geek-cafe-saas-sdk 0.42.0__tar.gz → 0.52.0__tar.gz

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/.gitignore

@@ -144,7 +144,7 @@ cython_debug/
 # Local configuration
 .pysetup.json
 
-activate.sh
+
 .pypirc
 .prompts
 .DS_Store

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: geek_cafe_saas_sdk
-Version: 0.42.0
+Version: 0.52.0
 Summary: Base Reusable Services for SaaS
 Project-URL: Homepage, https://github.com/geek-cafe-saas-sdk
 Project-URL: Documentation, https://github.com/geek-cafe-saas-sdk/blob/main/README.md

geek_cafe_saas_sdk-0.52.0/activate.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Auto-generated by pysetup.py
+# Activates the Python virtual environment
+
+source .venv/bin/activate
+
+# Display Python version and environment info
+echo "
+🐍 Python \$(python --version | cut -d' ' -f2) activated in \$(basename \$VIRTUAL_ENV) environment"
+echo "
+👉 Run 'deactivate' to exit the virtual environment"

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "geek_cafe_saas_sdk"
-version = "0.42.0"
+version = "0.52.0"
 description = "Base Reusable Services for SaaS"
 authors = [{ name = "Eric Wilson", email = "eric.wilson@geekcafe.com" }]
 requires-python = ">=3.8"

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/pysetup.py

@@ -1797,7 +1797,19 @@ Add your license here.
         
         # Create or update the activation script
         with open(activate_script, "w") as f:
-            f.write(f"#!/bin/bash\n\n# Auto-generated by pysetup.py\n# Activates the Python virtual environment\n\nsource {VENV}/bin/activate\n\n# Display Python version and environment info\necho \"\n🐍 Python \$(python --version | cut -d' ' -f2) activated in \$(basename \$VIRTUAL_ENV) environment\"\necho \"\n👉 Run 'deactivate' to exit the virtual environment\"\n")
+            f.write(f"""#!/bin/bash
+
+# Auto-generated by pysetup.py
+# Activates the Python virtual environment
+
+source {VENV}/bin/activate
+
+# Display Python version and environment info
+echo ""
+echo "🐍 Python $(python --version | cut -d' ' -f2) activated in $(basename $VIRTUAL_ENV) environment"
+echo ""
+echo "👉 Run 'deactivate' to exit the virtual environment"
+""")
         
         # Make it executable
         os.chmod(activate_script, 0o755)

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/src/geek_cafe_saas_sdk/__init__.py

@@ -3,7 +3,7 @@ Geek Cafe Services - Base Reusable Services for SaaS
 
 Version 0.6.0 adds File System Service
 """
-__version__ = "0.42.0"
+__version__ = "0.52.0"
 
 # Import main namespaces for easier access
 from . import core

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/src/geek_cafe_saas_sdk/core/audit/audit_log_model.py

@@ -161,7 +161,7 @@ class AuditLog(BaseModel):
         primary.partition_key.attribute_name = "pk"
         primary.partition_key.value = lambda: DynamoDBKey.build_key(("audit", self.id))
         primary.sort_key.attribute_name = "sk"
-        primary.sort_key.value = lambda: "metadata"
+        primary.sort_key.value = lambda: DynamoDBKey.build_key(("audit", ""))
         self.indexes.add_primary(primary)
         
         # GSI1: Query by resource (resource_type#resource_id / timestamp)

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/src/geek_cafe_saas_sdk/core/services/database_service.py

@@ -246,69 +246,6 @@ class DatabaseService(ABC, Generic[T]):
         # Field not provided = default to authenticated user (self-service)
         return authenticated_user_id
 
-    # REMOVED: _validate_tenant_access - too strict, doesn't support shares/admins
-    # Use _get_by_id() which has proper security checks built-in
-
-    def _check_resource_access(
-        self,
-        resource_id: str,
-        resource_owner_id: Optional[str],
-        resource_tenant_id: Optional[str],
-        required_permission: AccessLevel = AccessLevel.VIEW,
-        allow_tenant_access: bool = False
-    ) -> AccessResult:
-        """
-        Manually check access (for edge cases only - CRUD methods check automatically).
-        
-        NOTE: You typically don't need to call this. All CRUD operations
-        (_get_model_by_id_with_access_check, _save_model, _delete_model)
-        automatically check access. Use this only for:
-        - Pre-flight checks before expensive operations
-        - Custom access logic not covered by standard CRUD
-        
-        Args:
-            resource_id: The resource ID
-            resource_owner_id: The owner's user ID
-            resource_tenant_id: The resource's tenant ID
-            required_permission: Required permission level (VIEW, EDIT, etc.)
-            allow_tenant_access: If True, any user in same tenant can access
-            
-        Returns:
-            AccessResult with granted status and reason
-        """
-        return self._access_checker.check_access(
-            resource_id=resource_id,
-            resource_owner_id=resource_owner_id,
-            resource_tenant_id=resource_tenant_id,
-            required_permission=required_permission,
-            allow_tenant_access=allow_tenant_access
-        )
-    
-    def _require_resource_access(
-        self,
-        resource_id: str,
-        resource_owner_id: Optional[str],
-        resource_tenant_id: Optional[str],
-        required_permission: AccessLevel = AccessLevel.VIEW,
-        allow_tenant_access: bool = False
-    ) -> AccessResult:
-        """
-        Manually require access (for edge cases only - CRUD methods check automatically).
-        
-        NOTE: You typically don't need to call this. All CRUD operations
-        automatically check access. Use this only for edge cases.
-        
-        Raises:
-            AccessDeniedError: If access is denied
-        """
-        return self._access_checker.require_access(
-            resource_id=resource_id,
-            resource_owner_id=resource_owner_id,
-            resource_tenant_id=resource_tenant_id,
-            required_permission=required_permission,
-            allow_tenant_access=allow_tenant_access
-        )
-
     def _save_model(
         self,
         model: T,
@@ -363,7 +300,7 @@ class DatabaseService(ABC, Generic[T]):
             
             if not old_model:
                 try:
-                    old_model = self._get_model_by_id(model.id, model.__class__)
+                    old_model = self._fetch_model_raw(model.id, model.__class__)
                 except Exception as e:
                     logger.error(f"Failed to get old model: {e}")
                     pass
@@ -372,7 +309,7 @@ class DatabaseService(ABC, Generic[T]):
             # 
             # For proper UPDATE behavior (access check + audit logging with change tracking),
             # services SHOULD pass old_model when updating existing records:
-            #   old_model = self._get_model_by_id(id, ModelClass)
+            #   old_model = self._fetch_model_raw(id, ModelClass)
             #   # ... modify model ...
             #   return self._save_model(model, old_model=old_model)
             #
@@ -462,11 +399,6 @@ class DatabaseService(ABC, Generic[T]):
         except Exception:
             return None
 
-    # Backward compatibility alias - will be removed in future version
-    def _get_model_by_id(self, resource_id: str, model_class) -> Optional[T]:
-        """DEPRECATED: Use _get_by_id() with skip_security_check=True instead."""
-        return self._fetch_model_raw(resource_id, model_class)
-
     def _get_by_id(
         self,
         resource_id: str,
@@ -547,39 +479,9 @@ class DatabaseService(ABC, Generic[T]):
                 "action": "ACCESS_DENIED_MASKED_AS_NOT_FOUND"
             }
         )
-        return None
 
-    # ========================================
-    # DEPRECATED METHODS - Use _get_by_id() instead
-    # These are kept for backward compatibility only
-    # ========================================
-
-    def _get_model_by_id_with_access_check(
-        self,
-        resource_id: str,
-        model_class,
-        required_permission: AccessLevel = AccessLevel.VIEW,
-        include_deleted: bool = False,
-        allow_tenant_access: bool = False
-    ) -> Optional[T]:
-        """DEPRECATED: Use _get_by_id() instead. Will be removed in future version."""
-        return self._get_by_id(
-            resource_id,
-            model_class,
-            required_permission=required_permission,
-            include_deleted=include_deleted
-        )
-
-    def _get_model_by_id_with_tenant_check(
-        self, resource_id: str, model_class, tenant_id: Optional[str] = None, include_deleted: bool = True
-    ) -> Optional[T]:
-        """DEPRECATED: Use _get_by_id() instead. Will be removed in future version."""
-        logger.warning("DEPRECATED: Use _get_by_id() instead. Will be removed in future version.")
-        return self._get_by_id(
-            resource_id,
-            model_class,
-            include_deleted=include_deleted
-        )
+        # Raise access denied error
+        raise AccessDeniedError("Access denied for resource " + resource_id)
 
     def _delete_model(self, model: T, *, skip_access_check: bool = False) -> ServiceResult[bool]:
         """Delete model from database with **AUTOMATIC** access validation and audit logging.
@@ -659,24 +561,46 @@ class DatabaseService(ABC, Generic[T]):
         expression_attribute_names: Optional[dict] = None,
         start_key: Optional[dict] = None,
         limit: Optional[int] = None,
+        skip_security_check: bool = False,
+        required_permission: AccessLevel = AccessLevel.VIEW,
+        query_condition: str="begins_with"
     ) -> ServiceResult[List[T]]:
         """
-        Generic query method for GSI queries with automatic model mapping.
+        Generic query method for GSI queries with **AUTOMATIC** security filtering.
+
+        Security:
+            - Requires authentication (unless skip_security_check=True)
+            - Filters results to only include items the user has access to
+            - Silently removes inaccessible items (prevents enumeration attacks)
+            - Logs audit events for access denial attempts
 
         Args:
             model: The pre-configured model instance to use for the query
             index_name: The name of the GSI index to query
+            ascending: Sort order (default: descending)
+            strongly_consistent: Use strongly consistent reads
+            projection_expression: DynamoDB projection expression
+            expression_attribute_names: Expression attribute names
+            start_key: Pagination start key
+            limit: Maximum number of items to return
+            skip_security_check: If True, skip access filtering (use with caution)
+            required_permission: Required permission level for access check
 
         Returns:
-            ServiceResult containing a list of mapped model instances.
+            ServiceResult containing a list of accessible model instances.
             Pagination info is included in error_details as 'last_evaluated_key' if more results exist.
         """
         try:
+            # Require authentication unless skipping security
+            if not skip_security_check:
+                self.request_context.require_authentication()
+            
             # Get the key for the specified index from the provided model
-            key = model.get_key(index_name).key()
+            if index_name == "primary":
+                key = model.get_key("primary").key(query_key=True, condition=query_condition)
+            else:
+                key = model.get_key(index_name).key(condition=query_condition)
 
-            # key.to_string()
-            # extract_key_values(key_expression) is coming soon from boto3_assist
             if self.LOG_DYNAMO_DB_QUERY:
                 if hasattr(DynamoDBIndex, 'extract_key_values'):
                     values = DynamoDBIndex.extract_key_values(key)
@@ -693,7 +617,6 @@ class DatabaseService(ABC, Generic[T]):
                         logger.info(f"Querying index {index_name} with key {value}")
                     except Exception as e:
                         logger.error(f"Failed to extract key values: {e}")
-                
 
             # Execute the query
             response = self.dynamodb.query(
@@ -713,10 +636,48 @@ class DatabaseService(ABC, Generic[T]):
 
             # Map each item to a model instance
             model_class = type(model)
-            items = [model_class().map(item) for item in data]
+            all_items = [model_class().map(item) for item in data]
+
+            # SECURITY FILTERING: Filter items by access
+            if skip_security_check:
+                accessible_items = all_items
+            else:
+                accessible_items = []
+                denied_count = 0
+                
+                for item in all_items:
+                    access_result = self._access_checker.check_model_access(
+                        model=item,
+                        required_permission=required_permission
+                    )
+                    
+                    if access_result.granted:
+                        accessible_items.append(item)
+                    else:
+                        denied_count += 1
+                        # Log access denial for audit (silent filtering)
+                        logger.debug(
+                            f"List query filtered item due to access denial",
+                            extra={
+                                "resource_id": getattr(item, 'id', 'unknown'),
+                                "resource_type": type(item).__name__,
+                                "user_id": self._request_context.authenticated_user_id,
+                                "denial_reason": access_result.reason,
+                                "action": "LIST_ITEM_FILTERED"
+                            }
+                        )
+                
+                # Log audit event if any items were filtered
+                if denied_count > 0:
+                    self._log_list_access_denial(
+                        index_name=index_name,
+                        total_found=len(all_items),
+                        denied_count=denied_count,
+                        model_class=model_class
+                    )
 
             # Include pagination info if present
-            result = ServiceResult.success_result(items)
+            result = ServiceResult.success_result(accessible_items)
             if "LastEvaluatedKey" in response:
                 result.error_details = {"last_evaluated_key": response["LastEvaluatedKey"]}
 
@@ -728,6 +689,52 @@ class DatabaseService(ABC, Generic[T]):
                 error_code=ErrorCode.DATABASE_QUERY_FAILED,
                 context=f"Failed to query index {index_name} on table {self.table_name}",
             )
+    
+    def _log_list_access_denial(
+        self,
+        index_name: str,
+        total_found: int,
+        denied_count: int,
+        model_class: type
+    ) -> None:
+        """
+        Log an audit event when list query results are filtered due to access denial.
+        
+        This helps detect potential unauthorized access attempts or misconfigured permissions.
+        """
+        try:
+            if not self._audit_logger or not self._audit_logger.is_enabled:
+                return
+            
+            event = AuditEvent()
+            
+            # Actor
+            event.actor_tenant_id = self._request_context.authenticated_tenant_id
+            event.actor_user_id = self._request_context.authenticated_user_id
+            event.actor_email = getattr(self._request_context, 'authenticated_email', '') or ''
+            
+            # Resource owner - same as actor for list queries
+            event.tenant_id = self._request_context.authenticated_tenant_id
+            event.user_id = self._request_context.authenticated_user_id
+            
+            # What
+            event.action = "LIST_ACCESS_FILTERED"
+            event.resource_type = model_class.__name__
+            event.resource_id = f"query:{index_name}"
+            event.service_name = self.__class__.__name__
+            event.source_table_name = self.table_name
+            event.success = True  # The query succeeded, items were just filtered
+            event.new_values = {
+                "index_name": index_name,
+                "total_found": total_found,
+                "denied_count": denied_count,
+                "accessible_count": total_found - denied_count
+            }
+            
+            self._audit_logger.log(event)
+            
+        except Exception as e:
+            logger.warning(f"Failed to log list access denial audit event: {e}")
 
     def _delete_by_composite_key(
         self,

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/src/geek_cafe_saas_sdk/lambda_handlers/_base/base_handler.py

@@ -16,7 +16,11 @@ from geek_cafe_saas_sdk.utilities.response import (
     error_response,
     service_result_to_response,
 )
-from geek_cafe_saas_sdk.utilities.case_conversion import CaseFormat, CaseConverter
+from geek_cafe_saas_sdk.utilities.case_conversion import (
+    CaseFormat,
+    CaseConverter,
+    detect_payload_case_format,
+)
 from geek_cafe_saas_sdk.utilities.lambda_event_utility import LambdaEventUtility
 from geek_cafe_saas_sdk.utilities.logging_utility import LoggingUtility
 from geek_cafe_saas_sdk.utilities.environment_variables import EnvironmentVariables
@@ -242,6 +246,79 @@ class BaseLambdaHandler:
             # Default to camelCase for backwards compatibility
             return CaseFormat.CAMEL
 
+    def _get_request_case_format(
+        self, event: Dict[str, Any], body: Optional[Dict[str, Any]] = None
+    ) -> CaseFormat:
+        """
+        Determine the case format of the incoming request payload.
+        
+        Uses a hybrid approach (Option C):
+        1. Check for explicit client declaration via query param or header
+        2. Fall back to auto-detection from payload keys
+        3. Default to camelCase (most common for JS clients)
+        
+        Args:
+            event: Lambda event
+            body: Parsed request body (optional, for auto-detection)
+            
+        Returns:
+            CaseFormat of the incoming request
+            
+        Supported parameters:
+            - Query: ?requestCase=camelCase or ?request_case=snake_case
+            - Header: X-Request-Case: camelCase
+            
+        Examples:
+            # Explicit declaration
+            POST /api/users?requestCase=snake_case
+            {"user_name": "John", "created_at": "2024-01-01"}
+            
+            # Auto-detected as camelCase
+            POST /api/users
+            {"userName": "John", "createdAt": "2024-01-01"}
+        """
+        # 1. Check query string parameters (explicit declaration)
+        query_params = event.get('queryStringParameters') or {}
+        request_case = (
+            query_params.get('requestCase') or 
+            query_params.get('request_case') or 
+            query_params.get('request-case')
+        )
+        
+        if request_case:
+            try:
+                case_format = CaseFormat.from_string(request_case)
+                logger.debug(f"Client declared {case_format.value} request via query param")
+                return case_format
+            except ValueError:
+                logger.warning(f"Unknown request case format: {request_case}, using auto-detection")
+        
+        # 2. Check headers (explicit declaration)
+        headers = event.get('headers') or {}
+        # Headers can be case-insensitive, check common variations
+        request_case = (
+            headers.get('X-Request-Case') or
+            headers.get('x-request-case') or
+            headers.get('X-REQUEST-CASE')
+        )
+        
+        if request_case:
+            try:
+                case_format = CaseFormat.from_string(request_case)
+                logger.debug(f"Client declared {case_format.value} request via header")
+                return case_format
+            except ValueError:
+                logger.warning(f"Unknown request case format in header: {request_case}, using auto-detection")
+        
+        # 3. Auto-detect from payload if provided
+        if body and isinstance(body, dict):
+            detected = detect_payload_case_format(body)
+            logger.debug(f"Auto-detected request case format: {detected.value}")
+            return detected
+        
+        # 4. Default to camelCase (most common for JS clients)
+        return CaseFormat.CAMEL
+
     def _get_preserve_fields(self, event: Dict[str, Any]) -> Optional[Set[str]]:
         """
         Get fields to preserve from case conversion from client request.

{geek_cafe_saas_sdk-0.42.0 → geek_cafe_saas_sdk-0.52.0}/src/geek_cafe_saas_sdk/lambda_handlers/_base/decorators.py

@@ -32,7 +32,7 @@ def service_method(operation_name: Optional[str] = None):
         >>> @service_method("get_by_id")
         >>> def get_by_id(self, *, resource_id: str):
         >>>     # Just business logic - no try/except needed
-        >>>     file = self._get_model_by_id(resource_id)
+        >>>     file = self._get_by_id(resource_id)
         >>>     if not file:
         >>>         raise NotFoundError(f"File not found: {resource_id}")
         >>>     return ServiceResult.success_result(file)