capo-lambda 0.11.0__tar.gz → 0.12.0__tar.gz

{capo_lambda-0.11.0/src/capo_lambda.egg-info → capo_lambda-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-lambda
-Version: 0.11.0
+Version: 0.12.0
 Summary: Python SDK for AWS Lambda.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -18,6 +18,8 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: zapros>=0.13.0
+Provides-Extra: anyio
+Requires-Dist: anyio>=3.0; extra == "anyio"
 Provides-Extra: sso
 Requires-Dist: capo-sso>=0.2.0; extra == "sso"
 Requires-Dist: capo-sso-oidc>=0.2.0; extra == "sso"

{capo_lambda-0.11.0 → capo_lambda-0.12.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capo-lambda"
-version = "0.11.0"
+version = "0.12.0"
 description = "Python SDK for AWS Lambda."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -23,6 +23,8 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
+# Async file request bodies via Body.async_from_path
+anyio = ["anyio>=3.0"]
 # IAM Identity Center (SSO), assume-role and web-identity credentials providers
 sso = [
     "capo-sso>=0.2.0",

{capo_lambda-0.11.0 → capo_lambda-0.12.0}/src/capo_lambda/__init__.py

@@ -48,6 +48,7 @@ from ._auth._providers import (
 )
 from ._auth._signers import Signer as Signer
 from ._auth._signers import SigV4Signer as SigV4Signer
+from ._body import Body as Body
 from ._services._lambda import LambdaClient as LambdaClient
 from ._services._pipeline import (
     AsyncOperationOptions as AsyncOperationOptions,

{capo_lambda-0.11.0 → capo_lambda-0.12.0}/src/capo_lambda/_auth/_signers.py

@@ -48,6 +48,12 @@ class SigV4Signer(Signer[Credentials]):
             "session_token": creds.get("session_token"),
             "signing_region": self._auth_scheme["signingRegion"],
             "signing_name": self._auth_scheme["signingName"],
+            "disable_double_encoding": self._auth_scheme.get(
+                "disableDoubleEncoding", False
+            ),
+            "disable_normalize_path": self._auth_scheme.get(
+                "disableNormalizePath", False
+            ),
         }
         if req.body is None:
             body: bytes | None = b""
@@ -55,10 +61,6 @@ class SigV4Signer(Signer[Credentials]):
             body = req.body
         else:
             body = None
-        # Strip Accept-Encoding so transports/intermediaries can't transcode
-        # the response and so the value never enters the canonical request.
-        if "accept-encoding" in req.headers:
-            del req.headers["Accept-Encoding"]
         return sign_sigv4(req, ctx, body)
 
     def sign(self, req: Request) -> Request:
@@ -70,6 +72,12 @@ class SigV4Signer(Signer[Credentials]):
             "session_token": creds.get("session_token"),
             "signing_region": self._auth_scheme["signingRegion"],
             "signing_name": self._auth_scheme["signingName"],
+            "disable_double_encoding": self._auth_scheme.get(
+                "disableDoubleEncoding", False
+            ),
+            "disable_normalize_path": self._auth_scheme.get(
+                "disableNormalizePath", False
+            ),
         }
         if req.body is None:
             body: bytes | None = b""
@@ -77,8 +85,4 @@ class SigV4Signer(Signer[Credentials]):
             body = req.body
         else:
             body = None
-        # Strip Accept-Encoding so transports/intermediaries can't transcode
-        # the response and so the value never enters the canonical request.
-        if "accept-encoding" in req.headers:
-            del req.headers["Accept-Encoding"]
         return sign_sigv4(req, ctx, body)

{capo_lambda-0.11.0 → capo_lambda-0.12.0}/src/capo_lambda/_auth/_sigv4.py

@@ -25,21 +25,29 @@ from zapros._utils import get_host_header_value
 
 
 def build_sigv4_auth_scheme(
-    signing_name: str, region: str | None
+    signing_name: str, region: str | None, endpoint_scheme: dict[str, Any] | None = None
 ) -> dict[str, Any] | None:
-    """Return a sigv4 auth scheme dict for the given signing name and region.
-
-    Returns None when region is not set so callers can use it in an ``or`` chain.
+    """Return the sigv4 auth scheme for ``signing_name``/``region``, with the
+    endpoint rule set's matching ``authSchemes`` entry overlaid on top.
+
+    The rule set only *modifies* signing properties of the resolved scheme
+    (Smithy rules engine, ``authSchemes``): keys it carries win, keys it omits
+    keep the operation defaults — IAM's global endpoint names only
+    ``signingRegion``, for instance. Returns None when no signing region is
+    known from either source.
     """
-    if region is None:
-        return None
-    return {
+    scheme: dict[str, Any] = {
         "name": "sigv4",
         "signingName": signing_name,
         "signingRegion": region,
         "disableDoubleEncoding": False,
         "disableNormalizePath": False,
     }
+    if endpoint_scheme:
+        scheme.update(endpoint_scheme)
+    if scheme.get("signingRegion") is None:
+        return None
+    return scheme
 
 
 class SigV4AuthContext(TypedDict):
@@ -49,6 +57,11 @@ class SigV4AuthContext(TypedDict):
     session_token: str | None
     signing_region: str
     signing_name: str
+    # Rules-engine sigv4 auth-scheme flags (False = standard SigV4: normalize
+    # dot segments, double-encode the path). S3-family endpoint rulesets set
+    # ``disableDoubleEncoding`` so the path is signed exactly as sent.
+    disable_double_encoding: bool
+    disable_normalize_path: bool
 
 
 _SIGV4_ALGORITHM = "AWS4-HMAC-SHA256"
@@ -82,23 +95,49 @@ _UNSIGNED_HEADERS = frozenset(
 
 _MULTI_SPACE = re.compile(r" +")
 
+# Services that require the payload hash to travel in ``x-amz-content-sha256``.
+# Other services sign the hash into the canonical request without sending it.
+_S3_SIGNING_NAMES = frozenset({"s3", "s3express", "s3-outposts", "s3-object-lambda"})
+
 
 def _uri_encode(value: str) -> str:
     """RFC 3986 percent-encoding using only the unreserved set as safe."""
     return quote(value, safe="-_.~")
 
 
-def _canonical_path(path: str, *, service: str) -> str:
+def _remove_dot_segments(path: str) -> str:
+    """RFC 3986 §5.2.4 dot-segment removal (mirrors botocore's normalize_url_path)."""
+    segments: list[str] = []
+    for seg in path.split("/"):
+        if not seg or seg == ".":
+            continue
+        if seg == "..":
+            if segments:
+                segments.pop()
+        else:
+            segments.append(seg)
+    first = "/" if path.startswith("/") else ""
+    last = "/" if path.endswith("/") and segments else ""
+    return first + "/".join(segments) + last
+
+
+def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
     """Build CanonicalURI.
 
-    Per the SigV4 spec, every segment is URI-encoded; for services other
-    than S3 each segment is URI-encoded **twice**. S3 keeps the path
-    exactly as provided (no normalization, no double-encoding).
+    Per the SigV4 spec, every segment is URI-encoded; standard services
+    normalize dot segments and URI-encode each segment **twice**. The
+    rules-engine ``disableNormalizePath`` / ``disableDoubleEncoding`` flags
+    turn those steps off — S3-family services set both, so the path is
+    signed exactly as provided.
     """
     if not path:
         return "/"
-    if service == "s3":
-        return path if path.startswith("/") else "/" + path
+    if not path.startswith("/"):
+        path = "/" + path
+    if normalize:
+        path = _remove_dot_segments(path)
+    if not double_encode:
+        return path
     decoded = unquote(path)
     first = quote(decoded, safe="/~")
     return quote(first, safe="/~")
@@ -148,9 +187,12 @@ def _build_canonical_request(
     query: str,
     headers: Headers,
     payload_hash: str,
-    service: str,
+    double_encode: bool,
+    normalize: bool,
 ) -> tuple[str, str]:
-    canonical_uri = _canonical_path(path, service=service)
+    canonical_uri = _canonical_path(
+        path, double_encode=double_encode, normalize=normalize
+    )
     canonical_query = _canonical_query(query)
     canonical_headers, signed_headers = _canonical_headers(headers)
     canonical_request = (
@@ -212,8 +254,8 @@ def sign_sigv4(
         date_stamp = now.strftime("%Y%m%d")
         headers["X-Amz-Date"] = amz_date
 
-    # Payload hash. For S3, x-amz-content-sha256 is mandatory and must be set
-    # BEFORE computing the canonical request (it gets signed).
+    # Payload hash. For S3-family services, x-amz-content-sha256 is mandatory
+    # and must be set BEFORE computing the canonical request (it gets signed).
     payload_hash = headers.get("X-Amz-Content-SHA256")
     if payload_hash is None:
         if body is None:
@@ -222,7 +264,7 @@ def sign_sigv4(
             payload_hash = (
                 hashlib.sha256(body).hexdigest() if body else _EMPTY_PAYLOAD_SHA256
             )
-    if service == "s3":
+    if service in _S3_SIGNING_NAMES:
         headers["X-Amz-Content-SHA256"] = payload_hash
 
     # Session token (STS / assumed-role credentials).
@@ -240,7 +282,8 @@ def sign_sigv4(
         query=request.url.search,
         headers=headers,
         payload_hash=payload_hash,
-        service=service,
+        double_encode=not ctx["disable_double_encoding"],
+        normalize=not ctx["disable_normalize_path"],
     )
 
     credential_scope = f"{date_stamp}/{region}/{service}/aws4_request"
@@ -343,9 +386,14 @@ def presign_sigv4(
     existing = list(URLSearchParams(request.url.search).entries())
     canonical_query = _canonical_query_from_pairs(existing + amz_params)
 
+    canonical_uri = _canonical_path(
+        request.url.pathname,
+        double_encode=not ctx["disable_double_encoding"],
+        normalize=not ctx["disable_normalize_path"],
+    )
     canonical_request = (
         f"{request.method.upper()}\n"
-        f"{_canonical_path(request.url.pathname, service=service)}\n"
+        f"{canonical_uri}\n"
         f"{canonical_query}\n"
         f"{canonical_headers}\n"
         f"{signed_headers}\n"

{capo_lambda-0.11.0 → capo_lambda-0.12.0}/src/capo_lambda/_auth/_zapros_handler.py

@@ -33,6 +33,21 @@ def ensure_sync_handler(
     )
 
 
+def strip_accept_encoding(request: Request) -> Request:
+    """Drop the ``Accept-Encoding`` zapros adds to every request.
+
+    Like the AWS SDKs, the client never asks for transport compression: a
+    response body must be the service's actual bytes so ``Content-Length``,
+    checksums and ``Range`` stay coherent and a ``Content-Encoding`` on it is
+    always stored metadata (an S3 object's), never something to undo. Removing
+    the header before signing also keeps it out of the canonical request, where
+    a proxy rewriting it in flight would break the signature.
+    """
+    if "accept-encoding" in request.headers:
+        del request.headers["Accept-Encoding"]
+    return request
+
+
 class AuthMiddleware(BaseMiddleware, AsyncBaseMiddleware):
     """Sign the outgoing request using the Signer placed in ``context["signer"]``.
 
@@ -40,7 +55,8 @@ class AuthMiddleware(BaseMiddleware, AsyncBaseMiddleware):
     effective auth scheme to a concrete :class:`Signer` and threads it
     through ``request.context`` before dispatch. This middleware does the
     actual signing; ``None`` means the operation opted out via
-    ``@optionalAuth`` and the request passes through untouched.
+    ``@optionalAuth`` and the request passes through unsigned. Either way
+    ``Accept-Encoding`` is stripped first (see :func:`strip_accept_encoding`).
     """
 
     def __init__(self, next_handler: BaseHandler | AsyncBaseHandler) -> None:
@@ -49,6 +65,7 @@ class AuthMiddleware(BaseMiddleware, AsyncBaseMiddleware):
 
     def handle(self, request: Request) -> Response:
         next_handler = ensure_sync_handler(self.next)
+        request = strip_accept_encoding(request)
         signer = cast(Optional[Signer], request.context.get("signer"))
         if signer is not None:
             request = signer.sign(request)
@@ -56,6 +73,7 @@ class AuthMiddleware(BaseMiddleware, AsyncBaseMiddleware):
 
     async def ahandle(self, request: Request) -> Response:
         next_handler = ensure_async_handler(self.async_next)
+        request = strip_accept_encoding(request)
         signer = cast(Optional[Signer], request.context.get("signer"))
         if signer is not None:
             request = await signer.asign(request)

capo_lambda-0.12.0/src/capo_lambda/_body.py

@@ -0,0 +1,221 @@
+"""Request body abstraction for streaming operations.
+
+Hand-written, not regenerated.
+"""
+
+from __future__ import annotations
+
+import os
+from collections.abc import AsyncIterator, Callable, Iterator
+from contextlib import (
+    AbstractAsyncContextManager,
+    AbstractContextManager,
+    asynccontextmanager,
+    contextmanager,
+)
+from typing import TYPE_CHECKING, Generic, TypeVar, Union, cast
+
+from ._iter import AnyIterator
+
+if TYPE_CHECKING:
+    import anyio
+else:
+    try:
+        import anyio
+    except ImportError:
+        anyio = None
+
+_CHUNK_SIZE = 64 * 1024
+
+TStream = TypeVar("TStream", Iterator[bytes], AsyncIterator[bytes])
+
+# The opener yields the fresh stream together with its length, or ``None`` when
+# no stream could be produced (an exhausted or non-rewindable source, or logic
+# that decides dynamically it cannot reopen). Pairing the length with each open
+# lets it change between rebuilds instead of being fixed for the whole body.
+_ContextManager = Union[
+    AbstractContextManager[Union[tuple[TStream, int], None]],
+    AbstractAsyncContextManager[Union[tuple[TStream, int], None]],
+]
+
+
+class Body(AnyIterator[bytes], Generic[TStream]):
+    """A replayable request body whose length travels with each open.
+
+    A plain ``Iterator[bytes]`` can be sent only once, so a failed request
+    cannot be retried. A ``Body`` instead holds an *opener* — a context manager
+    that opens a fresh stream over the same source — and rebuilds the stream
+    before every attempt, closing whatever was left of the previous one.
+
+    ``TStream`` is ``Iterator[bytes]`` for bodies built with :meth:`from_path`
+    and ``AsyncIterator[bytes]`` for :meth:`async_from_path`; the former use
+    ``rebuild()``/``close()``, the latter ``arebuild()``/``aclose()``.
+    ``build_request`` rebuilds before every attempt.
+
+    Each open produces ``(stream, length)`` together, so the length is not bound
+    to the whole body and may differ from one rebuild to the next. A rebuild is
+    also not guaranteed to succeed: the source may be exhausted or
+    non-rewindable, so the opener can yield ``None`` and :meth:`rebuild` then
+    returns ``None`` instead of a pair. Callers check the return value::
+
+        for attempt in range(max_attempts):
+            opened = body.rebuild()
+            if opened is None:
+                raise RuntimeError("body could not be rebuilt")
+            stream, length = opened
+            send(stream, length)
+
+    ``length`` also holds the current stream's length as an attribute (``None``
+    before the first rebuild). Iterating a ``Body`` reads its current stream.
+    """
+
+    def __init__(self, opener: Callable[[], _ContextManager[TStream]]) -> None:
+        self._opener = opener
+        self._cm: _ContextManager[TStream] | None = None
+        self._stream: TStream | None = None
+        self.length: int | None = None
+
+    @classmethod
+    def from_path(
+        cls, path: str | os.PathLike[str], chunk_size: int = _CHUNK_SIZE
+    ) -> Body[Iterator[bytes]]:
+        """A body that reads ``path`` in ``chunk_size`` chunks, reopening it (and re-measuring it) on every rebuild."""
+
+        @contextmanager
+        def open_() -> Iterator[tuple[Iterator[bytes], int]]:
+            with open(path, "rb") as file:
+                length = os.fstat(file.fileno()).st_size
+                yield iter(lambda: file.read(chunk_size), b""), length
+
+        return Body(open_)
+
+    @classmethod
+    def async_from_path(
+        cls, path: str | os.PathLike[str], chunk_size: int = _CHUNK_SIZE
+    ) -> Body[AsyncIterator[bytes]]:
+        """The async counterpart of :meth:`from_path`; needs ``anyio`` installed."""
+        if anyio is None:
+            dist = (__package__ or "capo").replace("_", "-")
+            raise RuntimeError(
+                "Body.async_from_path() requires the anyio package; "
+                f"reinstall with the anyio feature enabled: {dist}[anyio]"
+            )
+
+        @asynccontextmanager
+        async def open_() -> AsyncIterator[tuple[AsyncIterator[bytes], int]]:
+            async with await anyio.open_file(path, "rb") as file:
+                length = os.fstat(file.wrapped.fileno()).st_size
+
+                async def chunks() -> AsyncIterator[bytes]:
+                    while chunk := await file.read(chunk_size):
+                        yield chunk
+
+                yield chunks(), length
+
+        return Body(open_)
+
+    @property
+    def stream(self) -> TStream | None:
+        """The current open stream, or ``None`` if none is open (before the first
+        rebuild, or after a close).
+
+        ``build_request`` reuses a non-``None`` stream instead of rebuilding, so
+        the retry layer stays in control of when a fresh stream is created.
+        """
+        return self._stream
+
+    def rebuild(self: Body[Iterator[bytes]]) -> tuple[Iterator[bytes], int] | None:
+        """Reopen the stream, closing any previous one, and return ``(stream, length)``.
+
+        ``None`` if the source could not be reopened.
+        """
+        self.close()
+        cm = self._opener()
+        if not isinstance(cm, AbstractContextManager):
+            raise TypeError(
+                "this Body has an async opener; use it with the async client (arebuild/aclose)"
+            )
+        cm = cast(AbstractContextManager["tuple[Iterator[bytes], int] | None"], cm)
+        opened = cm.__enter__()
+        if opened is None:
+            cm.__exit__(None, None, None)
+            return None
+        stream, length = opened
+        self._stream, self.length, self._cm = stream, length, cm
+        return stream, length
+
+    async def arebuild(
+        self: Body[AsyncIterator[bytes]],
+    ) -> tuple[AsyncIterator[bytes], int] | None:
+        """Async :meth:`rebuild`, returning ``(stream, length)`` or ``None``."""
+        await self.aclose()
+        cm = self._opener()
+        if not isinstance(cm, AbstractAsyncContextManager):
+            raise TypeError(
+                "this Body has a sync opener; use it with the sync client (rebuild/close)"
+            )
+        cm = cast(
+            AbstractAsyncContextManager["tuple[AsyncIterator[bytes], int] | None"], cm
+        )
+        opened = await cm.__aenter__()
+        if opened is None:
+            await cm.__aexit__(None, None, None)
+            return None
+        stream, length = opened
+        self._stream, self.length, self._cm = stream, length, cm
+        return stream, length
+
+    def close(self: Body[Iterator[bytes]]) -> None:
+        cm, self._cm, self._stream, self.length = self._cm, None, None, None
+        if cm is not None:
+            cast(AbstractContextManager[object], cm).__exit__(None, None, None)
+
+    async def aclose(self: Body[AsyncIterator[bytes]]) -> None:
+        cm, self._cm, self._stream, self.length = self._cm, None, None, None
+        if cm is not None:
+            await cast(AbstractAsyncContextManager[object], cm).__aexit__(
+                None, None, None
+            )
+
+    def __next__(self) -> bytes:
+        if self._stream is None:
+            raise RuntimeError("body has no open stream; call rebuild() first")
+        return next(cast(Iterator[bytes], self._stream))
+
+    async def __anext__(self) -> bytes:
+        if self._stream is None:
+            raise RuntimeError("body has no open stream; call rebuild() first")
+        return await cast(AsyncIterator[bytes], self._stream).__anext__()
+
+
+@contextmanager
+def closing_bodies(inp: object) -> Iterator[None]:
+    """Close every :class:`Body` in a request input when the operation finishes.
+
+    The operation method wraps its whole run (request build across retries, plus
+    response handling) in this, so a ``Body``'s stream is released once — and only
+    once — the operation is done. Non-``Body`` values (bytes, plain iterators,
+    ``StaticAnyIterator``) are left untouched.
+    """
+    try:
+        yield
+    finally:
+        if isinstance(inp, dict):
+            for value in inp.values():
+                if isinstance(value, Body):
+                    cast("Body[Iterator[bytes]]", value).close()
+
+
+@asynccontextmanager
+async def aclosing_bodies(inp: object) -> AsyncIterator[None]:
+    """Async :func:`closing_bodies`, awaiting :meth:`Body.aclose`."""
+    try:
+        yield
+    finally:
+        if isinstance(inp, dict):
+            for value in inp.values():
+                if isinstance(value, Body):
+                    await cast("Body[AsyncIterator[bytes]]", value).aclose()
+
+
+__all__ = ["Body", "aclosing_bodies", "closing_bodies"]

{capo_lambda-0.11.0 → capo_lambda-0.12.0}/src/capo_lambda/_operations/aws_gir_api_service/add_layer_version_permission.py

@@ -86,19 +86,26 @@ def get_signer(
     auth_schemes: list[dict[str, Any]] | None = None,
 ) -> capo_lambda._auth._signers.Signer | None:
     name_to_schema = {s["name"]: s for s in (auth_schemes or [])}  # noqa: F841
+    if (
+        options.credentials_provider is not None
+        and name_to_schema
+        and not name_to_schema.keys() & {"sigv4", "sigv4-s3express"}
+    ):
+        raise RuntimeError(
+            "Endpoint requires an unsupported auth scheme: " + ", ".join(name_to_schema)
+        )
     if options.credentials_provider is not None:
-        sigv4_config = (
-            name_to_schema.get("sigv4")
-            or name_to_schema.get("sigv4a")
-            or name_to_schema.get("sigv4-s3express")
-            or capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
-                "lambda", options.region
-            )
+        endpoint_scheme = name_to_schema.get("sigv4") or name_to_schema.get(
+            "sigv4-s3express"
         )
-        if sigv4_config is not None:
-            return capo_lambda._auth._signers.SigV4Signer(
-                options.credentials_provider, auth_scheme=sigv4_config
+        if endpoint_scheme is not None or not name_to_schema:
+            sigv4_config = capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
+                "lambda", options.region, endpoint_scheme
             )
+            if sigv4_config is not None:
+                return capo_lambda._auth._signers.SigV4Signer(
+                    options.credentials_provider, auth_scheme=sigv4_config
+                )
     raise RuntimeError("Auth was not resolved")
 
 
@@ -147,7 +154,7 @@ def add_layer_version_permission(
 ]:
     response = options.client.handler.handle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             response.read()
             handle_error(response)
         return handle_response(response), response
@@ -165,7 +172,7 @@ async def async_add_layer_version_permission(
 ]:
     response = await options.client.handler.ahandle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             await response.aread()
             handle_error(response)
         return await async_handle_response(response), response

{capo_lambda-0.11.0 → capo_lambda-0.12.0}/src/capo_lambda/_operations/aws_gir_api_service/add_permission.py

@@ -96,19 +96,26 @@ def get_signer(
     auth_schemes: list[dict[str, Any]] | None = None,
 ) -> capo_lambda._auth._signers.Signer | None:
     name_to_schema = {s["name"]: s for s in (auth_schemes or [])}  # noqa: F841
+    if (
+        options.credentials_provider is not None
+        and name_to_schema
+        and not name_to_schema.keys() & {"sigv4", "sigv4-s3express"}
+    ):
+        raise RuntimeError(
+            "Endpoint requires an unsupported auth scheme: " + ", ".join(name_to_schema)
+        )
     if options.credentials_provider is not None:
-        sigv4_config = (
-            name_to_schema.get("sigv4")
-            or name_to_schema.get("sigv4a")
-            or name_to_schema.get("sigv4-s3express")
-            or capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
-                "lambda", options.region
-            )
+        endpoint_scheme = name_to_schema.get("sigv4") or name_to_schema.get(
+            "sigv4-s3express"
         )
-        if sigv4_config is not None:
-            return capo_lambda._auth._signers.SigV4Signer(
-                options.credentials_provider, auth_scheme=sigv4_config
+        if endpoint_scheme is not None or not name_to_schema:
+            sigv4_config = capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
+                "lambda", options.region, endpoint_scheme
             )
+            if sigv4_config is not None:
+                return capo_lambda._auth._signers.SigV4Signer(
+                    options.credentials_provider, auth_scheme=sigv4_config
+                )
     raise RuntimeError("Auth was not resolved")
 
 
@@ -151,7 +158,7 @@ def add_permission(
 ]:
     response = options.client.handler.handle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             response.read()
             handle_error(response)
         return handle_response(response), response
@@ -168,7 +175,7 @@ async def async_add_permission(
 ]:
     response = await options.client.handler.ahandle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             await response.aread()
             handle_error(response)
         return await async_handle_response(response), response