capo-lambda 0.19.0__tar.gz → 0.20.0__tar.gz

{capo_lambda-0.19.0/src/capo_lambda.egg-info → capo_lambda-0.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-lambda
-Version: 0.19.0
+Version: 0.20.0
 Summary: Python SDK for AWS Lambda.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -18,7 +18,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jmespath>=1.0
-Requires-Dist: zapros>=0.13.0
+Requires-Dist: zapros>=0.21.0
 Provides-Extra: anyio
 Requires-Dist: anyio>=3.0; extra == "anyio"
 Provides-Extra: sso

{capo_lambda-0.19.0 → capo_lambda-0.20.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capo-lambda"
-version = "0.19.0"
+version = "0.20.0"
 description = "Python SDK for AWS Lambda."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -20,7 +20,7 @@ classifiers = [
 ]
 dependencies = [
     "jmespath>=1.0",
-    "zapros>=0.13.0",
+    "zapros>=0.21.0",
 ]
 
 [project.optional-dependencies]

{capo_lambda-0.19.0 → capo_lambda-0.20.0}/src/capo_lambda/_auth/_sigv4.py

@@ -17,7 +17,7 @@ import hmac
 import re
 from collections.abc import AsyncIterator, Iterator
 from typing import Any, Literal, TypedDict, cast
-from urllib.parse import quote, unquote
+from urllib.parse import quote
 
 import zapros
 from pywhatwgurl import URLSearchParams
@@ -134,11 +134,11 @@ def _remove_dot_segments(path: str) -> str:
 def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
     """Build CanonicalURI.
 
-    Per the SigV4 spec, every segment is URI-encoded; standard services
-    normalize dot segments and URI-encode each segment **twice**. The
-    rules-engine ``disableNormalizePath`` / ``disableDoubleEncoding`` flags
-    turn those steps off — S3-family services set both, so the path is
-    signed exactly as provided.
+    ``path`` is the path as sent on the wire, so it is already URI-encoded
+    once. Standard services normalize dot segments and URI-encode each
+    segment a second time. The rules-engine ``disableNormalizePath`` /
+    ``disableDoubleEncoding`` flags turn those steps off — S3-family
+    services set both, so the path is signed exactly as provided.
     """
     if not path:
         return "/"
@@ -148,9 +148,9 @@ def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
         path = _remove_dot_segments(path)
     if not double_encode:
         return path
-    decoded = unquote(path)
-    first = quote(decoded, safe="/~")
-    return quote(first, safe="/~")
+    # Never decode first: that would turn a "%2F" inside a segment (an ARN in
+    # a path label) into a separator and leave it out of the second encoding.
+    return quote(path, safe="/~")
 
 
 def _canonical_query(query: str) -> str:

{capo_lambda-0.19.0 → capo_lambda-0.20.0}/src/capo_lambda/_services/_lambda.py

@@ -400,9 +400,12 @@ class LambdaClient:
         credentials_provider: CredentialsProvider | None = None,
         anonymous: bool | None = None,
     ):
-        self._client = Client(http_handler).wrap_with_middleware(
-            lambda next: AuthMiddleware(next)
-        )
+        client = Client(http_handler)
+        # The handler the user gave us, or the default one for this environment.
+        # The SDK middlewares wrap it below, and the credential resolvers borrow
+        # it for their one-off calls.
+        raw_handler = client.handler
+        self._client = client.wrap_with_middleware(lambda next: AuthMiddleware(next))
         if credentials is not None and credentials_provider is not None:
             warnings.warn(
                 "Both credentials and credentials_provider given; provider takes precedence"
@@ -414,7 +417,7 @@ class LambdaClient:
             resolved_credentials_provider = StaticAwsCredentialsProvider(credentials)
         if resolved_credentials_provider is None and credentials is None:
             resolved_credentials_provider = default_aws_credentials_chain(
-                Client(http_handler)
+                Client(raw_handler)
             )
         self._config = LambdaClientConfig(
             {

{capo_lambda-0.19.0 → capo_lambda-0.20.0}/src/capo_lambda/_services/async__lambda.py

@@ -401,9 +401,12 @@ class AsyncLambdaClient:
         credentials_provider: CredentialsProvider | None = None,
         anonymous: bool | None = None,
     ):
-        self._client = AsyncClient(http_handler).wrap_with_middleware(
-            lambda next: AuthMiddleware(next)
-        )
+        client = AsyncClient(http_handler)
+        # The handler the user gave us, or the default one for this environment.
+        # The SDK middlewares wrap it below, and the credential resolvers borrow
+        # it for their one-off calls.
+        raw_handler = client.handler
+        self._client = client.wrap_with_middleware(lambda next: AuthMiddleware(next))
         if credentials is not None and credentials_provider is not None:
             warnings.warn(
                 "Both credentials and credentials_provider given; provider takes precedence"
@@ -415,7 +418,7 @@ class AsyncLambdaClient:
             resolved_credentials_provider = StaticAwsCredentialsProvider(credentials)
         if resolved_credentials_provider is None and credentials is None:
             resolved_credentials_provider = default_aws_credentials_chain(
-                AsyncClient(http_handler)
+                AsyncClient(raw_handler)
             )
         self._config = AsyncLambdaClientConfig(
             {

{capo_lambda-0.19.0 → capo_lambda-0.20.0/src/capo_lambda.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-lambda
-Version: 0.19.0
+Version: 0.20.0
 Summary: Python SDK for AWS Lambda.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -18,7 +18,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jmespath>=1.0
-Requires-Dist: zapros>=0.13.0
+Requires-Dist: zapros>=0.21.0
 Provides-Extra: anyio
 Requires-Dist: anyio>=3.0; extra == "anyio"
 Provides-Extra: sso

{capo_lambda-0.19.0 → capo_lambda-0.20.0}/src/capo_lambda.egg-info/requires.txt

@@ -1,5 +1,5 @@
 jmespath>=1.0
-zapros>=0.13.0
+zapros>=0.21.0
 
 [anyio]
 anyio>=3.0

{capo_lambda-0.19.0 → capo_lambda-0.20.0}/tests/test_sigv4.py

@@ -91,13 +91,28 @@ class TestCanonicalPath:
     def test_s3_preserves_dot_segments(self):
         assert _s3_path("/a/../b/./c") == "/a/../b/./c"
 
-    def test_non_s3_double_encodes(self):
-        # "/foo bar" → first encode → "/foo%20bar" → second → "/foo%2520bar"
-        assert _std_path("/foo bar") == "/foo%2520bar"
-
-    def test_non_s3_already_encoded_double_encodes(self):
-        # "/foo%20bar" gets unquoted to "/foo bar", then double-encoded.
+    def test_non_s3_encodes_wire_path_once_more(self):
+        # The path arrives URI-encoded once ("/foo bar" is sent as "/foo%20bar").
         assert _std_path("/foo%20bar") == "/foo%2520bar"
+        assert _std_path("/a%3Ab/caf%C3%A9~") == "/a%253Ab/caf%25C3%25A9~"
+
+    def test_non_s3_keeps_encoded_slash_inside_segment(self):
+        # An ARN in a path label: its "/" is sent as "%2F" and must stay part
+        # of the segment, not become a separator.
+        assert (
+            _std_path("/model/arn%3Aaws%3Abedrock%3A%3Afoundation-model%2Fx/converse")
+            == "/model/arn%253Aaws%253Abedrock%253A%253Afoundation-model%252Fx/converse"
+        )
+        assert _s3_path("/bucket/a%2Fb") == "/bucket/a%2Fb"
+
+    def test_non_s3_encodes_literal_reserved_characters_once(self):
+        # "@" and "$" appear literally in a few URI templates and are sent as is.
+        assert _std_path("/@connections/abc") == "/%40connections/abc"
+        assert _std_path("/things/t/jobs/$next") == "/things/t/jobs/%24next"
+
+    def test_non_s3_does_not_decode_the_wire_path(self):
+        assert _std_path("/a%2fb") == "/a%252fb"
+        assert _std_path("/a%25b") == "/a%2525b"
 
     def test_non_s3_removes_dot_segments(self):
         # Mirrors botocore's normalize_url_path: "." dropped, ".." pops,