botocore 1.38.45__py3-none-any.whl → 1.39.0__py3-none-any.whl

botocore/handlers.py

@@ -32,6 +32,7 @@ from botocore import (
     translate,  # noqa: F401
     utils,
 )
+from botocore.args import ClientConfigString
 from botocore.compat import (
     MD5_AVAILABLE,  # noqa: F401
     ETree,
@@ -65,10 +66,12 @@ from botocore.signers import (
     add_generate_presigned_post,
     add_generate_presigned_url,
 )
+from botocore.useragent import register_feature_id
 from botocore.utils import (
     SAFE_CHARS,
     SERVICE_NAME_ALIASES,  # noqa: F401
     ArnParser,
+    get_token_from_environment,
     hyphenize_service_id,  # noqa: F401
     is_global_accesspoint,  # noqa: F401
     percent_encode,
@@ -1292,12 +1295,6 @@ def _update_status_code(response, **kwargs):
         http_response.status_code = parsed_status_code
 
 
-def add_query_compatibility_header(model, params, **kwargs):
-    if not model.service_model.is_query_compatible:
-        return
-    params['headers']['x-amzn-query-mode'] = 'true'
-
-
 def _handle_request_validation_mode_member(params, model, **kwargs):
     client_config = kwargs.get("context", {}).get("client_config")
     if client_config is None:
@@ -1325,6 +1322,91 @@ def _set_extra_headers_for_unsigned_request(
         headers["X-Amz-Content-SHA256"] = "STREAMING-UNSIGNED-PAYLOAD-TRAILER"
 
 
+def _set_auth_scheme_preference_signer(context, signing_name, **kwargs):
+    """
+    Determines the appropriate signer to use based on the client configuration,
+    authentication scheme preferences, and the availability of a bearer token.
+    """
+    client_config = context.get('client_config')
+    if client_config is None:
+        return
+
+    signature_version = client_config.signature_version
+    auth_scheme_preference = client_config.auth_scheme_preference
+    auth_options = context.get('auth_options')
+
+    signature_version_set_in_code = (
+        isinstance(signature_version, ClientConfigString)
+        or signature_version is botocore.UNSIGNED
+    )
+    auth_preference_set_in_code = isinstance(
+        auth_scheme_preference, ClientConfigString
+    )
+    has_in_code_configuration = (
+        signature_version_set_in_code or auth_preference_set_in_code
+    )
+
+    resolved_signature_version = signature_version
+
+    # If signature version was not set in code, but an auth scheme preference
+    # is available, resolve it based on the preferred schemes and supported auth
+    # options for this service.
+    if (
+        not signature_version_set_in_code
+        and auth_scheme_preference
+        and auth_options
+    ):
+        preferred_schemes = auth_scheme_preference.split(',')
+        resolved = botocore.auth.resolve_auth_scheme_preference(
+            preferred_schemes, auth_options
+        )
+        resolved_signature_version = (
+            botocore.UNSIGNED if resolved == 'none' else resolved
+        )
+
+    # Prefer 'bearer' signature version if a bearer token is available, and it
+    # is allowed for this service. This can override earlier resolution if the
+    # config object didn't explicitly set a signature version.
+    if _should_prefer_bearer_auth(
+        has_in_code_configuration, signing_name, resolved_signature_version
+    ):
+        register_feature_id('BEARER_SERVICE_ENV_VARS')
+        resolved_signature_version = 'bearer'
+
+    if resolved_signature_version == signature_version:
+        return None
+    return resolved_signature_version
+
+
+def _should_prefer_bearer_auth(
+    has_in_code_configuration, signing_name, resolved_signature_version
+):
+    if signing_name not in get_bearer_auth_supported_services():
+        return False
+
+    has_token = get_token_from_environment(signing_name) is not None
+
+    # Prefer 'bearer' if a bearer token is available, and either:
+    #   Bearer was already resolved, or
+    #   No auth-related values were explicitly set in code
+    return has_token and (
+        resolved_signature_version == 'bearer' or not has_in_code_configuration
+    )
+
+
+def get_bearer_auth_supported_services():
+    """
+    Returns a set of services that support bearer token authentication.
+    These values correspond to the service's `signingName` property as defined
+    in model.py, falling back to `endpointPrefix` if `signingName` is not set.
+
+    Warning: This is a private interface and is subject to abrupt breaking changes,
+    including removal, in any botocore release. It is not intended for external use,
+    and its usage outside of botocore is not advised or supported.
+    """
+    return {'bedrock'}
+
+
 # This is a list of (event_name, handler).
 # When a Session is created, everything in this list will be
 # automatically registered with that Session.
@@ -1395,7 +1477,6 @@ BUILTIN_HANDLERS = [
     ('docs.response-params.s3.*.complete-section', document_expires_shape),
     ('before-endpoint-resolution.s3', customize_endpoint_resolver_builtins),
     ('before-call', add_recursion_detection_header),
-    ('before-call', add_query_compatibility_header),
     ('before-call.s3', add_expect_header),
     ('before-call.glacier', add_glacier_version),
     ('before-call.apigateway', add_accept_header),
@@ -1417,6 +1498,7 @@ BUILTIN_HANDLERS = [
     ('choose-signer.sts.AssumeRoleWithSAML', disable_signing),
     ('choose-signer.sts.AssumeRoleWithWebIdentity', disable_signing),
     ('choose-signer', set_operation_specific_signer),
+    ('choose-signer', _set_auth_scheme_preference_signer),
     ('before-parameter-build.s3.HeadObject', sse_md5),
     ('before-parameter-build.s3.GetObject', sse_md5),
     ('before-parameter-build.s3.PutObject', sse_md5),

botocore/serialize.py

@@ -221,6 +221,10 @@ class Serializer:
             value = "NaN"
         return value
 
+    def _handle_query_compatible_trait(self, operation_model, serialized):
+        if operation_model.service_model.is_query_compatible:
+            serialized['headers']['x-amzn-query-mode'] = 'true'
+
 
 class QuerySerializer(Serializer):
     TIMESTAMP_FORMAT = 'iso8601'
@@ -380,6 +384,8 @@ class JSONSerializer(Serializer):
             'X-Amz-Target': target,
             'Content-Type': f'application/x-amz-json-{json_version}',
         }
+        self._handle_query_compatible_trait(operation_model, serialized)
+
         body = self.MAP_TYPE()
         input_shape = operation_model.input_shape
         if input_shape is not None:
@@ -1198,6 +1204,7 @@ class RpcV2CBORSerializer(BaseRpcV2Serializer, CBORSerializer):
             header_val = 'application/vnd.amazon.eventstream'
         else:
             header_val = 'application/cbor'
+        self._handle_query_compatible_trait(operation_model, serialized)
 
         has_body = serialized['body'] != b''
         has_content_type = has_header('Content-Type', serialized['headers'])

botocore/session.py

@@ -521,7 +521,7 @@ class Session:
             ).load_credentials()
         return self._credentials
 
-    def get_auth_token(self):
+    def get_auth_token(self, **kwargs):
         """
         Return the :class:`botocore.tokens.AuthToken` object associated with
         this session. If the authorization token has not yet been loaded, this
@@ -529,8 +529,15 @@ class Session:
         return the cached authorization token.
 
         """
+        provider = self._components.get_component('token_provider')
+
+        signing_name = kwargs.get('signing_name')
+        if signing_name is not None:
+            auth_token = provider.load_token(signing_name=signing_name)
+            if auth_token is not None:
+                return auth_token
+
         if self._auth_token is None:
-            provider = self._components.get_component('token_provider')
             self._auth_token = provider.load_token()
         return self._auth_token
 
@@ -1015,6 +1022,7 @@ class Session:
             exceptions_factory,
             config_store,
             user_agent_creator=user_agent_creator,
+            auth_token_resolver=self.get_auth_token,
         )
         client = client_creator.create_client(
             service_name=service_name,

botocore/signers.py

@@ -25,6 +25,7 @@ from botocore.exceptions import (
     UnknownSignatureVersionError,
     UnsupportedSignatureVersionError,
 )
+from botocore.tokens import FrozenAuthToken
 from botocore.utils import (
     ArnParser,
     datetime2timestamp,
@@ -286,9 +287,12 @@ class RequestSigner:
             )
 
         if cls.REQUIRES_TOKEN is True:
-            frozen_token = None
-            if self._auth_token is not None:
+            if self._auth_token and not isinstance(
+                self._auth_token, FrozenAuthToken
+            ):
                 frozen_token = self._auth_token.get_frozen_token()
+            else:
+                frozen_token = self._auth_token
             auth = cls(frozen_token)
             return auth