salesforce-data-customcode 6.1.0.dev6__tar.gz → 6.1.0.dev7__tar.gz

{salesforce_data_customcode-6.1.0.dev6 → salesforce_data_customcode-6.1.0.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: salesforce-data-customcode
-Version: 6.1.0.dev6
+Version: 6.1.0.dev7
 Summary: Data Cloud Custom Code SDK
 License-Expression: Apache-2.0
 License-File: LICENSE.txt

{salesforce_data_customcode-6.1.0.dev6 → salesforce_data_customcode-6.1.0.dev7}/pyproject.toml

@@ -18,7 +18,7 @@ license = "Apache-2.0"
 name = "salesforce-data-customcode"
 readme = "README.md"
 requires-python = ">=3.10,<3.12"
-version = "6.1.0.dev6"
+version = "6.1.0.dev7"
 
 [tool.black]
 exclude = '''

salesforce_data_customcode-6.1.0.dev7/src/datacustomcode/named_credential/direct/auth.py

@@ -0,0 +1,191 @@
+# Copyright (c) 2025, Salesforce, Inc.
+# SPDX-License-Identifier: Apache-2
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Inject external credential auth into an outgoing request.
+"""
+
+from __future__ import annotations
+
+import base64
+import datetime
+import hashlib
+import hmac
+from typing import (
+    TYPE_CHECKING,
+    Any,
+    Dict,
+)
+import urllib.parse
+
+from requests.auth import AuthBase
+
+from datacustomcode.named_credential.direct.credentials import AuthType
+
+if TYPE_CHECKING:
+    from requests.models import PreparedRequest
+
+_SIGV4_ALGORITHM = "AWS4-HMAC-SHA256"
+
+
+class DynamicAuthHandler(AuthBase):
+    def __init__(self, cred_config: Dict[str, Any]) -> None:
+        self.config = cred_config
+        self.auth_type = cred_config.get("auth_type")
+
+    def __call__(self, request: PreparedRequest) -> PreparedRequest:
+        if self.auth_type == AuthType.BASIC.value:
+            user = self.config.get("username", "")
+            pwd = self.config.get("password", "")
+            token = base64.b64encode(f"{user}:{pwd}".encode()).decode()
+            request.headers["Authorization"] = f"Basic {token}"
+
+        elif self.auth_type == AuthType.CUSTOM.value:
+            for name, value in self.config.get("custom_headers", {}).items():
+                request.headers[name] = value
+
+        elif self.auth_type in (AuthType.OAUTH.value, AuthType.JWT.value):
+            bearer = self.config.get("access_token") or self.config.get("token")
+            if not bearer:
+                raise ValueError(
+                    f"'{self.auth_type}' auth requires an 'access_token' or 'token'."
+                )
+            request.headers["Authorization"] = f"Bearer {bearer}"
+
+        elif self.auth_type == AuthType.AWS_SIG_V4.value:
+            self._sign_aws_sigv4(request)
+
+        else:
+            raise ValueError(f"Unsupported auth_type '{self.auth_type}'.")
+
+        return request
+
+    def _sign_aws_sigv4(self, request: PreparedRequest) -> None:
+        """Sign ``request`` with AWS Signature Version 4.
+
+        Requires ``aws_access_key_id``, ``aws_secret_access_key``, ``aws_region``,
+        and ``aws_service`` in the credential config; ``aws_session_token`` is
+        optional (for temporary credentials). The signed date, payload hash, and
+        (when present) session token are added as ``x-amz-*`` headers so the sent
+        request matches what was signed.
+        """
+        access_key = self.config.get("aws_access_key_id")
+        secret_key = self.config.get("aws_secret_access_key")
+        region = self.config.get("aws_region")
+        service = self.config.get("aws_service")
+        session_token = self.config.get("aws_session_token")
+        missing = [
+            name
+            for name, value in (
+                ("aws_access_key_id", access_key),
+                ("aws_secret_access_key", secret_key),
+                ("aws_region", region),
+                ("aws_service", service),
+            )
+            if not value
+        ]
+        if missing:
+            raise ValueError(f"'{self.auth_type}' auth requires {', '.join(missing)}.")
+        access_key = str(access_key)
+        secret_key = str(secret_key)
+        region = str(region)
+        service = str(service)
+
+        parsed = urllib.parse.urlsplit(str(request.url or ""))
+        host = parsed.netloc
+        canonical_uri = urllib.parse.quote(parsed.path or "/", safe="/-_.~")
+        canonical_query = _canonical_query_string(parsed.query)
+
+        body = request.body or b""
+        if isinstance(body, str):
+            body = body.encode("utf-8")
+        payload_hash = hashlib.sha256(body).hexdigest()
+
+        now = datetime.datetime.now(datetime.timezone.utc)
+        amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+        datestamp = now.strftime("%Y%m%d")
+
+        request.headers["x-amz-date"] = amz_date
+        request.headers["x-amz-content-sha256"] = payload_hash
+        if session_token:
+            request.headers["x-amz-security-token"] = session_token
+
+        signed = {
+            "host": host,
+            "x-amz-content-sha256": payload_hash,
+            "x-amz-date": amz_date,
+        }
+        if session_token:
+            signed["x-amz-security-token"] = session_token
+        signed_headers = ";".join(sorted(signed))
+        canonical_headers = "".join(
+            f"{name}:{signed[name]}\n" for name in sorted(signed)
+        )
+
+        canonical_request = "\n".join(
+            [
+                request.method or "GET",
+                canonical_uri,
+                canonical_query,
+                canonical_headers,
+                signed_headers,
+                payload_hash,
+            ]
+        )
+        credential_scope = f"{datestamp}/{region}/{service}/aws4_request"
+        string_to_sign = "\n".join(
+            [
+                _SIGV4_ALGORITHM,
+                amz_date,
+                credential_scope,
+                hashlib.sha256(canonical_request.encode("utf-8")).hexdigest(),
+            ]
+        )
+        signing_key = _derive_signing_key(secret_key, datestamp, region, service)
+        signature = hmac.new(
+            signing_key, string_to_sign.encode("utf-8"), hashlib.sha256
+        ).hexdigest()
+
+        request.headers["Authorization"] = (
+            f"{_SIGV4_ALGORITHM} Credential={access_key}/{credential_scope}, "
+            f"SignedHeaders={signed_headers}, Signature={signature}"
+        )
+
+
+def _canonical_query_string(query: str) -> str:
+    """Build the AWS Sig V4 canonical query string from a raw query string."""
+    pairs = urllib.parse.parse_qsl(query, keep_blank_values=True)
+    encoded = [
+        (
+            urllib.parse.quote(key, safe="-_.~"),
+            urllib.parse.quote(value, safe="-_.~"),
+        )
+        for key, value in pairs
+    ]
+    encoded.sort()
+    return "&".join(f"{key}={value}" for key, value in encoded)
+
+
+def _derive_signing_key(
+    secret_key: str, datestamp: str, region: str, service: str
+) -> bytes:
+    """Derive the AWS Sig V4 signing key via the chained HMAC-SHA256 sequence."""
+
+    def _hmac(key: bytes, msg: str) -> bytes:
+        return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest()
+
+    k_date = _hmac(f"AWS4{secret_key}".encode(), datestamp)
+    k_region = _hmac(k_date, region)
+    k_service = _hmac(k_region, service)
+    return _hmac(k_service, "aws4_request")

{salesforce_data_customcode-6.1.0.dev6 → salesforce_data_customcode-6.1.0.dev7}/src/datacustomcode/named_credential/direct/credentials.py

@@ -41,6 +41,7 @@ CREDENTIAL_FILE_ENV_VAR = "DATACUSTOMCODE_EXTERNAL_CALLOUT_CONFIG"
 class AuthType(str, Enum):
     """External Credential auth types supported by External Services."""
 
+    AWS_SIG_V4 = "AwsSv4"
     BASIC = "Basic"
     CUSTOM = "Custom"
     JWT = "Jwt"

{salesforce_data_customcode-6.1.0.dev6 → salesforce_data_customcode-6.1.0.dev7}/src/datacustomcode/templates/script/examples/external_callout/README.md

@@ -122,7 +122,7 @@ matching entries in `config.json`) to point at your own DLOs.
 `auth_type` selects how auth is injected for local testing. It should mirror the
 External Credential your Named Credential uses in the org, so local and deployed
 runs behave the same. This example uses `Custom` (Gemini's `X-goog-api-key`);
-all four supported types:
+all supported types:
 
 | `auth_type` | Fields read | Header sent |
 | ----------- | ------------------------------- | --------------------------------------- |
@@ -130,7 +130,11 @@ all four supported types:
 | `Custom`    | `custom_headers` (sent verbatim)| the headers you list                    |
 | `OAuth`     | `access_token` or `token`       | `Authorization: Bearer <token>`         |
 | `Jwt`       | `access_token` or `token`       | `Authorization: Bearer <token>`         |
+| `AwsSv4`    | `aws_access_key_id`, `aws_secret_access_key`, `aws_region`, `aws_service`, optional `aws_session_token` | `Authorization: AWS4-HMAC-SHA256 ...` plus `x-amz-date` / `x-amz-content-sha256` (and `x-amz-security-token` when a session token is set) |
 
 `OAuth`/`Jwt` take a token you supply for the local run — the SDK does not fetch
 or refresh it. In the Data Cloud runtime the Named Credential handles token
 acquisition; this local config only stands in for that during testing.
+
+`AwsSv4` signs the request with AWS Signature Version 4 using the keys you
+supply, mirroring an AWS Signature Version 4 External Credential in the org.

salesforce_data_customcode-6.1.0.dev6/src/datacustomcode/named_credential/direct/auth.py

@@ -1,63 +0,0 @@
-# Copyright (c) 2025, Salesforce, Inc.
-# SPDX-License-Identifier: Apache-2
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-"""
-Inject external credential auth into an outgoing request.
-"""
-
-from __future__ import annotations
-
-import base64
-from typing import (
-    TYPE_CHECKING,
-    Any,
-    Dict,
-)
-
-from requests.auth import AuthBase
-
-from datacustomcode.named_credential.direct.credentials import AuthType
-
-if TYPE_CHECKING:
-    from requests.models import PreparedRequest
-
-
-class DynamicAuthHandler(AuthBase):
-    def __init__(self, cred_config: Dict[str, Any]) -> None:
-        self.config = cred_config
-        self.auth_type = cred_config.get("auth_type")
-
-    def __call__(self, request: PreparedRequest) -> PreparedRequest:
-        if self.auth_type == AuthType.BASIC.value:
-            user = self.config.get("username", "")
-            pwd = self.config.get("password", "")
-            token = base64.b64encode(f"{user}:{pwd}".encode()).decode()
-            request.headers["Authorization"] = f"Basic {token}"
-
-        elif self.auth_type == AuthType.CUSTOM.value:
-            for name, value in self.config.get("custom_headers", {}).items():
-                request.headers[name] = value
-
-        elif self.auth_type in (AuthType.OAUTH.value, AuthType.JWT.value):
-            bearer = self.config.get("access_token") or self.config.get("token")
-            if not bearer:
-                raise ValueError(
-                    f"'{self.auth_type}' auth requires an 'access_token' or 'token'."
-                )
-            request.headers["Authorization"] = f"Bearer {bearer}"
-
-        else:
-            raise ValueError(f"Unsupported auth_type '{self.auth_type}'.")
-
-        return request