capo-workspaces-thin-client 0.4.0__tar.gz → 0.6.0__tar.gz

{capo_workspaces_thin_client-0.4.0/src/capo_workspaces_thin_client.egg-info → capo_workspaces_thin_client-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-workspaces-thin-client
-Version: 0.4.0
+Version: 0.6.0
 Summary: Python SDK for AWS Workspaces Thin Client.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -17,7 +17,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: zapros>=0.13.0
+Requires-Dist: zapros>=0.21.0
 Provides-Extra: anyio
 Requires-Dist: anyio>=3.0; extra == "anyio"
 Provides-Extra: sso

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capo-workspaces-thin-client"
-version = "0.4.0"
+version = "0.6.0"
 description = "Python SDK for AWS Workspaces Thin Client."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -19,7 +19,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "zapros>=0.13.0",
+    "zapros>=0.21.0",
 ]
 
 [project.optional-dependencies]

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_auth/_sigv4.py

@@ -17,7 +17,7 @@ import hmac
 import re
 from collections.abc import AsyncIterator, Iterator
 from typing import Any, Literal, TypedDict, cast
-from urllib.parse import quote, unquote
+from urllib.parse import quote
 
 import zapros
 from pywhatwgurl import URLSearchParams
@@ -134,11 +134,11 @@ def _remove_dot_segments(path: str) -> str:
 def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
     """Build CanonicalURI.
 
-    Per the SigV4 spec, every segment is URI-encoded; standard services
-    normalize dot segments and URI-encode each segment **twice**. The
-    rules-engine ``disableNormalizePath`` / ``disableDoubleEncoding`` flags
-    turn those steps off — S3-family services set both, so the path is
-    signed exactly as provided.
+    ``path`` is the path as sent on the wire, so it is already URI-encoded
+    once. Standard services normalize dot segments and URI-encode each
+    segment a second time. The rules-engine ``disableNormalizePath`` /
+    ``disableDoubleEncoding`` flags turn those steps off — S3-family
+    services set both, so the path is signed exactly as provided.
     """
     if not path:
         return "/"
@@ -148,9 +148,9 @@ def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
         path = _remove_dot_segments(path)
     if not double_encode:
         return path
-    decoded = unquote(path)
-    first = quote(decoded, safe="/~")
-    return quote(first, safe="/~")
+    # Never decode first: that would turn a "%2F" inside a segment (an ARN in
+    # a path label) into a separator and leave it out of the second encoding.
+    return quote(path, safe="/~")
 
 
 def _canonical_query(query: str) -> str:

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/create_environment.py

@@ -145,7 +145,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/json"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/delete_device.py

@@ -128,7 +128,11 @@ def build_request(
         params.append(("clientToken", input_["client_token"]))
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/delete_environment.py

@@ -128,7 +128,11 @@ def build_request(
         params.append(("clientToken", input_["client_token"]))
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/deregister_device.py

@@ -133,7 +133,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/json"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/get_device.py

@@ -130,7 +130,11 @@ def build_request(
     params: list[tuple[str, str]] = []
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/get_environment.py

@@ -126,7 +126,11 @@ def build_request(
     params: list[tuple[str, str]] = []
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/get_software_set.py

@@ -126,7 +126,11 @@ def build_request(
     params: list[tuple[str, str]] = []
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/list_devices.py

@@ -127,7 +127,11 @@ def build_request(
         params.append(("maxResults", str(input_["max_results"])))
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/list_environments.py

@@ -123,7 +123,11 @@ def build_request(
         params.append(("maxResults", str(input_["max_results"])))
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/list_software_sets.py

@@ -123,7 +123,11 @@ def build_request(
         params.append(("maxResults", str(input_["max_results"])))
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/list_tags_for_resource.py

@@ -126,7 +126,11 @@ def build_request(
     params: list[tuple[str, str]] = []
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/tag_resource.py

@@ -131,7 +131,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/json"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/untag_resource.py

@@ -129,7 +129,11 @@ def build_request(
         params.append(("tagKeys", item))
     headers: dict[str, str] = {k: ", ".join(v) for k, v in endpoint.headers.items()}
     body: bytes | None = b""
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/update_device.py

@@ -131,7 +131,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/json"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/update_environment.py

@@ -141,7 +141,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/json"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_operations/thin_client/update_software_set.py

@@ -128,7 +128,11 @@ def build_request(
         allow_nan=False,
     ).encode()
     headers["content-type"] = "application/json"
-    signer = get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    signer = (
+        None
+        if options.anonymous
+        else get_signer(options, auth_schemes=endpoint.properties.get("authSchemes"))
+    )
     normalized_url = zapros.URL(url)
     for k, v in params:
         normalized_url.search_params.append(k, v)

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_services/_pipeline.py

@@ -40,6 +40,7 @@ class OperationOptions:
     endpoint: str | None = None
     retry_max_attempts: int | None = None
     credentials_provider: IdentityProvider[Credentials] | None = None
+    anonymous: bool | None = None
 
 
 @dataclass
@@ -51,6 +52,7 @@ class AsyncOperationOptions:
     endpoint: str | None = None
     retry_max_attempts: int | None = None
     credentials_provider: IdentityProvider[Credentials] | None = None
+    anonymous: bool | None = None
 
 
 @dataclass

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_services/async_work_spaces_thin_client.py

@@ -95,6 +95,7 @@ class AsyncWorkSpacesThinClientClientConfig(TypedDict, total=False, closed=True)
     use_fips: bool | None
     endpoint: str | None
     credentials_provider: IdentityProvider[Credentials] | None
+    anonymous: bool | None
 
 
 class AsyncWorkSpacesThinClientClient:
@@ -110,6 +111,7 @@ class AsyncWorkSpacesThinClientClient:
         endpoint: The value of the ``SDK::Endpoint`` endpoint parameter.
         credentials: AWS credentials for request signing.
         credentials_provider: Provider that resolves AWS credentials. Takes precedence over ``credentials``.
+        anonymous: Send requests unsigned, without resolving credentials, even for operations that require authentication.
     """
 
     def __init__(
@@ -123,10 +125,14 @@ class AsyncWorkSpacesThinClientClient:
         endpoint: str | None = None,
         credentials: Credentials | None = None,
         credentials_provider: CredentialsProvider | None = None,
+        anonymous: bool | None = None,
     ):
-        self._client = AsyncClient(http_handler).wrap_with_middleware(
-            lambda next: AuthMiddleware(next)
-        )
+        client = AsyncClient(http_handler)
+        # The handler the user gave us, or the default one for this environment.
+        # The SDK middlewares wrap it below, and the credential resolvers borrow
+        # it for their one-off calls.
+        raw_handler = client.handler
+        self._client = client.wrap_with_middleware(lambda next: AuthMiddleware(next))
         if credentials is not None and credentials_provider is not None:
             warnings.warn(
                 "Both credentials and credentials_provider given; provider takes precedence"
@@ -138,7 +144,7 @@ class AsyncWorkSpacesThinClientClient:
             resolved_credentials_provider = StaticAwsCredentialsProvider(credentials)
         if resolved_credentials_provider is None and credentials is None:
             resolved_credentials_provider = default_aws_credentials_chain(
-                AsyncClient(http_handler)
+                AsyncClient(raw_handler)
             )
         self._config = AsyncWorkSpacesThinClientClientConfig(
             {
@@ -149,6 +155,7 @@ class AsyncWorkSpacesThinClientClient:
                 "use_fips": use_fips,
                 "endpoint": endpoint,
                 "credentials_provider": resolved_credentials_provider,
+                "anonymous": anonymous,
             }
         )
 
@@ -177,6 +184,7 @@ class AsyncWorkSpacesThinClientClient:
             credentials_provider=overrides.get(
                 "credentials_provider", self._config.get("credentials_provider")
             ),
+            anonymous=overrides.get("anonymous", self._config.get("anonymous")),
         )
         return interceptors_, options_
 

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client/_services/work_spaces_thin_client.py

@@ -95,6 +95,7 @@ class WorkSpacesThinClientClientConfig(TypedDict, total=False, closed=True):
     use_fips: bool | None
     endpoint: str | None
     credentials_provider: IdentityProvider[Credentials] | None
+    anonymous: bool | None
 
 
 class WorkSpacesThinClientClient:
@@ -110,6 +111,7 @@ class WorkSpacesThinClientClient:
         endpoint: The value of the ``SDK::Endpoint`` endpoint parameter.
         credentials: AWS credentials for request signing.
         credentials_provider: Provider that resolves AWS credentials. Takes precedence over ``credentials``.
+        anonymous: Send requests unsigned, without resolving credentials, even for operations that require authentication.
     """
 
     def __init__(
@@ -123,10 +125,14 @@ class WorkSpacesThinClientClient:
         endpoint: str | None = None,
         credentials: Credentials | None = None,
         credentials_provider: CredentialsProvider | None = None,
+        anonymous: bool | None = None,
     ):
-        self._client = Client(http_handler).wrap_with_middleware(
-            lambda next: AuthMiddleware(next)
-        )
+        client = Client(http_handler)
+        # The handler the user gave us, or the default one for this environment.
+        # The SDK middlewares wrap it below, and the credential resolvers borrow
+        # it for their one-off calls.
+        raw_handler = client.handler
+        self._client = client.wrap_with_middleware(lambda next: AuthMiddleware(next))
         if credentials is not None and credentials_provider is not None:
             warnings.warn(
                 "Both credentials and credentials_provider given; provider takes precedence"
@@ -138,7 +144,7 @@ class WorkSpacesThinClientClient:
             resolved_credentials_provider = StaticAwsCredentialsProvider(credentials)
         if resolved_credentials_provider is None and credentials is None:
             resolved_credentials_provider = default_aws_credentials_chain(
-                Client(http_handler)
+                Client(raw_handler)
             )
         self._config = WorkSpacesThinClientClientConfig(
             {
@@ -149,6 +155,7 @@ class WorkSpacesThinClientClient:
                 "use_fips": use_fips,
                 "endpoint": endpoint,
                 "credentials_provider": resolved_credentials_provider,
+                "anonymous": anonymous,
             }
         )
 
@@ -177,6 +184,7 @@ class WorkSpacesThinClientClient:
             credentials_provider=overrides.get(
                 "credentials_provider", self._config.get("credentials_provider")
             ),
+            anonymous=overrides.get("anonymous", self._config.get("anonymous")),
         )
         return interceptors_, options_
 

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0/src/capo_workspaces_thin_client.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-workspaces-thin-client
-Version: 0.4.0
+Version: 0.6.0
 Summary: Python SDK for AWS Workspaces Thin Client.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -17,7 +17,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: zapros>=0.13.0
+Requires-Dist: zapros>=0.21.0
 Provides-Extra: anyio
 Requires-Dist: anyio>=3.0; extra == "anyio"
 Provides-Extra: sso

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/src/capo_workspaces_thin_client.egg-info/requires.txt

@@ -1,4 +1,4 @@
-zapros>=0.13.0
+zapros>=0.21.0
 
 [anyio]
 anyio>=3.0

{capo_workspaces_thin_client-0.4.0 → capo_workspaces_thin_client-0.6.0}/tests/test_sigv4.py

@@ -91,13 +91,28 @@ class TestCanonicalPath:
     def test_s3_preserves_dot_segments(self):
         assert _s3_path("/a/../b/./c") == "/a/../b/./c"
 
-    def test_non_s3_double_encodes(self):
-        # "/foo bar" → first encode → "/foo%20bar" → second → "/foo%2520bar"
-        assert _std_path("/foo bar") == "/foo%2520bar"
-
-    def test_non_s3_already_encoded_double_encodes(self):
-        # "/foo%20bar" gets unquoted to "/foo bar", then double-encoded.
+    def test_non_s3_encodes_wire_path_once_more(self):
+        # The path arrives URI-encoded once ("/foo bar" is sent as "/foo%20bar").
         assert _std_path("/foo%20bar") == "/foo%2520bar"
+        assert _std_path("/a%3Ab/caf%C3%A9~") == "/a%253Ab/caf%25C3%25A9~"
+
+    def test_non_s3_keeps_encoded_slash_inside_segment(self):
+        # An ARN in a path label: its "/" is sent as "%2F" and must stay part
+        # of the segment, not become a separator.
+        assert (
+            _std_path("/model/arn%3Aaws%3Abedrock%3A%3Afoundation-model%2Fx/converse")
+            == "/model/arn%253Aaws%253Abedrock%253A%253Afoundation-model%252Fx/converse"
+        )
+        assert _s3_path("/bucket/a%2Fb") == "/bucket/a%2Fb"
+
+    def test_non_s3_encodes_literal_reserved_characters_once(self):
+        # "@" and "$" appear literally in a few URI templates and are sent as is.
+        assert _std_path("/@connections/abc") == "/%40connections/abc"
+        assert _std_path("/things/t/jobs/$next") == "/things/t/jobs/%24next"
+
+    def test_non_s3_does_not_decode_the_wire_path(self):
+        assert _std_path("/a%2fb") == "/a%252fb"
+        assert _std_path("/a%25b") == "/a%2525b"
 
     def test_non_s3_removes_dot_segments(self):
         # Mirrors botocore's normalize_url_path: "." dropped, ".." pops,