velocity-python 0.1.81__tar.gz → 0.1.83__tar.gz

{velocity_python-0.1.81 → velocity_python-0.1.83}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.81
+Version: 0.1.83
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.81 → velocity_python-0.1.83}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.81"
+version = "0.1.83"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.1.81 → velocity_python-0.1.83}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.81"
+__version__ = version = "0.1.83"
 
 import importlib as _importlib
 

{velocity_python-0.1.81 → velocity_python-0.1.83}/src/velocity/aws/amplify_build.py

@@ -294,7 +294,54 @@ def _normalize_policy_document(policy_document: Any) -> Any:
         return json.loads(policy_document)
 
 
+def _canonical_statement(statement: Mapping[str, Any]) -> str:
+    """Canonical form for statement identity: scalar Action/Resource and their
+    list equivalents compare equal, action order is ignored."""
+    normalized: Dict[str, Any] = {}
+    for key, value in statement.items():
+        if key in ("Action", "NotAction", "Resource", "NotResource"):
+            items = value if isinstance(value, list) else [value]
+            normalized[key] = sorted(str(item) for item in items)
+        else:
+            normalized[key] = value
+    return json.dumps(normalized, sort_keys=True)
+
+
+def _merge_policy_statements(
+    current_document: Mapping[str, Any], desired_document: Mapping[str, Any]
+) -> Dict[str, Any]:
+    """Additive union of policy statements.
+
+    Every statement already on the policy is kept (manually-added grants and
+    other apps' statements survive); desired statements not already present are
+    appended. Statements are never removed here — remove manually when needed.
+    """
+    current_statements = list(current_document.get("Statement", []))
+    seen = {_canonical_statement(statement) for statement in current_statements}
+    merged = list(current_statements)
+    for statement in desired_document.get("Statement", []):
+        key = _canonical_statement(statement)
+        if key not in seen:
+            merged.append(statement)
+            seen.add(key)
+    merged_document = dict(current_document)
+    if "Version" not in merged_document and "Version" in desired_document:
+        merged_document["Version"] = desired_document["Version"]
+    merged_document["Statement"] = merged
+    return merged_document
+
+
 def _sync_managed_policy_document(iam_client, policy_arn: str, policy_document: Any) -> None:
+    """Ensure the managed policy contains every desired statement (additive).
+
+    The policy document is the union of what is already on the policy and the
+    desired statements; existing statements are never dropped. This keeps a
+    shared policy (e.g. lambda-vpc-execution, attached by every app's build)
+    stable across builds of apps with differing extra statements, and preserves
+    grants added out-of-band. Note: IAM managed policies cap at 6144 chars —
+    if the union outgrows that, create_policy_version raises and the surplus
+    must be pruned manually.
+    """
     policy = retryable_call(iam_client.get_policy, PolicyArn=policy_arn)["Policy"]
     current_version = retryable_call(
         iam_client.get_policy_version,
@@ -303,7 +350,9 @@ def _sync_managed_policy_document(iam_client, policy_arn: str, policy_document:
     )["PolicyVersion"]
 
     current_document = _normalize_policy_document(current_version["Document"])
-    desired_document = _normalize_policy_document(policy_document)
+    desired_document = _merge_policy_statements(
+        current_document, _normalize_policy_document(policy_document)
+    )
     if json.dumps(current_document, sort_keys=True) == json.dumps(desired_document, sort_keys=True):
         return
 

{velocity_python-0.1.81 → velocity_python-0.1.83}/src/velocity_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.81
+Version: 0.1.83
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.81 → velocity_python-0.1.83}/tests/test_amplify_build.py

@@ -215,3 +215,106 @@ def test_update_custom_redirect_rules_serves_static_html_and_jpeg():
     spa_rewrite = call["customRules"][1]["source"]
     for ext in ("html", "jpeg", "jpg", "css", "js"):
         assert f"|{ext}|" in f"|{spa_rewrite}|".replace("(", "|").replace(")", "|"), ext
+
+
+class FakeIamClient:
+    """Minimal IAM stub for _sync_managed_policy_document tests."""
+
+    class exceptions:
+        class NoSuchEntityException(Exception):
+            pass
+
+    def __init__(self, current_document):
+        self._document = current_document
+        self.created_versions = []
+
+    def get_policy(self, PolicyArn):
+        return {
+            "Policy": {
+                "PolicyName": PolicyArn.rsplit("/", 1)[-1],
+                "DefaultVersionId": "v1",
+            }
+        }
+
+    def get_policy_version(self, PolicyArn, VersionId):
+        return {"PolicyVersion": {"Document": self._document}}
+
+    def list_policy_versions(self, PolicyArn):
+        return {"Versions": [{"IsDefaultVersion": True, "VersionId": "v1", "CreateDate": 0}]}
+
+    def create_policy_version(self, PolicyArn, PolicyDocument, SetAsDefault):
+        import json as _json
+
+        self.created_versions.append(_json.loads(PolicyDocument))
+        return {}
+
+
+def _stmt(actions, resource, effect="Allow"):
+    return {"Effect": effect, "Action": actions, "Resource": resource}
+
+
+def test_sync_managed_policy_preserves_existing_statements(monkeypatch):
+    from velocity.aws import amplify_build
+
+    monkeypatch.setattr(amplify_build.time, "sleep", lambda *_: None)
+    manual_grant = _stmt(["s3:PutObject"], "arn:aws:s3:::client-uploads/*")
+    current = {"Version": "2012-10-17", "Statement": [manual_grant]}
+    desired = {"Version": "2012-10-17", "Statement": [_stmt(["ssm:GetParameter"], "*")]}
+
+    iam = FakeIamClient(current)
+    amplify_build._sync_managed_policy_document(iam, "arn:aws:iam::1:policy/p", desired)
+
+    assert len(iam.created_versions) == 1
+    written = iam.created_versions[0]["Statement"]
+    assert manual_grant in written, "manually-added grant must survive the sync"
+    assert _stmt(["ssm:GetParameter"], "*") in written
+
+
+def test_sync_managed_policy_noop_when_all_desired_present(monkeypatch):
+    from velocity.aws import amplify_build
+
+    monkeypatch.setattr(amplify_build.time, "sleep", lambda *_: None)
+    shared = _stmt(["ssm:GetParameter"], "*")
+    extra = _stmt(["s3:GetObject"], "arn:aws:s3:::other-apps-bucket/*")
+    current = {"Version": "2012-10-17", "Statement": [shared, extra]}
+    desired = {"Version": "2012-10-17", "Statement": [shared]}
+
+    iam = FakeIamClient(current)
+    amplify_build._sync_managed_policy_document(iam, "arn:aws:iam::1:policy/p", desired)
+
+    assert iam.created_versions == [], "no version churn when nothing new to add"
+
+
+def test_sync_managed_policy_dedupes_scalar_vs_list_forms(monkeypatch):
+    from velocity.aws import amplify_build
+
+    monkeypatch.setattr(amplify_build.time, "sleep", lambda *_: None)
+    current = {
+        "Version": "2012-10-17",
+        "Statement": [{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::b/*"}],
+    }
+    desired = {
+        "Version": "2012-10-17",
+        "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::b/*"]}],
+    }
+
+    iam = FakeIamClient(current)
+    amplify_build._sync_managed_policy_document(iam, "arn:aws:iam::1:policy/p", desired)
+
+    assert iam.created_versions == [], "scalar and list forms are the same statement"
+
+
+def test_merge_policy_statements_never_removes():
+    from velocity.aws.amplify_build import _merge_policy_statements
+
+    current = {
+        "Version": "2012-10-17",
+        "Statement": [_stmt(["a:One"], "*"), _stmt(["b:Two"], "arn:x")],
+    }
+    desired = {"Version": "2012-10-17", "Statement": [_stmt(["c:Three"], "*")]}
+
+    merged = _merge_policy_statements(current, desired)
+
+    assert merged["Statement"][:2] == current["Statement"]
+    assert _stmt(["c:Three"], "*") in merged["Statement"]
+    assert len(merged["Statement"]) == 3