velocity-python 0.1.46__tar.gz → 0.1.48__tar.gz

{velocity_python-0.1.46/src/velocity_python.egg-info → velocity_python-0.1.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.46
+Version: 0.1.48
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.46 → velocity_python-0.1.48}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.46"
+version = "0.1.48"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.1.46 → velocity_python-0.1.48}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.46"
+__version__ = version = "0.1.48"
 
 import importlib as _importlib
 

{velocity_python-0.1.46 → velocity_python-0.1.48}/src/velocity/aws/amplify.py

@@ -337,6 +337,7 @@ class AmplifyProject:
 }}"""
 
     def get_lambda_vpc_policy_template(self):
+        account_id = self.get_account_id()
         return {
             "Version": "2012-10-17",
             "Statement": [
@@ -356,6 +357,15 @@ class AmplifyProject:
                         "ec2:RevokeSecurityGroupEgress",
                         "cognito-idp:*",
                     ],
+                },
+                {
+                    "Effect": "Allow",
+                    "Resource": f"arn:aws:ssm:*:{account_id}:parameter/*",
+                    "Action": [
+                        "ssm:GetParameter",
+                        "ssm:GetParameters",
+                        "ssm:GetParametersByPath",
+                    ],
                 }
             ],
         }

{velocity_python-0.1.46 → velocity_python-0.1.48}/src/velocity/aws/amplify_build.py

@@ -7,6 +7,7 @@ import time
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Dict, Mapping, Optional, Sequence, Tuple, Union
+from urllib.parse import unquote
 
 import boto3
 import botocore.exceptions
@@ -271,6 +272,50 @@ def _serialize_policy_document(policy_document: Any) -> str:
     return json.dumps(policy_document)
 
 
+def _normalize_policy_document(policy_document: Any) -> Any:
+    if not isinstance(policy_document, str):
+        return policy_document
+    try:
+        return json.loads(unquote(policy_document))
+    except json.JSONDecodeError:
+        return json.loads(policy_document)
+
+
+def _sync_managed_policy_document(iam_client, policy_arn: str, policy_document: Any) -> None:
+    policy = retryable_call(iam_client.get_policy, PolicyArn=policy_arn)["Policy"]
+    current_version = retryable_call(
+        iam_client.get_policy_version,
+        PolicyArn=policy_arn,
+        VersionId=policy["DefaultVersionId"],
+    )["PolicyVersion"]
+
+    current_document = _normalize_policy_document(current_version["Document"])
+    desired_document = _normalize_policy_document(policy_document)
+    if json.dumps(current_document, sort_keys=True) == json.dumps(desired_document, sort_keys=True):
+        return
+
+    versions = retryable_call(iam_client.list_policy_versions, PolicyArn=policy_arn)["Versions"]
+    nondefault_versions = sorted(
+        (version for version in versions if not version["IsDefaultVersion"]),
+        key=lambda version: version["CreateDate"],
+    )
+    if len(versions) >= 5 and nondefault_versions:
+        retryable_call(
+            iam_client.delete_policy_version,
+            PolicyArn=policy_arn,
+            VersionId=nondefault_versions[0]["VersionId"],
+        )
+
+    print(f"Updating policy {policy['PolicyName']}")
+    retryable_call(
+        iam_client.create_policy_version,
+        PolicyArn=policy_arn,
+        PolicyDocument=_serialize_policy_document(desired_document),
+        SetAsDefault=True,
+    )
+    time.sleep(10)
+
+
 def ensure_lambda_policies_and_attach(
     app: AmplifyProject,
     function: Mapping[str, str],
@@ -318,6 +363,8 @@ def ensure_lambda_policies_and_attach(
                 PolicyDocument=_serialize_policy_document(policy_doc),
             )
             time.sleep(10)
+        else:
+            _sync_managed_policy_document(iam_client, policy_arn, policy_doc)
 
     role_name = function["Role"].split("/")[-1]
     attached_policies = retryable_call(

{velocity_python-0.1.46 → velocity_python-0.1.48}/src/velocity/aws/handlers/context.py

@@ -12,6 +12,7 @@ from botocore.exceptions import ClientError
 import hashlib
 import velocity
 import velocity.db
+from velocity.aws.ssm_config import getenv as config_getenv
 from velocity.logging import get_logger
 
 engine = velocity.db.postgres.initialize()
@@ -21,6 +22,13 @@ cognito_client = boto3.client("cognito-idp")
 logger = get_logger("velocity.aws.handlers.context")
 
 
+def _get_work_queue_name() -> str:
+    queue_name = str(config_getenv("SqsWorkQueue", "") or "").strip()
+    if not queue_name:
+        raise KeyError("SqsWorkQueue")
+    return queue_name
+
+
 @engine.transaction
 class Context:
 
@@ -372,7 +380,7 @@ class Context:
         batch_id = str(uuid.uuid4())
         results = {"batch_id": batch_id}
         queue = boto3.resource("sqs").get_queue_by_name(
-            QueueName=os.environ["SqsWorkQueue"]
+            QueueName=_get_work_queue_name()
         )
         if isinstance(payload, dict):
             payload = [payload]

{velocity_python-0.1.46 → velocity_python-0.1.48}/src/velocity/aws/ssm_config.py

@@ -1,20 +1,20 @@
 """
 SSM-backed configuration with environment-variable fallback.
 
-Opt-in: set ``VELOCITY_SSM_ENABLED=true`` in your Amplify environment variables
-(pushed via ``bootstrap.py secrets``).
-
-When enabled, ``getenv(key)`` reads from SSM at::
+``getenv(key)`` reads from SSM at::
 
     /{ProjectName}/{stage}/{key}
 
-and falls back to ``os.environ`` on a miss or any error.  Results are cached
-for the process lifetime so SSM is called at most once per key per Lambda
-cold start.
+when SSM loading is enabled. An explicit ``VELOCITY_SSM_ENABLED`` environment
+variable still overrides the behavior, but Lambda runtimes now auto-enable SSM
+when they can resolve both project and stage from the runtime environment.
+
+On an SSM miss or any other SSM error, ``getenv`` falls back to ``os.environ``.
+Results are cached for the process lifetime so SSM is called at most once per
+key per Lambda cold start.
 
-When **not** enabled (the default), ``getenv`` is a thin wrapper around
-``os.environ.get`` with zero extra overhead — preserving full backward
-compatibility for projects that don't use SSM (e.g. caringcent).
+Outside Lambda, or when project/stage cannot be resolved, ``getenv`` remains a
+thin wrapper around ``os.environ.get`` with no SSM call.
 """
 
 from __future__ import annotations
@@ -25,6 +25,15 @@ from typing import Optional
 
 logger = logging.getLogger(__name__)
 
+_LAMBDA_PROJECT_SUFFIXES = (
+    'QueueHandler',
+    'Scheduler',
+    'WebHooks',
+    'Public',
+    'Events',
+    'Data',
+)
+
 # Per-process cache: key → value (str) or sentinel _MISS.
 _MISS = object()
 _cache: dict[str, object] = {}
@@ -36,7 +45,11 @@ _SSM_ENABLED: bool | None = None
 def _is_enabled() -> bool:
     global _SSM_ENABLED
     if _SSM_ENABLED is None:
-        _SSM_ENABLED = os.environ.get('VELOCITY_SSM_ENABLED', '').lower() in ('1', 'true', 'yes')
+        configured = os.environ.get('VELOCITY_SSM_ENABLED')
+        if configured is not None:
+            _SSM_ENABLED = configured.lower() in ('1', 'true', 'yes')
+        else:
+            _SSM_ENABLED = _is_lambda_runtime() and bool(get_project_name()) and bool(get_stage())
     return _SSM_ENABLED
 
 
@@ -51,8 +64,41 @@ def _first_nonempty_env(*keys: str) -> str | None:
     return None
 
 
+def _lambda_function_name() -> str | None:
+    value = os.environ.get('AWS_LAMBDA_FUNCTION_NAME')
+    if value is None:
+        return None
+    value = value.strip()
+    return value or None
+
+
+def _is_lambda_runtime() -> bool:
+    return _lambda_function_name() is not None or os.environ.get('AWS_EXECUTION_ENV', '').startswith('AWS_Lambda_')
+
+
+def _infer_project_name_from_lambda_name() -> str | None:
+    function_name = _lambda_function_name()
+    if function_name is None:
+        return None
+
+    stage = _first_nonempty_env('AppStage', 'ENV', 'USER_BRANCH', 'AWS_BRANCH')
+    base_name = function_name
+    if stage:
+        suffix = f'-{stage}'
+        if base_name.endswith(suffix):
+            base_name = base_name[:-len(suffix)]
+
+    for suffix in _LAMBDA_PROJECT_SUFFIXES:
+        if base_name.endswith(suffix) and len(base_name) > len(suffix):
+            candidate = base_name[:-len(suffix)].strip()
+            if candidate:
+                return candidate
+
+    return base_name or None
+
+
 def get_project_name(default: Optional[str] = None) -> Optional[str]:
-    return _first_nonempty_env('ProjectName') or default
+    return _first_nonempty_env('ProjectName') or _infer_project_name_from_lambda_name() or default
 
 
 def get_stage(default: Optional[str] = None) -> Optional[str]:
@@ -97,8 +143,11 @@ def getenv(
     """
     Read a config value, checking SSM before ``os.environ``.
 
-    SSM is only consulted when ``VELOCITY_SSM_ENABLED=true`` is set in the
-    Lambda environment *and* both ``ProjectName`` and a resolved stage are present.
+    SSM is consulted when it is explicitly enabled via
+    ``VELOCITY_SSM_ENABLED=true`` or when Lambda runtime context provides enough
+    information to resolve both project and stage. Explicitly setting
+    ``VELOCITY_SSM_ENABLED=false`` disables SSM even in Lambda.
+
     All other cases fall straight through to ``os.environ``.
 
     Results are cached per process so SSM is queried at most once per key

{velocity_python-0.1.46 → velocity_python-0.1.48}/src/velocity/db/servers/postgres/__init__.py

@@ -98,51 +98,9 @@ class PostgreSQLInitializer(BaseInitializer):
 
 # Maintain backward compatibility
 def initialize(config=None, schema_locked=False, **kwargs):
-    """Backward compatible initialization function - matches original behavior exactly."""
-    try:
-        import psycopg
-    except ImportError as e:
-        raise ImportError(
-            "PostgreSQL driver not available. Install with: pip install velocity-python[postgres]"
-        ) from e
-
-    from .sql import SQL
-
-    konfig = {
-        "dbname": _getenv("DBDatabase") or os.environ["DBDatabase"],
-        "host": _getenv("DBHost") or os.environ["DBHost"],
-        "port": _getenv("DBPort") or os.environ["DBPort"],
-        "user": _getenv("DBUser") or os.environ["DBUser"],
-        "password": _getenv("DBPassword") or os.environ["DBPassword"],
-    }
-    konfig.update(config or {})
-    konfig.update(kwargs)
-
-    # Apply TCP keepalive defaults (user config takes precedence).
-    for key, default_val in _DEFAULT_KEEPALIVE.items():
-        konfig.setdefault(key, default_val)
-
-    # SSL mode.
-    ssl_mode = _getenv("VELOCITY_SSL_MODE")
-    if ssl_mode:
-        konfig.setdefault("sslmode", ssl_mode)
-
-    # Remap legacy 'database' key to 'dbname' for psycopg v3.
-    if "database" in konfig:
-        konfig["dbname"] = konfig.pop("database")
-
-    # Extract pool kwargs so they don't end up in the psycopg connect() call.
-    pool_kwargs = {}
-    for pool_key in ("pool_min", "pool_max", "pool_enabled", "pool_validate"):
-        if pool_key in konfig:
-            pool_kwargs[pool_key] = konfig.pop(pool_key)
-
-    # Check for environment variable override for schema locking
-    if os.environ.get("VELOCITY_SCHEMA_LOCKED", "").lower() in ("true", "1", "yes"):
-        schema_locked = True
-
-    return engine.Engine(
-        psycopg, konfig, SQL,
+    """Backward compatible wrapper around the shared PostgreSQL initializer."""
+    return PostgreSQLInitializer.initialize(
+        config=config,
         schema_locked=schema_locked,
-        **pool_kwargs,
+        **kwargs,
     )

{velocity_python-0.1.46 → velocity_python-0.1.48/src/velocity_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.46
+Version: 0.1.48
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.46 → velocity_python-0.1.48}/tests/test_ssm_config.py

@@ -25,6 +25,15 @@ def test_ssm_prefix_uses_aws_branch_when_env_missing(monkeypatch):
     assert ssm_config._ssm_prefix() == "/Client/production"
 
 
+def test_get_project_name_infers_from_lambda_function_name(monkeypatch):
+    ssm_config.clear_cache()
+    monkeypatch.delenv("ProjectName", raising=False)
+    monkeypatch.setenv("AWS_LAMBDA_FUNCTION_NAME", "BackOfficeScheduler-demo")
+    monkeypatch.setenv("ENV", "demo")
+
+    assert ssm_config.get_project_name() == "BackOffice"
+
+
 def test_getenv_falls_back_to_environment_when_disabled(monkeypatch):
     ssm_config.clear_cache()
     monkeypatch.delenv("VELOCITY_SSM_ENABLED", raising=False)
@@ -53,6 +62,27 @@ def test_getenv_reads_ssm_with_region_aliases(monkeypatch):
     client_factory.assert_called_once_with("ssm", region_name="us-west-2")
 
 
+def test_getenv_auto_enables_ssm_in_lambda_with_inferred_project(monkeypatch):
+    ssm_config.clear_cache()
+    monkeypatch.delenv("VELOCITY_SSM_ENABLED", raising=False)
+    monkeypatch.delenv("ProjectName", raising=False)
+    monkeypatch.setenv("AWS_LAMBDA_FUNCTION_NAME", "BackOfficeScheduler-demo")
+    monkeypatch.setenv("ENV", "demo")
+    monkeypatch.setenv("AWS_REGION", "us-west-2")
+    monkeypatch.setenv("DBDatabase", "env-db")
+
+    class FakeSSM:
+        def get_parameter(self, Name, WithDecryption):
+            assert Name == "/BackOffice/demo/DBDatabase"
+            assert WithDecryption is True
+            return {"Parameter": {"Value": "ssm-db"}}
+
+    with patch("boto3.client", return_value=FakeSSM()) as client_factory:
+        assert ssm_config.getenv("DBDatabase") == "ssm-db"
+
+    client_factory.assert_called_once_with("ssm", region_name="us-west-2")
+
+
 def test_getenv_raises_on_missing_when_disabled(monkeypatch):
     ssm_config.clear_cache()
     monkeypatch.delenv("VELOCITY_SSM_ENABLED", raising=False)