stackport 0.4.3__tar.gz → 0.4.5__tar.gz

{stackport-0.4.3/stackport.egg-info → stackport-0.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackport
-Version: 0.4.3
+Version: 0.4.5
 Summary: Universal AWS resource browser for local emulators
 Author: Davi Reis Vieira
 License: MIT

{stackport-0.4.3 → stackport-0.4.5}/backend/main.py

@@ -17,7 +17,7 @@ from botocore.exceptions import (
 )
 
 from backend.config import LOG_LEVEL, STACKPORT_ALLOW_WRITES, STACKPORT_LEARN, STACKPORT_PORT
-from backend.routes import dynamodb, ec2, endpoints, iam, lambda_svc, learn, logs, monitoring, resources, rds, s3, secretsmanager, sns, sqs, stats, stepfunctions, tags
+from backend.routes import dynamodb, ec2, endpoints, iam, lambda_svc, learn, logs, monitoring, resources, rds, s3, secretsmanager, sns, sqs, stats, stepfunctions, tags, kms
 from backend.websocket import logs_tail_endpoint, probe_loop, websocket_endpoint
 
 
@@ -137,6 +137,7 @@ app.include_router(resources.router, prefix="/api")
 app.include_router(rds.router, prefix="/api/rds", tags=["rds"])
 app.include_router(monitoring.router, prefix="/api/monitoring", tags=["monitoring"])
 app.include_router(sns.router, prefix="/api/sns", tags=["sns"])
+app.include_router(kms.router, prefix="/api/kms", tags=["kms"])
 if STACKPORT_LEARN:
     app.include_router(learn.router, prefix="/api/learn", tags=["learn"])
 

{stackport-0.4.3 → stackport-0.4.5}/backend/routes/dynamodb.py

@@ -1,4 +1,5 @@
 import base64
+import binascii
 import json
 import logging
 from typing import Any
@@ -27,6 +28,58 @@ def _plain_to_dynamodb_item(plain: dict[str, Any]) -> dict[str, Any]:
     return {k: _serializer.serialize(v) for k, v in plain.items()}
 
 
+# Binary (B / BS) travels as base64 over StackPort's HTTP API, the same way AWS
+# writes it in DynamoDB JSON. boto3 hands us raw bytes, which JSON cannot carry.
+
+
+def _to_json_safe(obj: Any) -> Any:
+    """Replace every bytes value with its base64 text. Safe to apply to whole
+    low-level responses: DynamoDB only returns bytes inside B and BS."""
+    if isinstance(obj, (bytes, bytearray)):
+        return base64.b64encode(obj).decode("ascii")
+    if isinstance(obj, dict):
+        return {k: _to_json_safe(v) for k, v in obj.items()}
+    if isinstance(obj, list):
+        return [_to_json_safe(v) for v in obj]
+    return obj
+
+
+def _b64_to_bytes(value: Any, name: str) -> bytes:
+    if isinstance(value, (bytes, bytearray)):
+        return bytes(value)
+    try:
+        return base64.b64decode(value, validate=True)
+    except (binascii.Error, TypeError, ValueError) as e:
+        raise HTTPException(status_code=400, detail=f"Attribute {name!r} is not valid base64 for type B") from e
+
+
+def _attr_from_json(av: Any, name: str) -> Any:
+    """Inverse of _to_json_safe for one DynamoDB attribute value. Type-aware, so
+    strings under S stay strings and only B / BS are decoded."""
+    if not isinstance(av, dict):
+        return av
+    if "B" in av:
+        return {**av, "B": _b64_to_bytes(av["B"], name)}
+    if "BS" in av and isinstance(av["BS"], list):
+        return {**av, "BS": [_b64_to_bytes(v, name) for v in av["BS"]]}
+    if "L" in av and isinstance(av["L"], list):
+        return {**av, "L": [_attr_from_json(v, name) for v in av["L"]]}
+    if "M" in av and isinstance(av["M"], dict):
+        return {**av, "M": {k: _attr_from_json(v, f"{name}.{k}") for k, v in av["M"].items()}}
+    return av
+
+
+def _item_from_json(item: dict[str, Any]) -> dict[str, Any]:
+    return {k: _attr_from_json(v, k) for k, v in item.items()}
+
+
+def _key_value(attr_type: str, value: str, name: str) -> dict[str, Any]:
+    """Typed key value for a query condition. Binary keys arrive as base64."""
+    if attr_type == "B":
+        return {"B": _b64_to_bytes(value, name)}
+    return {attr_type: value}
+
+
 def _get_partition_sort_keys(dynamodb: Any, table_name: str) -> tuple[str | None, str | None]:
     table_resp = dynamodb.describe_table(TableName=table_name)
     key_schema = table_resp["Table"].get("KeySchema", [])
@@ -56,7 +109,7 @@ def _coerce_item_dict(raw: dict[str, Any], item_format: str) -> dict[str, Any]:
             return _plain_to_dynamodb_item(raw)
         except TypeError as e:
             raise HTTPException(status_code=400, detail=f"Could not convert plain item to DynamoDB types: {e}") from e
-    return raw
+    return _item_from_json(raw)
 
 
 def _coerce_key_dict(raw: dict[str, Any], item_format: str) -> dict[str, Any]:
@@ -65,7 +118,7 @@ def _coerce_key_dict(raw: dict[str, Any], item_format: str) -> dict[str, Any]:
             return _plain_to_dynamodb_item(raw)
         except TypeError as e:
             raise HTTPException(status_code=400, detail=f"Could not convert plain key to DynamoDB types: {e}") from e
-    return raw
+    return _item_from_json(raw)
 
 
 def _invalidate_table_item_count(table_name: str, endpoint_url: str | None) -> None:
@@ -237,7 +290,7 @@ def scan_table(
     if exclusive_start_key:
         try:
             decoded = base64.b64decode(exclusive_start_key).decode("utf-8")
-            scan_params["ExclusiveStartKey"] = json.loads(decoded)
+            scan_params["ExclusiveStartKey"] = _item_from_json(json.loads(decoded))
         except Exception:
             logger.debug("Invalid exclusive_start_key", exc_info=True)
 
@@ -248,11 +301,11 @@ def scan_table(
         last_evaluated_key = resp.get("LastEvaluatedKey")
         next_token = None
         if last_evaluated_key:
-            next_token = base64.b64encode(json.dumps(last_evaluated_key).encode("utf-8")).decode("utf-8")
+            next_token = base64.b64encode(json.dumps(_to_json_safe(last_evaluated_key)).encode("utf-8")).decode("utf-8")
 
         return {
             "table": name,
-            "items": items,
+            "items": _to_json_safe(items),
             "count": len(items),
             "scanned_count": resp.get("ScannedCount", len(items)),
             "next_token": next_token,
@@ -285,19 +338,19 @@ def query_table(name: str, request: QueryRequest, ep: EndpointInfo = Depends(get
         # Build key condition expression
         key_condition = f"#{partition_key} = :pk"
         expression_attr_names = {f"#{partition_key}": partition_key}
-        expression_attr_values = {":pk": {partition_key_type: request.partition_key_value}}
+        expression_attr_values = {":pk": _key_value(partition_key_type, request.partition_key_value, partition_key)}
 
         if sort_key and request.sort_key_value:
             sort_key_type = attribute_defs.get(sort_key, "S")
             if request.sort_key_operator == "=":
                 key_condition += f" AND #{sort_key} = :sk"
-                expression_attr_values[":sk"] = {sort_key_type: request.sort_key_value}
+                expression_attr_values[":sk"] = _key_value(sort_key_type, request.sort_key_value, sort_key)
             elif request.sort_key_operator in ("<", "<=", ">", ">="):
                 key_condition += f" AND #{sort_key} {request.sort_key_operator} :sk"
-                expression_attr_values[":sk"] = {sort_key_type: request.sort_key_value}
+                expression_attr_values[":sk"] = _key_value(sort_key_type, request.sort_key_value, sort_key)
             elif request.sort_key_operator == "BEGINS_WITH":
                 key_condition += f" AND begins_with(#{sort_key}, :sk)"
-                expression_attr_values[":sk"] = {sort_key_type: request.sort_key_value}
+                expression_attr_values[":sk"] = _key_value(sort_key_type, request.sort_key_value, sort_key)
             expression_attr_names[f"#{sort_key}"] = sort_key
 
         query_params = {
@@ -313,10 +366,12 @@ def query_table(name: str, request: QueryRequest, ep: EndpointInfo = Depends(get
 
         return {
             "table": name,
-            "items": items,
+            "items": _to_json_safe(items),
             "count": len(items),
             "scanned_count": resp.get("ScannedCount", len(items)),
         }
+    except HTTPException:
+        raise
     except Exception as e:
         logger.error("Failed to query table %s: %s", name, e, exc_info=True)
         return {"error": str(e), "items": [], "count": 0}
@@ -411,7 +466,7 @@ def batch_write_items(
         return {
             "ok": True,
             "table": name,
-            "unprocessed": uproc,
+            "unprocessed": _to_json_safe(uproc),
             "message": "Some items were not processed; retry with returned keys.",
         }
 

stackport-0.4.5/backend/routes/kms.py

@@ -0,0 +1,163 @@
+from fastapi import APIRouter, Depends, HTTPException
+from backend.routes.common import EndpointInfo, get_endpoint_info
+from backend.aws_client import get_client
+import json, logging
+from botocore.exceptions import ClientError
+
+router = APIRouter()
+
+logger = logging.getLogger(__name__)
+
+
+@router.get("/keys")
+def list_keys(ep: EndpointInfo = Depends(get_endpoint_info)):
+    """List all KMS keys with basic information"""
+    try:
+        client = get_client("kms", **ep.client_kwargs())
+        paginator = client.get_paginator("list_keys")
+
+        all_keys = []
+
+        for pages in paginator.paginate():
+            for key in pages["Keys"]:
+                key_id = key["KeyId"]
+
+                metadata = client.describe_key(KeyId=key_id)["KeyMetadata"]
+
+                all_keys.append(
+                    {
+                        "status": metadata["KeyState"],
+                        "creationDate": metadata["CreationDate"],
+                        "keySpec": metadata["KeySpec"],
+                        "keyUsage": metadata["KeyUsage"],
+                        "keyID": key_id,
+                        "keyArn": metadata["Arn"],
+                    }
+                )
+
+        return {"keys": all_keys}
+    except Exception as e:
+        logger.error("Failed to list keys with metadata %s", id, exc_info=True)
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/keys/{id}")
+def get_key_detail(id: str, ep: EndpointInfo = Depends(get_endpoint_info)):
+    "Get detailed information for a specific kms key."
+    try:
+        client = get_client("kms", **ep.client_kwargs())
+        metadata = client.describe_key(KeyId=id)["KeyMetadata"]
+        tags = client.list_resource_tags(KeyId=id)
+        rotation_status = client.get_key_rotation_status(KeyId=id)
+        return {
+            "status": metadata["KeyState"],
+            "expiresAt": metadata.get("ValidTo"),
+            "origin": metadata["Origin"],
+            "description": metadata.get("Description"),
+            "tags": tags["Tags"],
+            "rotationStatus": {
+                "keyRotationEnabled": rotation_status["KeyRotationEnabled"],
+                "rotationPeriodInDays": rotation_status.get("RotationPeriodInDays"),
+                "nextRotationDate": rotation_status.get("NextRotationDate"),
+                "onDemandRotationStartDate": rotation_status.get(
+                    "OnDemandRotationStartDate"
+                ),
+            },
+        }
+    except HTTPException:
+        raise
+    except ClientError as e:
+        error_code = e.response["Error"]["Code"]
+        if error_code == "NotFoundException":
+            raise HTTPException(status_code=404, detail=f"Key {id} not found")
+        raise HTTPException(status_code=500, detail=str(e))
+    except Exception as e:
+        logger.error("Failed to get details for %s", id, exc_info=True)
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/keys/{id}/policy")
+def get_key_policy(id: str, ep: EndpointInfo = Depends(get_endpoint_info)):
+    "Get key policy for a specific kms key"
+    try:
+        client = get_client("kms", **ep.client_kwargs())
+        policy = client.get_key_policy(KeyId=id)
+        policy = json.loads(policy["Policy"])
+        return policy
+    except HTTPException:
+        raise
+    except ClientError as e:
+        error_code = e.response["Error"]["Code"]
+        if error_code == "NotFoundException":
+            raise HTTPException(status_code=404, detail=f"Key {id} not found")
+        raise HTTPException(status_code=500, detail=str(e))
+    except Exception as e:
+        logger.error("Failed to get policy document for %s", id, exc_info=True)
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/keys/{id}/grants")
+def list_grants(id: str, ep: EndpointInfo = Depends(get_endpoint_info)):
+    "List grants for a specific key"
+    try:
+        client = get_client("kms", **ep.client_kwargs())
+        paginator = client.get_paginator("list_grants")
+
+        all_grants = []
+        for pages in paginator.paginate(KeyId=id):
+            for grant in pages["Grants"]:
+                all_grants.append(
+                    {
+                        "grantID": grant["GrantId"],
+                        "grantee": grant["GranteePrincipal"],
+                        "operations": grant["Operations"],
+                        "creationDate": grant["CreationDate"],
+                    }
+                )
+
+        return all_grants
+    except HTTPException:
+        raise
+    except ClientError as e:
+        error_code = e.response["Error"]["Code"]
+        if error_code == "NotFoundException":
+            raise HTTPException(status_code=404, detail=f"Key {id} not found")
+        if error_code == "InvalidAction":
+            logger.warning(
+                "ListGrants is not supported by the configured KMS backend",
+                exc_info=True,
+            )
+            return []
+        raise HTTPException(status_code=500, detail=str(e))
+    except Exception as e:
+        logger.error("Failed to list grants for %s", id, exc_info=True)
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/keys/{id}/aliases")
+def get_aliases_detail(id: str, ep: EndpointInfo = Depends(get_endpoint_info)):
+    try:
+        client = get_client("kms", **ep.client_kwargs())
+        paginator = client.get_paginator("list_aliases")
+
+        all_aliases = []
+        for pages in paginator.paginate(KeyId=id):
+            for alias in pages["Aliases"]:
+                all_aliases.append(
+                    {
+                        "aliasName": alias["AliasName"],
+                        "aliasArn": alias["AliasArn"],
+                        "creationDate": alias.get("CreationDate"),
+                    }
+                )
+        return all_aliases
+    except HTTPException:
+        raise
+    except ClientError as e:
+        error_code = e.response["Error"]["Code"]
+        if error_code == "NotFoundException":
+            raise HTTPException(status_code=404, detail=f"Key {id} not found")
+        raise HTTPException(status_code=500, detail=str(e))
+    except Exception as e:
+        logger.error("Failed to get aliases for %s", id, exc_info=True)
+        raise HTTPException(status_code=500, detail=str(e))

{stackport-0.4.3 → stackport-0.4.5}/backend/routes/resources.py

@@ -85,6 +85,11 @@ _PREFERRED_ID_FIELD: dict[tuple[str, str], str] = {
     ("cognito-idp", "user_pools"): "Id",
     ("apigateway", "rest_apis"): "id",
     ("apigateway", "apis"): "ApiId",
+    ("iam", "policies"): "Arn",
+    ("ec2", "subnets"): "SubnetId",
+    ("ec2", "security_groups"): "GroupId",
+    ("elasticfilesystem", "file_systems"): "FileSystemId",
+    ("rds", "db_clusters"): "DBClusterIdentifier",
 }
 
 # Known ID field names for extracting a resource identifier from list results

{stackport-0.4.3 → stackport-0.4.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stackport"
-version = "0.4.3"
+version = "0.4.5"
 description = "Universal AWS resource browser for local emulators"
 readme = "README.md"
 license = {text = "MIT"}

{stackport-0.4.3 → stackport-0.4.5/stackport.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackport
-Version: 0.4.3
+Version: 0.4.5
 Summary: Universal AWS resource browser for local emulators
 Author: Davi Reis Vieira
 License: MIT

{stackport-0.4.3 → stackport-0.4.5}/stackport.egg-info/SOURCES.txt

@@ -15,27 +15,27 @@ backend/../ui/dist/favicon.png
 backend/../ui/dist/favicon.svg
 backend/../ui/dist/index.html
 backend/../ui/dist/stackport-logo.svg
-backend/../ui/dist/assets/CloudscapeAbout-BRbsDskR.js
-backend/../ui/dist/assets/CloudscapeDashboard-j2f4Elz2.js
-backend/../ui/dist/assets/CloudscapeLearn-CVW3k3X0.js
-backend/../ui/dist/assets/CloudscapeResourceBrowser-CgWdgn20.js
+backend/../ui/dist/assets/CloudscapeAbout-D8bVx2o1.js
+backend/../ui/dist/assets/CloudscapeDashboard-Cb3SVBox.js
+backend/../ui/dist/assets/CloudscapeLearn-DhnltSEL.js
+backend/../ui/dist/assets/CloudscapeResourceBrowser-BNBaU_zZ.js
 backend/../ui/dist/assets/CloudscapeResourceBrowser-CzwePG-V.css
-backend/../ui/dist/assets/CloudscapeSettings-CIXFvPKv.js
+backend/../ui/dist/assets/CloudscapeSettings-BMXbMPTT.js
 backend/../ui/dist/assets/CloudscapeShell-BXHVWjDE.css
-backend/../ui/dist/assets/CloudscapeShell-DNfhSg0O.js
-backend/../ui/dist/assets/StateMachineGraph-DvF_kIOO.js
-backend/../ui/dist/assets/index-BC7E-Fm4.js
-backend/../ui/dist/assets/index-BLdRlH9d.js
-backend/../ui/dist/assets/index-Ba-oOcd3.js
-backend/../ui/dist/assets/index-BkSgVQ0X.js
-backend/../ui/dist/assets/index-C5z3cir-.js
+backend/../ui/dist/assets/CloudscapeShell-Dd2hVOGq.js
+backend/../ui/dist/assets/StateMachineGraph-gL9KABj0.js
+backend/../ui/dist/assets/index-BBLXT2u8.js
+backend/../ui/dist/assets/index-BFIBfRr-.js
+backend/../ui/dist/assets/index-Blob5IHY.js
+backend/../ui/dist/assets/index-CN6POuiI.js
+backend/../ui/dist/assets/index-D8EPia5i.js
 backend/../ui/dist/assets/index-DE--A2EE.css
 backend/../ui/dist/assets/index-DKIdXFX0.css
 backend/../ui/dist/assets/index-DNBdeKId.css
 backend/../ui/dist/assets/index-DoY0HscW.css
 backend/../ui/dist/assets/index-DrkkXAoG.css
-backend/../ui/dist/assets/index-Dw6TGweb.js
 backend/../ui/dist/assets/index-Vf0UFiCT.css
+backend/../ui/dist/assets/index-u1-TTPf4.js
 backend/../ui/dist/assets/stepfunctions-graph-B6nvU4OB.js
 backend/../ui/dist/assets/utils-Cfmwk2UT.js
 backend/../ui/dist/aws-icons/acm.svg
@@ -83,6 +83,7 @@ backend/routes/dynamodb.py
 backend/routes/ec2.py
 backend/routes/endpoints.py
 backend/routes/iam.py
+backend/routes/kms.py
 backend/routes/lambda_svc.py
 backend/routes/learn.py
 backend/routes/logs.py
@@ -125,6 +126,7 @@ tests/test_ec2_routes.py
 tests/test_endpoint_store.py
 tests/test_endpoints.py
 tests/test_iam_routes.py
+tests/test_kms_routes.py
 tests/test_lambda_routes.py
 tests/test_learn_content.py
 tests/test_learn_routes.py
@@ -148,27 +150,27 @@ ui/dist/favicon.png
 ui/dist/favicon.svg
 ui/dist/index.html
 ui/dist/stackport-logo.svg
-ui/dist/assets/CloudscapeAbout-BRbsDskR.js
-ui/dist/assets/CloudscapeDashboard-j2f4Elz2.js
-ui/dist/assets/CloudscapeLearn-CVW3k3X0.js
-ui/dist/assets/CloudscapeResourceBrowser-CgWdgn20.js
+ui/dist/assets/CloudscapeAbout-D8bVx2o1.js
+ui/dist/assets/CloudscapeDashboard-Cb3SVBox.js
+ui/dist/assets/CloudscapeLearn-DhnltSEL.js
+ui/dist/assets/CloudscapeResourceBrowser-BNBaU_zZ.js
 ui/dist/assets/CloudscapeResourceBrowser-CzwePG-V.css
-ui/dist/assets/CloudscapeSettings-CIXFvPKv.js
+ui/dist/assets/CloudscapeSettings-BMXbMPTT.js
 ui/dist/assets/CloudscapeShell-BXHVWjDE.css
-ui/dist/assets/CloudscapeShell-DNfhSg0O.js
-ui/dist/assets/StateMachineGraph-DvF_kIOO.js
-ui/dist/assets/index-BC7E-Fm4.js
-ui/dist/assets/index-BLdRlH9d.js
-ui/dist/assets/index-Ba-oOcd3.js
-ui/dist/assets/index-BkSgVQ0X.js
-ui/dist/assets/index-C5z3cir-.js
+ui/dist/assets/CloudscapeShell-Dd2hVOGq.js
+ui/dist/assets/StateMachineGraph-gL9KABj0.js
+ui/dist/assets/index-BBLXT2u8.js
+ui/dist/assets/index-BFIBfRr-.js
+ui/dist/assets/index-Blob5IHY.js
+ui/dist/assets/index-CN6POuiI.js
+ui/dist/assets/index-D8EPia5i.js
 ui/dist/assets/index-DE--A2EE.css
 ui/dist/assets/index-DKIdXFX0.css
 ui/dist/assets/index-DNBdeKId.css
 ui/dist/assets/index-DoY0HscW.css
 ui/dist/assets/index-DrkkXAoG.css
-ui/dist/assets/index-Dw6TGweb.js
 ui/dist/assets/index-Vf0UFiCT.css
+ui/dist/assets/index-u1-TTPf4.js
 ui/dist/assets/stepfunctions-graph-B6nvU4OB.js
 ui/dist/assets/utils-Cfmwk2UT.js
 ui/dist/aws-icons/acm.svg

{stackport-0.4.3 → stackport-0.4.5}/tests/test_dynamodb_routes.py

@@ -407,3 +407,170 @@ class TestItemWrites:
         assert any(k.endswith(":dynamodb:item_count:t1") for k in cache_keys), (
             f"expected item_count cache invalidation, got calls: {cache_keys}"
         )
+
+
+# Binary attributes (#176). b"\x00\x8e\xff" is not valid UTF-8, which is what
+# crashed FastAPI's encoder; its base64 form is "AI7/".
+RAW = b"\x00\x8e\xff"
+RAW_B64 = "AI7/"
+
+
+def _hash_table(mock_ddb, key_type="S"):
+    mock_ddb.describe_table.return_value = {
+        "Table": {
+            "KeySchema": [{"AttributeName": "pk", "KeyType": "HASH"}],
+            "AttributeDefinitions": [{"AttributeName": "pk", "AttributeType": key_type}],
+        }
+    }
+
+
+class TestBinaryAttributes:
+    @patch("backend.routes.dynamodb.get_client")
+    def test_scan_returns_binary_as_base64(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        mock_ddb.scan.return_value = {
+            "Items": [
+                {
+                    "pk": {"S": "a"},
+                    "blob": {"B": RAW},
+                    "set": {"BS": [RAW, b"ok"]},
+                    "nested": {"M": {"inner": {"B": RAW}, "list": {"L": [{"B": RAW}, {"S": "keep"}]}}},
+                }
+            ],
+            "ScannedCount": 1,
+        }
+
+        resp = client.get("/api/dynamodb/tables/t1/items")
+        assert resp.status_code == 200
+        item = resp.json()["items"][0]
+        assert item["pk"] == {"S": "a"}
+        assert item["blob"] == {"B": RAW_B64}
+        assert item["set"] == {"BS": [RAW_B64, "b2s="]}
+        assert item["nested"]["M"]["inner"] == {"B": RAW_B64}
+        assert item["nested"]["M"]["list"]["L"] == [{"B": RAW_B64}, {"S": "keep"}]
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_scan_paginates_on_a_binary_key(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        mock_ddb.scan.return_value = {
+            "Items": [{"pk": {"B": RAW}}],
+            "ScannedCount": 1,
+            "LastEvaluatedKey": {"pk": {"B": RAW}},
+        }
+
+        first = client.get("/api/dynamodb/tables/t1/items?limit=1")
+        assert first.status_code == 200
+        body = first.json()
+        assert "error" not in body
+        assert body["next_token"]
+
+        client.get(f"/api/dynamodb/tables/t1/items?limit=1&exclusive_start_key={body['next_token']}")
+        assert mock_ddb.scan.call_args[1]["ExclusiveStartKey"] == {"pk": {"B": RAW}}
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_query_on_a_binary_partition_key(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        _hash_table(mock_ddb, key_type="B")
+        mock_ddb.query.return_value = {"Items": [{"pk": {"B": RAW}}], "ScannedCount": 1}
+
+        resp = client.post("/api/dynamodb/tables/t1/query", json={"partition_key_value": RAW_B64})
+        assert resp.status_code == 200
+        assert resp.json()["items"] == [{"pk": {"B": RAW_B64}}]
+        assert mock_ddb.query.call_args[1]["ExpressionAttributeValues"][":pk"] == {"B": RAW}
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_query_with_invalid_base64_key_is_400(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        _hash_table(mock_ddb, key_type="B")
+
+        resp = client.post("/api/dynamodb/tables/t1/query", json={"partition_key_value": "not base64!"})
+        assert resp.status_code == 400
+        mock_ddb.query.assert_not_called()
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_put_decodes_base64_to_bytes(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        _hash_table(mock_ddb)
+
+        resp = client.put(
+            "/api/dynamodb/tables/t1/items",
+            json={
+                "item": {"pk": {"S": "a"}, "blob": {"B": RAW_B64}, "set": {"BS": [RAW_B64]}, "m": {"M": {"x": {"B": RAW_B64}}}},
+                "item_format": "dynamodb",
+            },
+        )
+        assert resp.status_code == 200
+        item = mock_ddb.put_item.call_args[1]["Item"]
+        assert item["pk"] == {"S": "a"}
+        assert item["blob"] == {"B": RAW}
+        assert item["set"] == {"BS": [RAW]}
+        assert item["m"] == {"M": {"x": {"B": RAW}}}
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_put_with_invalid_base64_is_400(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        _hash_table(mock_ddb)
+
+        resp = client.put(
+            "/api/dynamodb/tables/t1/items",
+            json={"item": {"pk": {"S": "a"}, "blob": {"B": "not base64!"}}, "item_format": "dynamodb"},
+        )
+        assert resp.status_code == 400
+        assert "blob" in resp.json()["detail"]
+        mock_ddb.put_item.assert_not_called()
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_delete_and_batch_delete_by_binary_key(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        _hash_table(mock_ddb, key_type="B")
+        mock_ddb.batch_write_item.return_value = {"UnprocessedItems": {}}
+
+        resp = client.request(
+            "DELETE", "/api/dynamodb/tables/t1/items", json={"key": {"pk": {"B": RAW_B64}}, "item_format": "dynamodb"}
+        )
+        assert resp.status_code == 200
+        assert mock_ddb.delete_item.call_args[1]["Key"] == {"pk": {"B": RAW}}
+
+        resp = client.post(
+            "/api/dynamodb/tables/t1/items/batch",
+            json={"item_format": "dynamodb", "operations": [{"op": "delete", "key": {"pk": {"B": RAW_B64}}}]},
+        )
+        assert resp.status_code == 200
+        req = mock_ddb.batch_write_item.call_args[1]["RequestItems"]["t1"]
+        assert req == [{"DeleteRequest": {"Key": {"pk": {"B": RAW}}}}]
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_batch_unprocessed_binary_is_returned_as_base64(self, mock_get_client):
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        _hash_table(mock_ddb, key_type="B")
+        mock_ddb.batch_write_item.return_value = {
+            "UnprocessedItems": {"t1": [{"PutRequest": {"Item": {"pk": {"B": RAW}}}}]}
+        }
+
+        resp = client.post(
+            "/api/dynamodb/tables/t1/items/batch",
+            json={"item_format": "dynamodb", "operations": [{"op": "put", "item": {"pk": {"B": RAW_B64}}}]},
+        )
+        assert resp.status_code == 200
+        assert resp.json()["unprocessed"] == {"t1": [{"PutRequest": {"Item": {"pk": {"B": RAW_B64}}}}]}
+
+    @patch("backend.routes.dynamodb.get_client")
+    def test_scan_output_round_trips_through_put(self, mock_get_client):
+        """What Edit does: take an item from the scan and save it unchanged."""
+        mock_ddb = MagicMock()
+        mock_get_client.return_value = mock_ddb
+        _hash_table(mock_ddb)
+        original = {"pk": {"S": "a"}, "blob": {"B": RAW}, "set": {"BS": [RAW, b"ok"]}}
+        mock_ddb.scan.return_value = {"Items": [original], "ScannedCount": 1}
+
+        scanned = client.get("/api/dynamodb/tables/t1/items").json()["items"][0]
+        client.put("/api/dynamodb/tables/t1/items", json={"item": scanned, "item_format": "dynamodb"})
+        assert mock_ddb.put_item.call_args[1]["Item"] == original