stackport 0.2.3__tar.gz → 0.2.5__tar.gz

{stackport-0.2.3/stackport.egg-info → stackport-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackport
-Version: 0.2.3
+Version: 0.2.5
 Summary: Universal AWS resource browser for local emulators
 Author: Davi Reis Vieira
 License: MIT

{stackport-0.2.3 → stackport-0.2.5}/backend/main.py

@@ -58,11 +58,14 @@ class ReadOnlyMiddleware(BaseHTTPMiddleware):
 
     WRITE_METHODS = {"POST", "PUT", "DELETE", "PATCH"}
 
-    # POST endpoints that are read-only (query/invoke operations)
-    READ_ONLY_POST_PATTERNS = (
-        "/api/dynamodb/tables/",  # /tables/{name}/query
-        "/api/lambda/functions/",  # /functions/{name}/invoke
-    )
+    @staticmethod
+    def _is_read_only_post(path: str) -> bool:
+        """POST routes that are reads (not writes). Must not use path prefixes alone — e.g. item CRUD also lives under /api/dynamodb/tables/."""
+        if path.startswith("/api/dynamodb/tables/") and path.endswith("/query"):
+            return True
+        if path.startswith("/api/lambda/functions/") and path.endswith("/invoke"):
+            return True
+        return False
 
     async def dispatch(self, request: Request, call_next):
         if STACKPORT_ALLOW_WRITES:
@@ -74,10 +77,8 @@ class ReadOnlyMiddleware(BaseHTTPMiddleware):
 
         # Allow read-only POST operations (query, invoke)
         path = request.url.path
-        if request.method == "POST":
-            if any(path.startswith(p) for p in self.READ_ONLY_POST_PATTERNS):
-                # These are read operations that happen to use POST
-                return await call_next(request)
+        if request.method == "POST" and self._is_read_only_post(path):
+            return await call_next(request)
 
         # Block all write operations
         return JSONResponse(

{stackport-0.2.3 → stackport-0.2.5}/backend/routes/dynamodb.py

@@ -1,15 +1,75 @@
+import base64
+import json
 import logging
 from typing import Any
 
-from fastapi import APIRouter, Depends, Query
+from boto3.dynamodb.types import TypeSerializer
+from botocore.exceptions import ClientError
+from fastapi import APIRouter, Depends, HTTPException, Query
 
 from backend.aws_client import get_client
 from backend.cache import cache
 from backend.routes.common import get_endpoint_url
-from backend.schemas.dynamodb import QueryRequest
+from backend.schemas.dynamodb import BatchWriteRequest, DeleteItemRequest, PutItemRequest, QueryRequest
 
 logger = logging.getLogger(__name__)
 
+_serializer = TypeSerializer()
+
+
+def _plain_to_dynamodb_item(plain: dict[str, Any]) -> dict[str, Any]:
+    return {k: _serializer.serialize(v) for k, v in plain.items()}
+
+
+def _get_partition_sort_keys(dynamodb: Any, table_name: str) -> tuple[str | None, str | None]:
+    table_resp = dynamodb.describe_table(TableName=table_name)
+    key_schema = table_resp["Table"].get("KeySchema", [])
+    partition_key = next((k["AttributeName"] for k in key_schema if k["KeyType"] == "HASH"), None)
+    sort_key = next((k["AttributeName"] for k in key_schema if k["KeyType"] == "RANGE"), None)
+    return partition_key, sort_key
+
+
+def _require_key_attributes(
+    attrs: dict[str, Any],
+    partition_key: str | None,
+    sort_key: str | None,
+    *,
+    label: str,
+) -> None:
+    if not partition_key:
+        raise HTTPException(status_code=400, detail="Table has no partition key in key schema")
+    if partition_key not in attrs:
+        raise HTTPException(status_code=400, detail=f"Missing {label} attribute: {partition_key!r}")
+    if sort_key and sort_key not in attrs:
+        raise HTTPException(status_code=400, detail=f"Missing {label} attribute: {sort_key!r}")
+
+
+def _coerce_item_dict(raw: dict[str, Any], item_format: str) -> dict[str, Any]:
+    if item_format == "plain":
+        try:
+            return _plain_to_dynamodb_item(raw)
+        except TypeError as e:
+            raise HTTPException(status_code=400, detail=f"Could not convert plain item to DynamoDB types: {e}") from e
+    return raw
+
+
+def _coerce_key_dict(raw: dict[str, Any], item_format: str) -> dict[str, Any]:
+    if item_format == "plain":
+        try:
+            return _plain_to_dynamodb_item(raw)
+        except TypeError as e:
+            raise HTTPException(status_code=400, detail=f"Could not convert plain key to DynamoDB types: {e}") from e
+    return raw
+
+
+def _invalidate_table_item_count(table_name: str, endpoint_url: str | None) -> None:
+    cache.delete(f"{endpoint_url}:dynamodb:item_count:{table_name}")
+
+
+def _client_error_message(exc: ClientError) -> str:
+    err = exc.response.get("Error", {})
+    return err.get("Message", err.get("Code", str(exc)))
+
 router = APIRouter()
 
 
@@ -121,9 +181,6 @@ def scan_table(
     }
 
     if exclusive_start_key:
-        import base64
-        import json
-
         try:
             decoded = base64.b64decode(exclusive_start_key).decode("utf-8")
             scan_params["ExclusiveStartKey"] = json.loads(decoded)
@@ -137,9 +194,6 @@ def scan_table(
         last_evaluated_key = resp.get("LastEvaluatedKey")
         next_token = None
         if last_evaluated_key:
-            import base64
-            import json
-
             next_token = base64.b64encode(json.dumps(last_evaluated_key).encode("utf-8")).decode("utf-8")
 
         return {
@@ -212,3 +266,99 @@ def query_table(name: str, request: QueryRequest, endpoint_url: str | None = Dep
     except Exception as e:
         logger.error("Failed to query table %s: %s", name, e, exc_info=True)
         return {"error": str(e), "items": [], "count": 0}
+
+
+@router.api_route("/tables/{name}/items", methods=["POST", "PUT"])
+def put_table_item(
+    name: str,
+    request: PutItemRequest,
+    endpoint_url: str | None = Depends(get_endpoint_url),
+) -> dict[str, Any]:
+    """Create or replace an item (DynamoDB PutItem)."""
+    dynamodb = get_client("dynamodb", endpoint_url)
+    try:
+        partition_key, sort_key = _get_partition_sort_keys(dynamodb, name)
+    except Exception as e:
+        logger.error("put_item describe failed for %s: %s", name, e, exc_info=True)
+        raise HTTPException(status_code=400, detail=f"Failed to read table: {e}") from e
+
+    item = _coerce_item_dict(request.item, request.item_format)
+    _require_key_attributes(item, partition_key, sort_key, label="item")
+
+    try:
+        dynamodb.put_item(TableName=name, Item=item)
+    except ClientError as e:
+        msg = _client_error_message(e)
+        logger.error("put_item %s: %s", name, e, exc_info=True)
+        raise HTTPException(status_code=400, detail=msg) from e
+
+    _invalidate_table_item_count(name, endpoint_url)
+    return {"ok": True, "table": name}
+
+
+@router.delete("/tables/{name}/items")
+def delete_table_item(
+    name: str,
+    request: DeleteItemRequest,
+    endpoint_url: str | None = Depends(get_endpoint_url),
+) -> dict[str, Any]:
+    dynamodb = get_client("dynamodb", endpoint_url)
+    try:
+        partition_key, sort_key = _get_partition_sort_keys(dynamodb, name)
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=f"Failed to read table: {e}") from e
+
+    key = _coerce_key_dict(request.key, request.item_format)
+    _require_key_attributes(key, partition_key, sort_key, label="key")
+
+    try:
+        dynamodb.delete_item(TableName=name, Key=key)
+    except ClientError as e:
+        msg = _client_error_message(e)
+        raise HTTPException(status_code=400, detail=msg) from e
+
+    _invalidate_table_item_count(name, endpoint_url)
+    return {"ok": True, "table": name}
+
+
+@router.post("/tables/{name}/items/batch")
+def batch_write_items(
+    name: str,
+    request: BatchWriteRequest,
+    endpoint_url: str | None = Depends(get_endpoint_url),
+) -> dict[str, Any]:
+    dynamodb = get_client("dynamodb", endpoint_url)
+    try:
+        partition_key, sort_key = _get_partition_sort_keys(dynamodb, name)
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=f"Failed to read table: {e}") from e
+
+    batch_requests: list[dict[str, Any]] = []
+    for op in request.operations:
+        if op.op == "put":
+            item = _coerce_item_dict(op.item, request.item_format)
+            _require_key_attributes(item, partition_key, sort_key, label="item")
+            batch_requests.append({"PutRequest": {"Item": item}})
+        else:
+            key = _coerce_key_dict(op.key, request.item_format)
+            _require_key_attributes(key, partition_key, sort_key, label="key")
+            batch_requests.append({"DeleteRequest": {"Key": key}})
+
+    try:
+        resp = dynamodb.batch_write_item(RequestItems={name: batch_requests})
+    except ClientError as e:
+        msg = _client_error_message(e)
+        raise HTTPException(status_code=400, detail=msg) from e
+
+    _invalidate_table_item_count(name, endpoint_url)
+
+    uproc = resp.get("UnprocessedItems", {})
+    if uproc:
+        return {
+            "ok": True,
+            "table": name,
+            "unprocessed": uproc,
+            "message": "Some items were not processed; retry with returned keys.",
+        }
+
+    return {"ok": True, "table": name, "unprocessed": {}}

{stackport-0.2.3 → stackport-0.2.5}/backend/routes/resources.py

@@ -66,6 +66,7 @@ DESCRIBE_REGISTRY: dict[tuple[str, str], tuple[str, str, str, str | None]] = {
     ("glue", "crawlers"): ("glue", "get_crawler", "Name", "Crawler"),
     ("athena", "workgroups"): ("athena", "get_work_group", "WorkGroup", "WorkGroup"),
     # API
+    ("apigateway", "rest_apis"): ("apigateway", "get_rest_api", "restApiId", None),
     ("apigateway", "apis"): ("apigatewayv2", "get_api", "ApiId", None),
     ("appsync", "graphql_apis"): ("appsync", "get_graphql_api", "apiId", "graphqlApi"),
     # EMR
@@ -79,6 +80,10 @@ _PREFERRED_ID_FIELD: dict[tuple[str, str], str] = {
     ("events", "rules"): "Name",
     ("events", "event_buses"): "Name",
     ("wafv2", "web_acls"): "Name",
+    ("appsync", "graphql_apis"): "apiId",
+    ("elasticmapreduce", "clusters"): "Id",
+    ("cognito-idp", "user_pools"): "Id",
+    ("apigateway", "rest_apis"): "id",
 }
 
 # Known ID field names for extracting a resource identifier from list results
@@ -126,6 +131,8 @@ _ID_FIELDS = [
     "CrawlerName",
     "DatabaseName",
     "DistributionId",
+    "apiId",
+    "ClusterId",
 ]
 
 
@@ -201,6 +208,29 @@ def get_resource_detail(service: str, res_type: str, res_id: str, endpoint_url:
     if cached is not None:
         return cached
 
+    # SES identities are plain strings — aggregate detail from multiple APIs
+    if (service, res_type) == ("ses", "identities"):
+        try:
+            client = get_client("ses", endpoint_url)
+            verif = client.get_identity_verification_attributes(Identities=[res_id])
+            attrs = verif.get("VerificationAttributes", {}).get(res_id, {})
+            dkim = client.get_identity_dkim_attributes(Identities=[res_id])
+            dkim_attrs = dkim.get("DkimAttributes", {}).get(res_id, {})
+            detail = _serialize({
+                "Identity": res_id,
+                "VerificationStatus": attrs.get("VerificationStatus", "Unknown"),
+                "VerificationToken": attrs.get("VerificationToken"),
+                "DkimEnabled": dkim_attrs.get("DkimEnabled", False),
+                "DkimVerificationStatus": dkim_attrs.get("DkimVerificationStatus", "Unknown"),
+                "DkimTokens": dkim_attrs.get("DkimTokens", []),
+            })
+            result = {"service": service, "type": res_type, "id": res_id, "detail": detail}
+            cache.set(cache_key, result, ttl=5)
+            return result
+        except Exception as exc:
+            logger.warning("Failed to get detail for %s/%s/%s", service, res_type, res_id, exc_info=True)
+            raise HTTPException(status_code=500, detail=str(exc)) from exc
+
     # WAFv2 get_web_acl requires Name, Scope, AND Id — resolve Id from list first
     if (service, res_type) == ("wafv2", "web_acls"):
         try:

{stackport-0.2.3 → stackport-0.2.5}/backend/routes/stats.py

@@ -75,7 +75,10 @@ SERVICE_REGISTRY: dict[str, list[tuple[str, str, str, str]]] = {
         ("crawlers", "glue", "get_crawlers", "Crawlers"),
     ],
     "athena": [("workgroups", "athena", "list_work_groups", "WorkGroups")],
-    "apigateway": [("apis", "apigatewayv2", "get_apis", "Items")],
+    "apigateway": [
+        ("rest_apis", "apigateway", "get_rest_apis", "items"),
+        ("apis", "apigatewayv2", "get_apis", "Items"),
+    ],
     "firehose": [("delivery_streams", "firehose", "list_delivery_streams", "DeliveryStreamNames")],
     "cognito-idp": [("user_pools", "cognito-idp", "list_user_pools", "UserPools")],
     "cognito-identity": [("identity_pools", "cognito-identity", "list_identity_pools", "IdentityPools")],

{stackport-0.2.3 → stackport-0.2.5}/backend/routes/tags.py

@@ -356,6 +356,52 @@ def _set_tags_elasticache_cluster(client: Any, resource_id: str, tags: dict[str,
         client.add_tags_to_resource(ResourceName=arn, Tags=tag_list)
 
 
+def _get_tags_cognito_idp_user_pool(client: Any, resource_id: str) -> dict[str, str]:
+    pool = client.describe_user_pool(UserPoolId=resource_id)
+    arn = pool["UserPool"]["Arn"]
+    resp = client.list_tags_for_resource(ResourceArn=arn)
+    return resp.get("Tags", {})
+
+
+def _get_tags_emr_cluster(client: Any, resource_id: str) -> dict[str, str]:
+    resp = client.describe_cluster(ClusterId=resource_id)
+    return {t["Key"]: t["Value"] for t in resp["Cluster"].get("Tags", [])}
+
+
+def _get_tags_apigateway_rest_api(client: Any, resource_id: str) -> dict[str, str]:
+    arn = f"arn:aws:apigateway:{client.meta.region_name}::/restapis/{resource_id}"
+    resp = client.get_tags(resourceArn=arn)
+    return resp.get("tags", {})
+
+
+def _set_tags_cognito_idp_user_pool(client: Any, resource_id: str, tags: dict[str, str]) -> None:
+    pool = client.describe_user_pool(UserPoolId=resource_id)
+    arn = pool["UserPool"]["Arn"]
+    existing = client.list_tags_for_resource(ResourceArn=arn).get("Tags", {})
+    if existing:
+        client.untag_resource(ResourceArn=arn, TagKeys=list(existing.keys()))
+    if tags:
+        client.tag_resource(ResourceArn=arn, Tags=tags)
+
+
+def _set_tags_emr_cluster(client: Any, resource_id: str, tags: dict[str, str]) -> None:
+    existing = _get_tags_emr_cluster(client, resource_id)
+    if existing:
+        client.remove_tags(ResourceId=resource_id, TagKeys=list(existing.keys()))
+    if tags:
+        tag_list = [{"Key": k, "Value": v} for k, v in tags.items()]
+        client.add_tags(ResourceId=resource_id, Tags=tag_list)
+
+
+def _set_tags_apigateway_rest_api(client: Any, resource_id: str, tags: dict[str, str]) -> None:
+    arn = f"arn:aws:apigateway:{client.meta.region_name}::/restapis/{resource_id}"
+    existing = client.get_tags(resourceArn=arn).get("tags", {})
+    if existing:
+        client.untag_resource(resourceArn=arn, tagKeys=list(existing.keys()))
+    if tags:
+        client.tag_resource(resourceArn=arn, tags=tags)
+
+
 # --- Registries ---
 
 TAG_GETTER_REGISTRY: dict[tuple[str, str], tuple[str, Any]] = {
@@ -380,6 +426,9 @@ TAG_GETTER_REGISTRY: dict[tuple[str, str], tuple[str, Any]] = {
     ("ssm", "parameters"): ("ssm", _get_tags_ssm_parameter),
     ("elasticloadbalancing", "load_balancers"): ("elbv2", _get_tags_elbv2_load_balancer),
     ("elasticache", "cache_clusters"): ("elasticache", _get_tags_elasticache_cluster),
+    ("cognito-idp", "user_pools"): ("cognito-idp", _get_tags_cognito_idp_user_pool),
+    ("elasticmapreduce", "clusters"): ("emr", _get_tags_emr_cluster),
+    ("apigateway", "rest_apis"): ("apigateway", _get_tags_apigateway_rest_api),
 }
 
 TAG_SETTER_REGISTRY: dict[tuple[str, str], tuple[str, Any]] = {
@@ -403,6 +452,9 @@ TAG_SETTER_REGISTRY: dict[tuple[str, str], tuple[str, Any]] = {
     ("ssm", "parameters"): ("ssm", _set_tags_ssm_parameter),
     ("elasticloadbalancing", "load_balancers"): ("elbv2", _set_tags_elbv2_load_balancer),
     ("elasticache", "cache_clusters"): ("elasticache", _set_tags_elasticache_cluster),
+    ("cognito-idp", "user_pools"): ("cognito-idp", _set_tags_cognito_idp_user_pool),
+    ("elasticmapreduce", "clusters"): ("emr", _set_tags_emr_cluster),
+    ("apigateway", "rest_apis"): ("apigateway", _set_tags_apigateway_rest_api),
 }
 
 # Delete registry: (service, type) -> (boto3_service, callable(client, resource_id))

stackport-0.2.5/backend/schemas/dynamodb.py

@@ -0,0 +1,37 @@
+"""Pydantic schemas for DynamoDB API requests."""
+
+from typing import Any, Literal, Union
+
+from pydantic import BaseModel, Field
+
+
+class QueryRequest(BaseModel):
+    partition_key_value: str
+    sort_key_value: str | None = None
+    sort_key_operator: str = "="  # =, <, <=, >, >=, BETWEEN, BEGINS_WITH
+    limit: int = 25
+
+
+class PutItemRequest(BaseModel):
+    item: dict[str, Any]
+    item_format: Literal["dynamodb", "plain"] = "dynamodb"
+
+
+class DeleteItemRequest(BaseModel):
+    key: dict[str, Any]
+    item_format: Literal["dynamodb", "plain"] = "dynamodb"
+
+
+class _BatchOpPut(BaseModel):
+    op: Literal["put"] = "put"
+    item: dict[str, Any]
+
+
+class _BatchOpDelete(BaseModel):
+    op: Literal["delete"] = "delete"
+    key: dict[str, Any]
+
+
+class BatchWriteRequest(BaseModel):
+    item_format: Literal["dynamodb", "plain"] = "dynamodb"
+    operations: list[Union[_BatchOpPut, _BatchOpDelete]] = Field(min_length=1, max_length=25)

{stackport-0.2.3 → stackport-0.2.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stackport"
-version = "0.2.3"
+version = "0.2.5"
 description = "Universal AWS resource browser for local emulators"
 readme = "README.md"
 license = {text = "MIT"}

{stackport-0.2.3 → stackport-0.2.5/stackport.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackport
-Version: 0.2.3
+Version: 0.2.5
 Summary: Universal AWS resource browser for local emulators
 Author: Davi Reis Vieira
 License: MIT

{stackport-0.2.3 → stackport-0.2.5}/stackport.egg-info/SOURCES.txt

@@ -12,8 +12,8 @@ backend/websocket.py
 backend/../ui/dist/favicon.png
 backend/../ui/dist/favicon.svg
 backend/../ui/dist/index.html
-backend/../ui/dist/assets/index-B2xjVeE-.js
-backend/../ui/dist/assets/index-D_vb_J84.css
+backend/../ui/dist/assets/index-BXF-C5Pz.js
+backend/../ui/dist/assets/index-MwTr-ebs.css
 backend/../ui/dist/aws-icons/acm.svg
 backend/../ui/dist/aws-icons/apigateway.svg
 backend/../ui/dist/aws-icons/appsync.svg
@@ -96,8 +96,8 @@ tests/test_websocket.py
 ui/dist/favicon.png
 ui/dist/favicon.svg
 ui/dist/index.html
-ui/dist/assets/index-B2xjVeE-.js
-ui/dist/assets/index-D_vb_J84.css
+ui/dist/assets/index-BXF-C5Pz.js
+ui/dist/assets/index-MwTr-ebs.css
 ui/dist/aws-icons/acm.svg
 ui/dist/aws-icons/apigateway.svg
 ui/dist/aws-icons/appsync.svg

{stackport-0.2.3 → stackport-0.2.5}/tests/test_dynamodb_routes.py

@@ -253,3 +253,157 @@ class TestQueryTable:
         # Verify the query used begins_with
         call_kwargs = mock_ddb.query.call_args[1]
         assert "begins_with" in call_kwargs["KeyConditionExpression"]
+
+
+class TestItemWrites:
+    @patch("backend.routes.dynamodb.get_client")
+    def test_put_item_dynamodb(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        mock_ddb.describe_table.return_value = {
+            "Table": {
+                "KeySchema": [{"AttributeName": "pk", "KeyType": "HASH"}],
+                "AttributeDefinitions": [{"AttributeName": "pk", "AttributeType": "S"}],
+            }
+        }
+
+        resp = client.put(
+            "/api/dynamodb/tables/t1/items",
+            json={"item": {"pk": {"S": "a"}, "name": {"S": "X"}}, "item_format": "dynamodb"},
+        )
+        assert resp.status_code == 200
+        assert resp.json()["ok"] is True
+        mock_ddb.put_item.assert_called_once()
+        call_kw = mock_ddb.put_item.call_args[1]
+        assert call_kw["TableName"] == "t1"
+        assert call_kw["Item"]["pk"]["S"] == "a"
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_put_item_plain(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        mock_ddb.describe_table.return_value = {
+            "Table": {
+                "KeySchema": [{"AttributeName": "pk", "KeyType": "HASH"}],
+                "AttributeDefinitions": [{"AttributeName": "pk", "AttributeType": "S"}],
+            }
+        }
+
+        resp = client.post(
+            "/api/dynamodb/tables/t1/items",
+            json={"item": {"pk": "hello", "n": 42}, "item_format": "plain"},
+        )
+        assert resp.status_code == 200
+        it = mock_ddb.put_item.call_args[1]["Item"]
+        assert it["pk"]["S"] == "hello"
+        assert it["n"]["N"] == "42"
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_put_item_missing_key_returns_400(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        mock_ddb.describe_table.return_value = {
+            "Table": {
+                "KeySchema": [
+                    {"AttributeName": "pk", "KeyType": "HASH"},
+                    {"AttributeName": "sk", "KeyType": "RANGE"},
+                ],
+                "AttributeDefinitions": [
+                    {"AttributeName": "pk", "AttributeType": "S"},
+                    {"AttributeName": "sk", "AttributeType": "S"},
+                ],
+            }
+        }
+
+        resp = client.post(
+            "/api/dynamodb/tables/t1/items",
+            json={"item": {"pk": {"S": "a"}}, "item_format": "dynamodb"},
+        )
+        assert resp.status_code == 400
+        assert "sort" in resp.json()["detail"].lower() or "sk" in resp.json()["detail"].lower()
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_delete_item(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        mock_ddb.describe_table.return_value = {
+            "Table": {
+                "KeySchema": [{"AttributeName": "pk", "KeyType": "HASH"}],
+                "AttributeDefinitions": [{"AttributeName": "pk", "AttributeType": "S"}],
+            }
+        }
+
+        resp = client.request(
+            "DELETE",
+            "/api/dynamodb/tables/t1/items",
+            json={"key": {"pk": {"S": "a"}}, "item_format": "dynamodb"},
+        )
+        assert resp.status_code == 200
+        call_kw = mock_ddb.delete_item.call_args[1]
+        assert call_kw["Key"]["pk"]["S"] == "a"
+        assert call_kw["TableName"] == "t1"
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_batch_write(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        mock_ddb.describe_table.return_value = {
+            "Table": {
+                "KeySchema": [{"AttributeName": "pk", "KeyType": "HASH"}],
+                "AttributeDefinitions": [{"AttributeName": "pk", "AttributeType": "S"}],
+            }
+        }
+        mock_ddb.batch_write_item.return_value = {"UnprocessedItems": {}}
+
+        resp = client.post(
+            "/api/dynamodb/tables/t1/items/batch",
+            json={
+                "item_format": "dynamodb",
+                "operations": [
+                    {"op": "put", "item": {"pk": {"S": "1"}}},
+                    {"op": "delete", "key": {"pk": {"S": "2"}}},
+                ],
+            },
+        )
+        assert resp.status_code == 200
+        req = mock_ddb.batch_write_item.call_args[1]["RequestItems"]
+        assert "t1" in req
+        assert len(req["t1"]) == 2
+        assert "PutRequest" in req["t1"][0]
+        assert "DeleteRequest" in req["t1"][1]
+
+    @patch("backend.routes.dynamodb.cache.delete")
+    @patch("backend.routes.dynamodb.get_client")
+    def test_batch_write_partial_invalidates_cache(self, mock_get_client, mock_cache_delete):
+        """Cache must be invalidated even when some items are unprocessed,
+        because items NOT listed in UnprocessedItems were already written."""
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        mock_ddb.describe_table.return_value = {
+            "Table": {
+                "KeySchema": [{"AttributeName": "pk", "KeyType": "HASH"}],
+                "AttributeDefinitions": [{"AttributeName": "pk", "AttributeType": "S"}],
+            }
+        }
+        unprocessed = {"t1": [{"PutRequest": {"Item": {"pk": {"S": "1"}}}}]}
+        mock_ddb.batch_write_item.return_value = {"UnprocessedItems": unprocessed}
+
+        resp = client.post(
+            "/api/dynamodb/tables/t1/items/batch",
+            json={
+                "item_format": "dynamodb",
+                "operations": [
+                    {"op": "put", "item": {"pk": {"S": "1"}}},
+                    {"op": "put", "item": {"pk": {"S": "2"}}},
+                ],
+            },
+        )
+        assert resp.status_code == 200
+        body = resp.json()
+        assert body["unprocessed"] == unprocessed
+        assert "message" in body
+
+        cache_keys = [c.args[0] for c in mock_cache_delete.call_args_list]
+        assert any(k.endswith(":dynamodb:item_count:t1") for k in cache_keys), (
+            f"expected item_count cache invalidation, got calls: {cache_keys}"
+        )

{stackport-0.2.3 → stackport-0.2.5}/tests/test_readonly_middleware.py

@@ -88,6 +88,26 @@ class TestReadOnlyMiddleware:
             # Should NOT be blocked by middleware
             assert resp.status_code != 403
 
+    def test_dynamodb_item_write_post_blocked_when_writes_disabled(self):
+        """POST to item write paths must be blocked (not whitelisted like /query)."""
+        with patch("backend.main.STACKPORT_ALLOW_WRITES", False):
+            from backend.main import app
+
+            client = TestClient(app, raise_server_exceptions=False)
+
+            resp = client.post(
+                "/api/dynamodb/tables/t/items",
+                json={"item": {"pk": {"S": "a"}}, "item_format": "dynamodb"},
+            )
+            assert resp.status_code == 403
+            assert "disabled" in resp.json()["detail"].lower()
+
+            resp = client.post(
+                "/api/dynamodb/tables/t/items/batch",
+                json={"requests": []},
+            )
+            assert resp.status_code == 403
+
     def test_writes_allowed_when_enabled(self):
         """All write operations work when STACKPORT_ALLOW_WRITES=true."""
         with patch("backend.main.STACKPORT_ALLOW_WRITES", True):