capo-cloudcontrol 0.8.0__tar.gz → 0.10.0__tar.gz

{capo_cloudcontrol-0.8.0/src/capo_cloudcontrol.egg-info → capo_cloudcontrol-0.10.0}/PKG-INFO

@@ -1,7 +1,11 @@
 Metadata-Version: 2.4
 Name: capo-cloudcontrol
-Version: 0.8.0
+Version: 0.10.0
 Summary: Python SDK for AWS Cloudcontrol.
+Project-URL: Homepage, https://capo-sdk.dev/
+Project-URL: Documentation, https://capo-sdk.dev/services/cloudcontrol/
+Project-URL: Repository, https://github.com/kap-sh/capo/tree/main/services/cloudcontrol
+Project-URL: Changelog, https://github.com/kap-sh/capo/blob/main/services/cloudcontrol/CHANGELOG.md
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -27,7 +31,11 @@ Requires-Dist: capo-sso-oidc>=0.2.0; extra == "sso"
 Requires-Dist: capo-sts>=0.3.0; extra == "sso"
 Dynamic: license-file
 
-# Getting Started
+# capo-cloudcontrol: typed, async Python SDK for AWS Cloudcontrol
+
+`capo-cloudcontrol` is a typed Python SDK for AWS Cloudcontrol. It has an async client, `AsyncCloudControlClient`, for asyncio and trio, and a sync client, `CloudControlClient`, with the same methods. Requests and responses are typed with TypedDicts, so your editor and type checker know every field.
+
+It is part of [capo](https://capo-sdk.dev/), a community-driven alternative to boto3 and aioboto3, built on its own HTTP stack instead of botocore and generated from the official AWS Smithy models. Documentation: [https://capo-sdk.dev/services/cloudcontrol/](https://capo-sdk.dev/services/cloudcontrol/)
 
 ## Installation
 

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/README.md

@@ -1,4 +1,8 @@
-# Getting Started
+# capo-cloudcontrol: typed, async Python SDK for AWS Cloudcontrol
+
+`capo-cloudcontrol` is a typed Python SDK for AWS Cloudcontrol. It has an async client, `AsyncCloudControlClient`, for asyncio and trio, and a sync client, `CloudControlClient`, with the same methods. Requests and responses are typed with TypedDicts, so your editor and type checker know every field.
+
+It is part of [capo](https://capo-sdk.dev/), a community-driven alternative to boto3 and aioboto3, built on its own HTTP stack instead of botocore and generated from the official AWS Smithy models. Documentation: [https://capo-sdk.dev/services/cloudcontrol/](https://capo-sdk.dev/services/cloudcontrol/)
 
 ## Installation
 

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capo-cloudcontrol"
-version = "0.8.0"
+version = "0.10.0"
 description = "Python SDK for AWS Cloudcontrol."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -23,6 +23,12 @@ dependencies = [
     "zapros>=0.21.0",
 ]
 
+[project.urls]
+Homepage = "https://capo-sdk.dev/"
+Documentation = "https://capo-sdk.dev/services/cloudcontrol/"
+Repository = "https://github.com/kap-sh/capo/tree/main/services/cloudcontrol"
+Changelog = "https://github.com/kap-sh/capo/blob/main/services/cloudcontrol/CHANGELOG.md"
+
 [project.optional-dependencies]
 # Async file request bodies via Body.async_from_path
 anyio = ["anyio>=3.0"]

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/__init__.py

@@ -16,6 +16,9 @@ from ._auth._providers import (
 from ._auth._providers import (
     ChainedProvider as ChainedProvider,
 )
+from ._auth._providers import (
+    CredentialProcessError as CredentialProcessError,
+)
 from ._auth._providers import (
     CredentialsProvider as CredentialsProvider,
 )
@@ -31,6 +34,9 @@ from ._auth._providers import (
 from ._auth._providers import (
     MissingDependencyError as MissingDependencyError,
 )
+from ._auth._providers import (
+    ProcessCredentialsProvider as ProcessCredentialsProvider,
+)
 from ._auth._providers import (
     ProfileCredentialsProvider as ProfileCredentialsProvider,
 )
@@ -71,3 +77,9 @@ from ._services.async_cloud_control import (
     AsyncCloudControlClient as AsyncCloudControlClient,
 )
 from ._services.cloud_control import CloudControlClient as CloudControlClient
+from .types._unknown import (
+    UnknownEvent as UnknownEvent,
+)
+from .types._unknown import (
+    UnknownUnionMember as UnknownUnionMember,
+)

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/_auth/_providers.py

@@ -4,6 +4,7 @@ import configparser
 import hashlib
 import json
 import os
+import subprocess
 import time
 from abc import abstractmethod
 from dataclasses import dataclass
@@ -59,6 +60,10 @@ class IdentityNotFound(Exception):
     """Raised when a provider cannot resolve an identity. Chain continues."""
 
 
+class CredentialProcessError(Exception):
+    """Raised when a profile's `credential_process` fails or prints unusable output. Chain stops."""
+
+
 class MissingDependencyError(Exception):
     """Raised when a provider needs the `sso` extra but it is not installed."""
 
@@ -186,13 +191,27 @@ class ProfileCredentialsProvider(CredentialsProvider):
         self, credentials_file: Path | None = None, profile: str | None = None
     ) -> None:
         self._profile = profile or active_profile()
-        self._cred_file = credentials_file or Path(
-            os.environ.get("AWS_SHARED_CREDENTIALS_FILE")
-            or Path.home() / ".aws" / "credentials"
-        )
+        self._cred_file = credentials_file or _shared_credentials_file()
 
     def resolve_identity(self) -> Credentials:
-        section = self._load_section()
+        from_config, _ = _load_profile(self._profile)
+        from_credentials_file = _credentials_file_section(
+            self._profile, self._cred_file
+        )
+        section = {**from_config, **from_credentials_file}
+        if not section:
+            raise IdentityNotFound(
+                f"profile {self._profile!r} not found in credentials/config files"
+            )
+        # botocore's order: keys from the credentials file, then credential_process, then keys from the
+        # config file, so a profile with a process only takes its keys from the credentials file
+        if "credential_process" in section and not (
+            from_credentials_file.get("aws_access_key_id")
+            and from_credentials_file.get("aws_secret_access_key")
+        ):
+            raise IdentityNotFound(
+                f"profile {self._profile!r}: credential_process comes before the keys in the config file"
+            )
         ak = section.get("aws_access_key_id")
         sk = section.get("aws_secret_access_key")
         if not ak or not sk:
@@ -205,19 +224,94 @@ class ProfileCredentialsProvider(CredentialsProvider):
             out["session_token"] = token
         return out
 
-    def _load_section(self) -> dict[str, str]:
-        # config-file profile reuses the loader from _services/_aws_config
-        merged, _ = _load_profile(self._profile)
-        if self._cred_file.is_file():
-            cfg = configparser.ConfigParser(interpolation=None)
-            cfg.read(self._cred_file)
-            if cfg.has_section(self._profile):
-                merged.update(dict(cfg.items(self._profile)))
-        if not merged:
-            raise IdentityNotFound(
-                f"profile {self._profile!r} not found in credentials/config files"
+
+class ProcessCredentialsProvider(CredentialsProvider):
+    """Run the profile's ``credential_process`` command and read the credentials it prints.
+
+    This is how helpers such as ``aws-sso-cli`` hand out short-term credentials. The command
+    runs through the system shell, as in the Rust, Kotlin and Swift SDKs, so a quoted Windows path
+    works as written, and it must print the JSON document the AWS SDKs define (``Version`` 1).
+    The key is read from the credentials file as well as the config file. A profile without
+    ``credential_process`` is skipped; a command that fails or outlives the timeout stops the chain.
+    """
+
+    def __init__(
+        self,
+        credentials_file: Path | None = None,
+        profile: str | None = None,
+        timeout: float = 60.0,
+    ) -> None:
+        self._profile = profile or active_profile()
+        self._cred_file = credentials_file or _shared_credentials_file()
+        self._timeout = timeout
+
+    def resolve_identity(self) -> Credentials:
+        section = _load_merged_profile(self._profile, self._cred_file)
+        command = section.get("credential_process")
+        if not command:
+            raise IdentityNotFound(f"profile {self._profile!r}: no credential_process")
+        try:
+            # the shell is sh -c on POSIX and cmd.exe /c on Windows, which parses the path natively
+            result = subprocess.run(
+                command,
+                shell=True,
+                capture_output=True,
+                text=True,
+                check=False,
+                timeout=self._timeout,
+            )
+        except subprocess.TimeoutExpired:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process did not finish within {self._timeout} seconds"
+            ) from None
+        except OSError as e:
+            raise CredentialProcessError(f"profile {self._profile!r}: {e}") from e
+        # stdout carries the secret, so only stderr ever goes into an error message
+        if result.returncode != 0:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process exited with {result.returncode}: {result.stderr.strip()}"
+            )
+        try:
+            data = json.loads(result.stdout)
+        except ValueError:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process did not print JSON"
+            ) from None
+        if not isinstance(data, dict) or data.get("Version") != 1:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process output must be a JSON object with Version 1"
             )
-        return merged
+        try:
+            return _credentials_from_json(data, token_key="SessionToken")
+        except IdentityNotFound as e:
+            raise CredentialProcessError(f"profile {self._profile!r}: {e}") from None
+        except ValueError:
+            raise CredentialProcessError(
+                f"profile {self._profile!r}: credential_process printed an invalid Expiration"
+            ) from None
+
+
+def _shared_credentials_file() -> Path:
+    return Path(
+        os.environ.get("AWS_SHARED_CREDENTIALS_FILE")
+        or Path.home() / ".aws" / "credentials"
+    )
+
+
+def _load_merged_profile(profile: str, credentials_file: Path) -> dict[str, str]:
+    """The profile's keys from the config file, overlaid by the credentials file, as the AWS SDKs merge them."""
+    # config-file profile reuses the loader from _services/_aws_config
+    merged, _ = _load_profile(profile)
+    merged.update(_credentials_file_section(profile, credentials_file))
+    return merged
+
+
+def _credentials_file_section(profile: str, credentials_file: Path) -> dict[str, str]:
+    if not credentials_file.is_file():
+        return {}
+    cfg = configparser.ConfigParser(interpolation=None)
+    cfg.read(credentials_file)
+    return dict(cfg.items(profile)) if cfg.has_section(profile) else {}
 
 
 class EcsContainerCredentialsProvider(CredentialsProvider):
@@ -721,6 +815,7 @@ class AssumeRoleCredentialsProvider(CredentialsProvider):
             ),
             SsoCredentialsProvider(self._client, source_profile),
             ProfileCredentialsProvider(profile=source_profile),
+            ProcessCredentialsProvider(profile=source_profile),
         )
 
 
@@ -853,7 +948,10 @@ def _parse_iso8601(value: str) -> datetime:
     return datetime.fromisoformat(value.replace("Z", "+00:00"))
 
 
-def _credentials_from_json(data: dict[str, object]) -> Credentials:
+def _credentials_from_json(
+    data: dict[str, object], *, token_key: str = "Token"
+) -> Credentials:
+    # ECS and IMDS name the session token Token; credential_process names it SessionToken
     ak = data.get("AccessKeyId")
     sk = data.get("SecretAccessKey")
     if not isinstance(ak, str) or not isinstance(sk, str):
@@ -861,7 +959,7 @@ def _credentials_from_json(data: dict[str, object]) -> Credentials:
             "credentials response missing AccessKeyId/SecretAccessKey"
         )
     out: Credentials = {"access_key": ak, "secret_key": sk}
-    token = data.get("Token")
+    token = data.get(token_key)
     if isinstance(token, str):
         out["session_token"] = token
     exp = data.get("Expiration")
@@ -880,6 +978,7 @@ def default_aws_credentials_chain(
             WebIdentityCredentialsProvider(client),
             SsoCredentialsProvider(client),
             ProfileCredentialsProvider(),
+            ProcessCredentialsProvider(),
             EcsContainerCredentialsProvider(client),
             Ec2InstanceMetadataProvider(client),
         )

capo_cloudcontrol-0.10.0/src/capo_cloudcontrol/types/_unknown.py

@@ -0,0 +1,34 @@
+"""Stand-ins for union variants and events this client doesn't know about.
+
+A service may add a union member or an event after the client was generated.
+Smithy asks clients not to fail on those, so deserialization returns one of
+these instead of raising.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from .._protocol.eventstream import Message
+
+
+@dataclass(frozen=True)
+class UnknownUnionMember:
+    """A union variant the service sent that this client has no member for."""
+
+    name: str
+    """The variant's name on the wire."""
+
+
+@dataclass(frozen=True)
+class UnknownEvent:
+    """An event-stream event whose ``:event-type`` this client doesn't know."""
+
+    event_type: str
+    """The event's ``:event-type`` header."""
+
+    message: Message
+    """The raw message, headers and undecoded payload."""
+
+
+__all__ = ["UnknownEvent", "UnknownUnionMember"]

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/types/cancel_resource_request_input.py

@@ -4,8 +4,6 @@ from typing import TYPE_CHECKING
 
 from typing_extensions import TypedDict
 
-from capo_cloudcontrol.errors import DeserializationError
-
 if TYPE_CHECKING:
     import capo_cloudcontrol.types.request_token
 
@@ -27,5 +25,5 @@ def deserialize_aws_json_1_0(data: dict) -> CancelResourceRequestInput:
     if data.get("RequestToken") is not None:
         out["request_token"] = data["RequestToken"]
     else:
-        raise DeserializationError("CancelResourceRequestInput.request_token required")
+        out["request_token"] = ""
     return out

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/types/create_resource_input.py

@@ -4,8 +4,6 @@ from typing import TYPE_CHECKING, Any
 
 from typing_extensions import NotRequired, TypedDict
 
-from capo_cloudcontrol.errors import DeserializationError
-
 if TYPE_CHECKING:
     import capo_cloudcontrol.types.client_token
     import capo_cloudcontrol.types.properties
@@ -48,7 +46,7 @@ def deserialize_aws_json_1_0(data: dict) -> CreateResourceInput:
     if data.get("TypeName") is not None:
         out["type_name"] = data["TypeName"]
     else:
-        raise DeserializationError("CreateResourceInput.type_name required")
+        out["type_name"] = ""
     if data.get("TypeVersionId") is not None:
         out["type_version_id"] = data["TypeVersionId"]
     if data.get("RoleArn") is not None:
@@ -58,7 +56,7 @@ def deserialize_aws_json_1_0(data: dict) -> CreateResourceInput:
     if data.get("DesiredState") is not None:
         out["desired_state"] = data["DesiredState"]
     else:
-        raise DeserializationError("CreateResourceInput.desired_state required")
+        out["desired_state"] = ""
     return out
 
 

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/types/delete_resource_input.py

@@ -4,8 +4,6 @@ from typing import TYPE_CHECKING
 
 from typing_extensions import NotRequired, TypedDict
 
-from capo_cloudcontrol.errors import DeserializationError
-
 if TYPE_CHECKING:
     import capo_cloudcontrol.types.client_token
     import capo_cloudcontrol.types.identifier
@@ -48,7 +46,7 @@ def deserialize_aws_json_1_0(data: dict) -> DeleteResourceInput:
     if data.get("TypeName") is not None:
         out["type_name"] = data["TypeName"]
     else:
-        raise DeserializationError("DeleteResourceInput.type_name required")
+        out["type_name"] = ""
     if data.get("TypeVersionId") is not None:
         out["type_version_id"] = data["TypeVersionId"]
     if data.get("RoleArn") is not None:
@@ -58,5 +56,5 @@ def deserialize_aws_json_1_0(data: dict) -> DeleteResourceInput:
     if data.get("Identifier") is not None:
         out["identifier"] = data["Identifier"]
     else:
-        raise DeserializationError("DeleteResourceInput.identifier required")
+        out["identifier"] = ""
     return out

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/types/get_resource_input.py

@@ -4,8 +4,6 @@ from typing import TYPE_CHECKING
 
 from typing_extensions import NotRequired, TypedDict
 
-from capo_cloudcontrol.errors import DeserializationError
-
 if TYPE_CHECKING:
     import capo_cloudcontrol.types.identifier
     import capo_cloudcontrol.types.role_arn
@@ -43,7 +41,7 @@ def deserialize_aws_json_1_0(data: dict) -> GetResourceInput:
     if data.get("TypeName") is not None:
         out["type_name"] = data["TypeName"]
     else:
-        raise DeserializationError("GetResourceInput.type_name required")
+        out["type_name"] = ""
     if data.get("TypeVersionId") is not None:
         out["type_version_id"] = data["TypeVersionId"]
     if data.get("RoleArn") is not None:
@@ -51,5 +49,5 @@ def deserialize_aws_json_1_0(data: dict) -> GetResourceInput:
     if data.get("Identifier") is not None:
         out["identifier"] = data["Identifier"]
     else:
-        raise DeserializationError("GetResourceInput.identifier required")
+        out["identifier"] = ""
     return out

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/types/get_resource_request_status_input.py

@@ -4,8 +4,6 @@ from typing import TYPE_CHECKING
 
 from typing_extensions import TypedDict
 
-from capo_cloudcontrol.errors import DeserializationError
-
 if TYPE_CHECKING:
     import capo_cloudcontrol.types.request_token
 
@@ -27,7 +25,5 @@ def deserialize_aws_json_1_0(data: dict) -> GetResourceRequestStatusInput:
     if data.get("RequestToken") is not None:
         out["request_token"] = data["RequestToken"]
     else:
-        raise DeserializationError(
-            "GetResourceRequestStatusInput.request_token required"
-        )
+        out["request_token"] = ""
     return out

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/types/list_resources_input.py

@@ -4,8 +4,6 @@ from typing import TYPE_CHECKING, Any
 
 from typing_extensions import NotRequired, TypedDict
 
-from capo_cloudcontrol.errors import DeserializationError
-
 if TYPE_CHECKING:
     import capo_cloudcontrol.types.handler_next_token
     import capo_cloudcontrol.types.max_results
@@ -56,7 +54,7 @@ def deserialize_aws_json_1_0(data: dict) -> ListResourcesInput:
     if data.get("TypeName") is not None:
         out["type_name"] = data["TypeName"]
     else:
-        raise DeserializationError("ListResourcesInput.type_name required")
+        out["type_name"] = ""
     if data.get("TypeVersionId") is not None:
         out["type_version_id"] = data["TypeVersionId"]
     if data.get("RoleArn") is not None:

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol/types/update_resource_input.py

@@ -4,8 +4,6 @@ from typing import TYPE_CHECKING, Any
 
 from typing_extensions import NotRequired, TypedDict
 
-from capo_cloudcontrol.errors import DeserializationError
-
 if TYPE_CHECKING:
     import capo_cloudcontrol.types.client_token
     import capo_cloudcontrol.types.identifier
@@ -52,7 +50,7 @@ def deserialize_aws_json_1_0(data: dict) -> UpdateResourceInput:
     if data.get("TypeName") is not None:
         out["type_name"] = data["TypeName"]
     else:
-        raise DeserializationError("UpdateResourceInput.type_name required")
+        out["type_name"] = ""
     if data.get("TypeVersionId") is not None:
         out["type_version_id"] = data["TypeVersionId"]
     if data.get("RoleArn") is not None:
@@ -62,11 +60,11 @@ def deserialize_aws_json_1_0(data: dict) -> UpdateResourceInput:
     if data.get("Identifier") is not None:
         out["identifier"] = data["Identifier"]
     else:
-        raise DeserializationError("UpdateResourceInput.identifier required")
+        out["identifier"] = ""
     if data.get("PatchDocument") is not None:
         out["patch_document"] = data["PatchDocument"]
     else:
-        raise DeserializationError("UpdateResourceInput.patch_document required")
+        out["patch_document"] = ""
     return out
 
 

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0/src/capo_cloudcontrol.egg-info}/PKG-INFO

@@ -1,7 +1,11 @@
 Metadata-Version: 2.4
 Name: capo-cloudcontrol
-Version: 0.8.0
+Version: 0.10.0
 Summary: Python SDK for AWS Cloudcontrol.
+Project-URL: Homepage, https://capo-sdk.dev/
+Project-URL: Documentation, https://capo-sdk.dev/services/cloudcontrol/
+Project-URL: Repository, https://github.com/kap-sh/capo/tree/main/services/cloudcontrol
+Project-URL: Changelog, https://github.com/kap-sh/capo/blob/main/services/cloudcontrol/CHANGELOG.md
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -27,7 +31,11 @@ Requires-Dist: capo-sso-oidc>=0.2.0; extra == "sso"
 Requires-Dist: capo-sts>=0.3.0; extra == "sso"
 Dynamic: license-file
 
-# Getting Started
+# capo-cloudcontrol: typed, async Python SDK for AWS Cloudcontrol
+
+`capo-cloudcontrol` is a typed Python SDK for AWS Cloudcontrol. It has an async client, `AsyncCloudControlClient`, for asyncio and trio, and a sync client, `CloudControlClient`, with the same methods. Requests and responses are typed with TypedDicts, so your editor and type checker know every field.
+
+It is part of [capo](https://capo-sdk.dev/), a community-driven alternative to boto3 and aioboto3, built on its own HTTP stack instead of botocore and generated from the official AWS Smithy models. Documentation: [https://capo-sdk.dev/services/cloudcontrol/](https://capo-sdk.dev/services/cloudcontrol/)
 
 ## Installation
 

{capo_cloudcontrol-0.8.0 → capo_cloudcontrol-0.10.0}/src/capo_cloudcontrol.egg-info/SOURCES.txt

@@ -62,6 +62,7 @@ src/capo_cloudcontrol/errors/service_limit_exceeded_exception.py
 src/capo_cloudcontrol/errors/throttling_exception.py
 src/capo_cloudcontrol/errors/type_not_found_exception.py
 src/capo_cloudcontrol/errors/unsupported_action_exception.py
+src/capo_cloudcontrol/types/_unknown.py
 src/capo_cloudcontrol/types/cancel_resource_request_input.py
 src/capo_cloudcontrol/types/cancel_resource_request_output.py
 src/capo_cloudcontrol/types/client_token.py