velocity-python 0.1.49__tar.gz → 0.1.51__tar.gz

{velocity_python-0.1.49 → velocity_python-0.1.51}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.49
+Version: 0.1.51
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.49 → velocity_python-0.1.51}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.49"
+version = "0.1.51"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.1.49 → velocity_python-0.1.51}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.49"
+__version__ = version = "0.1.51"
 
 import importlib as _importlib
 

{velocity_python-0.1.49 → velocity_python-0.1.51}/src/velocity/aws/__init__.py

@@ -1,7 +1,8 @@
 import importlib as _importlib
 import os
 
-DEBUG = (os.environ.get("ENV") != "production") or (os.environ.get("DEBUG") == "Y")
+_APP_STAGE = os.environ.get("AppStage") or os.environ.get("AWS_BRANCH") or "demo"
+DEBUG = (_APP_STAGE != "production") or (os.environ.get("DEBUG") == "Y")
 
 
 # This is helpful for running HTTPS clients on lambda.

{velocity_python-0.1.49 → velocity_python-0.1.51}/src/velocity/aws/amplify_build.py

@@ -176,6 +176,7 @@ def initialize_build_environment(
     app_id, branch = get_amplify_app_id_and_branch(project_root)
     print(f"[INFO] Setting environment to: {branch}")
     env.set(branch)
+    os.environ["AppStage"] = branch
     os.environ["AWS_BRANCH"] = branch
     os.environ["AWS_APP_ID"] = app_id
     if include_run_on_build_env:
@@ -203,8 +204,8 @@ def build_environment_variables(
 
     build_datetime = _format_build_datetime(timezone_name)
     env_vars["BUILD_DATETIME"] = build_datetime
-    env_vars["USER_BRANCH"] = branch
-    env_vars["REACT_APP_USER_BRANCH"] = branch
+    env_vars["AppStage"] = branch
+    env_vars["AWS_BRANCH"] = branch
     env_vars["USER_REGION"] = app.get_region()
     env_vars["LOGLEVEL"] = "WARNING" if branch == "production" else "INFO"
 
@@ -338,32 +339,31 @@ def ensure_lambda_policies_and_attach(
         iam_client = boto3.client("iam")
 
     account_id = app.get_account_id()
-    lambda_layer_policy = {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": ["lambda:GetFunctionConfiguration"],
-                "Resource": f"arn:aws:lambda:*:{account_id}:function:*",
-            }
-        ],
-    }
 
     lambda_vpc_policy = app.get_lambda_vpc_policy_template()
     if config is not None:
         lambda_vpc_policy = config.build_lambda_policy_document(lambda_vpc_policy)
 
+    lambda_layer_statement = {
+        "Effect": "Allow",
+        "Action": ["lambda:GetFunctionConfiguration"],
+        "Resource": f"arn:aws:lambda:*:{account_id}:function:*",
+    }
+    statements = list(lambda_vpc_policy.get("Statement", []))
+    if not any(
+        statement.get("Action") == ["lambda:GetFunctionConfiguration"]
+        and statement.get("Resource") == f"arn:aws:lambda:*:{account_id}:function:*"
+        for statement in statements
+    ):
+        statements.append(lambda_layer_statement)
+    lambda_vpc_policy["Statement"] = statements
+
     required_policies = [
         (
             "lambda-vpc-execution",
             f"arn:aws:iam::{account_id}:policy/lambda-vpc-execution",
             lambda_vpc_policy,
         ),
-        (
-            "lambda-layer-access",
-            f"arn:aws:iam::{account_id}:policy/lambda-layer-access",
-            lambda_layer_policy,
-        ),
         ("AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", None),
     ]
 

{velocity_python-0.1.49 → velocity_python-0.1.51}/src/velocity/aws/handlers/context.py

@@ -33,8 +33,9 @@ def _get_work_queue_name() -> str:
 
 
 def _get_controls_vars() -> dict:
+    app_stage = config_get_stage()
     return {
-        "USER_BRANCH": config_get_stage(),
+        "AppStage": app_stage,
         "AWS_JOB_ID": os.environ.get("AWS_JOB_ID"),
         "LOGLEVEL": config_getenv("LOGLEVEL"),
         "USER_REGION": config_get_region(),
@@ -449,7 +450,7 @@ class Context:
         return str(config_get_stage("") or "").lower() == "production"
 
     def get_environment(self):
-        """Return the current USER_BRANCH value (defaults to demo)."""
+        """Return the current AppStage value (defaults to demo)."""
         return config_get_stage("demo")
 
     def get_current_lambda_layers(self):

{velocity_python-0.1.49 → velocity_python-0.1.51}/src/velocity/aws/handlers/mixins/web_handler.py

@@ -18,6 +18,7 @@ from datetime import date, datetime
 from typing import Any, Dict, List
 
 from velocity.aws.handlers.exceptions import AlertError
+from velocity.aws.ssm_config import get_stage as config_get_stage
 
 logger = logging.getLogger(__name__)
 
@@ -60,13 +61,14 @@ class WebHandler(ABC):
         session_data = context.session() or {}
 
         perf.start("track_activity_start build activity_data")
+        app_stage = config_get_stage("Unknown")
         self.activity_data = {
             "action": context.action(),
             "args": json.dumps(context.args()),
             "postdata": self._sanitize_postdata(postdata),
             "handler_name": self.__class__.__name__,
             "function_name": os.environ.get("AWS_LAMBDA_FUNCTION_NAME", "Unknown"),
-            "user_branch": os.environ.get("USER_BRANCH", "Unknown"),
+            "app_stage": app_stage,
             "start_timestamp": self.start_time,
         }
         perf.log(
@@ -239,6 +241,7 @@ class WebHandler(ABC):
 
     def log_error_to_system(self, tx, context, exception: Exception, tb_string: str):
         """Log error to the sys_log table"""
+        app_stage = config_get_stage("Unknown")
         error_data = {
             "level": "ERROR",
             "message": str(exception),
@@ -247,7 +250,7 @@ class WebHandler(ABC):
             "exception_type": exception.__class__.__name__,
             "handler_name": self.__class__.__name__,
             "action": context.action(),
-            "user_branch": os.environ.get("USER_BRANCH", "Unknown"),
+            "app_stage": app_stage,
             "function_name": os.environ.get("AWS_LAMBDA_FUNCTION_NAME", "Unknown"),
             "app_name": os.environ.get("ProjectName", "Unknown"),
             "user_agent": "AWS Lambda",
@@ -271,7 +274,7 @@ class WebHandler(ABC):
                 logger.debug("No sendmail callable configured; skipping notification.")
                 return
 
-            environment = os.environ.get("USER_BRANCH", "Unknown").title()
+            environment = config_get_stage("Unknown").title()
             function_name = os.environ.get("AWS_LAMBDA_FUNCTION_NAME", "Unknown")
 
             subject = f"{environment} Lambda Error - {function_name}"
@@ -414,12 +417,14 @@ Request Details:
     def log_error_metrics(self, tx, context, exception: Exception):
         """Log error metrics for monitoring"""
         try:
+            app_stage = config_get_stage("Unknown")
             metrics_data = {
                 "metric_type": "error_count",
                 "handler_name": self.__class__.__name__,
                 "action": context.action(),
                 "exception_type": exception.__class__.__name__,
-                "environment": os.environ.get("USER_BRANCH", "Unknown"),
+                "environment": app_stage,
+                "app_stage": app_stage,
                 "function_name": os.environ.get("AWS_LAMBDA_FUNCTION_NAME", "Unknown"),
                 "timestamp": time.time(),
                 "sys_modified_by": "Lambda",

{velocity_python-0.1.49 → velocity_python-0.1.51}/src/velocity/aws/ssm_config.py

@@ -3,17 +3,21 @@ SSM-backed configuration with environment-variable fallback.
 
 ``getenv(key)`` reads from SSM at::
 
-    /{ProjectName}/{stage}/{key}
+    /{ProjectName}/{AppStage}/{key}
+
+and, on a project-scoped miss, then tries::
+
+    /Global/{stage}/{key}
 
 when SSM loading is enabled. An explicit ``VELOCITY_SSM_ENABLED`` environment
 variable still overrides the behavior, but Lambda runtimes now auto-enable SSM
-when they can resolve both project and stage from the runtime environment.
+when they can resolve both project and AppStage from the runtime environment.
 
 On an SSM miss or any other SSM error, ``getenv`` falls back to ``os.environ``.
 Results are cached for the process lifetime so SSM is called at most once per
 key per Lambda cold start.
 
-Outside Lambda, or when project/stage cannot be resolved, ``getenv`` remains a
+Outside Lambda, or when project/AppStage cannot be resolved, ``getenv`` remains a
 thin wrapper around ``os.environ.get`` with no SSM call.
 """
 
@@ -81,7 +85,7 @@ def _infer_project_name_from_lambda_name() -> str | None:
     if function_name is None:
         return None
 
-    stage = _first_nonempty_env('AppStage', 'ENV', 'USER_BRANCH', 'AWS_BRANCH')
+    stage = _first_nonempty_env('AppStage', 'AWS_BRANCH')
     base_name = function_name
     if stage:
         suffix = f'-{stage}'
@@ -102,7 +106,7 @@ def get_project_name(default: Optional[str] = None) -> Optional[str]:
 
 
 def get_stage(default: Optional[str] = None) -> Optional[str]:
-    return _first_nonempty_env('AppStage', 'ENV', 'USER_BRANCH', 'AWS_BRANCH') or default
+    return _first_nonempty_env('AppStage', 'AWS_BRANCH') or default
 
 
 def get_region(default: Optional[str] = 'us-east-1') -> Optional[str]:
@@ -118,19 +122,37 @@ def _ssm_prefix() -> str | None:
     return None
 
 
-def _fetch(key: str) -> str | None:
-    """Single SSM GetParameter call; returns value or None on any failure."""
+def _ssm_parameter_names(key: str) -> list[str]:
     prefix = _ssm_prefix()
     if prefix is None:
+        return []
+
+    parameter_names = [f'{prefix}/{key}']
+    project = get_project_name()
+    stage = get_stage()
+    if project and stage and project != 'Global':
+        parameter_names.append(f'/Global/{stage}/{key}')
+    return parameter_names
+
+
+def _fetch(key: str) -> str | None:
+    """Resolve one key from project SSM first, then Global fallback."""
+    parameter_names = _ssm_parameter_names(key)
+    if not parameter_names:
         return None
-    param_name = f'{prefix}/{key}'
+
     try:
         import boto3
         ssm = boto3.client('ssm', region_name=get_region('us-east-1'))
-        resp = ssm.get_parameter(Name=param_name, WithDecryption=True)
-        return resp['Parameter']['Value']
+        for param_name in parameter_names:
+            try:
+                resp = ssm.get_parameter(Name=param_name, WithDecryption=True)
+                return resp['Parameter']['Value']
+            except Exception as exc:
+                logger.debug('SSM miss for %s: %s', param_name, exc)
+        return None
     except Exception as exc:
-        logger.debug('SSM miss for %s: %s', param_name, exc)
+        logger.debug('SSM client failure while resolving %s: %s', key, exc)
         return None
 
 

{velocity_python-0.1.49 → velocity_python-0.1.51}/src/velocity_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.49
+Version: 0.1.51
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.49 → velocity_python-0.1.51}/tests/test_ssm_config.py

@@ -83,6 +83,61 @@ def test_getenv_auto_enables_ssm_in_lambda_with_inferred_project(monkeypatch):
     client_factory.assert_called_once_with("ssm", region_name="us-west-2")
 
 
+def test_getenv_falls_back_to_global_when_project_key_missing(monkeypatch):
+    ssm_config.clear_cache()
+    monkeypatch.setenv("VELOCITY_SSM_ENABLED", "true")
+    monkeypatch.setenv("ProjectName", "BackOffice")
+    monkeypatch.setenv("ENV", "demo")
+
+    class FakeSSM:
+        def __init__(self):
+            self.calls = []
+
+        def get_parameter(self, Name, WithDecryption):
+            self.calls.append((Name, WithDecryption))
+            if Name == "/BackOffice/demo/DBHost":
+                raise Exception("missing local")
+            if Name == "/Global/demo/DBHost":
+                return {"Parameter": {"Value": "global-host"}}
+            raise AssertionError(Name)
+
+    fake_ssm = FakeSSM()
+
+    with patch("boto3.client", return_value=fake_ssm):
+        assert ssm_config.getenv("DBHost") == "global-host"
+
+    assert fake_ssm.calls == [
+        ("/BackOffice/demo/DBHost", True),
+        ("/Global/demo/DBHost", True),
+    ]
+
+
+def test_getenv_prefers_local_before_global(monkeypatch):
+    ssm_config.clear_cache()
+    monkeypatch.setenv("VELOCITY_SSM_ENABLED", "true")
+    monkeypatch.setenv("ProjectName", "BackOffice")
+    monkeypatch.setenv("ENV", "demo")
+
+    class FakeSSM:
+        def __init__(self):
+            self.calls = []
+
+        def get_parameter(self, Name, WithDecryption):
+            self.calls.append((Name, WithDecryption))
+            if Name == "/BackOffice/demo/DBHost":
+                return {"Parameter": {"Value": "local-host"}}
+            raise AssertionError(Name)
+
+    fake_ssm = FakeSSM()
+
+    with patch("boto3.client", return_value=fake_ssm):
+        assert ssm_config.getenv("DBHost") == "local-host"
+
+    assert fake_ssm.calls == [
+        ("/BackOffice/demo/DBHost", True),
+    ]
+
+
 def test_getenv_raises_on_missing_when_disabled(monkeypatch):
     ssm_config.clear_cache()
     monkeypatch.delenv("VELOCITY_SSM_ENABLED", raising=False)