velocity-python 0.1.66__tar.gz → 0.1.67__tar.gz

{velocity_python-0.1.66 → velocity_python-0.1.67}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.66
+Version: 0.1.67
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.66 → velocity_python-0.1.67}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.66"
+version = "0.1.67"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.1.66 → velocity_python-0.1.67}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.66"
+__version__ = version = "0.1.67"
 
 import importlib as _importlib
 

{velocity_python-0.1.66 → velocity_python-0.1.67}/src/velocity/aws/handlers/context.py

@@ -24,6 +24,10 @@ engine = velocity.db.postgres.initialize()
 cognito_client = boto3.client("cognito-idp")
 logger = get_logger("velocity.aws.handlers.context")
 
+# Cognito User Pool id shape, e.g. "us-east-1_aBcD1234". Used to distinguish a
+# real user-pool identity from other Identity Pool providers (developer-auth).
+_COGNITO_USER_POOL_ID_RE = re.compile(r"^[\w-]+_[0-9a-zA-Z]+$")
+
 
 def _get_work_queue_name() -> str:
     queue_name = str(config_getenv("SqsWorkQueue", "") or "").strip()
@@ -656,6 +660,21 @@ class Context:
         if not user_pool_id or not user_sub:
             raise AlertError("Incomplete Cognito identity provider data") from None
 
+        # Federated identities that are not Cognito User Pool logins — e.g.
+        # developer-authenticated Identity Pool identities used for admin
+        # masquerade — carry a provider name (like "login.caringcent.masquerade")
+        # that is not a user-pool id. Detect that and fail with a clear message
+        # rather than passing an invalid value to admin_get_user (which raises a
+        # cryptic "userPoolId failed to satisfy constraint" error).
+        if "cognito-idp" not in provider or not _COGNITO_USER_POOL_ID_RE.match(
+            user_pool_id
+        ):
+            raise AlertError(
+                "Request identity is not a Cognito User Pool user "
+                f"(authentication provider '{provider[:120]}'); "
+                "cannot resolve a Cognito user"
+            ) from None
+
         try:
             self.perf.start("cognito admin_get_user")
             response = cognito_client.admin_get_user(

{velocity_python-0.1.66 → velocity_python-0.1.67}/src/velocity_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.66
+Version: 0.1.67
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.66 → velocity_python-0.1.67}/src/velocity_python.egg-info/SOURCES.txt

@@ -164,6 +164,7 @@ tests/test_db_credentials_ssm_cascade.py
 tests/test_decorators.py
 tests/test_dirty_pipeline_fast_path.py
 tests/test_email_processing.py
+tests/test_get_cognito_user_provider.py
 tests/test_http_handler_rollback.py
 tests/test_iconv_money_to_cents.py
 tests/test_identifier_injection_guard.py

velocity_python-0.1.67/tests/test_get_cognito_user_provider.py

@@ -0,0 +1,66 @@
+import unittest
+from unittest.mock import patch
+
+from velocity.aws.handlers import context as handler_context
+from velocity.aws.handlers.context import Context
+from velocity.aws.handlers.exceptions import AlertError
+
+
+def _ctx(provider):
+    event = {
+        "requestContext": {"identity": {"cognitoAuthenticationProvider": provider}}
+    }
+    ctx = Context(
+        aws_event=event,
+        aws_context=None,
+        args={},
+        postdata={},
+        response=None,
+        session={},
+    )
+    return ctx, event
+
+
+# A real Cognito User Pool federation looks like
+# "cognito-idp.<region>.amazonaws.com/<poolId>,...:CognitoSignIn:<sub>".
+VALID_PROVIDER = (
+    "cognito-idp.us-east-1.amazonaws.com/us-east-1_Abc12345,"
+    "cognito-idp.us-east-1.amazonaws.com/us-east-1_Abc12345:CognitoSignIn:sub-123"
+)
+# A developer-authenticated Identity Pool identity (admin masquerade) carries
+# only the developer provider name.
+DEV_PROVIDER = "login.caringcent.masquerade"
+
+
+class TestGetCognitoUserProvider(unittest.TestCase):
+    def test_developer_provider_is_rejected_cleanly(self):
+        ctx, event = _ctx(DEV_PROVIDER)
+        with patch.object(handler_context, "cognito_client") as mock_cognito:
+            with self.assertRaises(AlertError) as cm:
+                ctx.get_cognito_user(event)
+            mock_cognito.admin_get_user.assert_not_called()
+        self.assertIn("not a Cognito User Pool user", str(cm.exception))
+
+    def test_developer_provider_optional_returns_none(self):
+        ctx, event = _ctx(DEV_PROVIDER)
+        with patch.object(handler_context, "cognito_client"):
+            self.assertIsNone(ctx.get_cognito_user_optional(event))
+
+    def test_valid_provider_passes_the_gate(self):
+        ctx, event = _ctx(VALID_PROVIDER)
+        with patch.object(handler_context, "cognito_client") as mock_cognito:
+            mock_cognito.admin_get_user.return_value = {
+                "Username": "user-1",
+                "UserAttributes": [{"Name": "email", "Value": "user@example.com"}],
+                "Enabled": True,
+                "UserStatus": "CONFIRMED",
+            }
+            user = ctx.get_cognito_user(event)
+        mock_cognito.admin_get_user.assert_called_once()
+        _, kwargs = mock_cognito.admin_get_user.call_args
+        self.assertEqual(kwargs["UserPoolId"], "us-east-1_Abc12345")
+        self.assertEqual(user["email"], "user@example.com")
+
+
+if __name__ == "__main__":
+    unittest.main()