salesforce-data-customcode 6.1.0.dev6__py3-none-any.whl → 6.1.0.dev7__py3-none-any.whl

datacustomcode/named_credential/direct/auth.py

@@ -19,11 +19,15 @@ Inject external credential auth into an outgoing request.
 from __future__ import annotations
 
 import base64
+import datetime
+import hashlib
+import hmac
 from typing import (
     TYPE_CHECKING,
     Any,
     Dict,
 )
+import urllib.parse
 
 from requests.auth import AuthBase
 
@@ -32,6 +36,8 @@ from datacustomcode.named_credential.direct.credentials import AuthType
 if TYPE_CHECKING:
     from requests.models import PreparedRequest
 
+_SIGV4_ALGORITHM = "AWS4-HMAC-SHA256"
+
 
 class DynamicAuthHandler(AuthBase):
     def __init__(self, cred_config: Dict[str, Any]) -> None:
@@ -57,7 +63,129 @@ class DynamicAuthHandler(AuthBase):
                 )
             request.headers["Authorization"] = f"Bearer {bearer}"
 
+        elif self.auth_type == AuthType.AWS_SIG_V4.value:
+            self._sign_aws_sigv4(request)
+
         else:
             raise ValueError(f"Unsupported auth_type '{self.auth_type}'.")
 
         return request
+
+    def _sign_aws_sigv4(self, request: PreparedRequest) -> None:
+        """Sign ``request`` with AWS Signature Version 4.
+
+        Requires ``aws_access_key_id``, ``aws_secret_access_key``, ``aws_region``,
+        and ``aws_service`` in the credential config; ``aws_session_token`` is
+        optional (for temporary credentials). The signed date, payload hash, and
+        (when present) session token are added as ``x-amz-*`` headers so the sent
+        request matches what was signed.
+        """
+        access_key = self.config.get("aws_access_key_id")
+        secret_key = self.config.get("aws_secret_access_key")
+        region = self.config.get("aws_region")
+        service = self.config.get("aws_service")
+        session_token = self.config.get("aws_session_token")
+        missing = [
+            name
+            for name, value in (
+                ("aws_access_key_id", access_key),
+                ("aws_secret_access_key", secret_key),
+                ("aws_region", region),
+                ("aws_service", service),
+            )
+            if not value
+        ]
+        if missing:
+            raise ValueError(f"'{self.auth_type}' auth requires {', '.join(missing)}.")
+        access_key = str(access_key)
+        secret_key = str(secret_key)
+        region = str(region)
+        service = str(service)
+
+        parsed = urllib.parse.urlsplit(str(request.url or ""))
+        host = parsed.netloc
+        canonical_uri = urllib.parse.quote(parsed.path or "/", safe="/-_.~")
+        canonical_query = _canonical_query_string(parsed.query)
+
+        body = request.body or b""
+        if isinstance(body, str):
+            body = body.encode("utf-8")
+        payload_hash = hashlib.sha256(body).hexdigest()
+
+        now = datetime.datetime.now(datetime.timezone.utc)
+        amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+        datestamp = now.strftime("%Y%m%d")
+
+        request.headers["x-amz-date"] = amz_date
+        request.headers["x-amz-content-sha256"] = payload_hash
+        if session_token:
+            request.headers["x-amz-security-token"] = session_token
+
+        signed = {
+            "host": host,
+            "x-amz-content-sha256": payload_hash,
+            "x-amz-date": amz_date,
+        }
+        if session_token:
+            signed["x-amz-security-token"] = session_token
+        signed_headers = ";".join(sorted(signed))
+        canonical_headers = "".join(
+            f"{name}:{signed[name]}\n" for name in sorted(signed)
+        )
+
+        canonical_request = "\n".join(
+            [
+                request.method or "GET",
+                canonical_uri,
+                canonical_query,
+                canonical_headers,
+                signed_headers,
+                payload_hash,
+            ]
+        )
+        credential_scope = f"{datestamp}/{region}/{service}/aws4_request"
+        string_to_sign = "\n".join(
+            [
+                _SIGV4_ALGORITHM,
+                amz_date,
+                credential_scope,
+                hashlib.sha256(canonical_request.encode("utf-8")).hexdigest(),
+            ]
+        )
+        signing_key = _derive_signing_key(secret_key, datestamp, region, service)
+        signature = hmac.new(
+            signing_key, string_to_sign.encode("utf-8"), hashlib.sha256
+        ).hexdigest()
+
+        request.headers["Authorization"] = (
+            f"{_SIGV4_ALGORITHM} Credential={access_key}/{credential_scope}, "
+            f"SignedHeaders={signed_headers}, Signature={signature}"
+        )
+
+
+def _canonical_query_string(query: str) -> str:
+    """Build the AWS Sig V4 canonical query string from a raw query string."""
+    pairs = urllib.parse.parse_qsl(query, keep_blank_values=True)
+    encoded = [
+        (
+            urllib.parse.quote(key, safe="-_.~"),
+            urllib.parse.quote(value, safe="-_.~"),
+        )
+        for key, value in pairs
+    ]
+    encoded.sort()
+    return "&".join(f"{key}={value}" for key, value in encoded)
+
+
+def _derive_signing_key(
+    secret_key: str, datestamp: str, region: str, service: str
+) -> bytes:
+    """Derive the AWS Sig V4 signing key via the chained HMAC-SHA256 sequence."""
+
+    def _hmac(key: bytes, msg: str) -> bytes:
+        return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest()
+
+    k_date = _hmac(f"AWS4{secret_key}".encode(), datestamp)
+    k_region = _hmac(k_date, region)
+    k_service = _hmac(k_region, service)
+    return _hmac(k_service, "aws4_request")

datacustomcode/named_credential/direct/credentials.py

@@ -41,6 +41,7 @@ CREDENTIAL_FILE_ENV_VAR = "DATACUSTOMCODE_EXTERNAL_CALLOUT_CONFIG"
 class AuthType(str, Enum):
     """External Credential auth types supported by External Services."""
 
+    AWS_SIG_V4 = "AwsSv4"
     BASIC = "Basic"
     CUSTOM = "Custom"
     JWT = "Jwt"

datacustomcode/templates/script/examples/external_callout/README.md

@@ -122,7 +122,7 @@ matching entries in `config.json`) to point at your own DLOs.
 `auth_type` selects how auth is injected for local testing. It should mirror the
 External Credential your Named Credential uses in the org, so local and deployed
 runs behave the same. This example uses `Custom` (Gemini's `X-goog-api-key`);
-all four supported types:
+all supported types:
 
 | `auth_type` | Fields read | Header sent |
 | ----------- | ------------------------------- | --------------------------------------- |
@@ -130,7 +130,11 @@ all four supported types:
 | `Custom`    | `custom_headers` (sent verbatim)| the headers you list                    |
 | `OAuth`     | `access_token` or `token`       | `Authorization: Bearer <token>`         |
 | `Jwt`       | `access_token` or `token`       | `Authorization: Bearer <token>`         |
+| `AwsSv4`    | `aws_access_key_id`, `aws_secret_access_key`, `aws_region`, `aws_service`, optional `aws_session_token` | `Authorization: AWS4-HMAC-SHA256 ...` plus `x-amz-date` / `x-amz-content-sha256` (and `x-amz-security-token` when a session token is set) |
 
 `OAuth`/`Jwt` take a token you supply for the local run — the SDK does not fetch
 or refresh it. In the Data Cloud runtime the Named Credential handles token
 acquisition; this local config only stands in for that during testing.
+
+`AwsSv4` signs the request with AWS Signature Version 4 using the keys you
+supply, mirroring an AWS Signature Version 4 External Credential in the org.

{salesforce_data_customcode-6.1.0.dev6.dist-info → salesforce_data_customcode-6.1.0.dev7.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: salesforce-data-customcode
-Version: 6.1.0.dev6
+Version: 6.1.0.dev7
 Summary: Data Cloud Custom Code SDK
 License-Expression: Apache-2.0
 License-File: LICENSE.txt

{salesforce_data_customcode-6.1.0.dev6.dist-info → salesforce_data_customcode-6.1.0.dev7.dist-info}/RECORD

@@ -57,8 +57,8 @@ datacustomcode/named_credential/__init__.py,sha256=XD_UI8ggOkFvkqCOZI_3dP1AkviqP
 datacustomcode/named_credential/base.py,sha256=-LMskZkKNoaFg-Zc80M_4IPLF7ru5pfnbkfLI7YXrFc,1816
 datacustomcode/named_credential/default.py,sha256=z03B0daZvTPiTmJWGAtDCICB1srelESg7QmPH2iRK5o,3339
 datacustomcode/named_credential/direct/__init__.py,sha256=zqErMI1GqEhseLnYkrWtq3WipRi_dP153c8wwLvgI-o,799
-datacustomcode/named_credential/direct/auth.py,sha256=U09jO0Pn3OEOEudmvcBmtkwoXqE0Ae_Mv6TAMqb3eG4,2201
-datacustomcode/named_credential/direct/credentials.py,sha256=fibIZTyBT1IbAGFjXwAXqYcQt9o_sB8zFmuixGmibE4,4534
+datacustomcode/named_credential/direct/auth.py,sha256=I1vdB8zVxdREwABDnjY7qwpTZFhT9OHJTsgpxPIuT84,6837
+datacustomcode/named_credential/direct/credentials.py,sha256=B1UpqwRXnzkjycUi50KfxJA5ZeAhR33gElRMzNOit4M,4560
 datacustomcode/named_credential/direct/transport.py,sha256=UL5eJJsyoAjr8ovJDQKQY3O20DivvbWFPGRyM8Y2or4,4078
 datacustomcode/named_credential/direct/url_resolver.py,sha256=KItv12Az0qoxnVacCTcM9t9AY7qB9_tqPWMgiP-7Y6s,3823
 datacustomcode/named_credential/errors.py,sha256=zyMEgljTf85digXrLrlR9HBh5Un4WtG0WsZx0K4EWt0,1212
@@ -111,7 +111,7 @@ datacustomcode/templates/script/account.ipynb,sha256=LIbxgiVxflNASdspF2lfpMKkKAT
 datacustomcode/templates/script/build_native_dependencies.sh,sha256=ICRrp4f1ATBwPaUiuVGjY-MwiubFswNJLf8gMGU6YNg,197
 datacustomcode/templates/script/examples/employee_hierarchy/employee_data.csv,sha256=C7ggLBfoyi3M2BdMLNyOeKqF-5OO-Da76lkwgWg2cVQ,302
 datacustomcode/templates/script/examples/employee_hierarchy/entrypoint.py,sha256=Mfm3iQtEHTQRW6cmZTwRKdTh3IeGWR-teXrd6x-YLSY,2223
-datacustomcode/templates/script/examples/external_callout/README.md,sha256=9pcepHizQxsTduNUjDF4GkkB8nM4dke9353mJxCZzjM,5646
+datacustomcode/templates/script/examples/external_callout/README.md,sha256=CNLPSS6anLxRQyZ6hxAXUuvUPH09HMv2GPoQQMsuT94,6056
 datacustomcode/templates/script/examples/external_callout/entrypoint.py,sha256=KgSAmkpJ1On7R3Lr4_Slf9rTHgLr3TjC43QSFbaIzUY,5005
 datacustomcode/templates/script/examples/external_callout/external_callout_config.json,sha256=PUCmw_humbVoCyswFneuGYx0INbqSTPOumDqtGOztiM,320
 datacustomcode/templates/script/examples/streaming_deltas/entrypoint.py,sha256=UQr1EhJURFFGI5626efvv-MxGHltzcpJcEJVmz5ZQdo,2333
@@ -122,8 +122,8 @@ datacustomcode/templates/script/requirements-dev.txt,sha256=OWwuy1awesqOZOS3Zizm
 datacustomcode/templates/script/requirements.txt,sha256=qJbqzs5z0Hrx590U3T7dHq_m8UQEx2TdhgrJSz-QHIQ,40
 datacustomcode/token_provider.py,sha256=qA_e4vqSXnxn0MccFFPULWO8ZeUOEAu5QpBnoYCg-fc,6839
 datacustomcode/version.py,sha256=9LlbVrzwBvut1L308QbwNBgxdQk5CrghH39JARVSxms,989
-salesforce_data_customcode-6.1.0.dev6.dist-info/METADATA,sha256=-7Xy6AdRhwyLbyCMCZqHQ8gbnuvdXUz744Ql0ZCE2Tw,27417
-salesforce_data_customcode-6.1.0.dev6.dist-info/WHEEL,sha256=eY7nduwzv-ldUxpzbRlxwvC693Hg6PX8bWDjEHjZ_dk,88
-salesforce_data_customcode-6.1.0.dev6.dist-info/entry_points.txt,sha256=WpQ94UB7UuRCYGOLtJV3vAgm1tl7iVf43VYRWIuNu5Y,74
-salesforce_data_customcode-6.1.0.dev6.dist-info/licenses/LICENSE.txt,sha256=iOi8EmQpfkFhMENi7VYtkl2EqS14pEOccoXHiW2dyPU,11443
-salesforce_data_customcode-6.1.0.dev6.dist-info/RECORD,,
+salesforce_data_customcode-6.1.0.dev7.dist-info/METADATA,sha256=jzc55cJlMHH-nGsNSzIrLu-GhN4nlmIOfK9fj8nZ1u4,27417
+salesforce_data_customcode-6.1.0.dev7.dist-info/WHEEL,sha256=eY7nduwzv-ldUxpzbRlxwvC693Hg6PX8bWDjEHjZ_dk,88
+salesforce_data_customcode-6.1.0.dev7.dist-info/entry_points.txt,sha256=WpQ94UB7UuRCYGOLtJV3vAgm1tl7iVf43VYRWIuNu5Y,74
+salesforce_data_customcode-6.1.0.dev7.dist-info/licenses/LICENSE.txt,sha256=iOi8EmQpfkFhMENi7VYtkl2EqS14pEOccoXHiW2dyPU,11443
+salesforce_data_customcode-6.1.0.dev7.dist-info/RECORD,,