fufu-cloud-cli 0.5.0__py3-none-any.whl

fufu_cloud_cli/control.py

@@ -0,0 +1,185 @@
+"""IAM and data commands with native AWS JSON field names."""
+import base64
+import json
+import os
+import re
+from pathlib import Path
+from .api_backend import ApiClient, segment
+from .errors import FufuError, require
+
+AWS_OPERATIONS = {
+ 'iam': {
+  'CreateRole': 'RoleName AssumeRolePolicyDocument', 'GetRole': 'RoleName', 'ListRoles': '', 'DeleteRole': 'RoleName',
+  'PutRolePolicy': 'RoleName PolicyName PolicyDocument', 'GetRolePolicy': 'RoleName PolicyName', 'DeleteRolePolicy': 'RoleName PolicyName',
+  'ListRolePolicies': 'RoleName', 'SimulatePrincipalPolicy': 'PolicySourceArn ActionNames ResourceArns',
+ },
+ 'dynamodb': {
+  'CreateTable': 'TableName AttributeDefinitions KeySchema BillingMode ProvisionedThroughput GlobalSecondaryIndexes LocalSecondaryIndexes StreamSpecification',
+  'DescribeTable': 'TableName', 'DeleteTable': 'TableName', 'ListTables': 'Limit ExclusiveStartTableName',
+  'PutItem': 'TableName Item ConditionExpression ExpressionAttributeNames ExpressionAttributeValues ReturnValues',
+  'GetItem': 'TableName Key ConsistentRead ProjectionExpression ExpressionAttributeNames',
+  'DeleteItem': 'TableName Key ConditionExpression ExpressionAttributeNames ExpressionAttributeValues ReturnValues',
+  'UpdateItem': 'TableName Key UpdateExpression ConditionExpression ExpressionAttributeNames ExpressionAttributeValues ReturnValues',
+  'Query': 'TableName IndexName KeyConditionExpression FilterExpression ExpressionAttributeNames ExpressionAttributeValues Limit ExclusiveStartKey ScanIndexForward ConsistentRead Select ProjectionExpression',
+  'Scan': 'TableName IndexName FilterExpression ExpressionAttributeNames ExpressionAttributeValues Limit ExclusiveStartKey ConsistentRead Select ProjectionExpression',
+  'BatchGetItem': 'RequestItems', 'BatchWriteItem': 'RequestItems',
+ },
+ 's3api': {
+  'CreateBucket': 'Bucket CreateBucketConfiguration', 'DeleteBucket': 'Bucket', 'ListBuckets': '', 'HeadBucket': 'Bucket',
+  'ListObjectsV2': 'Bucket Prefix MaxKeys ContinuationToken Delimiter StartAfter', 'PutObject': 'Bucket Key Body ContentType Metadata',
+  'GetObject': 'Bucket Key ChecksumMode', 'HeadObject': 'Bucket Key ChecksumMode', 'DeleteObject': 'Bucket Key',
+ },
+ 'sqs': {
+  'CreateQueue': 'QueueName Attributes', 'GetQueueUrl': 'QueueName', 'ListQueues': 'QueueNamePrefix MaxResults NextToken', 'DeleteQueue': 'QueueUrl',
+  'GetQueueAttributes': 'QueueUrl AttributeNames', 'SetQueueAttributes': 'QueueUrl Attributes',
+  'SendMessage': 'QueueUrl MessageBody DelaySeconds MessageAttributes', 'ReceiveMessage': 'QueueUrl MaxNumberOfMessages VisibilityTimeout WaitTimeSeconds MessageAttributeNames AttributeNames',
+  'DeleteMessage': 'QueueUrl ReceiptHandle', 'ChangeMessageVisibility': 'QueueUrl ReceiptHandle VisibilityTimeout',
+ },
+ 'ssm': { 'PutParameter': 'Name Value Type Overwrite Description', 'GetParameter': 'Name WithDecryption', 'GetParameters': 'Names WithDecryption', 'DeleteParameter': 'Name' },
+}
+JSON_FIELDS = set('AssumeRolePolicyDocument PolicyDocument AttributeDefinitions KeySchema ProvisionedThroughput GlobalSecondaryIndexes LocalSecondaryIndexes StreamSpecification Item Key ExpressionAttributeNames ExpressionAttributeValues ExclusiveStartKey RequestItems CreateBucketConfiguration Metadata Attributes MessageAttributes'.split())
+LIST_FIELDS = set('ActionNames ResourceArns Names AttributeNames MessageAttributeNames'.split())
+BOOL_FIELDS = set('ConsistentRead ScanIndexForward WithDecryption Overwrite Enabled'.split())
+INT_FIELDS = set('Limit MaxKeys MaxResults MaxNumberOfMessages VisibilityTimeout WaitTimeSeconds DelaySeconds BatchSize'.split())
+
+
+def dashed(value):
+    return re.sub(r'(?<!^)(?=[A-Z])', '-', value).lower().replace('v-2', 'v2')
+
+
+def read_json(value):
+    if value.startswith('file://'):
+        p = Path(value[7:]); require(p.is_file() and p.stat().st_size <= 1024**2, 'INVALID_INPUT', 'JSON 檔案上限為 1 MiB。')
+        value = p.read_text()
+    return json.loads(value)
+
+
+def command(argv, Parser):
+    p = Parser(prog='aws-fufu', description='FUFU IAM 與資料服務子集；原生欄位、預設拒絕與 explicit Deny。')
+    services = p.add_subparsers(dest='service', required=True)
+    for service, ops in AWS_OPERATIONS.items():
+        sub = services.add_parser(service).add_subparsers(dest='operation', required=True)
+        for op, spec in ops.items():
+            q = sub.add_parser(dashed(op)); q.set_defaults(native_operation=op)
+            q.add_argument('--cli-input-json')
+            for key in spec.split():
+                opt = '--' + dashed(key)
+                if key in BOOL_FIELDS:
+                    group = q.add_mutually_exclusive_group()
+                    group.add_argument(opt, dest=key, action='store_true', default=None)
+                    group.add_argument('--no-' + dashed(key), dest=key, action='store_false')
+                else:
+                    q.add_argument(opt, dest=key, nargs='+' if key in LIST_FIELDS or key in {'AttributeDefinitions', 'KeySchema'} else None,
+                                   type=int if key in INT_FIELDS else str)
+            if op == 'CreateTable': q.add_argument('--partition-key')
+            if op == 'GetObject': q.add_argument('outfile')
+            if op == 'PutParameter': q.add_argument('--value-env')
+    a = p.parse_args(argv)
+    params = read_json(a.cli_input_json) if a.cli_input_json else {}
+    require(isinstance(params, dict), 'INVALID_INPUT', '原生 CLI JSON 必須是物件。')
+    for key in AWS_OPERATIONS[a.service][a.native_operation].split():
+        value = getattr(a, key)
+        if value is None: continue
+        require(key not in params, 'INVALID_INPUT', '同一欄位不能同時由 JSON 與旗標指定。')
+        if key in {'AttributeDefinitions', 'KeySchema'}:
+            value = read_json(value[0]) if len(value) == 1 and (value[0].startswith(('[', 'file://'))) else [dict(item.split('=', 1) for item in v.split(',')) for v in value]
+        elif key in JSON_FIELDS and (key != 'Key' or a.service == 'dynamodb'): value = read_json(value)
+        if key == 'Body':
+            file = Path(value.removeprefix('fileb://').removeprefix('file://'))
+            require(file.is_file() and file.stat().st_size <= 6 * 1024**2, 'INVALID_INPUT', 'Object 檔案上限為 6 MiB。')
+            value = {'__fufu_bytes': base64.b64encode(file.read_bytes()).decode()}
+        params[key] = value
+    if getattr(a, 'partition_key', None):
+        require(not {'AttributeDefinitions', 'KeySchema'} & params.keys(), 'INVALID_INPUT', 'partition-key 與原生 key schema 不能混用。')
+        params.update(AttributeDefinitions=[{'AttributeName': a.partition_key, 'AttributeType': 'S'}], KeySchema=[{'AttributeName': a.partition_key, 'KeyType': 'HASH'}])
+    if a.native_operation == 'CreateTable' and not {'AttributeDefinitions', 'KeySchema'} & params.keys():
+        params.update(AttributeDefinitions=[{'AttributeName': 'id', 'AttributeType': 'S'}], KeySchema=[{'AttributeName': 'id', 'KeyType': 'HASH'}])
+    if a.native_operation == 'PutParameter':
+        if a.value_env:
+            require('Value' not in params, 'INVALID_INPUT', 'value 與 value-env 不能混用。')
+            require(a.value_env in os.environ, 'MISSING_ENV', '必要的受控環境變數尚未注入。')
+            params['Value'] = os.environ[a.value_env]
+        params.setdefault('Overwrite', False)
+        params.setdefault('Type', 'String')
+    if a.service == 'sqs' and 'QueueUrl' in params:
+        require(isinstance(params['QueueUrl'], str) and re.fullmatch(r'fufu://sqs/[A-Za-z0-9_-]{1,80}', params['QueueUrl']), 'INVALID_RESOURCE', 'QueueUrl 必須是 FUFU 租戶資源識別。')
+    with ApiClient('aws', read_only=bool(re.match(r'^(Get|List|Describe|Query|Scan|BatchGet|Simulate|Head)', a.native_operation))) as api:
+        result = api.request('POST', '/control/native', {'service': 's3' if a.service == 's3api' else a.service, 'operation': a.native_operation, 'params': params})
+    if a.native_operation == 'ReceiveMessage': result.setdefault('Messages', [])
+    if a.native_operation == 'ListQueues': result.setdefault('QueueUrls', [])
+    if a.native_operation == 'GetObject':
+        from .cloud_data import download_bytes
+        saved = download_bytes(a.outfile, result.pop('Body')['__fufu_bytes'])
+        return {**result, **saved}
+    return result
+
+
+def gcp_command(argv, Parser):
+    p = Parser(prog='gcloud-fufu', description='GCP service account 與 project IAM binding 的實際授權子集。')
+    roots = p.add_subparsers(dest='service', required=True)
+    sub = roots.add_parser('iam').add_subparsers(dest='group', required=True).add_parser('service-accounts').add_subparsers(dest='action', required=True)
+    sub.add_parser('list')
+    c = sub.add_parser('create'); c.add_argument('name'); c.add_argument('--display-name')
+    sub.add_parser('delete').add_argument('email')
+    sub = roots.add_parser('projects').add_subparsers(dest='action', required=True)
+    for act in ['get-iam-policy', 'add-iam-policy-binding', 'remove-iam-policy-binding']:
+        q = sub.add_parser(act); q.add_argument('project')
+        if act != 'get-iam-policy': q.add_argument('--member', required=True); q.add_argument('--role', required=True)
+    a = p.parse_args(argv)
+    op = {'get-iam-policy': 'list', 'add-iam-policy-binding': 'add-binding', 'remove-iam-policy-binding': 'remove-binding'}.get(a.action, a.action)
+    params = {k: getattr(a, k) for k in ['name', 'email', 'project', 'member', 'role'] if hasattr(a, k)}
+    if getattr(a, 'display_name', None): params['displayName'] = a.display_name
+    with ApiClient('gcp') as api: return api.request('POST', '/control/iam', {'operation': op, 'params': params})
+
+
+def gateway_command(argv, Parser):
+    p = Parser(prog='aws-fufu apigatewayv2', description='Lambda proxy payload 1.0；租戶登入 claims 明示為 mock。')
+    s = p.add_subparsers(dest='action', required=True)
+    for act in ['import-api', 'reimport-api']:
+        q = s.add_parser(act); q.add_argument('--body', required=True)
+        if act == 'reimport-api': q.add_argument('--api-id', required=True)
+    s.add_parser('get-apis')
+    s.add_parser('delete-api').add_argument('--api-id', required=True)
+    a = p.parse_args(argv)
+    with ApiClient('aws') as api:
+        if a.action == 'get-apis': return api.request('GET', '/control/apis')
+        if a.action == 'delete-api': return api.request('DELETE', '/control/apis/' + segment(a.api_id))
+        body = {'document': read_json(a.body)}
+        if a.action == 'reimport-api': body['id'] = a.api_id
+        return api.request('POST', '/control/apis', body)
+
+
+def mapping_command(argv, Parser):
+    p = Parser(prog='aws-fufu lambda', description='SQS mapping；使用 fufu events drain 執行有限批次。')
+    s = p.add_subparsers(dest='action', required=True)
+    q = s.add_parser('create-event-source-mapping'); q.add_argument('--function-name', required=True); q.add_argument('--event-source-arn', required=True); q.add_argument('--batch-size', type=int, default=1)
+    s.add_parser('list-event-source-mappings')
+    s.add_parser('delete-event-source-mapping').add_argument('--uuid', required=True)
+    a = p.parse_args(argv)
+    with ApiClient('aws') as api:
+        if a.action == 'list-event-source-mappings': return api.request('GET', '/control/mappings')
+        if a.action == 'delete-event-source-mapping': return api.request('DELETE', '/control/mappings/' + segment(a.uuid))
+        return api.request('POST', '/control/mappings', {'FunctionName': a.function_name, 'EventSourceArn': a.event_source_arn, 'BatchSize': a.batch_size})
+
+
+def fufu_control(argv, Parser):
+    p = Parser(prog='fufu', description='FUFU 明示簡化控制與 mock 目錄。')
+    s = p.add_subparsers(dest='group', required=True)
+    q = s.add_parser('gateway').add_subparsers(dest='action', required=True).add_parser('invoke')
+    q.add_argument('--api-id', required=True); q.add_argument('--path', required=True); q.add_argument('--method', default='POST'); q.add_argument('--body', default='{}')
+    q = s.add_parser('events').add_subparsers(dest='action', required=True).add_parser('drain'); q.add_argument('--uuid', required=True)
+    sub = s.add_parser('mock').add_subparsers(dest='action', required=True)
+    for act in ['create', 'list', 'delete']:
+        q = sub.add_parser(act); q.add_argument('--provider', required=True, choices=['aws', 'gcp', 'azure'])
+        if act != 'list': q.add_argument('--service', required=True); q.add_argument('--name', required=True)
+        if act == 'create': q.add_argument('--acknowledge-mock', action='store_true', required=True)
+    a = p.parse_args(argv)
+    with ApiClient(getattr(a, 'provider', 'aws')) as api:
+        if a.group == 'gateway':
+            result = api.request('POST', '/control/apis/' + segment(a.api_id) + '/invoke', {'method': a.method, 'path': a.path, 'body': json.dumps(read_json(a.body))})
+            require(result['status'] < 400, 'GATEWAY_HANDLER_FAILED', 'API handler 回傳錯誤；請核對測試資料與授權。')
+            return result
+        if a.group == 'events': return api.request('POST', '/control/mappings/' + segment(a.uuid) + '/drain', {})
+        if a.action == 'list': return {'resources': api.request('GET', '/control/status')['mocks'], 'mode': 'mock-only', 'executable': False}
+        if a.action == 'delete': return api.request('DELETE', '/control/mocks/' + segment(a.service) + '/' + segment(a.name))
+        return api.request('POST', '/control/mocks', {'name': a.name, 'service': a.service, 'acknowledgeMock': True})