velocity-python 0.1.66__tar.gz → 0.1.68__tar.gz

{velocity_python-0.1.66 → velocity_python-0.1.68}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.66
+Version: 0.1.68
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.66 → velocity_python-0.1.68}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.66"
+version = "0.1.68"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.1.66 → velocity_python-0.1.68}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.66"
+__version__ = version = "0.1.68"
 
 import importlib as _importlib
 

{velocity_python-0.1.66 → velocity_python-0.1.68}/src/velocity/aws/handlers/context.py

@@ -24,6 +24,10 @@ engine = velocity.db.postgres.initialize()
 cognito_client = boto3.client("cognito-idp")
 logger = get_logger("velocity.aws.handlers.context")
 
+# Cognito User Pool id shape, e.g. "us-east-1_aBcD1234". Used to distinguish a
+# real user-pool identity from other Identity Pool providers (developer-auth).
+_COGNITO_USER_POOL_ID_RE = re.compile(r"^[\w-]+_[0-9a-zA-Z]+$")
+
 
 def _get_work_queue_name() -> str:
     queue_name = str(config_getenv("SqsWorkQueue", "") or "").strip()
@@ -656,6 +660,21 @@ class Context:
         if not user_pool_id or not user_sub:
             raise AlertError("Incomplete Cognito identity provider data") from None
 
+        # Federated identities that are not Cognito User Pool logins — e.g.
+        # developer-authenticated Identity Pool identities used for admin
+        # masquerade — carry a provider name (like "login.caringcent.masquerade")
+        # that is not a user-pool id. Detect that and fail with a clear message
+        # rather than passing an invalid value to admin_get_user (which raises a
+        # cryptic "userPoolId failed to satisfy constraint" error).
+        if "cognito-idp" not in provider or not _COGNITO_USER_POOL_ID_RE.match(
+            user_pool_id
+        ):
+            raise AlertError(
+                "Request identity is not a Cognito User Pool user "
+                f"(authentication provider '{provider[:120]}'); "
+                "cannot resolve a Cognito user"
+            ) from None
+
         try:
             self.perf.start("cognito admin_get_user")
             response = cognito_client.admin_get_user(

{velocity_python-0.1.66 → velocity_python-0.1.68}/src/velocity/payment/stripe_adapter.py

@@ -521,6 +521,10 @@ class StripeAdapter(PaymentProcessorAdapter):
                     "platform_fee": platform_fee_cents,
                     "application_fee": application_fee_cents,
                     "client_amount": amount_cents - application_fee_cents,
+                    # Real Stripe processing cost from the settled BalanceTransaction
+                    # (None for an uncaptured manual auth); callers freeze it as the
+                    # 'stripe_settled' processor fee, else keep their estimate (M6).
+                    "actual_processor_fee": self._settled_processor_fee_cents(charge),
                 },
             }
 
@@ -621,6 +625,10 @@ class StripeAdapter(PaymentProcessorAdapter):
                 "platform_fee": platform_fee_cents,
                 "application_fee": payment_intent.application_fee_amount or application_fee_cents,
                 "client_amount": payment_intent.amount - (payment_intent.application_fee_amount or application_fee_cents),
+                # Real Stripe processing cost from the settled BalanceTransaction (None
+                # when not yet available); callers freeze it as the 'stripe_settled'
+                # processor fee, otherwise keep their formula estimate (FeeModel.md M6).
+                "actual_processor_fee": self._settled_processor_fee_cents(charge),
                 "error_message": None,
                 "metadata": {
                     "payment_intent": payment_intent,
@@ -849,13 +857,43 @@ class StripeAdapter(PaymentProcessorAdapter):
             latest_charge_id = getattr(payment_intent, "latest_charge", None)
             if latest_charge_id:
                 try:
-                    charge = stripe.Charge.retrieve(latest_charge_id, api_key=self._api_key)
+                    charge = stripe.Charge.retrieve(
+                        latest_charge_id,
+                        expand=["balance_transaction"],
+                        api_key=self._api_key,
+                    )
                 except stripe.error.StripeError:
                     charge = None
         if charge:
             upsert_stripe_charge_record(tx, charge, source=source)
         return charge
 
+    def _settled_processor_fee_cents(self, charge):
+        """Return the processor's actual fee (cents) from the charge's BalanceTransaction.
+
+        Stripe exposes the real processing cost on the charge's BalanceTransaction
+        (``balance_transaction.fee``). Returns ``None`` when it is not yet available
+        (e.g. an uncaptured manual authorization) or cannot be fetched — callers then
+        keep their formula estimate rather than over-reporting. Never raises. This is the
+        ``stripe_settled`` actual-cost source in CaringCent's FeeModel.md (M6).
+        """
+        if not charge:
+            return None
+        bt = getattr(charge, "balance_transaction", None)
+        if bt is None and isinstance(charge, dict):
+            bt = charge.get("balance_transaction")
+        try:
+            if bt is None:
+                return None
+            if isinstance(bt, str):
+                bt = stripe.BalanceTransaction.retrieve(bt, api_key=self._api_key)
+            fee = getattr(bt, "fee", None)
+            if fee is None and isinstance(bt, dict):
+                fee = bt.get("fee")
+            return int(fee) if fee is not None else None
+        except stripe.error.StripeError:
+            return None
+
     def _determine_account_status(self, account) -> str:
         """
         Determine human-readable account status from Stripe Account object.

{velocity_python-0.1.66 → velocity_python-0.1.68}/src/velocity_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.66
+Version: 0.1.68
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.66 → velocity_python-0.1.68}/src/velocity_python.egg-info/SOURCES.txt

@@ -164,6 +164,7 @@ tests/test_db_credentials_ssm_cascade.py
 tests/test_decorators.py
 tests/test_dirty_pipeline_fast_path.py
 tests/test_email_processing.py
+tests/test_get_cognito_user_provider.py
 tests/test_http_handler_rollback.py
 tests/test_iconv_money_to_cents.py
 tests/test_identifier_injection_guard.py

velocity_python-0.1.68/tests/test_get_cognito_user_provider.py

@@ -0,0 +1,66 @@
+import unittest
+from unittest.mock import patch
+
+from velocity.aws.handlers import context as handler_context
+from velocity.aws.handlers.context import Context
+from velocity.aws.handlers.exceptions import AlertError
+
+
+def _ctx(provider):
+    event = {
+        "requestContext": {"identity": {"cognitoAuthenticationProvider": provider}}
+    }
+    ctx = Context(
+        aws_event=event,
+        aws_context=None,
+        args={},
+        postdata={},
+        response=None,
+        session={},
+    )
+    return ctx, event
+
+
+# A real Cognito User Pool federation looks like
+# "cognito-idp.<region>.amazonaws.com/<poolId>,...:CognitoSignIn:<sub>".
+VALID_PROVIDER = (
+    "cognito-idp.us-east-1.amazonaws.com/us-east-1_Abc12345,"
+    "cognito-idp.us-east-1.amazonaws.com/us-east-1_Abc12345:CognitoSignIn:sub-123"
+)
+# A developer-authenticated Identity Pool identity (admin masquerade) carries
+# only the developer provider name.
+DEV_PROVIDER = "login.caringcent.masquerade"
+
+
+class TestGetCognitoUserProvider(unittest.TestCase):
+    def test_developer_provider_is_rejected_cleanly(self):
+        ctx, event = _ctx(DEV_PROVIDER)
+        with patch.object(handler_context, "cognito_client") as mock_cognito:
+            with self.assertRaises(AlertError) as cm:
+                ctx.get_cognito_user(event)
+            mock_cognito.admin_get_user.assert_not_called()
+        self.assertIn("not a Cognito User Pool user", str(cm.exception))
+
+    def test_developer_provider_optional_returns_none(self):
+        ctx, event = _ctx(DEV_PROVIDER)
+        with patch.object(handler_context, "cognito_client"):
+            self.assertIsNone(ctx.get_cognito_user_optional(event))
+
+    def test_valid_provider_passes_the_gate(self):
+        ctx, event = _ctx(VALID_PROVIDER)
+        with patch.object(handler_context, "cognito_client") as mock_cognito:
+            mock_cognito.admin_get_user.return_value = {
+                "Username": "user-1",
+                "UserAttributes": [{"Name": "email", "Value": "user@example.com"}],
+                "Enabled": True,
+                "UserStatus": "CONFIRMED",
+            }
+            user = ctx.get_cognito_user(event)
+        mock_cognito.admin_get_user.assert_called_once()
+        _, kwargs = mock_cognito.admin_get_user.call_args
+        self.assertEqual(kwargs["UserPoolId"], "us-east-1_Abc12345")
+        self.assertEqual(user["email"], "user@example.com")
+
+
+if __name__ == "__main__":
+    unittest.main()

{velocity_python-0.1.66 → velocity_python-0.1.68}/tests/test_payment_stripe_adapter.py

@@ -238,6 +238,79 @@ def test_authorize_payment_upserts_payment_intent_mirror(adapter, monkeypatch):
     ]
 
 
+def test_settled_processor_fee_from_expanded_balance_transaction(adapter):
+    # Stripe exposes the real processing cost on the charge's BalanceTransaction.
+    charge = SimpleNamespace(
+        id="ch_123",
+        balance_transaction=SimpleNamespace(id="txn_1", fee=332),
+    )
+    assert adapter._settled_processor_fee_cents(charge) == 332
+
+
+def test_settled_processor_fee_retrieves_unexpanded_balance_transaction(adapter, monkeypatch):
+    monkeypatch.setattr(
+        "velocity.payment.stripe_adapter.stripe.BalanceTransaction.retrieve",
+        lambda txn_id, api_key=None: SimpleNamespace(id=txn_id, fee=288),
+    )
+    charge = SimpleNamespace(id="ch_123", balance_transaction="txn_1")
+    assert adapter._settled_processor_fee_cents(charge) == 288
+
+
+def test_settled_processor_fee_none_when_unavailable(adapter):
+    # No charge, or no balance transaction yet (uncaptured auth) -> None, never raises.
+    assert adapter._settled_processor_fee_cents(None) is None
+    assert (
+        adapter._settled_processor_fee_cents(
+            SimpleNamespace(id="ch_1", balance_transaction=None)
+        )
+        is None
+    )
+
+
+def test_charge_stored_payment_method_reports_actual_processor_fee(adapter, monkeypatch):
+    monkeypatch.setattr(
+        "velocity.payment.stripe_adapter.stripe.PaymentIntent.create",
+        lambda **kwargs: SimpleNamespace(
+            id="pi_123",
+            latest_charge="ch_123",
+            status="succeeded",
+            amount=10420,
+            currency="usd",
+            application_fee_amount=820,
+        ),
+    )
+    monkeypatch.setattr(
+        "velocity.payment.stripe_adapter.stripe.Charge.retrieve",
+        lambda charge_id, expand=None, api_key=None: SimpleNamespace(
+            id=charge_id,
+            balance_transaction=SimpleNamespace(id="txn_1", fee=332),
+        ),
+    )
+    monkeypatch.setattr(
+        "velocity.payment.stripe_adapter.upsert_stripe_payment_intent_record",
+        lambda *a, **k: None,
+    )
+    monkeypatch.setattr(
+        "velocity.payment.stripe_adapter.upsert_stripe_charge_record",
+        lambda *a, **k: None,
+    )
+
+    result = adapter.charge_stored_payment_method(
+        None,
+        {
+            "amount": 10420,
+            "payment_method": "pm_123",
+            "customer_profile_id": "cus_123",
+            "processor_account_id": "acct_123",
+            "revenue_split_percentage": 8,
+            "client_id": "client_1",
+        },
+    )
+
+    assert result["success"] is True
+    assert result["actual_processor_fee"] == 332
+
+
 def test_authorize_payment_uses_explicit_application_fee(adapter, monkeypatch):
     captured = {}