cdk-factory 0.7.26__tar.gz → 0.7.27__tar.gz

{cdk_factory-0.7.26 → cdk_factory-0.7.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cdk_factory
-Version: 0.7.26
+Version: 0.7.27
 Summary: CDK Factory. A QuickStarter and best practices setup for CDK projects
 Author-email: Eric Wilson <eric.wilson@geekcafe.com>
 License: MIT License

{cdk_factory-0.7.26 → cdk_factory-0.7.27}/pyproject.toml

@@ -33,7 +33,7 @@ markers = [
 [project]
 
 name = "cdk_factory"
-version = "0.7.26"
+version = "0.7.27"
 authors = [
   { name="Eric Wilson", email="eric.wilson@geekcafe.com" }
 ]

{cdk_factory-0.7.26 → cdk_factory-0.7.27}/src/cdk_factory/configurations/resources/apigateway_route_config.py

@@ -72,7 +72,7 @@ class ApiGatewayConfigRouteConfig:
     @property
     def allow_public_override(self) -> bool:
         """Whether to allow public access when Cognito is available"""
-        return self._config.get("allow_public_override", False)
+        return str(self._config.get("allow_public_override", False)).lower() == "true"
 
     @property
     def dictionary(self) -> Dict[str, Any]:

{cdk_factory-0.7.26 → cdk_factory-0.7.27}/src/cdk_factory/stack_library/api_gateway/api_gateway_stack.py

@@ -350,28 +350,30 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
     def _validate_authorization_configuration(self, route, has_cognito_authorizer):
         """
         Validate authorization configuration for security and clarity.
-        
+
         This method implements 'secure by default' with explicit overrides:
         - If Cognito is available and route wants NONE auth, requires explicit override
         - If Cognito is not available and route wants COGNITO auth, raises error
         - Provides verbose warnings for monitoring and security awareness
-        
+
         Args:
             route (dict): Route configuration
             has_cognito_authorizer (bool): Whether a Cognito authorizer is configured
-            
+
         Raises:
             ValueError: When there are security conflicts without explicit overrides
         """
         import logging
-        
-        auth_type = route.get("authorization_type", "COGNITO")
-        explicit_override = route.get("allow_public_override", False)
+
+        auth_type = str(route.get("authorization_type", "COGNITO")).upper()
+        explicit_override = (
+            str(route.get("allow_public_override", False)).lower() == "true"
+        )
         route_path = route.get("path", "unknown")
         method = route.get("method", "unknown")
-        
+
         logger = logging.getLogger(__name__)
-        
+
         # Case 1: Cognito available + NONE requested + No explicit override = ERROR
         if has_cognito_authorizer and auth_type == "NONE" and not explicit_override:
             error_msg = (
@@ -383,11 +385,12 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
                 f"   1. Remove Cognito configuration if you want public access\n"
                 f"   2. Add 'allow_public_override': true to explicitly allow public access\n"
                 f"   3. Remove 'authorization_type': 'NONE' to use secure Cognito auth\n\n"
-                f"🔒 This prevents accidental public endpoints when authentication is available."
+                f"🔒 This prevents accidental public endpoints when authentication is available.\n\n"
+                f"👉 ApiGatewayStack documentation for more details: https://github.com/your-repo/api-gateway-stack"
             )
             raise ValueError(error_msg)
-        
-        # Case 2: No Cognito + COGNITO explicitly requested = ERROR  
+
+        # Case 2: No Cognito + COGNITO explicitly requested = ERROR
         # Only error if COGNITO was explicitly requested, not if it's the default
         if not has_cognito_authorizer and route.get("authorization_type") == "COGNITO":
             error_msg = (
@@ -401,7 +404,7 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
                 f"   4. Remove explicit authorization_type to use default behavior"
             )
             raise ValueError(error_msg)
-        
+
         # Case 3: Cognito available + NONE requested + Explicit override = WARN
         if has_cognito_authorizer and auth_type == "NONE" and explicit_override:
             warning_msg = (
@@ -411,10 +414,10 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
                 f"   📊 Consider monitoring this endpoint for unexpected usage patterns\n"
                 f"   🔍 Review periodically: Should this endpoint be secured?"
             )
-            
+
             # Print to console during deployment for visibility
             print(warning_msg)
-            
+
             # Structured logging for monitoring and metrics
             logger.warning(
                 "Public endpoint configured with Cognito available",
@@ -426,10 +429,10 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
                     "authorization_type": "NONE",
                     "metric_name": "public_endpoint_with_cognito",
                     "security_decision": "intentional_public",
-                    "recommendation": "review_periodically"
-                }
+                    "recommendation": "review_periodically",
+                },
             )
-        
+
         # Case 4: No Cognito + NONE = INFO (expected for public-only APIs)
         if not has_cognito_authorizer and auth_type == "NONE":
             logger.info(
@@ -439,8 +442,8 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
                     "method": method,
                     "authorization_type": "NONE",
                     "cognito_available": False,
-                    "security_decision": "public_only_api"
-                }
+                    "security_decision": "public_only_api",
+                },
             )
 
     def _setup_lambda_integration(
@@ -448,23 +451,27 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
     ):
         """Setup Lambda integration for a route"""
         import logging
-        
+
         route_path = route["path"]
         # Secure by default: require Cognito authorization unless explicitly set to NONE
         authorization_type = route.get("authorization_type", "COGNITO")
-        
+
         # If no Cognito authorizer available and default COGNITO, fall back to NONE
-        if not authorizer and authorization_type == "COGNITO" and "authorization_type" not in route:
+        if (
+            not authorizer
+            and authorization_type == "COGNITO"
+            and "authorization_type" not in route
+        ):
             authorization_type = "NONE"
             logger = logging.getLogger(__name__)
             logger.info(
                 f"No Cognito authorizer available for route {route_path} ({route.get('method', 'unknown')}), "
                 f"defaulting to public access (NONE authorization)"
             )
-        
+
         # Validate authorization configuration for security
         self._validate_authorization_configuration(route, authorizer is not None)
-        
+
         # If set to NONE (explicitly or by fallback), skip authorization
         if authorization_type == "NONE":
             authorizer = None
@@ -502,20 +509,24 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
     ):
         """Setup fallback Lambda integration for routes without src"""
         import logging
-        
+
         route_path = route["path"]
         # Secure by default: require Cognito authorization unless explicitly set to NONE
         authorization_type = route.get("authorization_type", "COGNITO")
-        
+
         # If no Cognito authorizer available and default COGNITO, fall back to NONE
-        if not authorizer and authorization_type == "COGNITO" and "authorization_type" not in route:
+        if (
+            not authorizer
+            and authorization_type == "COGNITO"
+            and "authorization_type" not in route
+        ):
             authorization_type = "NONE"
             logger = logging.getLogger(__name__)
             logger.info(
                 f"No Cognito authorizer available for route {route_path} ({route.get('method', 'unknown')}), "
                 f"defaulting to public access (NONE authorization)"
             )
-        
+
         # Validate authorization configuration for security
         self._validate_authorization_configuration(route, authorizer is not None)