lambda-api-decorators-cdk 0.4.1__tar.gz → 0.4.4__tar.gz

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Install test and build dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install build pytest setuptools-scm
+          python -m pip install build pytest setuptools-scm lambda-api-decorators
           python -m pip install .
 
       - name: Run tests

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/.github/workflows/tests.yml

@@ -2,7 +2,9 @@ name: Tests
 
 on:
   push:
+    branches: [main]
   pull_request:
+    branches: [main]
 
 permissions:
   contents: read
@@ -27,7 +29,7 @@ jobs:
       - name: Install package and test dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install --editable . pytest tomli
+          python -m pip install --editable . lambda-api-decorators pytest tomli
 
       - name: Verify package import
         run: python -c "import lambda_api_decorators_cdk"

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/AGENTS.md

@@ -10,7 +10,7 @@ The project goal is:
 
 GitHub organization:
 
-`lambda-api-decorators`
+`infrastructure-as-decorator`
 
 Package:
 
@@ -22,7 +22,7 @@ Python module:
 
 Project documentation:
 
-`https://lambda-api-decorators.github.io/`
+`https://infrastructure-as-decorator.github.io/`
 
 ## Design principles
 

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lambda-api-decorators-cdk
-Version: 0.4.1
+Version: 0.4.4
 Summary: AWS CDK integration for Lambda API Decorators. Generate AWS Lambda and API Gateway infrastructure from decorated Python handlers.
 Author: Mateo Marcos, Emanuel Arguinarena, Lucas Picchi
 License: MIT License
@@ -24,9 +24,10 @@ License: MIT License
         LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
         SOFTWARE.
-Project-URL: Homepage, https://github.com/lambda-api-decorators/lambda-api-decorators-cdk
-Project-URL: Repository, https://github.com/lambda-api-decorators/lambda-api-decorators-cdk
-Project-URL: Bug Reports, https://github.com/lambda-api-decorators/lambda-api-decorators-cdk
+Project-URL: Homepage, https://infrastructure-as-decorator.github.io/
+Project-URL: Documentation, https://infrastructure-as-decorator.github.io/docs/api-reference/index
+Project-URL: Repository, https://github.com/infrastructure-as-decorator/lambda-api-decorators-cdk
+Project-URL: Bug Reports, https://github.com/infrastructure-as-decorator/lambda-api-decorators-cdk/issues
 Keywords: cdk,lambda,aws,api gateway,ast
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Intended Audience :: Developers
@@ -49,7 +50,7 @@ Dynamic: license-file
 
 AWS CDK integration for [Lambda API Decorators](https://github.com/infrastructure-as-decorator/lambda-api-decorators). Define API routes with Python decorators and let CDK create the Lambda functions, integrations, routes, and related configuration.
 
-The complete cross-package guides and architecture documentation are available at [lambda-api-decorators.github.io](https://infrastructure-as-decorator.github.io/).
+The complete cross-package guides and architecture documentation are available at [infrastructure-as-decorator.github.io](https://infrastructure-as-decorator.github.io/).
 
 ## Installation
 
@@ -161,7 +162,7 @@ authorizer = apigateway.TokenAuthorizer(self, "UsersAuthorizer", handler=authori
 config = LambdaApiConfig(authorizers={"users": authorizer}, default_authorizer="users")
 ```
 
-The resource registries also allow decorated handlers to request least-privilege grants for registered DynamoDB tables and S3 buckets. See the [complete documentation](https://lambda-api-decorators.github.io/) for decorator syntax and supported access levels.
+The resource registries also allow decorated handlers to request least-privilege grants for registered DynamoDB tables and S3 buckets. See the [complete documentation](https://infrastructure-as-decorator.github.io/docs/api-reference/index) for decorator syntax and supported access levels.
 
 ## Low-level builder
 

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/README.md

@@ -2,7 +2,7 @@
 
 AWS CDK integration for [Lambda API Decorators](https://github.com/infrastructure-as-decorator/lambda-api-decorators). Define API routes with Python decorators and let CDK create the Lambda functions, integrations, routes, and related configuration.
 
-The complete cross-package guides and architecture documentation are available at [lambda-api-decorators.github.io](https://infrastructure-as-decorator.github.io/).
+The complete cross-package guides and architecture documentation are available at [infrastructure-as-decorator.github.io](https://infrastructure-as-decorator.github.io/).
 
 ## Installation
 
@@ -114,7 +114,7 @@ authorizer = apigateway.TokenAuthorizer(self, "UsersAuthorizer", handler=authori
 config = LambdaApiConfig(authorizers={"users": authorizer}, default_authorizer="users")
 ```
 
-The resource registries also allow decorated handlers to request least-privilege grants for registered DynamoDB tables and S3 buckets. See the [complete documentation](https://lambda-api-decorators.github.io/) for decorator syntax and supported access levels.
+The resource registries also allow decorated handlers to request least-privilege grants for registered DynamoDB tables and S3 buckets. See the [complete documentation](https://infrastructure-as-decorator.github.io/docs/api-reference/index) for decorator syntax and supported access levels.
 
 ## Low-level builder
 

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/pyproject.toml

@@ -84,9 +84,10 @@ dependencies = [
 # maintainers, and where to support the project financially. The key is
 # what's used to render the link text on PyPI.
 [project.urls]
-"Homepage" = "https://github.com/lambda-api-decorators/lambda-api-decorators-cdk"
-"Repository" = "https://github.com/lambda-api-decorators/lambda-api-decorators-cdk"
-"Bug Reports" = "https://github.com/lambda-api-decorators/lambda-api-decorators-cdk"
+Homepage = "https://infrastructure-as-decorator.github.io/"
+Documentation = "https://infrastructure-as-decorator.github.io/docs/api-reference/index"
+Repository = "https://github.com/infrastructure-as-decorator/lambda-api-decorators-cdk"
+"Bug Reports" = "https://github.com/infrastructure-as-decorator/lambda-api-decorators-cdk/issues"
 
 # The following would provide a command line executable called `sample`
 # which executes the function `main` from this package when invoked.

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/src/lambda_api_decorators_cdk/lambda_api_config.py

@@ -1,4 +1,5 @@
-from typing import Mapping, Optional, Sequence
+from collections.abc import Mapping
+from typing import Optional, Sequence
 
 from aws_cdk import Duration
 from aws_cdk import aws_ec2 as ec2
@@ -29,7 +30,29 @@ class LambdaApiConfig:
         s3_buckets: Optional[Mapping[str, s3.IBucket]] = None,
         authorizers: Optional[Mapping[str, object]] = None,
         default_authorizer: Optional[str] = None,
+        default_runtime: Optional[str] = None,
+        default_role: Optional[iam.IRole] = None,
+        common_environment: Optional[Mapping[str, str]] = None,
+        role_registry: Optional[Mapping[str, iam.IRole]] = None,
+        environment_registry: Optional[Mapping[str, Mapping[str, str]]] = None,
+        layer_registry: Optional[Mapping[str, lambda_.ILayerVersion]] = None,
+        security_group_registry: Optional[Mapping[str, ec2.ISecurityGroup]] = None,
+        vpc_registry: Optional[Mapping[str, ec2.IVpc]] = None,
+        dynamodb_table_registry: Optional[Mapping[str, dynamodb.ITable]] = None,
+        s3_bucket_registry: Optional[Mapping[str, s3.IBucket]] = None,
+        authorizer_registry: Optional[Mapping[str, object]] = None,
     ) -> None:
+        if default_runtime is not None:
+            self._validate_runtime_name(default_runtime)
+        if default_runtime is not None and runtime is not None:
+            raise ValueError("runtime and default_runtime cannot both be supplied")
+        if default_role is not None and role is not None:
+            raise ValueError("role and default_role cannot both be supplied")
+        if common_environment is not None and environment is not None:
+            raise ValueError(
+                "environment and common_environment cannot both be supplied"
+            )
+
         self._default_runtime = runtime
         self._default_timeout = timeout
         self._default_memory_size = memory_size
@@ -40,7 +63,13 @@ class LambdaApiConfig:
         self._common_security_groups = (
             list(security_groups) if security_groups is not None else []
         )
-        self._common_environments = dict(environment) if environment is not None else {}
+        self._common_environments = dict(
+            common_environment if common_environment is not None else environment or {}
+        )
+        if default_runtime is not None:
+            self._default_runtime = default_runtime
+        if default_role is not None:
+            self._default_role = default_role
 
         self._custom_runtimes = {}
         self._custom_roles = {}
@@ -61,6 +90,49 @@ class LambdaApiConfig:
         self._default_authorizer = None
         self.set_default_authorizer(default_authorizer)
 
+        for key, value in (role_registry or {}).items():
+            self.register_role(key, value)
+        for key, value in (environment_registry or {}).items():
+            self.register_environment(key, value)
+        for key, value in (layer_registry or {}).items():
+            self.register_layer(key, value)
+        for key, value in (security_group_registry or {}).items():
+            self.register_security_group(key, value)
+        for key, value in (vpc_registry or {}).items():
+            self.register_vpc(key, value)
+        for key, value in (dynamodb_table_registry or {}).items():
+            self.register_dynamodb_table(key, value)
+        for key, value in (s3_bucket_registry or {}).items():
+            self.register_s3_bucket(key, value)
+        for key, value in (authorizer_registry or {}).items():
+            self.register_authorizer(key, value)
+
+    @staticmethod
+    def _validate_runtime_name(runtime: str) -> None:
+        supported = {
+            "python3.10", "python3.11", "python3.12", "python3.13", "python3.14"
+        }
+        if not isinstance(runtime, str):
+            raise TypeError("runtime must be a string")
+        if runtime not in supported:
+            raise ValueError(
+                "runtime must be one of {}".format(", ".join(sorted(supported)))
+            )
+
+    @staticmethod
+    def _validate_registry_key(key: str, registry_name: str) -> None:
+        if not isinstance(key, str):
+            raise TypeError(f"{registry_name} keys must be strings")
+        if not key.strip():
+            raise ValueError(f"{registry_name} keys must not be empty or whitespace")
+
+    @classmethod
+    def _register(cls, registry: dict, key: str, value, registry_name: str) -> None:
+        cls._validate_registry_key(key, registry_name)
+        if key in registry:
+            raise ValueError(f"{registry_name} key {key!r} is already registered")
+        registry[key] = value
+
     def set_default_runtime(self, runtime: Optional[lambda_.Runtime]) -> None:
         self._default_runtime = runtime
 
@@ -90,9 +162,6 @@ class LambdaApiConfig:
         if security_group not in self._common_security_groups:
             self._common_security_groups.append(security_group)
 
-    def add_common_environment(self, key: str, value: str) -> None:
-        self._common_environments[key] = value
-
     def add_custom_runtime(self, key: str, runtime: lambda_.Runtime) -> None:
         self._custom_runtimes[key] = runtime
 
@@ -141,6 +210,50 @@ class LambdaApiConfig:
             raise ValueError(f"Authorizer key {key!r} is already registered")
         self._authorizers[key] = authorizer
 
+    def register_role(self, key: str, role: iam.IRole) -> None:
+        self._register(self._custom_roles, key, role, "role registry")
+
+    def register_environment(self, key: str, value: Mapping[str, str]) -> None:
+        if not isinstance(value, Mapping):
+            raise TypeError("environment registry values must be mappings")
+        self._register(self._custom_environments, key, dict(value), "environment registry")
+
+    def register_layer(self, key: str, layer: lambda_.ILayerVersion) -> None:
+        self._register(self._custom_layers, key, layer, "layer registry")
+
+    def register_security_group(self, key: str, security_group: ec2.ISecurityGroup) -> None:
+        self._register(
+            self._custom_security_groups, key, security_group, "security group registry"
+        )
+
+    def register_vpc(
+        self,
+        key: str,
+        vpc: ec2.IVpc,
+        vpc_subnets: Optional[ec2.SubnetSelection] = None,
+    ) -> None:
+        self._register(self._custom_vpcs, key, (vpc, vpc_subnets), "vpc registry")
+
+    def register_dynamodb_table(self, key: str, table: dynamodb.ITable) -> None:
+        self._register(self._dynamodb_tables, key, table, "dynamodb table registry")
+
+    def register_s3_bucket(self, key: str, bucket: s3.IBucket) -> None:
+        self._register(self._s3_buckets, key, bucket, "s3 bucket registry")
+
+    def register_authorizer(self, key: str, authorizer: object) -> None:
+        self._validate_registry_key(key, "authorizer registry")
+        interfaces = getattr(authorizer, "__jsii_ifaces__", ()) if authorizer is not None else ()
+        supported = {
+            "aws_cdk.aws_apigateway.IAuthorizer",
+            "aws_cdk.aws_apigatewayv2.IHttpRouteAuthorizer",
+        }
+        if not any(
+            f"{interface.__module__}.{interface.__name__}" in supported
+            for interface in interfaces
+        ):
+            raise TypeError("authorizer registry values must be CDK authorizers")
+        self._register(self._authorizers, key, authorizer, "authorizer registry")
+
     def set_default_authorizer(self, key: Optional[str]) -> None:
         if key is None:
             self._default_authorizer = None
@@ -179,7 +292,10 @@ class LambdaApiConfig:
             custom_runtimes=dict(self._custom_runtimes),
             custom_roles=dict(self._custom_roles),
             custom_layers=dict(self._custom_layers),
-            custom_environments=dict(self._custom_environments),
+            custom_environments={
+                key: dict(value) if isinstance(value, Mapping) else value
+                for key, value in self._custom_environments.items()
+            },
             custom_security_groups=dict(self._custom_security_groups),
             custom_vpcs=dict(self._custom_vpcs),
             dynamodb_tables=dict(self._dynamodb_tables),

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/src/lambda_api_decorators_cdk/resource_builder.py

@@ -50,7 +50,7 @@ class ResourceBuilder():
                 ) -> 'ResourceBuilder':
     
         '''
-        Creates base instance of a Resource Builder. By default, there are no predetermined custom, common nor default settings with the exception of the following custom runtimes: python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, python3.14.
+        Creates base instance of a Resource Builder. By default, there are no predetermined custom, common nor default settings with the exception of the following custom runtimes: python3.10, python3.11, python3.12, python3.13, python3.14.
         You can optionally specify arguments (Keep in mind some of them are constructs of the aws_cdk toolkit) such as:
         @param default_runtime
         @param default_timeout
@@ -93,8 +93,6 @@ class ResourceBuilder():
         self._physical_dynamodb_tables = {}
         self._physical_s3_buckets = {}
 
-        self.custom_runtimes.update({'python3.8':lambda_.Runtime.PYTHON_3_8})
-        self.custom_runtimes.update({'python3.9':lambda_.Runtime.PYTHON_3_9})
         self.custom_runtimes.update({'python3.10':lambda_.Runtime.PYTHON_3_10})
         self.custom_runtimes.update({'python3.11':lambda_.Runtime.PYTHON_3_11})
         self.custom_runtimes.update({'python3.12':lambda_.Runtime.PYTHON_3_12})
@@ -132,10 +130,6 @@ class ResourceBuilder():
         '''Add a common security group for all your Lambda Functions.'''
         self.common_security_groups.append(security_group) if security_group not in self.common_security_groups else None
 
-    def add_common_environment(self, key:str, value):
-        '''Add a common environment variable and value for all your Lambda Functions.'''
-        self.common_environments.update({key:value})
-
     def add_custom_vpc(self, key: str, vpc: ec2.Vpc, vpc_subnets: list):
         self.custom_vpcs.update({key:(vpc, vpc_subnets)})
     
@@ -197,7 +191,7 @@ class ResourceBuilder():
     def get_custom_layer(self, value: str) -> lambda_.LayerVersion | _lambda_python.PythonLayerVersion:
         if value in self.custom_layers:
             return self.custom_layers[value]
-        else: raise KeyError(f'Value {value} not previously declared as custom layer')
+        else: raise KeyError(f'layer registry key {value!r} is not registered')
 
     def get_custom_roles(self):
         return self.custom_roles
@@ -205,26 +199,28 @@ class ResourceBuilder():
     def get_custom_role(self, value: str) -> iam.Role:
         if value in self.custom_roles:
             return self.custom_roles[value]
-        else: raise KeyError(f'Value {value} not previously declared as custom role')
+        else: raise KeyError(f'role registry key {value!r} is not registered')
     
     def get_custom_security_group(self, value: str) -> ec2.SecurityGroup:
         if value in self.custom_security_groups:
             return self.custom_security_groups[value]
-        else: raise KeyError(f'Value {value} not previously declared as custom security group')
+        else: raise KeyError(f'security group registry key {value!r} is not registered')
     
-    def get_custom_environment(self, value: str) -> str:
+    def get_custom_environment(self, value: str):
         if value in self.custom_environments:
             return self.custom_environments[value]
-        else: raise KeyError(f'Value {value} not previously declared as custom environment')
+        else: raise KeyError(f'environment registry key {value!r} is not registered')
     
     def get_custom_runtime(self, value: str) -> lambda_.Runtime: 
         if value in self.custom_runtimes:
             return self.custom_runtimes[value]
-        else: raise KeyError(f'Value {value} not previously declared as custom runtime')
+        else: raise KeyError(f'runtime alias {value!r} is not registered')
     
     def get_custom_vpc(self, value: str) -> tuple:
-        #TODO
-        return self.custom_vpcs[value]
+        try:
+            return self.custom_vpcs[value]
+        except KeyError:
+            raise KeyError(f'vpc registry key {value!r} is not registered') from None
 
     def build(self, construct, api_resource: apigateway.IResource, lambda_path:str,
               print_tree: bool = False,
@@ -245,9 +241,9 @@ class ResourceBuilder():
         if print_tree:
             ast_helper.dump_tree(graph)
         self._prepare_layers(construct, graph, layer_sources)
-        self._emit_authorization_diagnostics(construct, graph)
         self.build_from_graph(
             construct, graph, api_resource, lambda_root, source_layout)
+        self._emit_configuration_diagnostics(construct, graph)
 
     def build_http(self, construct, http_api: apigateway2.HttpApi,
                    lambda_path:str, print_tree: bool = False,
@@ -267,9 +263,9 @@ class ResourceBuilder():
         if print_tree:
             ast_helper.dump_tree(graph)
         self._prepare_layers(construct, graph, layer_sources)
-        self._emit_authorization_diagnostics(construct, graph)
         self.build_http_from_graph(
             construct, graph, http_api, lambda_root, source_layout)
+        self._emit_configuration_diagnostics(construct, graph)
 
     @staticmethod
     def _discover_layer_sources(layers_path: Optional[str]):
@@ -312,6 +308,8 @@ class ResourceBuilder():
 
     def _resolve_runtime(self, decorators: dict):
         runtime = self.get_default_runtime()
+        if isinstance(runtime, str):
+            runtime = self.get_custom_runtime(runtime)
         if 'runtime' in decorators:
             runtime = self.get_custom_runtime(decorators['runtime'])
         return runtime
@@ -476,9 +474,17 @@ class ResourceBuilder():
             elif key == 'environment':
                 if type(value) == list:
                     for v in value:
-                        options[key][v] = self.get_custom_environment(v)
+                        selected = self.get_custom_environment(v)
+                        if isinstance(selected, dict):
+                            options[key].update(selected)
+                        else:
+                            options[key][v] = selected
                 else:
-                    options[key][value] = self.get_custom_environment(value)
+                    selected = self.get_custom_environment(value)
+                    if isinstance(selected, dict):
+                        options[key].update(selected)
+                    else:
+                        options[key][value] = selected
             elif key == 'vpc':
                 options[key] = self.get_custom_vpc(value)
         return options
@@ -520,6 +526,127 @@ class ResourceBuilder():
             return None
         return key if state == "authorizer" else self.default_authorizer
 
+    @staticmethod
+    def _diagnostic_rows(graph: ast_helper.Resource):
+        rows = []
+
+        def visit(resource):
+            for method in resource.get_methods():
+                rows.append((resource.get_path(), method))
+            for child in resource.get_connections():
+                visit(child)
+
+        visit(graph)
+        return sorted(rows, key=lambda item: (item[0], item[1].get_method()))
+
+    @staticmethod
+    def _diagnostic_table(title, default_label, columns, rows):
+        if not rows:
+            return None
+        lines = [title, default_label, "", "  ".join(columns)]
+        lines.extend("    ".join(row) for row in rows)
+        return "\n".join(lines)
+
+    def _emit_configuration_diagnostics(self, construct, graph):
+        if not isinstance(construct, Construct):
+            return
+        self._emit_authorization_diagnostics(construct, graph)
+        self._emit_role_diagnostics(construct, graph)
+        self._emit_vpc_diagnostics(construct, graph)
+        self._emit_shared_role_warning(construct, graph)
+
+    def _emit_role_diagnostics(self, construct, graph):
+        if self.default_role is None:
+            return
+        rows = []
+        for path, method in self._diagnostic_rows(graph):
+            decorators = self._configuration_decorators(method)
+            selected = decorators.get("role")
+            if selected is None:
+                continue
+            effective = self.get_custom_role(selected)
+            if effective is self.default_role:
+                continue
+            rows.append((method.get_method(), path, str(selected)))
+        message = self._diagnostic_table(
+            "Execution role overrides",
+            "Default role: configured default",
+            ("METHOD", "PATH", "EFFECTIVE"),
+            rows,
+        )
+        if message:
+            Annotations.of(construct).add_info(message)
+
+    @staticmethod
+    def _subnet_selection_name(selection):
+        if selection is None:
+            return "NONE"
+        subnet_type = getattr(selection, "subnet_type", None)
+        if subnet_type is not None:
+            return getattr(subnet_type, "value", str(subnet_type))
+        if getattr(selection, "subnet_group_name", None):
+            return str(selection.subnet_group_name)
+        if getattr(selection, "one_per_az", False):
+            return "ONE_PER_AZ"
+        if getattr(selection, "subnets", None):
+            return "EXPLICIT_SUBNETS"
+        return "DEFAULT"
+
+    def _emit_vpc_diagnostics(self, construct, graph):
+        if self.default_vpc is None:
+            return
+        default_vpc, default_subnets = self.default_vpc
+        rows = []
+        for path, method in self._diagnostic_rows(graph):
+            decorators = self._configuration_decorators(method)
+            selected = decorators.get("vpc")
+            if selected is None:
+                continue
+            effective_vpc, effective_subnets = self.get_custom_vpc(selected)
+            if (
+                effective_vpc is default_vpc
+                and effective_subnets is default_subnets
+            ):
+                continue
+            rows.append((
+                method.get_method(),
+                path,
+                str(selected),
+                self._subnet_selection_name(effective_subnets),
+            ))
+        message = self._diagnostic_table(
+            "VPC overrides",
+            "Default VPC: configured default",
+            ("METHOD", "PATH", "EFFECTIVE", "SUBNETS"),
+            rows,
+        )
+        if message:
+            Annotations.of(construct).add_info(message)
+
+    def _emit_shared_role_warning(self, construct, graph):
+        roles = {}
+        for path, method in self._diagnostic_rows(graph):
+            decorators = self._configuration_decorators(method)
+            selected = decorators.get("role")
+            if selected is None:
+                continue
+            grants = {
+                invocation.name
+                for invocation in method.get_decorator_invocations()
+                if invocation.name in {"grant_dynamodb", "grant_s3"}
+            }
+            if not grants:
+                continue
+            effective = self.get_custom_role(selected)
+            roles.setdefault(id(effective), (effective, set()))[1].add(path)
+
+        if any(len(paths) > 1 for _, paths in roles.values()):
+            Annotations.of(construct).add_warning_v2(
+                "LAD_ROLE_SHARED_PERMISSIONS",
+                "LAD_ROLE_SHARED_PERMISSIONS: an explicit execution role with "
+                "derived permissions is shared by multiple Lambda handlers.",
+            )
+
     @staticmethod
     def _implements_interface(authorizer, interface) -> bool:
         return interface in getattr(authorizer, "__jsii_ifaces__", ())
@@ -603,14 +730,21 @@ class ResourceBuilder():
             return
         deviations.sort(key=lambda item: (item[0], item[1]))
         if self.default_authorizer is None:
-            heading = "Default authorizer: PUBLIC\n\nProtected routes:"
+            default_label = "Default authorizer: PUBLIC"
         else:
-            heading = f"Default authorizer: {self.default_authorizer}\n\nOverrides:"
-        details = "\n".join(
-            f"    {method} {path}    {value}"
+            default_label = f"Default authorizer: {self.default_authorizer}"
+        rows = [
+            (method, path, value)
             for path, method, value in deviations
+        ]
+        message = self._diagnostic_table(
+            "Authorization overrides",
+            default_label,
+            ("METHOD", "PATH", "EFFECTIVE"),
+            rows,
         )
-        Annotations.of(construct).add_info(f"{heading}\n{details}")
+        if message:
+            Annotations.of(construct).add_info(message)
 
     @staticmethod
     def _physical_resource_id(resource_type: str, physical_name: str) -> str:
@@ -841,11 +975,38 @@ class ResourceBuilder():
         return self.build_lambda_function(
             construct, method, lambda_root, source_layout)
 
+    @staticmethod
+    def _validate_single_route_handlers(graph: ast_helper.Resource) -> None:
+        seen = {}
+
+        def visit(resource):
+            for method in resource.get_methods():
+                handler = (
+                    method.get_path_to_file(),
+                    method.get_file(),
+                    method.get_handler(),
+                    method.get_method(),
+                )
+                if handler in seen:
+                    raise ValueError(
+                        f"Handler {handler[2]!r} has multiple routes for "
+                        f"HTTP method {handler[3]!r}: "
+                        f"{seen[handler]!r} and {resource.get_path()!r}"
+                    )
+                seen[handler] = resource.get_path()
+            for child in resource.get_connections():
+                visit(child)
+
+        visit(graph)
+
     def build_from_graph(self, construct, graph: ast_helper.Resource,
                          api_resource: apigateway.IResource,
                          lambda_root: Optional[Path] = None,
                          source_layout: SourceLayout = SourceLayout.ROOT):
 
+        if isinstance(construct, Construct):
+            self._validate_single_route_handlers(graph)
+
         path = graph.get_path()
         level = path.count('/')
         if level <= 1 and len(path) <= 1: #root '/'
@@ -877,6 +1038,9 @@ class ResourceBuilder():
                               http_api: apigateway2.HttpApi,
                               lambda_root: Optional[Path] = None,
                               source_layout: SourceLayout = SourceLayout.ROOT):
+        if isinstance(construct, Construct):
+            self._validate_single_route_handlers(graph)
+
         method_mapping = {
             'GET': apigateway2.HttpMethod.GET,
             'POST': apigateway2.HttpMethod.POST,

{lambda_api_decorators_cdk-0.4.1 → lambda_api_decorators_cdk-0.4.4}/src/lambda_api_decorators_cdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lambda-api-decorators-cdk
-Version: 0.4.1
+Version: 0.4.4
 Summary: AWS CDK integration for Lambda API Decorators. Generate AWS Lambda and API Gateway infrastructure from decorated Python handlers.
 Author: Mateo Marcos, Emanuel Arguinarena, Lucas Picchi
 License: MIT License
@@ -24,9 +24,10 @@ License: MIT License
         LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
         SOFTWARE.
-Project-URL: Homepage, https://github.com/lambda-api-decorators/lambda-api-decorators-cdk
-Project-URL: Repository, https://github.com/lambda-api-decorators/lambda-api-decorators-cdk
-Project-URL: Bug Reports, https://github.com/lambda-api-decorators/lambda-api-decorators-cdk
+Project-URL: Homepage, https://infrastructure-as-decorator.github.io/
+Project-URL: Documentation, https://infrastructure-as-decorator.github.io/docs/api-reference/index
+Project-URL: Repository, https://github.com/infrastructure-as-decorator/lambda-api-decorators-cdk
+Project-URL: Bug Reports, https://github.com/infrastructure-as-decorator/lambda-api-decorators-cdk/issues
 Keywords: cdk,lambda,aws,api gateway,ast
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Intended Audience :: Developers
@@ -49,7 +50,7 @@ Dynamic: license-file
 
 AWS CDK integration for [Lambda API Decorators](https://github.com/infrastructure-as-decorator/lambda-api-decorators). Define API routes with Python decorators and let CDK create the Lambda functions, integrations, routes, and related configuration.
 
-The complete cross-package guides and architecture documentation are available at [lambda-api-decorators.github.io](https://infrastructure-as-decorator.github.io/).
+The complete cross-package guides and architecture documentation are available at [infrastructure-as-decorator.github.io](https://infrastructure-as-decorator.github.io/).
 
 ## Installation
 
@@ -161,7 +162,7 @@ authorizer = apigateway.TokenAuthorizer(self, "UsersAuthorizer", handler=authori
 config = LambdaApiConfig(authorizers={"users": authorizer}, default_authorizer="users")
 ```
 
-The resource registries also allow decorated handlers to request least-privilege grants for registered DynamoDB tables and S3 buckets. See the [complete documentation](https://lambda-api-decorators.github.io/) for decorator syntax and supported access levels.
+The resource registries also allow decorated handlers to request least-privilege grants for registered DynamoDB tables and S3 buckets. See the [complete documentation](https://infrastructure-as-decorator.github.io/docs/api-reference/index) for decorator syntax and supported access levels.
 
 ## Low-level builder