velocity-python 0.1.47__tar.gz → 0.1.49__tar.gz

{velocity_python-0.1.47/src/velocity_python.egg-info → velocity_python-0.1.49}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.47
+Version: 0.1.49
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.47 → velocity_python-0.1.49}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.47"
+version = "0.1.49"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.1.47 → velocity_python-0.1.49}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.47"
+__version__ = version = "0.1.49"
 
 import importlib as _importlib
 

{velocity_python-0.1.47 → velocity_python-0.1.49}/src/velocity/aws/amplify.py

@@ -337,6 +337,7 @@ class AmplifyProject:
 }}"""
 
     def get_lambda_vpc_policy_template(self):
+        account_id = self.get_account_id()
         return {
             "Version": "2012-10-17",
             "Statement": [
@@ -356,6 +357,15 @@ class AmplifyProject:
                         "ec2:RevokeSecurityGroupEgress",
                         "cognito-idp:*",
                     ],
+                },
+                {
+                    "Effect": "Allow",
+                    "Resource": f"arn:aws:ssm:*:{account_id}:parameter/*",
+                    "Action": [
+                        "ssm:GetParameter",
+                        "ssm:GetParameters",
+                        "ssm:GetParametersByPath",
+                    ],
                 }
             ],
         }

{velocity_python-0.1.47 → velocity_python-0.1.49}/src/velocity/aws/amplify_build.py

@@ -7,6 +7,7 @@ import time
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Dict, Mapping, Optional, Sequence, Tuple, Union
+from urllib.parse import unquote
 
 import boto3
 import botocore.exceptions
@@ -59,6 +60,9 @@ class BackendDeploymentConfig:
         "WebHooks",
     )
     memory_size_by_token: Mapping[str, int] = field(default_factory=dict)
+    extra_lambda_policy_statements: Tuple[Mapping[str, Any], ...] = field(
+        default_factory=tuple
+    )
     use_reserved_concurrency: bool = True
 
     def resolve_queue_name(self, branch: str) -> str:
@@ -75,6 +79,15 @@ class BackendDeploymentConfig:
                 return memory_size
         return None
 
+    def build_lambda_policy_document(
+        self, base_policy_document: Mapping[str, Any]
+    ) -> Dict[str, Any]:
+        policy_document = dict(base_policy_document)
+        statements = list(policy_document.get("Statement", []))
+        statements.extend(dict(statement) for statement in self.extra_lambda_policy_statements)
+        policy_document["Statement"] = statements
+        return policy_document
+
 
 def _normalize_project_root(project_root: Union[str, Path]) -> Path:
     return Path(project_root).resolve()
@@ -271,9 +284,54 @@ def _serialize_policy_document(policy_document: Any) -> str:
     return json.dumps(policy_document)
 
 
+def _normalize_policy_document(policy_document: Any) -> Any:
+    if not isinstance(policy_document, str):
+        return policy_document
+    try:
+        return json.loads(unquote(policy_document))
+    except json.JSONDecodeError:
+        return json.loads(policy_document)
+
+
+def _sync_managed_policy_document(iam_client, policy_arn: str, policy_document: Any) -> None:
+    policy = retryable_call(iam_client.get_policy, PolicyArn=policy_arn)["Policy"]
+    current_version = retryable_call(
+        iam_client.get_policy_version,
+        PolicyArn=policy_arn,
+        VersionId=policy["DefaultVersionId"],
+    )["PolicyVersion"]
+
+    current_document = _normalize_policy_document(current_version["Document"])
+    desired_document = _normalize_policy_document(policy_document)
+    if json.dumps(current_document, sort_keys=True) == json.dumps(desired_document, sort_keys=True):
+        return
+
+    versions = retryable_call(iam_client.list_policy_versions, PolicyArn=policy_arn)["Versions"]
+    nondefault_versions = sorted(
+        (version for version in versions if not version["IsDefaultVersion"]),
+        key=lambda version: version["CreateDate"],
+    )
+    if len(versions) >= 5 and nondefault_versions:
+        retryable_call(
+            iam_client.delete_policy_version,
+            PolicyArn=policy_arn,
+            VersionId=nondefault_versions[0]["VersionId"],
+        )
+
+    print(f"Updating policy {policy['PolicyName']}")
+    retryable_call(
+        iam_client.create_policy_version,
+        PolicyArn=policy_arn,
+        PolicyDocument=_serialize_policy_document(desired_document),
+        SetAsDefault=True,
+    )
+    time.sleep(10)
+
+
 def ensure_lambda_policies_and_attach(
     app: AmplifyProject,
     function: Mapping[str, str],
+    config: Optional[BackendDeploymentConfig] = None,
     iam_client=None,
 ) -> None:
     if iam_client is None:
@@ -291,11 +349,15 @@ def ensure_lambda_policies_and_attach(
         ],
     }
 
+    lambda_vpc_policy = app.get_lambda_vpc_policy_template()
+    if config is not None:
+        lambda_vpc_policy = config.build_lambda_policy_document(lambda_vpc_policy)
+
     required_policies = [
         (
             "lambda-vpc-execution",
             f"arn:aws:iam::{account_id}:policy/lambda-vpc-execution",
-            app.get_lambda_vpc_policy_template(),
+            lambda_vpc_policy,
         ),
         (
             "lambda-layer-access",
@@ -318,6 +380,8 @@ def ensure_lambda_policies_and_attach(
                 PolicyDocument=_serialize_policy_document(policy_doc),
             )
             time.sleep(10)
+        else:
+            _sync_managed_policy_document(iam_client, policy_arn, policy_doc)
 
     role_name = function["Role"].split("/")[-1]
     attached_policies = retryable_call(
@@ -462,7 +526,7 @@ def run_backend_deployment(
         else:
             queue_producers.append(function)
 
-        ensure_lambda_policies_and_attach(app, function)
+        ensure_lambda_policies_and_attach(app, function, config=config)
 
         timeout_value = config.resolve_timeout(function_name)
         memory_value = config.resolve_memory_size(function_name)

{velocity_python-0.1.47 → velocity_python-0.1.49}/src/velocity/aws/handlers/context.py

@@ -12,6 +12,10 @@ from botocore.exceptions import ClientError
 import hashlib
 import velocity
 import velocity.db
+from velocity.aws.ssm_config import getenv as config_getenv
+from velocity.aws.ssm_config import get_project_name as config_get_project_name
+from velocity.aws.ssm_config import get_region as config_get_region
+from velocity.aws.ssm_config import get_stage as config_get_stage
 from velocity.logging import get_logger
 
 engine = velocity.db.postgres.initialize()
@@ -21,6 +25,25 @@ cognito_client = boto3.client("cognito-idp")
 logger = get_logger("velocity.aws.handlers.context")
 
 
+def _get_work_queue_name() -> str:
+    queue_name = str(config_getenv("SqsWorkQueue", "") or "").strip()
+    if not queue_name:
+        raise KeyError("SqsWorkQueue")
+    return queue_name
+
+
+def _get_controls_vars() -> dict:
+    return {
+        "USER_BRANCH": config_get_stage(),
+        "AWS_JOB_ID": os.environ.get("AWS_JOB_ID"),
+        "LOGLEVEL": config_getenv("LOGLEVEL"),
+        "USER_REGION": config_get_region(),
+        "ProjectName": config_get_project_name(),
+        "DBDatabase": config_getenv("DBDatabase"),
+        "BUILD_DATETIME": config_getenv("BUILD_DATETIME"),
+    }
+
+
 @engine.transaction
 class Context:
 
@@ -372,7 +395,7 @@ class Context:
         batch_id = str(uuid.uuid4())
         results = {"batch_id": batch_id}
         queue = boto3.resource("sqs").get_queue_by_name(
-            QueueName=os.environ["SqsWorkQueue"]
+            QueueName=_get_work_queue_name()
         )
         if isinstance(payload, dict):
             payload = [payload]
@@ -423,11 +446,11 @@ class Context:
 
     def _is_production(self):
         """Return True when running in production environment."""
-        return os.environ.get("USER_BRANCH", "").lower() == "production"
+        return str(config_get_stage("") or "").lower() == "production"
 
     def get_environment(self):
         """Return the current USER_BRANCH value (defaults to demo)."""
-        return os.environ.get("USER_BRANCH", "demo")
+        return config_get_stage("demo")
 
     def get_current_lambda_layers(self):
         """Return details about the Lambda layers attached to the running function."""
@@ -459,21 +482,8 @@ class Context:
             return []
 
     def get_pass_through_vars(self, tx):
-        """Return environment and layer information for controls.vars."""
-        vars = dict(
-            [
-                (x, os.environ.get(x))
-                for x in [
-                    "USER_BRANCH",
-                    "AWS_JOB_ID",
-                    "LOGLEVEL",
-                    "USER_REGION",
-                    "ProjectName",
-                    "DBDatabase",
-                    "BUILD_DATETIME",
-                ]
-            ]
-        )
+        """Return runtime and config information for controls.vars."""
+        vars = _get_controls_vars()
 
         temp = {"controls": {"vars": vars}}
 

{velocity_python-0.1.47 → velocity_python-0.1.49/src/velocity_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.47
+Version: 0.1.49
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.47 → velocity_python-0.1.49}/tests/test_amplify_build.py

@@ -74,6 +74,36 @@ def test_backend_deployment_config_resolves_queue_timeout_and_memory_size():
     assert config.resolve_memory_size("ClientUtility-demo") is None
 
 
+def test_backend_deployment_config_merges_extra_lambda_policy_statements():
+    config = BackendDeploymentConfig(
+        queue_name_template="clients-queue-{branch}",
+        extra_lambda_policy_statements=(
+            {
+                "Effect": "Allow",
+                "Action": ["ssm:PutParameter"],
+                "Resource": "*",
+            },
+        ),
+    )
+
+    base_policy = {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": ["ssm:GetParameter"],
+                "Resource": "*",
+            }
+        ],
+    }
+
+    merged = config.build_lambda_policy_document(base_policy)
+
+    assert len(merged["Statement"]) == 2
+    assert merged["Statement"][0]["Action"] == ["ssm:GetParameter"]
+    assert merged["Statement"][1]["Action"] == ["ssm:PutParameter"]
+
+
 def test_build_environment_variables_reads_project_metadata(tmp_path, monkeypatch):
     amplify_dir = tmp_path / "amplify" / "backend"
     amplify_dir.mkdir(parents=True)

{velocity_python-0.1.47 → velocity_python-0.1.49}/tests/test_context_job_descriptions.py

@@ -87,6 +87,67 @@ class TestQueueJobDescriptions(unittest.TestCase):
         self.assertEqual(1, len(fake_context.jobs))
         self.assertIsNone(fake_context.jobs[0]["description"])
 
+    def test_get_pass_through_vars_uses_ssm_aware_runtime_helpers(self):
+        fake_context = _FakeContext()
+
+        def _fake_config_getenv(key, default=None, **kwargs):
+            values = {
+                "LOGLEVEL": "INFO",
+                "DBDatabase": "cc_demo",
+                "BUILD_DATETIME": "05/28/2026 11:00PM",
+            }
+            return values.get(key, default)
+
+        with patch.dict(
+            handler_context.os.environ,
+            {"AWS_JOB_ID": "job-123"},
+            clear=False,
+        ), patch.object(
+            handler_context,
+            "config_get_stage",
+            return_value="demo",
+        ), patch.object(
+            handler_context,
+            "config_get_region",
+            return_value="us-east-1",
+        ), patch.object(
+            handler_context,
+            "config_get_project_name",
+            return_value="BackOffice",
+        ), patch.object(
+            handler_context,
+            "config_getenv",
+            side_effect=_fake_config_getenv,
+        ):
+            result = handler_context.Context.get_pass_through_vars.__wrapped__(
+                fake_context,
+                tx=None,
+            )
+
+        self.assertEqual(
+            {
+                "USER_BRANCH": "demo",
+                "AWS_JOB_ID": "job-123",
+                "LOGLEVEL": "INFO",
+                "USER_REGION": "us-east-1",
+                "ProjectName": "BackOffice",
+                "DBDatabase": "cc_demo",
+                "BUILD_DATETIME": "05/28/2026 11:00PM",
+            },
+            result["controls"]["vars"],
+        )
+
+    def test_environment_helpers_use_stage_alias_resolution(self):
+        fake_context = _FakeContext()
+
+        with patch.object(
+            handler_context,
+            "config_get_stage",
+            side_effect=["production", "demo"],
+        ):
+            self.assertTrue(handler_context.Context._is_production(fake_context))
+            self.assertEqual("demo", handler_context.Context.get_environment(fake_context))
+
 
 if __name__ == "__main__":
     unittest.main()