django-lambda-tasks 0.4.11__tar.gz → 0.5.0__tar.gz

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/.kiro/steering/product.md

@@ -138,12 +138,12 @@ class SQSLambdaTaskMessage(BaseModel):
 
 When the environment variable `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` is set, the loader parses the reference, fetches the named Secrets Manager secret, parses its JSON content as a flat key-value mapping, and sets the resulting pairs as environment variables.
 
-Required format: `<arn>:<version-stage>:<version-id>` (9 colon-separated segments — the ARN is 7 segments, plus version-stage and version-id). Both suffix fields must be non-empty.
+Required format: `<arn>:<version-id>` (8 colon-separated segments — the ARN is 7 segments, plus the version-id). The version-id must be non-empty.
 
 Behaviour:
 - If `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` is not set, does nothing (no AWS API calls)
 - Validates the reference format before any AWS call — malformed references raise `ValueError` immediately
-- Fetches the secret via `secretsmanager.get_secret_value(SecretId=..., VersionStage=..., VersionId=...)`
+- Fetches the secret via `secretsmanager.get_secret_value(SecretId=..., VersionId=...)`
 - Validates the secret value is a flat JSON object (all values must be strings, no empty keys)
 - Sets each key-value pair in `os.environ` — existing env vars are overridden (no conflict detection)
 - Idempotent via a module-level `_loaded` sentinel — subsequent calls are free no-ops
@@ -155,12 +155,12 @@ Behaviour:
 
 Any env var prefixed `LAMBDA_TASKS_SECRET_` is treated as a Secrets Manager reference. The unprefixed name is the target env var.
 
-Required format: `<arn>:<json-key>:<version-stage>:<version-id>` (10 colon-separated segments, all fields non-empty).
+Required format: `<arn>:<json-key>:<version-stage>:<version-id>` (10 colon-separated segments). The version-stage segment must be empty. The json-key and version-id must be non-empty.
 
 Behaviour:
 - All references are validated before any AWS call — malformed references raise `ValueError` immediately
 - Setting both `LAMBDA_TASKS_SECRET_FOO` and `FOO` is a configuration error and raises `ValueError`
-- Calls are batched by `(ARN, version-stage, version-id)` — one `GetSecretValue` per unique combination
+- Calls are batched by `(ARN, version-id)` — one `GetSecretValue` per unique combination
 - Fetched secrets are cached in-process; warm invocations pay no extra cost
 
 ## Models

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-lambda-tasks
-Version: 0.4.11
+Version: 0.5.0
 Summary: Run async tasks in a lambda function
 Requires-Python: >=3.10
 Requires-Dist: awslambdaric
@@ -150,7 +150,7 @@ LAMBDA_TASKS_DEFAULT_HARD_TIMEOUT = 270
 
 | Setting | Type | Description |
 |---|---|---|
-| `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` | env var | Secrets Manager reference (`<arn>:<version-stage>:<version-id>`) to load as environment variables at Lambda cold start. |
+| `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` | env var | Secrets Manager reference (`<arn>:<version-id>`) to load as environment variables at Lambda cold start. |
 | `LAMBDA_TASKS_SECRET_*` | env var(s) | Secrets Manager references resolved into env vars at Lambda cold start. The unprefixed name becomes the target env var. |
 
 These are environment variables set on the Lambda function, not Django settings. See [Loading environment variables from Secrets Manager](#loading-environment-variables-from-secrets-manager) and [Resolving individual secrets from AWS Secrets Manager](#resolving-individual-secrets-from-aws-secrets-manager) for full details.
@@ -203,7 +203,6 @@ Key characteristics:
 
 ```python
 @lambda_task(
-    delay=0,               # seconds — SQS DelaySeconds before message becomes visible
     soft_timeout=60,       # seconds — overrides global default for this task
     hard_timeout=90,       # seconds — overrides global default for this task
     queue="default",       # named queue from LAMBDA_TASKS_QUEUES
@@ -493,20 +492,20 @@ Ensure the Lambda execution environment has `DJANGO_SETTINGS_MODULE` set and tha
 | Environment Variable | Required | Description |
 |---|---|---|
 | `DJANGO_SETTINGS_MODULE` | Yes | Django settings module path (e.g. `myapp.settings.production`). |
-| `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` | No | Secrets Manager reference (`<arn>:<version-stage>:<version-id>`) to load as environment variables at cold start (runs first). |
+| `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` | No | Secrets Manager reference (`<arn>:<version-id>`) to load as environment variables at cold start (runs first). |
 | `LAMBDA_TASKS_SECRET_*` | No | Secrets Manager references resolved into individual env vars at cold start (runs second, after environment loading). |
 
 ### Loading environment variables from Secrets Manager
 
 The Lambda handler supports loading environment variables from an AWS Secrets Manager secret at cold start. This lets you manage environment configuration centrally in Secrets Manager without baking values into the Lambda deployment package.
 
-Set the `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` environment variable to a full reference including version stage and version ID:
+Set the `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` environment variable to a full reference including version ID:
 
 ```
-LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN=arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod/environment:AWSCURRENT:v1
+LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN=arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod/environment:v1
 ```
 
-The format is `<arn>:<version-stage>:<version-id>` (9 colon-separated segments — the ARN is 7 segments, plus version-stage and version-id). Both suffix fields must be non-empty.
+The format is `<arn>:<version-id>` (8 colon-separated segments — the ARN is 7 segments, plus the version-id). The version-id must be non-empty.
 
 The secret value must be a flat JSON object where all keys and values are strings:
 
@@ -521,8 +520,8 @@ The secret value must be a flat JSON object where all keys and values are string
 At cold start (on the first handler invocation), before `resolve_secrets_into_env()` and `django.setup()`, the handler calls `resolve_environment()` which:
 
 1. Checks for the `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` env var — if not set, does nothing
-2. Parses and validates the reference format (9 segments, non-empty version-stage and version-id)
-3. Fetches the secret via `secretsmanager.get_secret_value(SecretId=..., VersionStage=..., VersionId=...)`
+2. Parses and validates the reference format (8 segments, non-empty version-id)
+3. Fetches the secret via `secretsmanager.get_secret_value(SecretId=..., VersionId=...)`
 4. Validates the secret value is a flat JSON object (all values must be strings, no empty keys)
 5. Sets each key-value pair in `os.environ` — existing env vars are overridden
 6. Caches the result via a module-level sentinel — subsequent calls are free no-ops
@@ -533,7 +532,7 @@ Because environment loading runs first, the secret can provide `DJANGO_SETTINGS_
 
 The following raise `ValueError` at cold start, preventing the Lambda container from starting:
 
-- Reference format is invalid (wrong segment count, empty version-stage or version-id)
+- Reference format is invalid (wrong segment count, empty version-id)
 - Secret value is not valid JSON
 - JSON is not a flat object (contains non-string values) — error message lists the offending keys
 - JSON contains an empty string key
@@ -547,14 +546,14 @@ The Lambda handler supports loading individual secret values from AWS Secrets Ma
 Set any env var with the prefix `LAMBDA_TASKS_SECRET_` to a full Secrets Manager dynamic reference. The unprefixed name becomes the target env var:
 
 ```
-LAMBDA_TASKS_SECRET_DATABASE_URL=arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod:DATABASE_URL:AWSCURRENT:v1
+LAMBDA_TASKS_SECRET_DATABASE_URL=arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod:DATABASE_URL::v1
 ```
 
 At cold start (on the first handler invocation), after `resolve_environment()` and before `django.setup()`, the handler calls `resolve_secrets_into_env()` which:
 
 1. Scans all env vars for the `LAMBDA_TASKS_SECRET_` prefix
 2. Validates every reference — malformed references raise immediately so the container fails to start rather than misconfiguring Django silently
-3. Groups references by `(ARN, version-stage, version-id)` and makes one `GetSecretValue` call per unique combination
+3. Groups references by `(ARN, version-id)` and makes one `GetSecretValue` call per unique combination
 4. Extracts the named JSON key from the secret and writes it into `os.environ`
 5. Caches fetched secrets in-process — warm invocations pay no extra cost
 
@@ -566,18 +565,18 @@ Every value must follow the full dynamic reference syntax:
 <arn>:<json-key>:<version-stage>:<version-id>
 ```
 
-All four fields are required and must be non-empty. The secret value must be a JSON object; `json-key` names the field to extract.
+The version-stage segment must be empty. The json-key and version-id fields are required and must be non-empty. The secret value must be a JSON object; `json-key` names the field to extract.
 
 ```
-# arn (7 segments) : json-key : version-stage : version-id
-arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod:DATABASE_URL:AWSCURRENT:v1
+# arn (7 segments) : json-key : version-stage (empty) : version-id
+arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod:DATABASE_URL::v1
 ```
 
-Multiple env vars can reference different keys from the same secret — only one `GetSecretValue` call is made for that `(ARN, version-stage, version-id)` combination:
+Multiple env vars can reference different keys from the same secret — only one `GetSecretValue` call is made for that `(ARN, version-id)` combination:
 
 ```
-LAMBDA_TASKS_SECRET_DATABASE_URL=arn:...:myapp/prod:DATABASE_URL:AWSCURRENT:v1
-LAMBDA_TASKS_SECRET_SECRET_KEY=arn:...:myapp/prod:SECRET_KEY:AWSCURRENT:v1
+LAMBDA_TASKS_SECRET_DATABASE_URL=arn:...:myapp/prod:DATABASE_URL::v1
+LAMBDA_TASKS_SECRET_SECRET_KEY=arn:...:myapp/prod:SECRET_KEY::v1
 ```
 
 #### Validation errors
@@ -585,7 +584,8 @@ LAMBDA_TASKS_SECRET_SECRET_KEY=arn:...:myapp/prod:SECRET_KEY:AWSCURRENT:v1
 The following all raise `ValueError` at cold start, preventing the Lambda container from starting with a misconfigured environment:
 
 - Wrong number of colon-separated segments (must be exactly 10)
-- Empty `json-key`, `version-stage`, or `version-id`
+- Empty `json-key` or `version-id`
+- Non-empty `version-stage` (version-stage is not supported)
 - Both `LAMBDA_TASKS_SECRET_FOO` and `FOO` are set — use one or the other
 - The named JSON key does not exist in the fetched secret
 - The secret value is not valid JSON

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/README.md

@@ -138,7 +138,7 @@ LAMBDA_TASKS_DEFAULT_HARD_TIMEOUT = 270
 
 | Setting | Type | Description |
 |---|---|---|
-| `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` | env var | Secrets Manager reference (`<arn>:<version-stage>:<version-id>`) to load as environment variables at Lambda cold start. |
+| `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` | env var | Secrets Manager reference (`<arn>:<version-id>`) to load as environment variables at Lambda cold start. |
 | `LAMBDA_TASKS_SECRET_*` | env var(s) | Secrets Manager references resolved into env vars at Lambda cold start. The unprefixed name becomes the target env var. |
 
 These are environment variables set on the Lambda function, not Django settings. See [Loading environment variables from Secrets Manager](#loading-environment-variables-from-secrets-manager) and [Resolving individual secrets from AWS Secrets Manager](#resolving-individual-secrets-from-aws-secrets-manager) for full details.
@@ -191,7 +191,6 @@ Key characteristics:
 
 ```python
 @lambda_task(
-    delay=0,               # seconds — SQS DelaySeconds before message becomes visible
     soft_timeout=60,       # seconds — overrides global default for this task
     hard_timeout=90,       # seconds — overrides global default for this task
     queue="default",       # named queue from LAMBDA_TASKS_QUEUES
@@ -481,20 +480,20 @@ Ensure the Lambda execution environment has `DJANGO_SETTINGS_MODULE` set and tha
 | Environment Variable | Required | Description |
 |---|---|---|
 | `DJANGO_SETTINGS_MODULE` | Yes | Django settings module path (e.g. `myapp.settings.production`). |
-| `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` | No | Secrets Manager reference (`<arn>:<version-stage>:<version-id>`) to load as environment variables at cold start (runs first). |
+| `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` | No | Secrets Manager reference (`<arn>:<version-id>`) to load as environment variables at cold start (runs first). |
 | `LAMBDA_TASKS_SECRET_*` | No | Secrets Manager references resolved into individual env vars at cold start (runs second, after environment loading). |
 
 ### Loading environment variables from Secrets Manager
 
 The Lambda handler supports loading environment variables from an AWS Secrets Manager secret at cold start. This lets you manage environment configuration centrally in Secrets Manager without baking values into the Lambda deployment package.
 
-Set the `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` environment variable to a full reference including version stage and version ID:
+Set the `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` environment variable to a full reference including version ID:
 
 ```
-LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN=arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod/environment:AWSCURRENT:v1
+LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN=arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod/environment:v1
 ```
 
-The format is `<arn>:<version-stage>:<version-id>` (9 colon-separated segments — the ARN is 7 segments, plus version-stage and version-id). Both suffix fields must be non-empty.
+The format is `<arn>:<version-id>` (8 colon-separated segments — the ARN is 7 segments, plus the version-id). The version-id must be non-empty.
 
 The secret value must be a flat JSON object where all keys and values are strings:
 
@@ -509,8 +508,8 @@ The secret value must be a flat JSON object where all keys and values are string
 At cold start (on the first handler invocation), before `resolve_secrets_into_env()` and `django.setup()`, the handler calls `resolve_environment()` which:
 
 1. Checks for the `LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN` env var — if not set, does nothing
-2. Parses and validates the reference format (9 segments, non-empty version-stage and version-id)
-3. Fetches the secret via `secretsmanager.get_secret_value(SecretId=..., VersionStage=..., VersionId=...)`
+2. Parses and validates the reference format (8 segments, non-empty version-id)
+3. Fetches the secret via `secretsmanager.get_secret_value(SecretId=..., VersionId=...)`
 4. Validates the secret value is a flat JSON object (all values must be strings, no empty keys)
 5. Sets each key-value pair in `os.environ` — existing env vars are overridden
 6. Caches the result via a module-level sentinel — subsequent calls are free no-ops
@@ -521,7 +520,7 @@ Because environment loading runs first, the secret can provide `DJANGO_SETTINGS_
 
 The following raise `ValueError` at cold start, preventing the Lambda container from starting:
 
-- Reference format is invalid (wrong segment count, empty version-stage or version-id)
+- Reference format is invalid (wrong segment count, empty version-id)
 - Secret value is not valid JSON
 - JSON is not a flat object (contains non-string values) — error message lists the offending keys
 - JSON contains an empty string key
@@ -535,14 +534,14 @@ The Lambda handler supports loading individual secret values from AWS Secrets Ma
 Set any env var with the prefix `LAMBDA_TASKS_SECRET_` to a full Secrets Manager dynamic reference. The unprefixed name becomes the target env var:
 
 ```
-LAMBDA_TASKS_SECRET_DATABASE_URL=arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod:DATABASE_URL:AWSCURRENT:v1
+LAMBDA_TASKS_SECRET_DATABASE_URL=arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod:DATABASE_URL::v1
 ```
 
 At cold start (on the first handler invocation), after `resolve_environment()` and before `django.setup()`, the handler calls `resolve_secrets_into_env()` which:
 
 1. Scans all env vars for the `LAMBDA_TASKS_SECRET_` prefix
 2. Validates every reference — malformed references raise immediately so the container fails to start rather than misconfiguring Django silently
-3. Groups references by `(ARN, version-stage, version-id)` and makes one `GetSecretValue` call per unique combination
+3. Groups references by `(ARN, version-id)` and makes one `GetSecretValue` call per unique combination
 4. Extracts the named JSON key from the secret and writes it into `os.environ`
 5. Caches fetched secrets in-process — warm invocations pay no extra cost
 
@@ -554,18 +553,18 @@ Every value must follow the full dynamic reference syntax:
 <arn>:<json-key>:<version-stage>:<version-id>
 ```
 
-All four fields are required and must be non-empty. The secret value must be a JSON object; `json-key` names the field to extract.
+The version-stage segment must be empty. The json-key and version-id fields are required and must be non-empty. The secret value must be a JSON object; `json-key` names the field to extract.
 
 ```
-# arn (7 segments) : json-key : version-stage : version-id
-arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod:DATABASE_URL:AWSCURRENT:v1
+# arn (7 segments) : json-key : version-stage (empty) : version-id
+arn:aws:secretsmanager:eu-west-1:123456789012:secret:myapp/prod:DATABASE_URL::v1
 ```
 
-Multiple env vars can reference different keys from the same secret — only one `GetSecretValue` call is made for that `(ARN, version-stage, version-id)` combination:
+Multiple env vars can reference different keys from the same secret — only one `GetSecretValue` call is made for that `(ARN, version-id)` combination:
 
 ```
-LAMBDA_TASKS_SECRET_DATABASE_URL=arn:...:myapp/prod:DATABASE_URL:AWSCURRENT:v1
-LAMBDA_TASKS_SECRET_SECRET_KEY=arn:...:myapp/prod:SECRET_KEY:AWSCURRENT:v1
+LAMBDA_TASKS_SECRET_DATABASE_URL=arn:...:myapp/prod:DATABASE_URL::v1
+LAMBDA_TASKS_SECRET_SECRET_KEY=arn:...:myapp/prod:SECRET_KEY::v1
 ```
 
 #### Validation errors
@@ -573,7 +572,8 @@ LAMBDA_TASKS_SECRET_SECRET_KEY=arn:...:myapp/prod:SECRET_KEY:AWSCURRENT:v1
 The following all raise `ValueError` at cold start, preventing the Lambda container from starting with a misconfigured environment:
 
 - Wrong number of colon-separated segments (must be exactly 10)
-- Empty `json-key`, `version-stage`, or `version-id`
+- Empty `json-key` or `version-id`
+- Non-empty `version-stage` (version-stage is not supported)
 - Both `LAMBDA_TASKS_SECRET_FOO` and `FOO` are set — use one or the other
 - The named JSON key does not exist in the fetched secret
 - The secret value is not valid JSON

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/lambda_tasks/environment_loader.py

@@ -8,10 +8,10 @@ object (all keys and values must be strings), and sets each key-value pair in
 
 Required value format::
 
-    LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN=arn:aws:secretsmanager:eu-west-1:123:secret:my-env:AWSCURRENT:v1
+    LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN=arn:aws:secretsmanager:eu-west-1:123:secret:my-env:v1
 
-That is: ``<arn>:<version-stage>:<version-id>`` (9 colon-separated segments).
-The ARN is 7 segments, plus version-stage and version-id.
+That is: ``<arn>:<version-id>`` (8 colon-separated segments).
+The ARN is 7 segments, plus the version-id.
 
 This is called by the handler on the first invocation (cold start) — before
 ``resolve_secrets_into_env()`` and before ``django.setup()`` — so that
@@ -36,7 +36,6 @@ _loaded: bool = False
 
 class _EnvironmentSecretReference(NamedTuple):
     arn: str
-    version_stage: str
     version_id: str
 
 
@@ -76,40 +75,34 @@ def _parse_reference(*, value: str) -> _EnvironmentSecretReference:
 
     Expected format::
 
-        <arn>:<version-stage>:<version-id>
+        <arn>:<version-id>
 
-    The ARN itself is 7 colon-separated segments, plus 2 suffix segments
-    (version-stage, version-id) = 9 total.
-    Both suffix fields must be non-empty.
+    The ARN itself is 7 colon-separated segments, plus 1 suffix segment
+    (version-id) = 8 total.
+    The version-id field must be non-empty.
 
     Raises ``ValueError`` if the format is invalid.
     """
     parts = value.split(":")
 
-    if len(parts) != 9:
+    if len(parts) != 8:
         raise ValueError(
             "LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN has an invalid format. "
-            "Expected <arn>:<version-stage>:<version-id> "
-            f"(9 colon-separated segments), got {len(parts)}: {value!r}"
+            "Expected <arn>:<version-id> "
+            f"(8 colon-separated segments), got {len(parts)}: {value!r}"
         )
 
     arn = ":".join(parts[:7])
-    version_stage = parts[7]
-    version_id = parts[8]
-
-    for field, field_value in (
-        ("version-stage", version_stage),
-        ("version-id", version_id),
-    ):
-        if not field_value:
-            raise ValueError(
-                f"LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN is missing the "
-                f"{field} segment: {value!r}"
-            )
+    version_id = parts[7]
+
+    if not version_id:
+        raise ValueError(
+            f"LAMBDA_TASKS_ENVIRONMENT_SECRETS_MANAGER_ARN is missing the "
+            f"version-id segment: {value!r}"
+        )
 
     return _EnvironmentSecretReference(
         arn=arn,
-        version_stage=version_stage,
         version_id=version_id,
     )
 
@@ -119,7 +112,6 @@ def _fetch_secret(*, ref: _EnvironmentSecretReference) -> str:
     client = boto3.client("secretsmanager")
     response = client.get_secret_value(
         SecretId=ref.arn,
-        VersionStage=ref.version_stage,
         VersionId=ref.version_id,
     )
     return response["SecretString"]

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/lambda_tasks/models.py

@@ -18,7 +18,7 @@ from redis.exceptions import LockError
 
 from lambda_tasks.local_executor import submit_task
 from lambda_tasks.logging import task_logger
-from lambda_tasks.settings import LambdaTasksSettings
+from lambda_tasks.settings import MAX_DELAY, LambdaTasksSettings
 from lambda_tasks.timeouts import TimeoutContext
 
 
@@ -188,7 +188,7 @@ class SQSLambdaTaskMessage(BaseModel):
                         )
 
                         delay = min(
-                            wrapper.retry_delay + round(random.uniform(1, 5)), 900
+                            wrapper.retry_delay + round(random.uniform(1, 5)), MAX_DELAY
                         )
 
                         retry_task = SQSLambdaTask(

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/lambda_tasks/secret_loader.py

@@ -8,11 +8,12 @@ Required value format
 ---------------------
 Every reference must follow the full dynamic reference syntax::
 
-    LAMBDA_TASKS_SECRET_DJANGO_ADMIN_URL=arn:aws:secretsmanager:eu-west-1:123:secret:my-secret:DJANGO_ADMIN_URL:AWSCURRENT:v1
+    LAMBDA_TASKS_SECRET_DJANGO_ADMIN_URL=arn:aws:secretsmanager:eu-west-1:123:secret:my-secret:DJANGO_ADMIN_URL::v1
 
 That is: ``<arn>:<json-key>:<version-stage>:<version-id>``
 
-All four suffix segments must be present and non-empty.
+The version-stage segment must be empty (version-stage is not supported).
+All other suffix segments must be present and non-empty.
 A malformed reference raises ``ValueError`` immediately so the Lambda
 container fails at cold start rather than silently misconfiguring Django.
 
@@ -20,7 +21,7 @@ It is a configuration error to set both ``LAMBDA_TASKS_SECRET_FOO`` and
 ``FOO`` — use one or the other.  Having both raises ``ValueError`` at cold
 start so the misconfiguration is caught immediately.
 
-Calls are batched by unique (ARN, version-stage, version-id) combination —
+Calls are batched by unique (ARN, version-id) combination —
 one ``GetSecretValue`` call per unique combination, regardless of how many
 env vars reference it.  Results are cached in-process so repeated calls to
 ``resolve_secrets_into_env`` are free after the first.
@@ -41,15 +42,14 @@ _PREFIX = "LAMBDA_TASKS_SECRET_"
 # subsequent calls return immediately without re-scanning or re-resolving.
 _loaded: bool = False
 
-# Module-level cache: (arn, version_stage, version_id) → raw secret string.
+# Module-level cache: (arn, version_id) → raw secret string.
 # Populated on first call; reused for the lifetime of the Lambda container.
-_secret_cache: dict[tuple[str, str, str], dict[str, str]] = {}
+_secret_cache: dict[tuple[str, str], dict[str, str]] = {}
 
 
 class _SecretReference(NamedTuple):
     arn: str
     json_key: str
-    version_stage: str
     version_id: str
 
 
@@ -62,7 +62,8 @@ def _parse_reference(*, env_var: str, value: str) -> _SecretReference:
 
     The ARN itself is 7 colon-separated segments, plus 3 suffix segments
     (json-key, version-stage, version-id) = 10 total.
-    All four suffix fields must be non-empty.
+    The version-stage segment must be empty. The json-key and version-id
+    segments must be non-empty.
 
     Raises ``ValueError`` if the format is invalid — this is intentional so
     the Lambda container fails at cold start rather than starting with a
@@ -83,21 +84,28 @@ def _parse_reference(*, env_var: str, value: str) -> _SecretReference:
     arn = ":".join(parts[:7])
     json_key, version_stage, version_id = parts[7], parts[8], parts[9]
 
-    for field, field_value in (
-        ("json-key", json_key),
-        ("version-stage", version_stage),
-        ("version-id", version_id),
-    ):
-        if not field_value:
-            raise ValueError(
-                f"{env_var} is missing the {field} segment in its Secrets Manager "
-                f"reference: {value!r}"
-            )
+    if not json_key:
+        raise ValueError(
+            f"{env_var} is missing the json-key segment in its Secrets Manager "
+            f"reference: {value!r}"
+        )
+
+    if version_stage:
+        raise ValueError(
+            f"{env_var} has a non-empty version-stage segment in its Secrets Manager "
+            f"reference: {value!r}. The version-stage must be empty "
+            f"(format: <arn>:<json-key>::<version-id>)."
+        )
+
+    if not version_id:
+        raise ValueError(
+            f"{env_var} is missing the version-id segment in its Secrets Manager "
+            f"reference: {value!r}"
+        )
 
     return _SecretReference(
         arn=arn,
         json_key=json_key,
-        version_stage=version_stage,
         version_id=version_id,
     )
 
@@ -105,10 +113,10 @@ def _parse_reference(*, env_var: str, value: str) -> _SecretReference:
 def _fetch_secret(*, client: Any, ref: _SecretReference) -> dict[str, str]:
     """Fetch a secret string from Secrets Manager, using the module cache.
 
-    The cache key is ``(arn, version_stage, version_id)`` so that references
+    The cache key is ``(arn, version_id)`` so that references
     to different versions of the same secret are fetched independently.
     """
-    cache_key = (ref.arn, ref.version_stage, ref.version_id)
+    cache_key = (ref.arn, ref.version_id)
 
     if cache_key in _secret_cache:
         return _secret_cache[cache_key]
@@ -117,7 +125,6 @@ def _fetch_secret(*, client: Any, ref: _SecretReference) -> dict[str, str]:
 
     response = client.get_secret_value(
         SecretId=ref.arn,
-        VersionStage=ref.version_stage,
         VersionId=ref.version_id,
     )
 
@@ -171,10 +178,8 @@ def resolve_secrets_into_env() -> None:
             "Use one or the other, not both."
         )
 
-    # Unique (arn, version_stage, version_id) combinations to minimise API calls.
-    unique_cache_keys = {
-        (ref.arn, ref.version_stage, ref.version_id) for ref in references.values()
-    }
+    # Unique (arn, version_id) combinations to minimise API calls.
+    unique_cache_keys = {(ref.arn, ref.version_id) for ref in references.values()}
     uncached = unique_cache_keys - _secret_cache.keys()
     logger.info(
         f"Resolving {len(references)} secret reference(s) from"

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["lambda_tasks"]
 
 [project]
 name = "django-lambda-tasks"
-version = "0.4.11"
+version = "0.5.0"
 description = "Run async tasks in a lambda function"
 readme = "README.md"
 requires-python = ">=3.10"

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/tests/test_environment_loader.py

@@ -19,8 +19,8 @@ from lambda_tasks.environment_loader import (
     resolve_environment,
 )
 
-# A valid 9-segment reference used throughout tests
-_VALID_REF = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:my-env:AWSCURRENT:v1"
+# A valid 8-segment reference used throughout tests
+_VALID_REF = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:my-env:v1"
 _VALID_ARN = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:my-env"
 
 
@@ -83,36 +83,28 @@ class TestParseReference:
     """Unit tests for _parse_reference covering format validation."""
 
     def test_valid_reference_returns_named_tuple(self) -> None:
-        """A valid 9-segment reference is parsed correctly."""
+        """A valid 8-segment reference is parsed correctly."""
         ref = _parse_reference(value=_VALID_REF)
         assert ref.arn == _VALID_ARN
-        assert ref.version_stage == "AWSCURRENT"
         assert ref.version_id == "v1"
 
     def test_too_few_segments_raises_value_error(self) -> None:
-        """Fewer than 9 segments raises ValueError."""
-        with pytest.raises(ValueError, match="9 colon-separated segments"):
+        """Fewer than 8 segments raises ValueError."""
+        with pytest.raises(ValueError, match="8 colon-separated segments"):
             _parse_reference(value="arn:aws:secretsmanager:eu-west-1:123:secret:my-env")
 
     def test_too_many_segments_raises_value_error(self) -> None:
-        """More than 9 segments raises ValueError."""
-        with pytest.raises(ValueError, match="9 colon-separated segments"):
+        """More than 8 segments raises ValueError."""
+        with pytest.raises(ValueError, match="8 colon-separated segments"):
             _parse_reference(
-                value="arn:aws:secretsmanager:eu-west-1:123:secret:my-env:AWSCURRENT:v1:extra"
-            )
-
-    def test_empty_version_stage_raises_value_error(self) -> None:
-        """Empty version-stage raises ValueError."""
-        with pytest.raises(ValueError, match="version-stage"):
-            _parse_reference(
-                value="arn:aws:secretsmanager:eu-west-1:123:secret:my-env::v1"
+                value="arn:aws:secretsmanager:eu-west-1:123:secret:my-env:v1:extra"
             )
 
     def test_empty_version_id_raises_value_error(self) -> None:
         """Empty version-id raises ValueError."""
         with pytest.raises(ValueError, match="version-id"):
             _parse_reference(
-                value="arn:aws:secretsmanager:eu-west-1:123:secret:my-env:AWSCURRENT:"
+                value="arn:aws:secretsmanager:eu-west-1:123:secret:my-env:"
             )
 
 
@@ -344,7 +336,7 @@ class TestResolveHappyPath:
         mock_secretsmanager_client: MagicMock,
         monkeypatch,
     ) -> None:
-        """_fetch_secret calls get_secret_value with ARN, VersionStage, and VersionId."""
+        """_fetch_secret calls get_secret_value with ARN and VersionId only."""
         set_env_arn(value=_VALID_REF)
         mock_secretsmanager_client.get_secret_value.return_value = {
             "SecretString": json.dumps({"KEY": "value"})
@@ -354,7 +346,6 @@ class TestResolveHappyPath:
 
         mock_secretsmanager_client.get_secret_value.assert_called_once_with(
             SecretId=_VALID_ARN,
-            VersionStage="AWSCURRENT",
             VersionId="v1",
         )
 
@@ -369,7 +360,7 @@ class TestResolveHappyPath:
         """An env var with wrong segment count raises ValueError before any API call."""
         set_env_arn(value="arn:aws:secretsmanager:eu-west-1:123:secret:my-env")
 
-        with pytest.raises(ValueError, match="9 colon-separated segments"):
+        with pytest.raises(ValueError, match="8 colon-separated segments"):
             resolve_environment()
 
         mock_secretsmanager_client.get_secret_value.assert_not_called()

{django_lambda_tasks-0.4.11 → django_lambda_tasks-0.5.0}/tests/test_secret_loader.py

@@ -23,9 +23,9 @@ ARN = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:my-secret"
 ARN2 = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:other-secret"
 
 # A valid full reference: <arn>:<json-key>:<version-stage>:<version-id>
-# ARN = 7 segments, + 3 suffix = 10 total. version-id may be empty string.
-VALID_REF = f"{ARN}:MY_KEY:AWSCURRENT:AWSCURRENT"
-VALID_REF2 = f"{ARN2}:OTHER_KEY:AWSCURRENT:AWSCURRENT"
+# ARN = 7 segments, + 3 suffix = 10 total. version-stage must be empty.
+VALID_REF = f"{ARN}:MY_KEY::v1"
+VALID_REF2 = f"{ARN2}:OTHER_KEY::v1"
 
 
 @pytest.fixture(autouse=True)
@@ -48,15 +48,13 @@ class TestParseReferenceValid:
         ref = _parse_reference(env_var="LAMBDA_TASKS_SECRET_X", value=VALID_REF)
         assert ref.arn == ARN
         assert ref.json_key == "MY_KEY"
-        assert ref.version_stage == "AWSCURRENT"
-        assert ref.version_id == "AWSCURRENT"
+        assert ref.version_id == "v1"
 
     def test_version_id_populated(self):
-        value = f"{ARN}:DJANGO_ADMIN_URL:AWSCURRENT:abc123"
+        value = f"{ARN}:DJANGO_ADMIN_URL::abc123"
         ref = _parse_reference(env_var="LAMBDA_TASKS_SECRET_X", value=value)
         assert ref.arn == ARN
         assert ref.json_key == "DJANGO_ADMIN_URL"
-        assert ref.version_stage == "AWSCURRENT"
         assert ref.version_id == "abc123"
 
 
@@ -72,17 +70,17 @@ class TestParseReferenceInvalid:
 
     def test_empty_json_key_rejected(self):
         # 10 segments but key is empty
-        value = f"{ARN}::AWSCURRENT:abc123"
+        value = f"{ARN}:::abc123"
         with pytest.raises(ValueError, match="missing the json-key"):
             _parse_reference(env_var="LAMBDA_TASKS_SECRET_X", value=value)
 
-    def test_empty_version_stage_rejected(self):
-        value = f"{ARN}:MY_KEY::abc123"
-        with pytest.raises(ValueError, match="missing the version-stage"):
+    def test_non_empty_version_stage_rejected(self):
+        value = f"{ARN}:MY_KEY:AWSCURRENT:abc123"
+        with pytest.raises(ValueError, match="version-stage must be empty"):
             _parse_reference(env_var="LAMBDA_TASKS_SECRET_X", value=value)
 
     def test_empty_version_id_rejected(self):
-        value = f"{ARN}:MY_KEY:AWSCURRENT:"
+        value = f"{ARN}:MY_KEY::"
         with pytest.raises(ValueError, match="missing the version-id"):
             _parse_reference(env_var="LAMBDA_TASKS_SECRET_X", value=value)
 
@@ -140,7 +138,7 @@ class TestMalformedReference:
         mock_boto3.client.assert_not_called()
 
     def test_empty_key_raises_before_any_boto3_call(self, monkeypatch):
-        monkeypatch.setenv("LAMBDA_TASKS_SECRET_MY_VAR", f"{ARN}::AWSCURRENT:abc123")
+        monkeypatch.setenv("LAMBDA_TASKS_SECRET_MY_VAR", f"{ARN}:::abc123")
         with patch("lambda_tasks.secret_loader.boto3") as mock_boto3:
             with pytest.raises(ValueError, match="missing the json-key"):
                 resolve_secrets_into_env()
@@ -239,8 +237,8 @@ class TestResolution:
 
 class TestBatching:
     def test_single_api_call_for_same_arn(self, monkeypatch):
-        ref_a = f"{ARN}:KEY_A:AWSCURRENT:AWSCURRENT"
-        ref_b = f"{ARN}:KEY_B:AWSCURRENT:AWSCURRENT"
+        ref_a = f"{ARN}:KEY_A::v1"
+        ref_b = f"{ARN}:KEY_B::v1"
         monkeypatch.setenv("LAMBDA_TASKS_SECRET_VAR_A", ref_a)
         monkeypatch.setenv("LAMBDA_TASKS_SECRET_VAR_B", ref_b)
         monkeypatch.delenv("VAR_A", raising=False)
@@ -256,8 +254,7 @@ class TestBatching:
 
         client.get_secret_value.assert_called_once_with(
             SecretId=ARN,
-            VersionStage="AWSCURRENT",
-            VersionId="AWSCURRENT",
+            VersionId="v1",
         )
         assert os.environ["VAR_A"] == "val-a"
         assert os.environ["VAR_B"] == "val-b"
@@ -315,9 +312,7 @@ class TestCaching:
         mock_boto3.client.assert_not_called()
 
     def test_no_boto3_client_created_when_all_cached(self, monkeypatch):
-        secret_loader._secret_cache[(ARN, "AWSCURRENT", "AWSCURRENT")] = {
-            "MY_KEY": "pre-cached"
-        }
+        secret_loader._secret_cache[(ARN, "v1")] = {"MY_KEY": "pre-cached"}
         monkeypatch.setenv("LAMBDA_TASKS_SECRET_MY_VAR", VALID_REF)
         monkeypatch.delenv("MY_VAR", raising=False)