velocity-python 0.1.48__tar.gz → 0.1.50__tar.gz

{velocity_python-0.1.48/src/velocity_python.egg-info → velocity_python-0.1.50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.48
+Version: 0.1.50
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.48 → velocity_python-0.1.50}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.48"
+version = "0.1.50"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.1.48 → velocity_python-0.1.50}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.48"
+__version__ = version = "0.1.50"
 
 import importlib as _importlib
 

{velocity_python-0.1.48 → velocity_python-0.1.50}/src/velocity/aws/amplify_build.py

@@ -60,6 +60,9 @@ class BackendDeploymentConfig:
         "WebHooks",
     )
     memory_size_by_token: Mapping[str, int] = field(default_factory=dict)
+    extra_lambda_policy_statements: Tuple[Mapping[str, Any], ...] = field(
+        default_factory=tuple
+    )
     use_reserved_concurrency: bool = True
 
     def resolve_queue_name(self, branch: str) -> str:
@@ -76,6 +79,15 @@ class BackendDeploymentConfig:
                 return memory_size
         return None
 
+    def build_lambda_policy_document(
+        self, base_policy_document: Mapping[str, Any]
+    ) -> Dict[str, Any]:
+        policy_document = dict(base_policy_document)
+        statements = list(policy_document.get("Statement", []))
+        statements.extend(dict(statement) for statement in self.extra_lambda_policy_statements)
+        policy_document["Statement"] = statements
+        return policy_document
+
 
 def _normalize_project_root(project_root: Union[str, Path]) -> Path:
     return Path(project_root).resolve()
@@ -319,6 +331,7 @@ def _sync_managed_policy_document(iam_client, policy_arn: str, policy_document:
 def ensure_lambda_policies_and_attach(
     app: AmplifyProject,
     function: Mapping[str, str],
+    config: Optional[BackendDeploymentConfig] = None,
     iam_client=None,
 ) -> None:
     if iam_client is None:
@@ -336,11 +349,15 @@ def ensure_lambda_policies_and_attach(
         ],
     }
 
+    lambda_vpc_policy = app.get_lambda_vpc_policy_template()
+    if config is not None:
+        lambda_vpc_policy = config.build_lambda_policy_document(lambda_vpc_policy)
+
     required_policies = [
         (
             "lambda-vpc-execution",
             f"arn:aws:iam::{account_id}:policy/lambda-vpc-execution",
-            app.get_lambda_vpc_policy_template(),
+            lambda_vpc_policy,
         ),
         (
             "lambda-layer-access",
@@ -509,7 +526,7 @@ def run_backend_deployment(
         else:
             queue_producers.append(function)
 
-        ensure_lambda_policies_and_attach(app, function)
+        ensure_lambda_policies_and_attach(app, function, config=config)
 
         timeout_value = config.resolve_timeout(function_name)
         memory_value = config.resolve_memory_size(function_name)

{velocity_python-0.1.48 → velocity_python-0.1.50}/src/velocity/aws/handlers/context.py

@@ -13,6 +13,9 @@ import hashlib
 import velocity
 import velocity.db
 from velocity.aws.ssm_config import getenv as config_getenv
+from velocity.aws.ssm_config import get_project_name as config_get_project_name
+from velocity.aws.ssm_config import get_region as config_get_region
+from velocity.aws.ssm_config import get_stage as config_get_stage
 from velocity.logging import get_logger
 
 engine = velocity.db.postgres.initialize()
@@ -29,6 +32,18 @@ def _get_work_queue_name() -> str:
     return queue_name
 
 
+def _get_controls_vars() -> dict:
+    return {
+        "USER_BRANCH": config_get_stage(),
+        "AWS_JOB_ID": os.environ.get("AWS_JOB_ID"),
+        "LOGLEVEL": config_getenv("LOGLEVEL"),
+        "USER_REGION": config_get_region(),
+        "ProjectName": config_get_project_name(),
+        "DBDatabase": config_getenv("DBDatabase"),
+        "BUILD_DATETIME": config_getenv("BUILD_DATETIME"),
+    }
+
+
 @engine.transaction
 class Context:
 
@@ -431,11 +446,11 @@ class Context:
 
     def _is_production(self):
         """Return True when running in production environment."""
-        return os.environ.get("USER_BRANCH", "").lower() == "production"
+        return str(config_get_stage("") or "").lower() == "production"
 
     def get_environment(self):
         """Return the current USER_BRANCH value (defaults to demo)."""
-        return os.environ.get("USER_BRANCH", "demo")
+        return config_get_stage("demo")
 
     def get_current_lambda_layers(self):
         """Return details about the Lambda layers attached to the running function."""
@@ -467,21 +482,8 @@ class Context:
             return []
 
     def get_pass_through_vars(self, tx):
-        """Return environment and layer information for controls.vars."""
-        vars = dict(
-            [
-                (x, os.environ.get(x))
-                for x in [
-                    "USER_BRANCH",
-                    "AWS_JOB_ID",
-                    "LOGLEVEL",
-                    "USER_REGION",
-                    "ProjectName",
-                    "DBDatabase",
-                    "BUILD_DATETIME",
-                ]
-            ]
-        )
+        """Return runtime and config information for controls.vars."""
+        vars = _get_controls_vars()
 
         temp = {"controls": {"vars": vars}}
 

{velocity_python-0.1.48 → velocity_python-0.1.50}/src/velocity/aws/ssm_config.py

@@ -5,6 +5,10 @@ SSM-backed configuration with environment-variable fallback.
 
     /{ProjectName}/{stage}/{key}
 
+and, on a project-scoped miss, then tries::
+
+    /Global/{stage}/{key}
+
 when SSM loading is enabled. An explicit ``VELOCITY_SSM_ENABLED`` environment
 variable still overrides the behavior, but Lambda runtimes now auto-enable SSM
 when they can resolve both project and stage from the runtime environment.
@@ -118,19 +122,37 @@ def _ssm_prefix() -> str | None:
     return None
 
 
-def _fetch(key: str) -> str | None:
-    """Single SSM GetParameter call; returns value or None on any failure."""
+def _ssm_parameter_names(key: str) -> list[str]:
     prefix = _ssm_prefix()
     if prefix is None:
+        return []
+
+    parameter_names = [f'{prefix}/{key}']
+    project = get_project_name()
+    stage = get_stage()
+    if project and stage and project != 'Global':
+        parameter_names.append(f'/Global/{stage}/{key}')
+    return parameter_names
+
+
+def _fetch(key: str) -> str | None:
+    """Resolve one key from project SSM first, then Global fallback."""
+    parameter_names = _ssm_parameter_names(key)
+    if not parameter_names:
         return None
-    param_name = f'{prefix}/{key}'
+
     try:
         import boto3
         ssm = boto3.client('ssm', region_name=get_region('us-east-1'))
-        resp = ssm.get_parameter(Name=param_name, WithDecryption=True)
-        return resp['Parameter']['Value']
+        for param_name in parameter_names:
+            try:
+                resp = ssm.get_parameter(Name=param_name, WithDecryption=True)
+                return resp['Parameter']['Value']
+            except Exception as exc:
+                logger.debug('SSM miss for %s: %s', param_name, exc)
+        return None
     except Exception as exc:
-        logger.debug('SSM miss for %s: %s', param_name, exc)
+        logger.debug('SSM client failure while resolving %s: %s', key, exc)
         return None
 
 

{velocity_python-0.1.48 → velocity_python-0.1.50/src/velocity_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.48
+Version: 0.1.50
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.48 → velocity_python-0.1.50}/tests/test_amplify_build.py

@@ -74,6 +74,36 @@ def test_backend_deployment_config_resolves_queue_timeout_and_memory_size():
     assert config.resolve_memory_size("ClientUtility-demo") is None
 
 
+def test_backend_deployment_config_merges_extra_lambda_policy_statements():
+    config = BackendDeploymentConfig(
+        queue_name_template="clients-queue-{branch}",
+        extra_lambda_policy_statements=(
+            {
+                "Effect": "Allow",
+                "Action": ["ssm:PutParameter"],
+                "Resource": "*",
+            },
+        ),
+    )
+
+    base_policy = {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": ["ssm:GetParameter"],
+                "Resource": "*",
+            }
+        ],
+    }
+
+    merged = config.build_lambda_policy_document(base_policy)
+
+    assert len(merged["Statement"]) == 2
+    assert merged["Statement"][0]["Action"] == ["ssm:GetParameter"]
+    assert merged["Statement"][1]["Action"] == ["ssm:PutParameter"]
+
+
 def test_build_environment_variables_reads_project_metadata(tmp_path, monkeypatch):
     amplify_dir = tmp_path / "amplify" / "backend"
     amplify_dir.mkdir(parents=True)

{velocity_python-0.1.48 → velocity_python-0.1.50}/tests/test_context_job_descriptions.py

@@ -87,6 +87,67 @@ class TestQueueJobDescriptions(unittest.TestCase):
         self.assertEqual(1, len(fake_context.jobs))
         self.assertIsNone(fake_context.jobs[0]["description"])
 
+    def test_get_pass_through_vars_uses_ssm_aware_runtime_helpers(self):
+        fake_context = _FakeContext()
+
+        def _fake_config_getenv(key, default=None, **kwargs):
+            values = {
+                "LOGLEVEL": "INFO",
+                "DBDatabase": "cc_demo",
+                "BUILD_DATETIME": "05/28/2026 11:00PM",
+            }
+            return values.get(key, default)
+
+        with patch.dict(
+            handler_context.os.environ,
+            {"AWS_JOB_ID": "job-123"},
+            clear=False,
+        ), patch.object(
+            handler_context,
+            "config_get_stage",
+            return_value="demo",
+        ), patch.object(
+            handler_context,
+            "config_get_region",
+            return_value="us-east-1",
+        ), patch.object(
+            handler_context,
+            "config_get_project_name",
+            return_value="BackOffice",
+        ), patch.object(
+            handler_context,
+            "config_getenv",
+            side_effect=_fake_config_getenv,
+        ):
+            result = handler_context.Context.get_pass_through_vars.__wrapped__(
+                fake_context,
+                tx=None,
+            )
+
+        self.assertEqual(
+            {
+                "USER_BRANCH": "demo",
+                "AWS_JOB_ID": "job-123",
+                "LOGLEVEL": "INFO",
+                "USER_REGION": "us-east-1",
+                "ProjectName": "BackOffice",
+                "DBDatabase": "cc_demo",
+                "BUILD_DATETIME": "05/28/2026 11:00PM",
+            },
+            result["controls"]["vars"],
+        )
+
+    def test_environment_helpers_use_stage_alias_resolution(self):
+        fake_context = _FakeContext()
+
+        with patch.object(
+            handler_context,
+            "config_get_stage",
+            side_effect=["production", "demo"],
+        ):
+            self.assertTrue(handler_context.Context._is_production(fake_context))
+            self.assertEqual("demo", handler_context.Context.get_environment(fake_context))
+
 
 if __name__ == "__main__":
     unittest.main()

{velocity_python-0.1.48 → velocity_python-0.1.50}/tests/test_ssm_config.py

@@ -83,6 +83,61 @@ def test_getenv_auto_enables_ssm_in_lambda_with_inferred_project(monkeypatch):
     client_factory.assert_called_once_with("ssm", region_name="us-west-2")
 
 
+def test_getenv_falls_back_to_global_when_project_key_missing(monkeypatch):
+    ssm_config.clear_cache()
+    monkeypatch.setenv("VELOCITY_SSM_ENABLED", "true")
+    monkeypatch.setenv("ProjectName", "BackOffice")
+    monkeypatch.setenv("ENV", "demo")
+
+    class FakeSSM:
+        def __init__(self):
+            self.calls = []
+
+        def get_parameter(self, Name, WithDecryption):
+            self.calls.append((Name, WithDecryption))
+            if Name == "/BackOffice/demo/DBHost":
+                raise Exception("missing local")
+            if Name == "/Global/demo/DBHost":
+                return {"Parameter": {"Value": "global-host"}}
+            raise AssertionError(Name)
+
+    fake_ssm = FakeSSM()
+
+    with patch("boto3.client", return_value=fake_ssm):
+        assert ssm_config.getenv("DBHost") == "global-host"
+
+    assert fake_ssm.calls == [
+        ("/BackOffice/demo/DBHost", True),
+        ("/Global/demo/DBHost", True),
+    ]
+
+
+def test_getenv_prefers_local_before_global(monkeypatch):
+    ssm_config.clear_cache()
+    monkeypatch.setenv("VELOCITY_SSM_ENABLED", "true")
+    monkeypatch.setenv("ProjectName", "BackOffice")
+    monkeypatch.setenv("ENV", "demo")
+
+    class FakeSSM:
+        def __init__(self):
+            self.calls = []
+
+        def get_parameter(self, Name, WithDecryption):
+            self.calls.append((Name, WithDecryption))
+            if Name == "/BackOffice/demo/DBHost":
+                return {"Parameter": {"Value": "local-host"}}
+            raise AssertionError(Name)
+
+    fake_ssm = FakeSSM()
+
+    with patch("boto3.client", return_value=fake_ssm):
+        assert ssm_config.getenv("DBHost") == "local-host"
+
+    assert fake_ssm.calls == [
+        ("/BackOffice/demo/DBHost", True),
+    ]
+
+
 def test_getenv_raises_on_missing_when_disabled(monkeypatch):
     ssm_config.clear_cache()
     monkeypatch.delenv("VELOCITY_SSM_ENABLED", raising=False)