardInterrupt
+            service.channel = mock_ch
+
+        with patch.object(service, "_connect", side_effect=fake_connect), \
+             patch("base_api_utils.services.amqp_service.time.sleep"):
+            with pytest.raises(KeyboardInterrupt):
+                service.subscribe()
+
+        mock_conn.close.assert_called_once()
+
+    def test_delay_grows_exponentially_across_failures(self):
+        """Reconnection delay doubles on each successive failure."""
+        service = _make_service(base_delay=1.0, max_delay=60.0, jitter=False)
+        connect_attempts = 0
+
+        def failing_connect():
+            nonlocal connect_attempts
+            connect_attempts += 1
+            if connect_attempts > 3:
+                raise KeyboardInterrupt
+            raise ConnectionError("broker unavailable")
+
+        with patch.object(service, "_connect", side_effect=failing_connect), \
+             patch("base_api_utils.services.amqp_service.time.sleep") as mock_sleep:
+            with pytest.raises(KeyboardInterrupt):
+                service.subscribe()
+
+        delays = [c.args[0] for c in mock_sleep.call_args_list]
+        assert delays == [1.0, 2.0, 4.0]
+
+    def test_subscribe_raises_when_queue_name_is_none(self):
+        """subscribe() must fail fast when queue_name is not configured."""
+        service = _make_service(queue_name=None)
+        with pytest.raises(ValueError, match="queue_name is required"):
+            service.subscribe()

base_api_utils-1.1.118/tests/test_check_sponsor_user_permissions.py

@@ -0,0 +1,188 @@
+import functools
+import importlib.util
+import sys
+from contextlib import contextmanager
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+
+# ── Stub classes ──────────────────────────────────────────────────────────────
+
+class _ValidationError(Exception):
+    pass
+
+
+class _AuthenticationFailed(Exception):
+    pass
+
+
+class _PermissionDenied(Exception):
+    pass
+
+
+_mock_access_token_service = MagicMock()
+_mock_access_token_service.validate_token_info = MagicMock()
+
+_mock_get_path = MagicMock(return_value="/api/endpoint")
+_mock_is_admin = MagicMock(return_value=False)
+_APPLICATION_TYPE_SERVICE = 'SERVICE'
+
+_mock_user_permissions_service = MagicMock()
+_mock_user_permissions_service.has_permissions = MagicMock(return_value=True)
+
+_stub_functional = MagicMock()
+_stub_functional.wraps = functools.wraps
+
+_STUBS = {
+    "django": MagicMock(),
+    "django.core": MagicMock(),
+    "django.core.exceptions": MagicMock(PermissionDenied=_PermissionDenied),
+    "django.utils": MagicMock(),
+    "django.utils.functional": _stub_functional,
+    "django.utils.translation": MagicMock(gettext_lazy=lambda s: s),
+    "rest_framework": MagicMock(),
+    "rest_framework.exceptions": MagicMock(
+        ValidationError=_ValidationError,
+        AuthenticationFailed=_AuthenticationFailed,
+    ),
+    "base_api_utils": MagicMock(),
+    "base_api_utils.security": MagicMock(AccessTokenService=_mock_access_token_service),
+    "base_api_utils.security.shared": MagicMock(
+        get_path=_mock_get_path,
+        is_admin=_mock_is_admin,
+        application_type_service=_APPLICATION_TYPE_SERVICE,
+    ),
+    "base_api_utils.security.user_permissions_service": MagicMock(
+        UserPermissionsService=_mock_user_permissions_service,
+    ),
+}
+
+
+@contextmanager
+def _patched_modules():
+    saved = {name: sys.modules.get(name) for name in _STUBS}
+    sys.modules.update(_STUBS)
+    try:
+        yield
+    finally:
+        for name, orig in saved.items():
+            if orig is None:
+                sys.modules.pop(name, None)
+            else:
+                sys.modules[name] = orig
+
+
+def _load_module():
+    src = (
+        Path(__file__).resolve().parent.parent
+        / "src" / "base_api_utils" / "security" / "check_sponsor_user_permissions.py"
+    )
+    with _patched_modules():
+        spec = importlib.util.spec_from_file_location(
+            "base_api_utils.security.check_sponsor_user_permissions_isolated", src
+        )
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+    return module
+
+
+_mod = _load_module()
+check_sponsor_user_permissions = _mod.check_sponsor_user_permissions
+
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+def _make_request(token_info, method="get"):
+    request = MagicMock()
+    request.method = method.upper()
+    request.auth = token_info
+    return request
+
+
+def _make_view(token_info, sponsor_id=1, summit_id=2, method="get"):
+    view = MagicMock()
+    view.request = _make_request(token_info, method)
+    return view, {"sponsor_id": sponsor_id, "summit_id": summit_id}
+
+
+def _make_decorated():
+    @check_sponsor_user_permissions()
+    def endpoint(view, token_info=None, **kwargs):
+        return "ok"
+
+    return endpoint
+
+
+# ── Tests ─────────────────────────────────────────────────────────────────────
+
+@pytest.mark.unit
+class TestCheckSponsorUserPermissions:
+
+    def setup_method(self):
+        _mock_access_token_service.validate_token_info.reset_mock()
+        _mock_is_admin.reset_mock()
+        _mock_is_admin.return_value = False
+        _mock_user_permissions_service.has_permissions.reset_mock()
+        _mock_user_permissions_service.has_permissions.return_value = True
+
+    def test_service_type_application_bypasses_permission_check(self):
+        """SERVICE application_type skips UserPermissionsService entirely."""
+        token_info = {"application_type": "SERVICE"}
+        view, kwargs = _make_view(token_info)
+        decorated = _make_decorated()
+
+        with patch.dict("os.environ", {"ENV": ""}):
+            result = decorated(view, **kwargs)
+
+        assert result == "ok"
+        _mock_user_permissions_service.has_permissions.assert_not_called()
+
+    def test_non_service_application_type_proceeds_to_permission_check(self):
+        """A different application_type is not bypassed."""
+        token_info = {"application_type": "CONFIDENTIAL"}
+        view, kwargs = _make_view(token_info)
+        decorated = _make_decorated()
+
+        with patch.dict("os.environ", {"ENV": ""}):
+            result = decorated(view, **kwargs)
+
+        assert result == "ok"
+        _mock_user_permissions_service.has_permissions.assert_called_once()
+
+    def test_no_application_type_proceeds_to_permission_check(self):
+        """Token without application_type is not bypassed."""
+        token_info = {}
+        view, kwargs = _make_view(token_info)
+        decorated = _make_decorated()
+
+        with patch.dict("os.environ", {"ENV": ""}):
+            result = decorated(view, **kwargs)
+
+        assert result == "ok"
+        _mock_user_permissions_service.has_permissions.assert_called_once()
+
+    def test_service_type_bypass_takes_precedence_after_admin_check(self):
+        """Service bypass is checked after is_admin; both independently allow access."""
+        token_info = {"application_type": "SERVICE"}
+        view, kwargs = _make_view(token_info)
+        decorated = _make_decorated()
+        _mock_is_admin.return_value = False
+
+        with patch.dict("os.environ", {"ENV": ""}):
+            result = decorated(view, **kwargs)
+
+        assert result == "ok"
+        _mock_user_permissions_service.has_permissions.assert_not_called()
+
+    def test_permission_denied_raises_authentication_failed(self):
+        """Regular user with no access gets AuthenticationFailed."""
+        token_info = {}
+        view, kwargs = _make_view(token_info)
+        decorated = _make_decorated()
+        _mock_user_permissions_service.has_permissions.return_value = False
+
+        with patch.dict("os.environ", {"ENV": ""}):
+            with pytest.raises(_AuthenticationFailed):
+                decorated(view, **kwargs)