PyPI - capo-devops-agent - Versions diffs - 0.5.0__tar.gz → 0.6.0__tar.gz - Mend

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-devops-agent
-Version: 0.5.0
+Version: 0.6.0
 Summary: Python SDK for AWS Devops Agent.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -17,7 +17,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: zapros>=0.13.0
+Requires-Dist: zapros>=0.21.0
 Provides-Extra: anyio
 Requires-Dist: anyio>=3.0; extra == "anyio"
 Provides-Extra: sso

@@ -1,6 +1,6 @@
 [project]
 name = "capo-devops-agent"
-version = "0.5.0"
+version = "0.6.0"
 description = "Python SDK for AWS Devops Agent."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -19,7 +19,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "zapros>=0.13.0",
+    "zapros>=0.21.0",
 ]
 [project.optional-dependencies]

@@ -17,7 +17,7 @@ import hmac
 import re
 from collections.abc import AsyncIterator, Iterator
 from typing import Any, Literal, TypedDict, cast
-from urllib.parse import quote, unquote
+from urllib.parse import quote
 import zapros
 from pywhatwgurl import URLSearchParams
@@ -134,11 +134,11 @@ def _remove_dot_segments(path: str) -> str:
 def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
     """Build CanonicalURI.
-    Per the SigV4 spec, every segment is URI-encoded; standard services
-    normalize dot segments and URI-encode each segment **twice**. The
-    rules-engine ``disableNormalizePath`` / ``disableDoubleEncoding`` flags
-    turn those steps off — S3-family services set both, so the path is
-    signed exactly as provided.
+    ``path`` is the path as sent on the wire, so it is already URI-encoded
+    once. Standard services normalize dot segments and URI-encode each
+    segment a second time. The rules-engine ``disableNormalizePath`` /
+    ``disableDoubleEncoding`` flags turn those steps off — S3-family
+    services set both, so the path is signed exactly as provided.
     """
     if not path:
         return "/"
@@ -148,9 +148,9 @@ def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
         path = _remove_dot_segments(path)
     if not double_encode:
         return path
-    decoded = unquote(path)
-    first = quote(decoded, safe="/~")
-    return quote(first, safe="/~")
+    # Never decode first: that would turn a "%2F" inside a segment (an ARN in
+    # a path label) into a separator and leave it out of the second encoding.
+    return quote(path, safe="/~")
 def _canonical_query(query: str) -> str:

@@ -279,9 +279,12 @@ class AsyncDevOpsAgentClient:
         credentials_provider: CredentialsProvider | None = None,
         anonymous: bool | None = None,
     ):
-        self._client = AsyncClient(http_handler).wrap_with_middleware(
-            lambda next: AuthMiddleware(next)
-        )
+        client = AsyncClient(http_handler)
+        # The handler the user gave us, or the default one for this environment.
+        # The SDK middlewares wrap it below, and the credential resolvers borrow
+        # it for their one-off calls.
+        raw_handler = client.handler
+        self._client = client.wrap_with_middleware(lambda next: AuthMiddleware(next))
         if credentials is not None and credentials_provider is not None:
             warnings.warn(
                 "Both credentials and credentials_provider given; provider takes precedence"
@@ -293,7 +296,7 @@ class AsyncDevOpsAgentClient:
             resolved_credentials_provider = StaticAwsCredentialsProvider(credentials)
         if resolved_credentials_provider is None and credentials is None:
             resolved_credentials_provider = default_aws_credentials_chain(
-                AsyncClient(http_handler)
+                AsyncClient(raw_handler)
             )
         self._config = AsyncDevOpsAgentClientConfig(
             {

@@ -275,9 +275,12 @@ class DevOpsAgentClient:
         credentials_provider: CredentialsProvider | None = None,
         anonymous: bool | None = None,
     ):
-        self._client = Client(http_handler).wrap_with_middleware(
-            lambda next: AuthMiddleware(next)
-        )
+        client = Client(http_handler)
+        # The handler the user gave us, or the default one for this environment.
+        # The SDK middlewares wrap it below, and the credential resolvers borrow
+        # it for their one-off calls.
+        raw_handler = client.handler
+        self._client = client.wrap_with_middleware(lambda next: AuthMiddleware(next))
         if credentials is not None and credentials_provider is not None:
             warnings.warn(
                 "Both credentials and credentials_provider given; provider takes precedence"
@@ -289,7 +292,7 @@ class DevOpsAgentClient:
             resolved_credentials_provider = StaticAwsCredentialsProvider(credentials)
         if resolved_credentials_provider is None and credentials is None:
             resolved_credentials_provider = default_aws_credentials_chain(
-                Client(http_handler)
+                Client(raw_handler)
             )
         self._config = DevOpsAgentClientConfig(
             {

@@ -91,13 +91,28 @@ class TestCanonicalPath:
     def test_s3_preserves_dot_segments(self):
         assert _s3_path("/a/../b/./c") == "/a/../b/./c"
-    def test_non_s3_double_encodes(self):
-        # "/foo bar" → first encode → "/foo%20bar" → second → "/foo%2520bar"
-        assert _std_path("/foo bar") == "/foo%2520bar"
-    def test_non_s3_already_encoded_double_encodes(self):
-        # "/foo%20bar" gets unquoted to "/foo bar", then double-encoded.
+    def test_non_s3_encodes_wire_path_once_more(self):
+        # The path arrives URI-encoded once ("/foo bar" is sent as "/foo%20bar").
         assert _std_path("/foo%20bar") == "/foo%2520bar"
+        assert _std_path("/a%3Ab/caf%C3%A9~") == "/a%253Ab/caf%25C3%25A9~"
+    def test_non_s3_keeps_encoded_slash_inside_segment(self):
+        # An ARN in a path label: its "/" is sent as "%2F" and must stay part
+        # of the segment, not become a separator.
+        assert (
+            _std_path("/model/arn%3Aaws%3Abedrock%3A%3Afoundation-model%2Fx/converse")
+            == "/model/arn%253Aaws%253Abedrock%253A%253Afoundation-model%252Fx/converse"
+        )
+        assert _s3_path("/bucket/a%2Fb") == "/bucket/a%2Fb"
+    def test_non_s3_encodes_literal_reserved_characters_once(self):
+        # "@" and "$" appear literally in a few URI templates and are sent as is.
+        assert _std_path("/@connections/abc") == "/%40connections/abc"
+        assert _std_path("/things/t/jobs/$next") == "/things/t/jobs/%24next"
+    def test_non_s3_does_not_decode_the_wire_path(self):
+        assert _std_path("/a%2fb") == "/a%252fb"
+        assert _std_path("/a%25b") == "/a%2525b"
     def test_non_s3_removes_dot_segments(self):
         # Mirrors botocore's normalize_url_path: "." dropped, ".." pops,

capo-devops-agent 0.5.0__tar.gz → 0.6.0__tar.gz

capo-devops-agent 0.5.0tar.gz → 0.6.0tar.gz