capo-cloudcontrol 0.5.0__tar.gz → 0.7.0__tar.gz

{capo_cloudcontrol-0.5.0/src/capo_cloudcontrol.egg-info → capo_cloudcontrol-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-cloudcontrol
-Version: 0.5.0
+Version: 0.7.0
 Summary: Python SDK for AWS Cloudcontrol.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -18,7 +18,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jmespath>=1.0
-Requires-Dist: zapros>=0.13.0
+Requires-Dist: zapros>=0.21.0
 Provides-Extra: anyio
 Requires-Dist: anyio>=3.0; extra == "anyio"
 Provides-Extra: sso

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capo-cloudcontrol"
-version = "0.5.0"
+version = "0.7.0"
 description = "Python SDK for AWS Cloudcontrol."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -20,7 +20,7 @@ classifiers = [
 ]
 dependencies = [
     "jmespath>=1.0",
-    "zapros>=0.13.0",
+    "zapros>=0.21.0",
 ]
 
 [project.optional-dependencies]

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_auth/_sigv4.py

@@ -17,7 +17,7 @@ import hmac
 import re
 from collections.abc import AsyncIterator, Iterator
 from typing import Any, Literal, TypedDict, cast
-from urllib.parse import quote, unquote
+from urllib.parse import quote
 
 import zapros
 from pywhatwgurl import URLSearchParams
@@ -134,11 +134,11 @@ def _remove_dot_segments(path: str) -> str:
 def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
     """Build CanonicalURI.
 
-    Per the SigV4 spec, every segment is URI-encoded; standard services
-    normalize dot segments and URI-encode each segment **twice**. The
-    rules-engine ``disableNormalizePath`` / ``disableDoubleEncoding`` flags
-    turn those steps off — S3-family services set both, so the path is
-    signed exactly as provided.
+    ``path`` is the path as sent on the wire, so it is already URI-encoded
+    once. Standard services normalize dot segments and URI-encode each
+    segment a second time. The rules-engine ``disableNormalizePath`` /
+    ``disableDoubleEncoding`` flags turn those steps off — S3-family
+    services set both, so the path is signed exactly as provided.
     """
     if not path:
         return "/"
@@ -148,9 +148,9 @@ def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
         path = _remove_dot_segments(path)
     if not double_encode:
         return path
-    decoded = unquote(path)
-    first = quote(decoded, safe="/~")
-    return quote(first, safe="/~")
+    # Never decode first: that would turn a "%2F" inside a segment (an ARN in
+    # a path label) into a separator and leave it out of the second encoding.
+    return quote(path, safe="/~")
 
 
 def _canonical_query(query: str) -> str:

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_operations/cloud_api_service/cancel_resource_request.py

@@ -111,7 +111,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/x-amz-json-1.0"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_operations/cloud_api_service/create_resource.py

@@ -198,7 +198,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/x-amz-json-1.0"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_operations/cloud_api_service/delete_resource.py

@@ -198,7 +198,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/x-amz-json-1.0"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_operations/cloud_api_service/get_resource.py

@@ -188,7 +188,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/x-amz-json-1.0"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_operations/cloud_api_service/get_resource_request_status.py

@@ -107,7 +107,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/x-amz-json-1.0"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_operations/cloud_api_service/list_resource_requests.py

@@ -102,7 +102,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/x-amz-json-1.0"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_operations/cloud_api_service/list_resources.py

@@ -188,7 +188,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/x-amz-json-1.0"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_operations/cloud_api_service/update_resource.py

@@ -198,7 +198,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/x-amz-json-1.0"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_services/_pipeline.py

@@ -40,6 +40,7 @@ class OperationOptions:
     endpoint: str | None = None
     retry_max_attempts: int | None = None
     credentials_provider: IdentityProvider[Credentials] | None = None
+    anonymous: bool | None = None
 
 
 @dataclass
@@ -51,6 +52,7 @@ class AsyncOperationOptions:
     endpoint: str | None = None
     retry_max_attempts: int | None = None
     credentials_provider: IdentityProvider[Credentials] | None = None
+    anonymous: bool | None = None
 
 
 @dataclass

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_services/async_cloud_control.py

@@ -70,6 +70,7 @@ class AsyncCloudControlClientConfig(TypedDict, total=False, closed=True):
     use_fips: bool | None
     endpoint: str | None
     credentials_provider: IdentityProvider[Credentials] | None
+    anonymous: bool | None
 
 
 class AsyncCloudControlClient:
@@ -85,6 +86,7 @@ class AsyncCloudControlClient:
         endpoint: The value of the ``SDK::Endpoint`` endpoint parameter.
         credentials: AWS credentials for request signing.
         credentials_provider: Provider that resolves AWS credentials. Takes precedence over ``credentials``.
+        anonymous: Send requests unsigned, without resolving credentials, even for operations that require authentication.
     """
 
     def __init__(
@@ -98,10 +100,14 @@ class AsyncCloudControlClient:
         endpoint: str | None = None,
         credentials: Credentials | None = None,
         credentials_provider: CredentialsProvider | None = None,
+        anonymous: bool | None = None,
     ):
-        self._client = AsyncClient(http_handler).wrap_with_middleware(
-            lambda next: AuthMiddleware(next)
-        )
+        client = AsyncClient(http_handler)
+        # The handler the user gave us, or the default one for this environment.
+        # The SDK middlewares wrap it below, and the credential resolvers borrow
+        # it for their one-off calls.
+        raw_handler = client.handler
+        self._client = client.wrap_with_middleware(lambda next: AuthMiddleware(next))
         if credentials is not None and credentials_provider is not None:
             warnings.warn(
                 "Both credentials and credentials_provider given; provider takes precedence"
@@ -113,7 +119,7 @@ class AsyncCloudControlClient:
             resolved_credentials_provider = StaticAwsCredentialsProvider(credentials)
         if resolved_credentials_provider is None and credentials is None:
             resolved_credentials_provider = default_aws_credentials_chain(
-                AsyncClient(http_handler)
+                AsyncClient(raw_handler)
             )
         self._config = AsyncCloudControlClientConfig(
             {
@@ -124,6 +130,7 @@ class AsyncCloudControlClient:
                 "use_fips": use_fips,
                 "endpoint": endpoint,
                 "credentials_provider": resolved_credentials_provider,
+                "anonymous": anonymous,
             }
         )
 
@@ -152,6 +159,7 @@ class AsyncCloudControlClient:
             credentials_provider=overrides.get(
                 "credentials_provider", self._config.get("credentials_provider")
             ),
+            anonymous=overrides.get("anonymous", self._config.get("anonymous")),
         )
         return interceptors_, options_
 

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol/_services/cloud_control.py

@@ -70,6 +70,7 @@ class CloudControlClientConfig(TypedDict, total=False, closed=True):
     use_fips: bool | None
     endpoint: str | None
     credentials_provider: IdentityProvider[Credentials] | None
+    anonymous: bool | None
 
 
 class CloudControlClient:
@@ -85,6 +86,7 @@ class CloudControlClient:
         endpoint: The value of the ``SDK::Endpoint`` endpoint parameter.
         credentials: AWS credentials for request signing.
         credentials_provider: Provider that resolves AWS credentials. Takes precedence over ``credentials``.
+        anonymous: Send requests unsigned, without resolving credentials, even for operations that require authentication.
     """
 
     def __init__(
@@ -98,10 +100,14 @@ class CloudControlClient:
         endpoint: str | None = None,
         credentials: Credentials | None = None,
         credentials_provider: CredentialsProvider | None = None,
+        anonymous: bool | None = None,
     ):
-        self._client = Client(http_handler).wrap_with_middleware(
-            lambda next: AuthMiddleware(next)
-        )
+        client = Client(http_handler)
+        # The handler the user gave us, or the default one for this environment.
+        # The SDK middlewares wrap it below, and the credential resolvers borrow
+        # it for their one-off calls.
+        raw_handler = client.handler
+        self._client = client.wrap_with_middleware(lambda next: AuthMiddleware(next))
         if credentials is not None and credentials_provider is not None:
             warnings.warn(
                 "Both credentials and credentials_provider given; provider takes precedence"
@@ -113,7 +119,7 @@ class CloudControlClient:
             resolved_credentials_provider = StaticAwsCredentialsProvider(credentials)
         if resolved_credentials_provider is None and credentials is None:
             resolved_credentials_provider = default_aws_credentials_chain(
-                Client(http_handler)
+                Client(raw_handler)
             )
         self._config = CloudControlClientConfig(
             {
@@ -124,6 +130,7 @@ class CloudControlClient:
                 "use_fips": use_fips,
                 "endpoint": endpoint,
                 "credentials_provider": resolved_credentials_provider,
+                "anonymous": anonymous,
             }
         )
 
@@ -152,6 +159,7 @@ class CloudControlClient:
             credentials_provider=overrides.get(
                 "credentials_provider", self._config.get("credentials_provider")
             ),
+            anonymous=overrides.get("anonymous", self._config.get("anonymous")),
         )
         return interceptors_, options_
 

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0/src/capo_cloudcontrol.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-cloudcontrol
-Version: 0.5.0
+Version: 0.7.0
 Summary: Python SDK for AWS Cloudcontrol.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -18,7 +18,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jmespath>=1.0
-Requires-Dist: zapros>=0.13.0
+Requires-Dist: zapros>=0.21.0
 Provides-Extra: anyio
 Requires-Dist: anyio>=3.0; extra == "anyio"
 Provides-Extra: sso

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/src/capo_cloudcontrol.egg-info/requires.txt

@@ -1,5 +1,5 @@
 jmespath>=1.0
-zapros>=0.13.0
+zapros>=0.21.0
 
 [anyio]
 anyio>=3.0

{capo_cloudcontrol-0.5.0 → capo_cloudcontrol-0.7.0}/tests/test_sigv4.py

@@ -91,13 +91,28 @@ class TestCanonicalPath:
     def test_s3_preserves_dot_segments(self):
         assert _s3_path("/a/../b/./c") == "/a/../b/./c"
 
-    def test_non_s3_double_encodes(self):
-        # "/foo bar" → first encode → "/foo%20bar" → second → "/foo%2520bar"
-        assert _std_path("/foo bar") == "/foo%2520bar"
-
-    def test_non_s3_already_encoded_double_encodes(self):
-        # "/foo%20bar" gets unquoted to "/foo bar", then double-encoded.
+    def test_non_s3_encodes_wire_path_once_more(self):
+        # The path arrives URI-encoded once ("/foo bar" is sent as "/foo%20bar").
         assert _std_path("/foo%20bar") == "/foo%2520bar"
+        assert _std_path("/a%3Ab/caf%C3%A9~") == "/a%253Ab/caf%25C3%25A9~"
+
+    def test_non_s3_keeps_encoded_slash_inside_segment(self):
+        # An ARN in a path label: its "/" is sent as "%2F" and must stay part
+        # of the segment, not become a separator.
+        assert (
+            _std_path("/model/arn%3Aaws%3Abedrock%3A%3Afoundation-model%2Fx/converse")
+            == "/model/arn%253Aaws%253Abedrock%253A%253Afoundation-model%252Fx/converse"
+        )
+        assert _s3_path("/bucket/a%2Fb") == "/bucket/a%2Fb"
+
+    def test_non_s3_encodes_literal_reserved_characters_once(self):
+        # "@" and "$" appear literally in a few URI templates and are sent as is.
+        assert _std_path("/@connections/abc") == "/%40connections/abc"
+        assert _std_path("/things/t/jobs/$next") == "/things/t/jobs/%24next"
+
+    def test_non_s3_does_not_decode_the_wire_path(self):
+        assert _std_path("/a%2fb") == "/a%252fb"
+        assert _std_path("/a%25b") == "/a%2525b"
 
     def test_non_s3_removes_dot_segments(self):
         # Mirrors botocore's normalize_url_path: "." dropped, ".." pops,