spinta 0.2.dev19__tar.gz → 0.2.dev21__tar.gz

{spinta-0.2.dev19 → spinta-0.2.dev21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spinta
-Version: 0.2.dev19
+Version: 0.2.dev21
 Summary: A platform for describing, extracting, transforming, loading and serving open data.
 License: MIT
 License-File: LICENSE
@@ -70,7 +70,7 @@ Requires-Dist: sqlalchemy (>=1.4,<1.5)
 Requires-Dist: sqlalchemy-utils (<=0.41.2)
 Requires-Dist: sqlean-py (<=3.49.1)
 Requires-Dist: sqlparse
-Requires-Dist: starlette (>=0.49.1)
+Requires-Dist: starlette (>=0.52.1,<1.0.0)
 Requires-Dist: tabulate
 Requires-Dist: toposort
 Requires-Dist: tqdm

{spinta-0.2.dev19 → spinta-0.2.dev21}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "spinta"
-version = "0.2dev19"
+version = "0.2dev21"
 description = "A platform for describing, extracting, transforming, loading and serving open data."
 authors = ["Mantas Zimnickas <sirexas@gmail.com>"]
 license = "MIT"
@@ -55,7 +55,7 @@ requests = "*"
 setuptools = "*"
 setuptools-scm = "*"
 # https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw
-starlette = ">=0.49.1"
+starlette = ">=0.52.1,<1.0.0"
 pydantic = "*"
 toposort = "*"
 tqdm = "*"

spinta-0.2.dev21/spinta/adapters/rc/__init__.py

@@ -0,0 +1 @@
+"""Organization-specific SOAP helpers (e.g. RC broker request signing)."""

spinta-0.2.dev21/spinta/adapters/rc/signature_adapter.py

@@ -0,0 +1,118 @@
+import base64
+import subprocess
+
+from lxml import etree
+
+from spinta.components import Context
+from spinta.core.config import RawConfig
+from spinta.core.ufuncs import Expr
+from spinta.datasets.backends.dataframe.backends.soap.ufuncs.components import SoapQueryBuilder
+from spinta.datasets.backends.dataframe.backends.soap.ufuncs.ufuncs import MakeCDATA
+
+RC_ACTION_TYPE_FIELD = "ActionType"
+RC_CALLER_CODE_FIELD = "CallerCode"
+RC_END_USER_INFO_FIELD = "EndUserInfo"
+RC_PARAMETERS_FIELD = "Parameters"
+RC_TIME_FIELD = "Time"
+
+
+def is_quoted(value: str) -> bool:
+    """True if ``value`` has matching outer ``'`` or ``"`` quotes (Katalogas ``is_quoted``)."""
+    return len(value) > 1 and value[0] == value[-1] and value[0] in ('"', "'")
+
+
+def _require_rc_private_key_path(raw_config: RawConfig | None) -> str:
+    """Return the configured PEM path, or raise if raw config / key path is missing."""
+    if raw_config is None:
+        raise RuntimeError("RC signature adapter was loaded but application configuration is missing.")
+    path = raw_config.get("rc_signature", "private_key_path", default=None)
+    if not path or not str(path).strip():
+        raise RuntimeError(
+            "When using the RC signature SOAP adapter, set `rc_signature.private_key_path` in configuration."
+        )
+    return str(path)
+
+
+def validate_soap_adapter_config(raw_config: RawConfig | None) -> None:
+    """Invoked by soap plugin loader when this module is listed in ``soap_adapter_modules``."""
+    _require_rc_private_key_path(raw_config)
+
+
+def _get_private_key_path(context: Context) -> str:
+    return _require_rc_private_key_path(context.get("rc"))
+
+
+def _compute_rc_signature(args: str, key_path: str) -> str:
+    """Compute RC-style signature using openssl CLI.
+    This mirrors the legacy shell example:
+        echo -n "$ARGS" | openssl dgst -sha256 -sign $PRIVATE_KEY_FILE | base64 -w0
+    """
+    proc = subprocess.run(
+        ["openssl", "dgst", "-sha256", "-sign", key_path],
+        input=args.encode("utf-8"),
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=True,
+    )
+    sig_b64 = base64.b64encode(proc.stdout).decode("ascii")
+
+    return sig_b64.replace("\r", "").replace("\n", "")
+
+
+def build_rc_string_to_sign(soap_body: dict[str, object]) -> str:
+    """Return the plaintext that RC signs and verifies for SOAP calls.
+
+    The broker does not sign the whole XML; it expects an RSA-SHA256 signature over one
+    concatenated string, in this exact order with no delimiters: ActionType, CallerCode,
+    EndUserInfo, Parameters, Time. The server rebuilds the same string and checks the
+    signature, so we must assemble identical pieces from `soap_body`.
+    """
+
+    input_block = soap_body.get("input")
+    input_dict = input_block if isinstance(input_block, dict) else None
+
+    def _get(name: str, default: str = "") -> str:
+        value = soap_body.get(f"input/{name}")
+        if value is None and input_dict is not None:
+            value = input_dict.get(name)
+
+        if value is None:
+            value = soap_body.get(name, default)
+
+        if isinstance(value, MakeCDATA):
+            value = value.data
+
+        if isinstance(value, etree.CDATA):
+            value = str(value)
+
+        if name == RC_PARAMETERS_FIELD and isinstance(value, str) and is_quoted(value):
+            value = value[1:-1]
+
+        return "" if value is None else str(value)
+
+    action_type = _get(RC_ACTION_TYPE_FIELD)
+    caller_code = _get(RC_CALLER_CODE_FIELD)
+    end_user_info = _get(RC_END_USER_INFO_FIELD, "")
+    parameters = _get(RC_PARAMETERS_FIELD, "")
+    time_value = _get(RC_TIME_FIELD)
+
+    return f"{action_type}{caller_code}{end_user_info}{parameters}{time_value}"
+
+
+def compute_rc_signature_from_body(soap_body: dict[str, object], context: Context) -> str:
+    """Build string-to-sign from soap_body and return base64 signature."""
+    key_path = _get_private_key_path(context)
+    args = build_rc_string_to_sign(soap_body)
+
+    return _compute_rc_signature(args, key_path)
+
+
+def get_deferred_prepare_names() -> list[str]:
+    return ["rc_signature"]
+
+
+def get_body_resolvers() -> dict[str, object]:
+    def rc_signature_resolver(env: SoapQueryBuilder, expr: Expr | None = None) -> str:
+        return compute_rc_signature_from_body(env.soap_request_body, env.context)
+
+    return {"rc_signature": rc_signature_resolver}

spinta-0.2.dev21/spinta/adapters/soap_plugins.py

@@ -0,0 +1,122 @@
+"""Load optional SOAP adapter modules from ``soap_adapter_modules`` paths in config."""
+
+import importlib.util
+import logging
+from pathlib import Path
+from types import ModuleType
+from typing import Any, Callable
+
+from spinta.core.ufuncs import Expr, UFuncRegistry
+from spinta.core.config import RawConfig
+from spinta.ufuncs.loadbuilder.components import LoadBuilder
+from spinta.datasets.backends.dataframe.backends.soap.ufuncs.components import SoapQueryBuilder
+
+log = logging.getLogger(__name__)
+
+
+_deferred_prepare_names_cache: set[str] | None = None
+
+
+def get_deferred_prepare_names() -> set[str]:
+    """Names of prepare ufuncs left unresolved until the SOAP body is built (empty before register)."""
+    return _deferred_prepare_names_cache or set()
+
+
+def _load_adapter_module_from_path(file_path: str, raw_config: RawConfig | None = None) -> ModuleType | None:
+    try:
+        path = Path(file_path)
+        if not path.exists():
+            log.warning("SOAP adapter module not found: %s", file_path)
+            return None
+        spec = importlib.util.spec_from_file_location(path.stem, path)
+        if spec is None or spec.loader is None:
+            log.warning("Failed to create module spec for: %s", file_path)
+            return None
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        log.info("Loaded SOAP adapter module from: %s", file_path)
+        if hasattr(module, "validate_soap_adapter_config"):
+            module.validate_soap_adapter_config(raw_config)
+        return module
+    except Exception as e:
+        log.warning("Failed to load SOAP adapter module %s: %s", file_path, e)
+        return None
+
+
+def _load_adapters_from_config(raw_config: RawConfig | None) -> tuple[set[str], dict[str, Callable[..., Any]]]:
+    deferred: set[str] = set()
+    body_resolvers: dict[str, Callable[..., Any]] = {}
+
+    if raw_config is None:
+        return deferred, body_resolvers
+
+    module_paths = raw_config.get("soap_adapter_modules", default=[])
+    if not module_paths:
+        return deferred, body_resolvers
+
+    if isinstance(module_paths, str):
+        module_paths = [module_paths]
+
+    for module_path in module_paths:
+        module = _load_adapter_module_from_path(module_path, raw_config)
+        if module is None:
+            continue
+
+        if hasattr(module, "get_deferred_prepare_names"):
+            try:
+                result = module.get_deferred_prepare_names()
+            except Exception as e:
+                log.warning("Failed to call get_deferred_prepare_names in %s: %s", module_path, e)
+            else:
+                if isinstance(result, (list, tuple)):
+                    deferred.update(result)
+                else:
+                    deferred.add(str(result))
+
+        if hasattr(module, "get_body_resolvers"):
+            try:
+                result = module.get_body_resolvers()
+            except Exception as e:
+                log.warning("Failed to call get_body_resolvers in %s: %s", module_path, e)
+            else:
+                if isinstance(result, dict):
+                    body_resolvers.update(result)
+
+    return deferred, body_resolvers
+
+
+def _deferred_prepare_resolver(env, expr: Expr) -> Expr:
+    env.param.soap_body = {env.this: expr}
+    return expr
+
+
+def _make_body_resolver(callable_fn: Callable[..., Any]) -> Callable[[SoapQueryBuilder, Expr], Any]:
+    """Adapter may implement ``fn(env)`` only; fall back if ``fn(env, expr)`` raises ``TypeError``."""
+
+    def body_resolver(env: SoapQueryBuilder, expr: Expr) -> Any:
+        try:
+            return callable_fn(env, expr)
+        except TypeError:
+            return callable_fn(env)
+
+    return body_resolver
+
+
+def register_soap_ufuncs(registry: UFuncRegistry, raw_config: RawConfig | None = None) -> None:
+    """Register SOAP adapter resolvers from config (`soap_adapter_modules`).
+    Adapters are loaded from local Python files listed in:
+        soap_adapter_modules:
+          - /path/to/adapter.py
+    Call this after resolver.collect().
+    """
+    global _deferred_prepare_names_cache
+
+    deferred, body_resolvers = _load_adapters_from_config(raw_config)
+
+    _deferred_prepare_names_cache = deferred
+
+    for name in deferred:
+        registry.register(name, _deferred_prepare_resolver, (LoadBuilder, Expr))
+
+    for name, callable_fn in body_resolvers.items():
+        registry.register(name, _make_body_resolver(callable_fn), (SoapQueryBuilder, Expr))