capo-backup 0.2.0__tar.gz → 0.5.0__tar.gz

{capo_backup-0.2.0/src/capo_backup.egg-info → capo_backup-0.5.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: capo-backup
-Version: 0.2.0
-Summary: Python SDK for Backup.
+Version: 0.5.0
+Summary: Python SDK for AWS Backup.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -57,8 +57,8 @@ from capo_backup import AsyncBackupClient
 
 async def main():
     async with AsyncBackupClient() as backup:
-        # Example: paginate over list_backup_jobs
-        async for item in backup.iter_list_backup_jobs():
+        # Example: paginate over list_backup_access_points
+        async for item in backup.iter_list_backup_access_points():
             print(item)
 ```
 

{capo_backup-0.2.0 → capo_backup-0.5.0}/README.md

@@ -29,8 +29,8 @@ from capo_backup import AsyncBackupClient
 
 async def main():
     async with AsyncBackupClient() as backup:
-        # Example: paginate over list_backup_jobs
-        async for item in backup.iter_list_backup_jobs():
+        # Example: paginate over list_backup_access_points
+        async for item in backup.iter_list_backup_access_points():
             print(item)
 ```
 

{capo_backup-0.2.0 → capo_backup-0.5.0}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "capo-backup"
-version = "0.2.0"
-description = "Python SDK for Backup."
+version = "0.5.0"
+description = "Python SDK for AWS Backup."
 readme = "README.md"
 requires-python = ">=3.10"
 classifiers = [

{capo_backup-0.2.0 → capo_backup-0.5.0}/src/capo_backup/_auth/_signers.py

@@ -7,7 +7,7 @@ from zapros import Request
 
 from capo_backup._auth._identity import Credentials, Identity
 from capo_backup._auth._providers import IdentityProvider
-from capo_backup._auth._sigv4 import SigV4AuthContext, sign_sigv4
+from capo_backup._auth._sigv4 import S3_SIGNING_NAMES, SigV4AuthContext, sign_sigv4
 
 IdentityT = TypeVar("IdentityT", bound="Identity")
 
@@ -30,14 +30,25 @@ class SigV4Signer(Signer[Credentials]):
     The full auth scheme (``name`` variant, ``signingName``, ``signingRegion``,
     encoding/normalization flags) is provided by the caller — either from the
     endpoint rule-set's ``authSchemes`` property or built by the generated
-    ``get_signer`` from operation defaults.
+    ``get_signer`` from operation defaults. ``unsigned_payload`` mirrors the
+    operation's ``aws.auth#unsignedPayload`` trait: the body is sent but left
+    out of the signature. ``event_stream`` marks a request event stream: the
+    request is signed with the ``STREAMING-AWS4-HMAC-SHA256-EVENTS`` payload
+    marker and every event with a signature chained from it.
     """
 
     def __init__(
-        self, provider: IdentityProvider[Credentials], *, auth_scheme: dict[str, Any]
+        self,
+        provider: IdentityProvider[Credentials],
+        *,
+        auth_scheme: dict[str, Any],
+        unsigned_payload: bool = False,
+        event_stream: bool = False,
     ) -> None:
         super().__init__(provider)
         self._auth_scheme = auth_scheme
+        self._unsigned_payload = unsigned_payload
+        self._event_stream = event_stream
 
     async def asign(self, req: Request) -> Request:
         creds = await self.provider.aresolve_identity()
@@ -55,13 +66,24 @@ class SigV4Signer(Signer[Credentials]):
                 "disableNormalizePath", False
             ),
         }
-        if req.body is None:
-            body: bytes | None = b""
-        elif isinstance(req.body, bytes):
-            body = req.body
-        else:
-            body = None
-        return sign_sigv4(req, ctx, body)
+        unsigned_payload = self._unsigned_payload
+        if (
+            not unsigned_payload
+            and not self._event_stream
+            and req.body is not None
+            and not isinstance(req.body, bytes)
+        ):
+            if self._auth_scheme["signingName"] in S3_SIGNING_NAMES:
+                # S3 accepts UNSIGNED-PAYLOAD for any operation; streamed bodies rely on it.
+                unsigned_payload = True
+            else:
+                raise NotImplementedError(
+                    "Currently we don't support signed chunked payloads, so buffer the body and "
+                    "pass bytes as a workaround; chunked signed implementation coming soon"
+                )
+        return sign_sigv4(
+            req, ctx, unsigned_payload=unsigned_payload, event_stream=self._event_stream
+        )
 
     def sign(self, req: Request) -> Request:
         creds = self.provider.resolve_identity()
@@ -79,10 +101,21 @@ class SigV4Signer(Signer[Credentials]):
                 "disableNormalizePath", False
             ),
         }
-        if req.body is None:
-            body: bytes | None = b""
-        elif isinstance(req.body, bytes):
-            body = req.body
-        else:
-            body = None
-        return sign_sigv4(req, ctx, body)
+        unsigned_payload = self._unsigned_payload
+        if (
+            not unsigned_payload
+            and not self._event_stream
+            and req.body is not None
+            and not isinstance(req.body, bytes)
+        ):
+            if self._auth_scheme["signingName"] in S3_SIGNING_NAMES:
+                # S3 accepts UNSIGNED-PAYLOAD for any operation; streamed bodies rely on it.
+                unsigned_payload = True
+            else:
+                raise NotImplementedError(
+                    "Currently we don't support signed chunked payloads, so buffer the body and "
+                    "pass bytes as a workaround; chunked signed implementation coming soon"
+                )
+        return sign_sigv4(
+            req, ctx, unsigned_payload=unsigned_payload, event_stream=self._event_stream
+        )

{capo_backup-0.2.0 → capo_backup-0.5.0}/src/capo_backup/_auth/_sigv4.py

@@ -1,4 +1,4 @@
-"""AWS Signature Version 4 — single-chunk signing.
+"""AWS Signature Version 4 — single-chunk and event-stream signing.
 
 Reference:
     https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
@@ -15,7 +15,8 @@ import functools
 import hashlib
 import hmac
 import re
-from typing import Any, Literal, TypedDict
+from collections.abc import AsyncIterator, Iterator
+from typing import Any, Literal, TypedDict, cast
 from urllib.parse import quote, unquote
 
 import zapros
@@ -23,6 +24,9 @@ from pywhatwgurl import URLSearchParams
 from zapros import Headers, Request
 from zapros._utils import get_host_header_value
 
+from .._iter import AnyIterator
+from .._protocol.eventstream import HeaderValue, Message, encode_headers
+
 
 def build_sigv4_auth_scheme(
     signing_name: str, region: str | None, endpoint_scheme: dict[str, Any] | None = None
@@ -65,6 +69,10 @@ class SigV4AuthContext(TypedDict):
 
 
 _SIGV4_ALGORITHM = "AWS4-HMAC-SHA256"
+# Per-event algorithm and request payload marker of a signed event stream.
+_EVENT_ALGORITHM = "AWS4-HMAC-SHA256-PAYLOAD"
+_EVENT_STREAM_PAYLOAD = "STREAMING-AWS4-HMAC-SHA256-EVENTS"
+_AMZ_DATE_FORMAT = "%Y%m%dT%H%M%SZ"
 _EMPTY_PAYLOAD_SHA256 = hashlib.sha256(b"").hexdigest()
 
 # Headers excluded from the signed-headers set. Mirrors botocore's denylist:
@@ -95,9 +103,11 @@ _UNSIGNED_HEADERS = frozenset(
 
 _MULTI_SPACE = re.compile(r" +")
 
-# Services that require the payload hash to travel in ``x-amz-content-sha256``.
-# Other services sign the hash into the canonical request without sending it.
-_S3_SIGNING_NAMES = frozenset({"s3", "s3express", "s3-outposts", "s3-object-lambda"})
+# Services that require the payload hash to travel in ``x-amz-content-sha256``
+# on every request, and that accept ``UNSIGNED-PAYLOAD`` for any operation.
+# Other services sign the hash into the canonical request without sending it,
+# and only see the header when the payload is left unsigned.
+S3_SIGNING_NAMES = frozenset({"s3", "s3express", "s3-outposts", "s3-object-lambda"})
 
 
 def _uri_encode(value: str) -> str:
@@ -231,12 +241,20 @@ def _canonical_query_from_pairs(pairs: list[tuple[str, str]]) -> str:
 def sign_sigv4(
     request: Request,
     ctx: SigV4AuthContext,
-    body: bytes | None,
+    *,
+    unsigned_payload: bool = False,
+    event_stream: bool = False,
 ) -> Request:
     """Return a new ``Request`` carrying SigV4 single-chunk auth headers.
 
-    Pass ``body=None`` to sign with ``UNSIGNED-PAYLOAD`` (streaming requests).
-    The original ``request.body`` is forwarded unchanged in that case.
+    The payload hash covers ``request.body``, which must be ``bytes`` or
+    ``None``. ``unsigned_payload`` signs ``UNSIGNED-PAYLOAD`` instead and
+    forwards any body unchanged (streaming S3 requests and operations carrying
+    ``aws.auth#unsignedPayload``). ``event_stream`` signs a request event
+    stream: the ``STREAMING-AWS4-HMAC-SHA256-EVENTS`` marker stands in for the
+    payload hash and the body — an iterator of encoded event messages — is
+    wrapped in an :class:`EventStreamIterator` that signs every event with a
+    signature chained from this request's.
     """
     service = ctx["signing_name"]
     region = ctx["signing_region"]
@@ -250,21 +268,31 @@ def sign_sigv4(
         date_stamp = amz_date[:8]
     else:
         now = _amz_now()
-        amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+        amz_date = now.strftime(_AMZ_DATE_FORMAT)
         date_stamp = now.strftime("%Y%m%d")
         headers["X-Amz-Date"] = amz_date
 
-    # Payload hash. For S3-family services, x-amz-content-sha256 is mandatory
-    # and must be set BEFORE computing the canonical request (it gets signed).
+    # Payload hash. For S3-family services, x-amz-content-sha256 is mandatory;
+    # for every service it is the only way to announce an unsigned payload or
+    # an event stream.
+    # Either way it must be set BEFORE computing the canonical request (it
+    # gets signed).
     payload_hash = headers.get("X-Amz-Content-SHA256")
     if payload_hash is None:
-        if body is None:
+        if event_stream:
+            payload_hash = _EVENT_STREAM_PAYLOAD
+        elif unsigned_payload:
             payload_hash = "UNSIGNED-PAYLOAD"
+        elif request.body is None:
+            payload_hash = _EMPTY_PAYLOAD_SHA256
+        elif isinstance(request.body, bytes):
+            payload_hash = hashlib.sha256(request.body).hexdigest()
         else:
-            payload_hash = (
-                hashlib.sha256(body).hexdigest() if body else _EMPTY_PAYLOAD_SHA256
+            raise TypeError(
+                "sign_sigv4 hashes a bytes body only; pass unsigned_payload=True "
+                "to send a streamed body without a payload hash"
             )
-    if service in _S3_SIGNING_NAMES:
+    if service in S3_SIGNING_NAMES or unsigned_payload or event_stream:
         headers["X-Amz-Content-SHA256"] = payload_hash
 
     # Session token (STS / assumed-role credentials).
@@ -308,18 +336,135 @@ def sign_sigv4(
         f"Signature={signature}"
     )
 
-    effective_body = body if body is not None else request.body
-    if effective_body is not None:
+    body = request.body
+    if event_stream:
+        if not isinstance(body, (Iterator, AsyncIterator)):
+            raise TypeError(
+                "event_stream requires an iterator of encoded events as the body"
+            )
+        body = EventStreamIterator(
+            cast("Iterator[bytes] | AsyncIterator[bytes]", body), ctx, signature
+        )
+    if body is not None:
         return Request(
             request.url,
             request.method,
             headers,
-            body=effective_body,
+            body=body,
             context=request.context,
         )
     return Request(request.url, request.method, headers, context=request.context)
 
 
+def _sign_event(
+    ctx: SigV4AuthContext, prior_signature: str, payload: bytes
+) -> tuple[bytes, str]:
+    """Wrap one encoded event in a signed outer message.
+
+    Returns ``(frame, signature)``; the hex signature seeds the next event.
+    The string to sign chains every frame to its predecessor — the first one
+    to the request's ``Authorization`` signature — so the service can verify
+    the stream incrementally::
+
+        AWS4-HMAC-SHA256-PAYLOAD
+        <date, YYYYMMDDTHHMMSSZ>
+        <credential scope>
+        <prior signature, hex>
+        <hex sha256 of the encoded ``:date`` header>
+        <hex sha256 of the payload>
+
+    The AWS SDKs (and the service) use the ``-PAYLOAD`` algorithm name; the
+    Transcribe developer guide's pseudocode omits the suffix.
+    """
+    service = ctx["signing_name"]
+    region = ctx["signing_region"]
+    now = _amz_now()
+    amz_date = now.strftime(_AMZ_DATE_FORMAT)
+    date_stamp = amz_date[:8]
+    credential_scope = f"{date_stamp}/{region}/{service}/aws4_request"
+    date_header: dict[str, HeaderValue] = {":date": now}
+    string_to_sign = "\n".join(
+        (
+            _EVENT_ALGORITHM,
+            amz_date,
+            credential_scope,
+            prior_signature,
+            hashlib.sha256(encode_headers(date_header)).hexdigest(),
+            hashlib.sha256(payload).hexdigest(),
+        )
+    )
+    signing_key = _derive_signing_key(
+        ctx["secret_access_key"], date_stamp, region, service
+    )
+    signature = hmac.new(
+        signing_key, string_to_sign.encode("utf-8"), hashlib.sha256
+    ).hexdigest()
+    frame = Message(
+        {**date_header, ":chunk-signature": bytes.fromhex(signature)}, payload
+    ).encode()
+    return frame, signature
+
+
+class EventStreamIterator(AnyIterator[bytes]):
+    """Sign a request event stream, one frame per event.
+
+    Wraps an iterator of encoded event messages (as produced by the generated
+    ``serialize_event_*`` functions). Each event becomes the payload of an
+    outer message carrying ``:date`` and ``:chunk-signature`` headers, the
+    signature chained from the previous frame's and seeded by the request's
+    ``Authorization`` signature. Once the events are exhausted, one empty
+    signed frame is yielded to mark the end of the stream.
+
+    Like :class:`~capo._body.Body`, it is both a sync and an async iterator:
+    iterate it the way the wrapped source is iterable (``next`` over a sync
+    source, ``async for`` over an async one).
+
+    Reference:
+        https://docs.aws.amazon.com/transcribe/latest/dg/streaming-setting-up.html
+    """
+
+    def __init__(
+        self,
+        events: Iterator[bytes] | AsyncIterator[bytes],
+        ctx: SigV4AuthContext,
+        seed_signature: str,
+    ) -> None:
+        self._events = events
+        self._ctx = ctx
+        self._prior_signature = seed_signature
+        self._ended = False
+
+    def _frame(self, payload: bytes) -> bytes:
+        frame, self._prior_signature = _sign_event(
+            self._ctx, self._prior_signature, payload
+        )
+        return frame
+
+    def __next__(self) -> bytes:
+        if self._ended:
+            raise StopIteration
+        if not isinstance(self._events, Iterator):
+            raise TypeError("this event stream wraps an async source; use `async for`")
+        try:
+            payload = next(cast(Iterator[bytes], self._events))
+        except StopIteration:
+            self._ended = True
+            payload = b""
+        return self._frame(payload)
+
+    async def __anext__(self) -> bytes:
+        if self._ended:
+            raise StopAsyncIteration
+        if not isinstance(self._events, AsyncIterator):
+            raise TypeError("this event stream wraps a sync source; use `for`")
+        try:
+            payload = await cast(AsyncIterator[bytes], self._events).__anext__()
+        except StopAsyncIteration:
+            self._ended = True
+            payload = b""
+        return self._frame(payload)
+
+
 def presign_sigv4(
     request: Request,
     ctx: SigV4AuthContext,
@@ -346,7 +491,7 @@ def presign_sigv4(
     service = ctx["signing_name"]
     region = ctx["signing_region"]
 
-    amz_date = sign_time.strftime("%Y%m%dT%H%M%SZ")
+    amz_date = sign_time.strftime(_AMZ_DATE_FORMAT)
     date_stamp = sign_time.strftime("%Y%m%d")
     credential_scope = f"{date_stamp}/{region}/{service}/aws4_request"
 

{capo_backup-0.2.0 → capo_backup-0.5.0}/src/capo_backup/_operations/cryo_controller_user_manager/associate_backup_vault_mpa_approval_team.py

@@ -20,7 +20,11 @@ import capo_backup.errors.service_unavailable_exception
 import capo_backup.types.associate_backup_vault_mpa_approval_team_input
 from capo_backup._protocol.errors import parse_error_metadata_json
 from capo_backup._rule_engine._endpoint_rule_set import EndpointParams, resolve
-from capo_backup._services._pipeline import AsyncOperationOptions, OperationOptions
+from capo_backup._services._pipeline import (
+    AsyncOperationOptions,
+    OperationOptions,
+    raise_error,
+)
 from capo_backup.errors import UnknownServiceError
 
 
@@ -120,7 +124,7 @@ def associate_backup_vault_mpa_approval_team(
     try:
         if response.status >= 300:
             response.read()
-            handle_error(response)
+            raise_error(response, handle_error)
         return None, response
     except BaseException:
         response.close()
@@ -135,7 +139,7 @@ async def async_associate_backup_vault_mpa_approval_team(
     try:
         if response.status >= 300:
             await response.aread()
-            handle_error(response)
+            raise_error(response, handle_error)
         return None, response
     except BaseException:
         await response.aclose()

{capo_backup-0.2.0 → capo_backup-0.5.0}/src/capo_backup/_operations/cryo_controller_user_manager/cancel_legal_hold.py

@@ -21,7 +21,11 @@ import capo_backup.types.cancel_legal_hold_input
 import capo_backup.types.cancel_legal_hold_output
 from capo_backup._protocol.errors import parse_error_metadata_json
 from capo_backup._rule_engine._endpoint_rule_set import EndpointParams, resolve
-from capo_backup._services._pipeline import AsyncOperationOptions, OperationOptions
+from capo_backup._services._pipeline import (
+    AsyncOperationOptions,
+    OperationOptions,
+    raise_error,
+)
 from capo_backup.errors import UnknownServiceError
 
 
@@ -135,7 +139,7 @@ def cancel_legal_hold(
     try:
         if response.status >= 300:
             response.read()
-            handle_error(response)
+            raise_error(response, handle_error)
         return handle_response(response), response
     except BaseException:
         response.close()
@@ -152,7 +156,7 @@ async def async_cancel_legal_hold(
     try:
         if response.status >= 300:
             await response.aread()
-            handle_error(response)
+            raise_error(response, handle_error)
         return await async_handle_response(response), response
     except BaseException:
         await response.aclose()

capo_backup-0.5.0/src/capo_backup/_operations/cryo_controller_user_manager/create_backup_access_point.py

@@ -0,0 +1,185 @@
+"""Generated from Smithy shape ``com.amazonaws.backup#CreateBackupAccessPoint``."""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+import zapros
+from typing_extensions import Never
+
+import capo_backup._auth._signers
+import capo_backup._auth._sigv4
+import capo_backup._protocol.eventstream
+import capo_backup.errors.already_exists_exception
+import capo_backup.errors.conflict_exception
+import capo_backup.errors.invalid_parameter_value_exception
+import capo_backup.errors.invalid_request_exception
+import capo_backup.errors.limit_exceeded_exception
+import capo_backup.errors.missing_parameter_value_exception
+import capo_backup.errors.resource_not_found_exception
+import capo_backup.errors.service_unavailable_exception
+import capo_backup.types.access_point_metadata_map
+import capo_backup.types.access_point_status
+import capo_backup.types.create_backup_access_point_request
+import capo_backup.types.create_backup_access_point_response
+import capo_backup.types.tag_map
+from capo_backup._protocol.errors import parse_error_metadata_json
+from capo_backup._rule_engine._endpoint_rule_set import EndpointParams, resolve
+from capo_backup._services._pipeline import (
+    AsyncOperationOptions,
+    OperationOptions,
+    raise_error,
+)
+from capo_backup.errors import UnknownServiceError
+
+
+def handle_error(response: zapros.Response) -> Never:
+    data = json.loads(response.read())
+    code, message = parse_error_metadata_json(response, data)
+    match code:
+        case "AlreadyExistsException":
+            raise capo_backup.errors.already_exists_exception.AlreadyExistsException.from_json(
+                data, message
+            )
+        case "ConflictException":
+            raise capo_backup.errors.conflict_exception.ConflictException.from_json(
+                data, message
+            )
+        case "InvalidParameterValueException":
+            raise capo_backup.errors.invalid_parameter_value_exception.InvalidParameterValueException.from_json(
+                data, message
+            )
+        case "InvalidRequestException":
+            raise capo_backup.errors.invalid_request_exception.InvalidRequestException.from_json(
+                data, message
+            )
+        case "LimitExceededException":
+            raise capo_backup.errors.limit_exceeded_exception.LimitExceededException.from_json(
+                data, message
+            )
+        case "MissingParameterValueException":
+            raise capo_backup.errors.missing_parameter_value_exception.MissingParameterValueException.from_json(
+                data, message
+            )
+        case "ResourceNotFoundException":
+            raise capo_backup.errors.resource_not_found_exception.ResourceNotFoundException.from_json(
+                data, message
+            )
+        case "ServiceUnavailableException":
+            raise capo_backup.errors.service_unavailable_exception.ServiceUnavailableException.from_json(
+                data, message
+            )
+        case _:
+            raise UnknownServiceError(code=code, message=message, response=response)
+
+
+def handle_response(
+    response: zapros.Response,
+) -> capo_backup.types.create_backup_access_point_response.CreateBackupAccessPointResponse:
+    out: capo_backup.types.create_backup_access_point_response.CreateBackupAccessPointResponse = capo_backup.types.create_backup_access_point_response.deserialize_json(
+        json.loads(response.read())
+    )
+    return out
+
+
+async def async_handle_response(
+    response: zapros.Response,
+) -> capo_backup.types.create_backup_access_point_response.CreateBackupAccessPointResponse:
+    out: capo_backup.types.create_backup_access_point_response.CreateBackupAccessPointResponse = capo_backup.types.create_backup_access_point_response.deserialize_json(
+        json.loads(await response.aread())
+    )
+    return out
+
+
+def get_signer(
+    options: AsyncOperationOptions | OperationOptions,
+    auth_schemes: list[dict[str, Any]] | None = None,
+) -> capo_backup._auth._signers.Signer | None:
+    name_to_schema = {s["name"]: s for s in (auth_schemes or [])}  # noqa: F841
+    if (
+        options.credentials_provider is not None
+        and name_to_schema
+        and not name_to_schema.keys() & {"sigv4", "sigv4-s3express"}
+    ):
+        raise RuntimeError(
+            "Endpoint requires an unsupported auth scheme: " + ", ".join(name_to_schema)
+        )
+    if options.credentials_provider is not None:
+        endpoint_scheme = name_to_schema.get("sigv4") or name_to_schema.get(
+            "sigv4-s3express"
+        )
+        if endpoint_scheme is not None or not name_to_schema:
+            sigv4_config = capo_backup._auth._sigv4.build_sigv4_auth_scheme(
+                "backup", options.region, endpoint_scheme
+            )
+            if sigv4_config is not None:
+                return capo_backup._auth._signers.SigV4Signer(
+                    options.credentials_provider, auth_scheme=sigv4_config
+                )
+    raise RuntimeError("Auth was not resolved")
+
+
+def build_request(
+    options: OperationOptions | AsyncOperationOptions,
+    input_: capo_backup.types.create_backup_access_point_request.CreateBackupAccessPointRequest,
+) -> zapros.Request:
+    endpoint = resolve(
+        EndpointParams(
+            Region=options.region,
+            UseDualStack=options.use_dual_stack,
+            UseFIPS=options.use_fips,
+            Endpoint=options.endpoint,
+        )
+    )  # noqa: F841
+    url = endpoint.url.rstrip("/") + "/backup-access-point/create"
+    params: list[tuple[str, str]] = []
+    headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
+    body: bytes | None = json.dumps(
+        capo_backup.types.create_backup_access_point_request.serialize_json(input_),
+        allow_nan=False,
+    ).encode()
+    headers["content-type"] = "application/json"
+    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    normalized_url = zapros.URL(url)
+    for k, v in params:
+        normalized_url.search_params.append(k, v)
+    return zapros.Request(
+        normalized_url, "PUT", headers=headers, body=body, context={"signer": signer}
+    )
+
+
+def create_backup_access_point(
+    options: OperationOptions,
+    input_: capo_backup.types.create_backup_access_point_request.CreateBackupAccessPointRequest,
+) -> tuple[
+    capo_backup.types.create_backup_access_point_response.CreateBackupAccessPointResponse,
+    zapros.Response,
+]:
+    response = options.client.handler.handle(build_request(options, input_))
+    try:
+        if response.status >= 300:
+            response.read()
+            raise_error(response, handle_error)
+        return handle_response(response), response
+    except BaseException:
+        response.close()
+        raise
+
+
+async def async_create_backup_access_point(
+    options: AsyncOperationOptions,
+    input_: capo_backup.types.create_backup_access_point_request.CreateBackupAccessPointRequest,
+) -> tuple[
+    capo_backup.types.create_backup_access_point_response.CreateBackupAccessPointResponse,
+    zapros.Response,
+]:
+    response = await options.client.handler.ahandle(build_request(options, input_))
+    try:
+        if response.status >= 300:
+            await response.aread()
+            raise_error(response, handle_error)
+        return await async_handle_response(response), response
+    except BaseException:
+        await response.aclose()
+        raise

{capo_backup-0.2.0 → capo_backup-0.5.0}/src/capo_backup/_operations/cryo_controller_user_manager/create_backup_plan.py

@@ -24,7 +24,11 @@ import capo_backup.types.tags
 import capo_backup.types.timestamp
 from capo_backup._protocol.errors import parse_error_metadata_json
 from capo_backup._rule_engine._endpoint_rule_set import EndpointParams, resolve
-from capo_backup._services._pipeline import AsyncOperationOptions, OperationOptions
+from capo_backup._services._pipeline import (
+    AsyncOperationOptions,
+    OperationOptions,
+    raise_error,
+)
 from capo_backup.errors import UnknownServiceError
 
 
@@ -145,7 +149,7 @@ def create_backup_plan(
     try:
         if response.status >= 300:
             response.read()
-            handle_error(response)
+            raise_error(response, handle_error)
         return handle_response(response), response
     except BaseException:
         response.close()
@@ -162,7 +166,7 @@ async def async_create_backup_plan(
     try:
         if response.status >= 300:
             await response.aread()
-            handle_error(response)
+            raise_error(response, handle_error)
         return await async_handle_response(response), response
     except BaseException:
         await response.aclose()