velocity-python 0.2.1__py3-none-any.whl → 0.2.2__py3-none-any.whl

velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.2.1"
+__version__ = version = "0.2.2"
 
 import importlib as _importlib
 

velocity/aws/authz.py

@@ -0,0 +1,428 @@
+"""Who may do what, decided in one place.
+
+One pure function answers every authorization question::
+
+    can(principal, action, resource, context) -> Decision
+
+* **Deny by default.** Nothing is allowed unless a rule permits it.
+* **A forbid beats any permit.**
+* **An error can only take access away.** A permit rule whose condition
+  raises is skipped; a forbid rule whose condition raises forbids. Either
+  way the rule is named in ``Decision.errors`` and logged.
+* **No I/O.** A decision is id comparisons and set lookups. Whoever already
+  loaded the row passes its owner in; this module never loads data.
+
+Rules are data, declared beside the feature they govern and registered once
+at import::
+
+    from velocity.aws import authz
+
+    RULES = (
+        authz.permit("notes.own", {"notes.read", "notes.write"}, when=authz.owner),
+        authz.permit("notes.read_any", "notes.read",
+                     when=authz.holds("notes.read_any"), audit=True),
+        authz.forbid("notes.masquerade_write", "notes.write",
+                     when=authz.masquerading),
+    )
+    authz.register(*RULES)
+
+Permissions are plain names a principal holds. Code never checks a role:
+a role is a bundle of permissions, and which bundle a user gets is the
+site's decision (``principal_permissions`` on the handler).
+
+**On a handler.** :func:`principal_for` builds the principal from the user
+row the handler already loaded; :func:`decide` asks; :func:`require` asks,
+refuses with a 403, and records the use of any rule marked ``audit`` in
+``sys_security_events`` *before* the access happens (no audit row, no
+access). The handler attributes they read:
+
+==========================  ================================================
+``authz_mode``              ``"off"`` (default), ``"log"`` or ``"enforce"``:
+                            how the *existing* generic surfaces (the
+                            DataService table gate) use the decision. New
+                            actions written against :func:`require` are
+                            always enforced.
+``authz_rules``             a handler's own rules, beside the registered ones
+``principal_permissions``   ``(current_user) -> iterable of names``; the
+                            default grants none
+==========================  ================================================
+
+The request shape and the decision rule are those of AWS's Cedar policy
+language, on purpose: the rules can move there without changing a caller.
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass, field
+from fnmatch import fnmatchcase
+from typing import Any, Callable, Optional
+
+from velocity.aws import ssm_config
+from velocity.aws.handlers.exceptions import AccessError
+
+logger = logging.getLogger(__name__)
+
+PERMIT = "permit"
+FORBID = "forbid"
+
+OFF = "off"
+LOG = "log"
+ENFORCE = "enforce"
+MODES = (OFF, LOG, ENFORCE)
+
+# The action the DataService table gate asks about, and its resource type.
+DATA_ACCESS = "data.access"
+TABLE = "table"
+SYSTEM_PREFIX = "sys_"
+
+# The audit sink's ``guard`` value for a use of an ``audit`` rule.
+PRIVILEGED_ACCESS = "privileged_access"
+
+
+@dataclass(frozen=True)
+class Principal:
+    """Who is asking. ``user_sys_id`` is the row id in the site's user table
+    (never an email). ``real_user`` is set in a masquerade session: the
+    administrator who is acting as this user."""
+
+    user_sys_id: Optional[int] = None
+    permissions: frozenset = frozenset()
+    tenant: Any = None
+    real_user: Any = None
+
+    def holds(self, permission):
+        return permission in self.permissions
+
+
+@dataclass(frozen=True)
+class Resource:
+    """The specific object: its type, id, owner (a user row id) and tenant."""
+
+    type: str
+    id: Any = None
+    owner: Optional[int] = None
+    tenant: Any = None
+
+
+@dataclass(frozen=True)
+class Rule:
+    name: str
+    effect: str
+    actions: frozenset
+    when: Optional[Callable] = None
+    audit: bool = False
+
+    def covers(self, action):
+        return any(
+            action == pattern or ("*" in pattern and fnmatchcase(action, pattern))
+            for pattern in self.actions
+        )
+
+
+@dataclass(frozen=True)
+class Decision:
+    """The answer. ``rule`` is the rule that decided (``None`` when nothing
+    permitted); ``audit`` is true when that rule's use must be recorded."""
+
+    allowed: bool
+    action: str
+    rule: Optional[str] = None
+    audit: bool = False
+    errors: tuple = field(default_factory=tuple)
+
+    def __bool__(self):
+        return self.allowed
+
+
+def _rule(effect, name, actions, when, audit):
+    if not isinstance(name, str) or not name:
+        raise ValueError("A rule needs a name.")
+    if isinstance(actions, str):
+        actions = (actions,)
+    actions = frozenset(actions or ())
+    if not actions or not all(isinstance(a, str) and a for a in actions):
+        raise ValueError(f"Rule '{name}' names no action.")
+    if when is not None and not callable(when):
+        raise ValueError(f"Rule '{name}': 'when' must be callable.")
+    return Rule(name, effect, actions, when, bool(audit))
+
+
+def permit(name, actions, *, when=None, audit=False):
+    """Allow ``actions`` (a name, or names; ``*`` is a wildcard) when
+    ``when(principal, action, resource, context)`` is true. ``audit=True``
+    marks a privileged rule: each use is recorded."""
+    return _rule(PERMIT, name, actions, when, audit)
+
+
+def forbid(name, actions, *, when=None):
+    """Refuse ``actions`` when ``when(...)`` is true, whatever permits."""
+    return _rule(FORBID, name, actions, when, False)
+
+
+# ── conditions ─────────────────────────────────────────────────────────────
+
+
+def owner(principal, action, resource, context):
+    """The resource belongs to the principal."""
+    return (
+        principal.user_sys_id is not None
+        and resource is not None
+        and resource.owner is not None
+        and resource.owner == principal.user_sys_id
+    )
+
+
+def masquerading(principal, action, resource, context):
+    """An administrator is acting as this user."""
+    return principal.real_user is not None or bool((context or {}).get("masquerade"))
+
+
+def signed_in(principal, action, resource, context):
+    return principal.user_sys_id is not None
+
+
+def holds(permission):
+    """The principal holds the named permission."""
+
+    def condition(principal, action, resource, context):
+        return principal.holds(permission)
+
+    return condition
+
+
+def table(*names):
+    """The resource is one of these tables."""
+    wanted = frozenset(names)
+
+    def condition(principal, action, resource, context):
+        return resource is not None and resource.type == TABLE and resource.id in wanted
+
+    return condition
+
+
+def all_of(*conditions):
+    def condition(principal, action, resource, context):
+        return all(c(principal, action, resource, context) for c in conditions)
+
+    return condition
+
+
+def any_of(*conditions):
+    def condition(principal, action, resource, context):
+        return any(c(principal, action, resource, context) for c in conditions)
+
+    return condition
+
+
+def _ordinary_table(principal, action, resource, context):
+    return (
+        resource is not None
+        and resource.type == TABLE
+        and isinstance(resource.id, str)
+        and not resource.id.startswith(SYSTEM_PREFIX)
+    )
+
+
+# ── the registry ───────────────────────────────────────────────────────────
+
+# Until each site declares rules per table, an ordinary table stays reachable
+# through the generic Data actions exactly as the table gate, the rwx hooks
+# and the tenant scope already allow. System tables (``sys_…``) get no such
+# rule: they are refused unless the handler declares one.
+BUILTIN_RULES = (permit("data.ordinary_tables", DATA_ACCESS, when=_ordinary_table),)
+
+_REGISTERED = {}
+
+
+def register(*rules):
+    """Add rules to the ones every handler evaluates. Registering the same
+    rule again is a no-op; a different rule under a taken name is an error."""
+    for rule in rules:
+        if not isinstance(rule, Rule):
+            raise ValueError("register() takes rules made by permit() or forbid().")
+        known = _REGISTERED.get(rule.name)
+        if known is not None and known != rule:
+            raise ValueError(f"An authorization rule named '{rule.name}' exists.")
+        _REGISTERED[rule.name] = rule
+
+
+def registered():
+    """Every rule a handler evaluates before its own."""
+    return BUILTIN_RULES + tuple(_REGISTERED.values())
+
+
+# ── the decision ───────────────────────────────────────────────────────────
+
+
+def can(principal, action, resource=None, context=None, *, rules=None):
+    """Decide. See the module docstring for the rule."""
+    rules = registered() if rules is None else tuple(rules)
+    context = context or {}
+    permitted = None
+    errors = []
+    if not isinstance(principal, Principal) or not isinstance(action, str):
+        return Decision(False, str(action))
+    for rule in rules:
+        if not rule.covers(action):
+            continue
+        try:
+            matched = rule.when is None or bool(
+                rule.when(principal, action, resource, context)
+            )
+        except Exception:
+            logger.warning(
+                "authorization rule %s failed on %s", rule.name, action, exc_info=True
+            )
+            errors.append(rule.name)
+            # an error can only take access away
+            matched = rule.effect == FORBID
+        if not matched:
+            continue
+        if rule.effect == FORBID:
+            return Decision(False, action, rule.name, False, tuple(errors))
+        if permitted is None:
+            permitted = rule
+    if permitted is None:
+        return Decision(False, action, None, False, tuple(errors))
+    return Decision(True, action, permitted.name, permitted.audit, tuple(errors))
+
+
+# ── on a handler ───────────────────────────────────────────────────────────
+
+
+def mode_of(handler):
+    """``AuthzMode`` config first, then the handler's ``authz_mode``. Blank
+    is ``off``; a value that is not a mode is ``enforce`` (fail closed)."""
+    raw = None
+    try:
+        raw = ssm_config.getenv("AuthzMode", None)
+    except Exception:
+        raw = None
+    raw = str(raw or getattr(handler, "authz_mode", None) or OFF).strip().lower()
+    return raw if raw in MODES else ENFORCE
+
+
+def _session(context):
+    try:
+        return context.session() or {}
+    except Exception:
+        return {}
+
+
+def principal_for(handler, context=None):
+    """The principal for the request ``handler`` is serving, from the user
+    row it already loaded. No query."""
+    user = getattr(handler, "current_user", None) or {}
+    try:
+        user_sys_id = int(user.get("sys_id"))
+    except (TypeError, ValueError, AttributeError):
+        user_sys_id = None
+    if user_sys_id is not None and user_sys_id <= 0:
+        user_sys_id = None
+    permissions = ()
+    hook = getattr(handler, "principal_permissions", None)
+    if callable(hook) and user_sys_id is not None:
+        try:
+            permissions = hook(user) or ()
+        except Exception:
+            # no permissions is the safe answer
+            logger.warning("principal_permissions failed", exc_info=True)
+            permissions = ()
+    context = context if context is not None else getattr(handler, "context", None)
+    masquerade = _session(context).get("masquerade") if context is not None else None
+    real_user = None
+    if masquerade:
+        real_user = (
+            masquerade.get("real_user") if isinstance(masquerade, dict) else None
+        ) or True
+    return Principal(
+        user_sys_id=user_sys_id,
+        permissions=frozenset(p for p in permissions if isinstance(p, str)),
+        tenant=user.get("tenant") if isinstance(user, dict) else None,
+        real_user=real_user,
+    )
+
+
+def rules_for(handler):
+    return registered() + tuple(getattr(handler, "authz_rules", None) or ())
+
+
+def decide(handler, action, resource=None, context=None):
+    """The decision for the request ``handler`` is serving."""
+    principal = principal_for(handler, context)
+    facts = {"masquerade": principal.real_user is not None}
+    return can(principal, action, resource, facts, rules=rules_for(handler))
+
+
+def require(handler, tx, context, action, resource=None):
+    """Decide and enforce, whatever ``authz_mode`` says: for actions written
+    against the policy. A denial raises :class:`AccessError` (403). A use of
+    an ``audit`` rule is recorded first, and refused when it cannot be."""
+    decision = decide(handler, action, resource, context)
+    if not decision.allowed:
+        logger.warning(
+            "authorization refused %s on %s (%s)",
+            action,
+            _describe(resource),
+            decision.rule or "no rule permits it",
+        )
+        raise AccessError("You do not have access to that.")
+    if decision.audit and not _record(handler, tx, context, decision, resource):
+        raise AccessError("That access could not be recorded, so it was refused.")
+    return decision
+
+
+_WOULD_REFUSE = set()
+
+
+def gate(handler, action, resource=None):
+    """The decision for an EXISTING generic surface, under ``authz_mode``:
+    ``off`` allows without asking, ``log`` asks and logs what it would
+    refuse (once per container per action and resource) and allows,
+    ``enforce`` returns the decision's answer."""
+    mode = mode_of(handler)
+    if mode == OFF:
+        return True
+    decision = decide(handler, action, resource)
+    if decision.allowed:
+        return True
+    if mode == LOG:
+        key = (action, getattr(resource, "type", None), getattr(resource, "id", None))
+        if key not in _WOULD_REFUSE:
+            _WOULD_REFUSE.add(key)
+            logger.warning(
+                "authz (log only) would refuse %s on %s (%s)",
+                action,
+                _describe(resource),
+                decision.rule or "no rule permits it",
+            )
+        return True
+    return False
+
+
+def _describe(resource):
+    if resource is None:
+        return "-"
+    return f"{resource.type}:{resource.id}"
+
+
+def _record(handler, tx, context, decision, resource):
+    # imported here: the capabilities package pulls in more than a pure
+    # decision module should load at import
+    from velocity.aws.capabilities.security import record_event
+
+    session = _session(context)
+    actor = (
+        (session.get("masquerade") or {}).get("real_user")
+        if isinstance(session.get("masquerade"), dict)
+        else None
+    ) or session.get("email_address")
+    return record_event(
+        tx,
+        PRIVILEGED_ACCESS,
+        f"{decision.action} on {_describe(resource)} by rule {decision.rule}",
+        aws_event=getattr(handler, "aws_event", None),
+        context=context,
+        user_email=actor,
+    )

velocity/aws/handlers/mixins/data_service.py

@@ -13,7 +13,7 @@ import re
 from io import BytesIO
 from types import MappingProxyType
 
-from velocity.aws import dirty_pipeline, ssm_config
+from velocity.aws import authz, dirty_pipeline, ssm_config
 from velocity.aws import facets
 from velocity.aws.handlers.exceptions import AccessError, AlertError, BadRequestError
 from velocity.aws.handlers.mixins.client_input import MODES, STRICT, ClientInputGuard
@@ -72,6 +72,9 @@ def _fk_blocked_delete_message(table, exc):
 
 
 _IDENTIFIER_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+# Owner-scoped tables already warned about under the legacy client SQL mode
+# (once per container, not once per request).
+_OWNER_SCOPE_WARNED = set()
 
 
 TEXT_TYPES = frozenset(
@@ -695,6 +698,44 @@ class DataServiceMixin:
     client_denied_tables = frozenset()
     client_allowed_tables = None
 
+    # The authorization decision point (velocity.aws.authz) at the client
+    # table gate. ``"off"`` (default): the gate is as above. ``"log"``: every
+    # table is also put to the rules and what they would refuse is logged,
+    # nothing is refused. ``"enforce"``: a table no rule permits is refused.
+    # The ``AuthzMode`` config key overrides this per environment. Out of the
+    # box the rules permit every ordinary table and NO system table
+    # (``sys_…``): a handler that serves one in a grid declares it, e.g.
+    #   authz_rules = (authz.permit("flags.admin", authz.DATA_ACCESS,
+    #       when=authz.all_of(authz.table("sys_feature_flags"),
+    #                         authz.holds("site.admin"))),)
+    # ``principal_permissions(current_user)`` says which permissions the
+    # signed-in user holds; the default is none.
+    authz_mode = authz.OFF
+    authz_rules = ()
+
+    def principal_permissions(self, current_user):
+        return ()
+
+    # Tables whose every row belongs to ONE signed-in user: ``{table: owner
+    # column}``. The owner column holds the user's sign-in email as the
+    # session carries it. Each hooked action (query, find, read, write,
+    # delete) confines the caller to their own rows, and the direct actions
+    # refuse the table — the rule ``tenant_scope`` gives a site, applied by
+    # the framework itself and resolved BEFORE the site's ``tenant_scope``,
+    # so an override that forgets ``super()`` cannot switch it off.
+    #
+    # ``user_data`` is here because the framework owns it: per-user settings
+    # written by ``store-user-data`` and read back by the browser through the
+    # generic ``query``, which until this rule let any signed-in user read or
+    # overwrite another user's rows by naming their ``userid``.
+    #
+    # Enforced under the strict client SQL mode. Under legacy mode the
+    # browser can send raw SQL around any row predicate, so nothing here can
+    # be a boundary: the rule is skipped and a warning is logged, leaving
+    # legacy behaviour exactly as it was. Set the attribute to ``{}`` to opt
+    # a handler out.
+    owner_scoped_tables = MappingProxyType({"user_data": "userid"})
+
     # How much SQL-shaped input the boundary accepts from the browser
     # (velocity.aws.handlers.mixins.client_input): "strict" (Contract C — dict
     # filters, plain columns, structured @@search) or "legacy" (string
@@ -795,7 +836,9 @@ class DataServiceMixin:
         if table in self.client_denied_tables:
             return False
         allowed = self.client_allowed_tables
-        return allowed is None or table in allowed
+        if allowed is not None and table not in allowed:
+            return False
+        return authz.gate(self, authz.DATA_ACCESS, authz.Resource(authz.TABLE, table))
 
     def _assert_client_table(self, table, label="table"):
         """The table gate every client action passes (SEC 4.2)."""
@@ -914,9 +957,12 @@ class DataServiceMixin:
             )
 
     def _assert_direct_unscoped(self, table, context):
-        """A tenant-scoped table is never reachable through a direct action
-        (they cannot apply the scope)."""
-        if self.tenant_scope(context, table) is not None:
+        """A tenant-scoped or owner-scoped table is never reachable through a
+        direct action (they cannot apply the scope)."""
+        if (
+            self._owner_scope(context, table) is not None
+            or self.tenant_scope(context, table) is not None
+        ):
             raise AlertError(
                 f"Direct access to '{table}' is not permitted; "
                 "use the standard data actions."
@@ -995,11 +1041,47 @@ class DataServiceMixin:
         """
         return None
 
+    def _owner_scope(self, context, table):
+        """``(column, values)`` confining ``table`` to the signed-in user, or
+        ``None`` when the table is not in :attr:`owner_scoped_tables` — or
+        when this handler runs the legacy client SQL mode, where no row
+        predicate is a boundary (see the attribute's comment).
+
+        The values are the session's email as it stands and lowercased: rows
+        written before emails were normalized keep matching. The first value
+        is the one stamped on a new row. A session without an email is
+        refused."""
+        column = (self.owner_scoped_tables or {}).get(table)
+        if not column:
+            return None
+        if self.client_sql_mode_effective != STRICT:
+            if table not in _OWNER_SCOPE_WARNED:
+                _OWNER_SCOPE_WARNED.add(table)
+                logger.warning(
+                    "%s rows are not confined to their owner: this handler "
+                    "runs the legacy client SQL mode, under which no row rule "
+                    "can be enforced. Move it to strict mode.",
+                    table,
+                )
+            return None
+        session = context.session() if hasattr(context, "session") else None
+        email = (session or {}).get("email_address")
+        if not isinstance(email, str) or not email.strip():
+            raise AlertError("Access denied: no signed-in user for this session.")
+        email = email.strip()
+        return column, tuple(dict.fromkeys((email, email.lower())))
+
     def _resolve_tenant_scope(self, tx, table, context):
         """``(column, values)`` for ``table``, or ``None`` (unscoped). Fails
         closed: a scope under any client SQL mode but strict, a malformed
-        scope, an empty value, or a table without the column is refused."""
-        scope = self.tenant_scope(context, table)
+        scope, an empty value, or a table without the column is refused.
+
+        A table in :attr:`owner_scoped_tables` takes the framework's owner
+        scope; the site's :meth:`tenant_scope` is not consulted for it."""
+        scope = self._owner_scope(context, table)
+        owned = scope is not None
+        if scope is None:
+            scope = self.tenant_scope(context, table)
         if scope is None:
             return None
         # The predicate is only a boundary when the client cannot send raw
@@ -1030,7 +1112,12 @@ class DataServiceMixin:
         except Exception:  # noqa: BLE001 — unknown schema is not scoped schema
             available = set()
         if column.lower() not in available:
-            raise AlertError(f"Access denied: {table} is not tenant-scoped.")
+            # An owner-scoped table that does not exist yet (user_data on a
+            # fresh site, before anyone has saved a setting) has no rows to
+            # confine: keep the scope and let the read come back empty, as it
+            # did before. A table that exists WITHOUT the column is refused.
+            if not (owned and not available):
+                raise AlertError(f"Access denied: {table} is not tenant-scoped.")
         return column, values
 
     @staticmethod
@@ -1066,10 +1153,12 @@ class DataServiceMixin:
                     f"Access denied: {column} must be one of your own values."
                 )
         if not keys and creating:
-            if len(values) != 1:
+            if len(values) != 1 and table not in (self.owner_scoped_tables or {}):
                 raise AlertError(
                     f"Access denied: choose the {column} for this {table} record."
                 )
+            # an owner scope's values are one person's email in two spellings:
+            # the first is the session's own
             incoming[column] = values[0]
 
     def _check_tenant_row(self, table, scope, row):

velocity/aws/handlers/mixins/web_handler.py

@@ -17,12 +17,17 @@ from abc import ABC
 from datetime import date, datetime
 from typing import Any, Dict, List
 
-from velocity.aws.handlers.exceptions import AlertError
+from velocity.aws import authz, user_data
+from velocity.aws.handlers.exceptions import AccessError, AlertError, NotFoundError
 from velocity.aws.ssm_config import get_project_name as config_get_project_name
 from velocity.aws.ssm_config import get_stage as config_get_stage
 
 logger = logging.getLogger(__name__)
 
+# Where store-user-data keeps a user's settings (WebHandler.user_data_mode).
+USER_DATA_ROWS = "rows"
+USER_DATA_DOCUMENT = "document"
+
 _NUMERIC = "NUMERIC(19, 6)"  # time.time() floats, as velocity infers them
 
 # Tables this mixin writes, declared for velocity.aws.schema.ensure_infrastructure
@@ -119,6 +124,15 @@ class WebHandler(ABC):
     SYSTEM_LOG_TABLE = "sys_log"
     LAMBDA_METRICS_TABLE = "lambda_metrics"
 
+    # Where store-user-data keeps a user's settings, and whether get-user-data
+    # returns them. "rows" is the store every app started on: one row per
+    # (userid, key) in ``user_data``, read back by the browser through the
+    # generic query. "document" is one JSONB document per user in
+    # ``sys_user_data``, keyed by the user's row id and patched under a row
+    # lock (velocity.aws.user_data). A handler moves to "document" in the same
+    # release as its frontend starts reading ``controls.user_data``.
+    user_data_mode = USER_DATA_ROWS
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.start_time = None
@@ -566,6 +580,13 @@ Request Details:
         # admin's real identity alongside the user they are acting as.
         masquerade = (context.session() or {}).get("masquerade")
         controls["masquerade"] = masquerade or None
+        if self.user_data_mode == USER_DATA_DOCUMENT:
+            # The signed-in user's saved settings, in the same response: one
+            # read, and no reason for the browser to query the table itself.
+            owner = current_user.get("sys_id")
+            saved = user_data.load(tx, owner) if owner else {}
+            controls["user_data"] = saved.get("data", {})
+            controls["user_data_revision"] = saved.get("revision", 0)
         context.response().update_store(
             {
                 "controls": controls,
@@ -576,18 +597,48 @@ Request Details:
         )
 
     def OnActionStoreUserData(self, tx, context):
-        """Persist per-user UI settings posted by omnilib's user-settings store.
-
-        Generic counterpart to :meth:`OnActionGetUserData`. omnilib sends
-        ``{"userData": {keyPath: fragment, ...}}``; each entry is upserted into
-        the per-user settings table keyed by ``(userid, key)``. Business-agnostic
-        — every app shares the same store, so this lives here rather than being
-        re-implemented per app. App handlers may override to add side effects.
+        """Persist per-user UI settings posted by the browser:
+        ``{"userData": {key: value, ...}}``.
+
+        ``user_data_mode`` decides where they go:
+
+        * ``"rows"`` (the default, and the behaviour before
+          :mod:`velocity.aws.user_data`): each entry is upserted into the
+          per-user settings table keyed by ``(userid, key)``.
+        * ``"document"``: each entry is a patch to the signed-in user's one
+          document in ``sys_user_data`` (see :mod:`velocity.aws.user_data`),
+          applied under a row lock. The owner is the signed-in user's row,
+          taken from the session; nothing in the request can name another
+          user. A masquerade session saves nothing: an administrator acting
+          as a user sees that user's settings and leaves them as they were.
+
+        Business-agnostic — every app shares the same store, so this lives
+        here rather than being re-implemented per app. App handlers may
+        override to add side effects.
         """
         userdata = (context.payload() or {}).get("userData")
         if not userdata:
             return
-        email = (context.session() or {}).get("email_address")
+        session = context.session() or {}
+        email = session.get("email_address")
+        if self.user_data_mode == USER_DATA_DOCUMENT:
+            owner = (getattr(self, "current_user", None) or {}).get("sys_id")
+            decision = authz.decide(
+                self, user_data.WRITE, user_data.resource(owner), context
+            )
+            if decision.rule == user_data.MASQUERADE_WRITE:
+                # not an error: the interface saves as it goes, and an
+                # administrator acting as a user should not see a failure
+                # for every click
+                context.response().set_body({"saved": False, "reason": "masquerade"})
+                return
+            if not decision.allowed:
+                raise AccessError("You do not have access to that.")
+            result = user_data.apply(
+                tx, owner, user_data.patch_from_payload(userdata), by=email
+            )
+            context.response().set_body({"saved": True, "revision": result["revision"]})
+            return
         table = getattr(context, "USER_DATA_TABLE", "user_data")
         for key, val in userdata.items():
             tx.table(table).upsert(
@@ -595,6 +646,61 @@ Request Details:
                 {"userid": email, "key": key},
             )
 
+    def _other_user_document(self, tx, context):
+        """The user row id a ``*-user-document`` request names, checked: the
+        actions exist only in ``document`` mode, and the id must be a row of
+        this handler's user table."""
+        if self.user_data_mode != USER_DATA_DOCUMENT:
+            raise NotFoundError("Unknown action")
+        named = (context.payload() or {}).get("user_sys_id")
+        target = user_data.resource(named)
+        user_table = getattr(self, "user_table", None)
+        if not user_table or not tx.table(user_table).find({"sys_id": target.id}):
+            raise AlertError("That user was not found.")
+        return target
+
+    def OnActionReadUserDocument(self, tx, context):
+        """Any user's settings document: ``{"user_sys_id": n}``.
+
+        The one place a request names a user. Allowed for the document's
+        owner, or a caller holding ``user_data.read_any``; that use is
+        recorded in ``sys_security_events`` before the document is read, and
+        refused when it cannot be recorded."""
+        target = self._other_user_document(tx, context)
+        authz.require(self, tx, context, user_data.READ, target)
+        saved = user_data.load(tx, target.id)
+        context.response().set_body(
+            {
+                "user_sys_id": target.id,
+                "data": saved["data"],
+                "revision": saved["revision"],
+            }
+        )
+
+    def OnActionWriteUserDocument(self, tx, context):
+        """Patch any user's settings document:
+        ``{"user_sys_id": n, "userData": {path: value}}`` (``null`` removes).
+
+        Allowed for the document's owner, or a caller holding
+        ``user_data.write_any`` (separate from reading), recorded the same
+        way; never in a masquerade session."""
+        target = self._other_user_document(tx, context)
+        authz.require(self, tx, context, user_data.WRITE, target)
+        session = context.session() or {}
+        result = user_data.apply(
+            tx,
+            target.id,
+            user_data.patch_from_payload((context.payload() or {}).get("userData")),
+            by=session.get("email_address"),
+        )
+        context.response().set_body(
+            {
+                "user_sys_id": target.id,
+                "data": result["data"],
+                "revision": result["revision"],
+            }
+        )
+
     # ------------------------------------------------------------------
     # Enhanced lifecycle hooks
     # ------------------------------------------------------------------

velocity/aws/schema.py

@@ -47,6 +47,7 @@ SCHEMA_SOURCES: Dict[str, Tuple[str, ...]] = {
         "velocity.aws.capabilities.provisioning",
         "velocity.aws.handlers.mixins.web_handler",
         "velocity.aws.handlers.mixins.session_control",
+        "velocity.aws.user_data",
         "velocity.db.migrations",
     ),
     "assets": ("velocity.aws.assets",),

velocity/aws/user_data.py

@@ -0,0 +1,404 @@
+"""Per-user settings as one document, patched in place.
+
+A signed-in user's interface settings — toolbar shortcuts, preferences, each
+grid's layout and filter presets — live in ONE row of ``sys_user_data``: a
+JSONB document keyed by the user's row id in the site's user table, never by
+email. The browser never sends the whole document. Each save is a small patch
+and :func:`apply` applies it to the current server copy under a row lock, so
+two tabs saving different settings both succeed, and removing a setting
+really removes it.
+
+    from velocity.aws import user_data
+
+    user_data.apply(tx, user_sys_id, [("set", "settings.rowsPerPage", 50),
+                                      ("unset", "grids.gmail_message.presets")])
+    user_data.read(tx, user_sys_id, "settings.workingContext", default={})
+
+The document's first level is fixed (``NAMESPACES``); below it each feature
+owns its branch::
+
+    toolbar.shortcuts          the toolbar's links
+    settings.<key>             preferences (useUserSettings)
+    grids.<table>.layout       one table's grid layout
+    grids.<table>.presets      one table's saved filter presets
+    state.<path>               any other persisted interface state
+
+A path is dotted keys. A list is a value: it is replaced whole, never patched
+by index.
+
+**The wire format** of ``store-user-data`` is unchanged —
+``{"userData": {key: value}}`` — and :func:`patch_from_payload` reads each
+entry as a patch: a path under one of the namespaces is a ``set`` (``None``
+is an ``unset``), and the key names the browser used before this module
+(``toolbarShortcuts``, ``userSettings``, ``filter_presets_<table>`` and the
+nested store fragments ``setUserData`` sends) are translated, so a browser
+tab still running an older bundle keeps saving correctly.
+
+**Who may touch a document** is decided by :data:`RULES`, on the one
+decision point (:mod:`velocity.aws.authz`): the owner reads and writes their
+own; ``user_data.read_any`` and ``user_data.write_any`` are two separate
+permissions for anyone else's, each use recorded; and nothing is written in a
+masquerade session. :func:`read` and :func:`apply` themselves take the
+owner's row id from the caller and trust it: the handler (``WebHandler``,
+``user_data_mode = "document"``) asks the decision point first. This module
+is business-agnostic.
+"""
+
+from __future__ import annotations
+
+import copy
+import json
+import re
+
+from velocity.aws import authz
+from velocity.aws.handlers.exceptions import AlertError
+from velocity.db.exceptions import DbDuplicateKeyError
+from velocity.misc.format import to_json
+
+TABLE = "sys_user_data"
+
+# Declared for velocity.aws.schema.ensure_infrastructure (the step that lets an
+# environment run with the schema locked).
+SCHEMA = {
+    TABLE: {
+        "columns": {"user_sys_id": "BIGINT", "data": "JSONB", "revision": "BIGINT"},
+        # one document per user; also what the first-write race falls back on
+        "unique_indexes": [
+            {"columns": ["user_sys_id"], "name": "idx__sys_user_data__user_sys_id"}
+        ],
+    },
+}
+
+NAMESPACES = ("toolbar", "settings", "grids", "state")
+MAX_BYTES = 256 * 1024
+MAX_DEPTH = 12
+MAX_OPERATIONS = 200
+
+SET = "set"
+UNSET = "unset"
+
+# Actions, the resource type, and the two permissions for another user's
+# document. Reading and changing are separate permissions on purpose.
+READ = "user_data.read"
+WRITE = "user_data.write"
+RESOURCE = "user_data"
+READ_ANY = "user_data.read_any"
+WRITE_ANY = "user_data.write_any"
+MASQUERADE_WRITE = "user_data.masquerade_write"
+
+RULES = (
+    authz.permit("user_data.own", {READ, WRITE}, when=authz.owner),
+    authz.permit(READ_ANY, READ, when=authz.holds(READ_ANY), audit=True),
+    authz.permit(WRITE_ANY, WRITE, when=authz.holds(WRITE_ANY), audit=True),
+    # an administrator acting as a user sees that user's settings and leaves
+    # them as they were
+    authz.forbid(MASQUERADE_WRITE, WRITE, when=authz.masquerading),
+)
+authz.register(*RULES)
+
+
+def resource(user_sys_id):
+    """A user's document as the decision point sees it."""
+    owner = _owner(user_sys_id)
+    return authz.Resource(RESOURCE, id=owner, owner=owner)
+
+
+_SEGMENT = re.compile(r"^[A-Za-z0-9_@-]{1,80}$")
+# The names the browser used before the document, and where each one lives now.
+_LEGACY_KEYS = {"toolbarShortcuts": "toolbar.shortcuts", "userSettings": "settings"}
+_LEGACY_PRESETS = "filter_presets_"
+
+
+class UserDataError(AlertError, ValueError):
+    """A patch that cannot be applied. The message is safe to show."""
+
+
+# ── paths ──────────────────────────────────────────────────────────────────
+
+
+def split(path):
+    """``"grids.gmail_message.layout"`` as a tuple of segments, or raise.
+
+    The first segment must be one of :data:`NAMESPACES`; every segment is a
+    plain key (letters, digits, ``_``, ``-``, ``@``), so a path can never
+    reach outside the document or collide with a JSON operator."""
+    if not isinstance(path, str) or not path:
+        raise UserDataError("A setting needs a name.")
+    parts = tuple(path.split("."))
+    if len(parts) > MAX_DEPTH:
+        raise UserDataError(f"Settings can be nested at most {MAX_DEPTH} deep.")
+    if parts[0] not in NAMESPACES:
+        raise UserDataError(
+            f"'{parts[0]}' is not a kind of setting ({', '.join(NAMESPACES)})."
+        )
+    for part in parts:
+        if not _SEGMENT.match(part):
+            raise UserDataError(f"'{path}' is not a valid setting name.")
+    return parts
+
+
+def get_at(document, path, default=None):
+    """The value at ``path``, or ``default`` when nothing is there."""
+    node = document
+    for part in split(path):
+        if not isinstance(node, dict) or part not in node:
+            return default
+        node = node[part]
+    return node
+
+
+def set_at(document, path, value):
+    """``document`` with ``value`` at ``path``; missing parents are created
+    and a non-object in the way is replaced. The argument is not changed."""
+    parts = split(path)
+    out = dict(document or {})
+    node = out
+    for part in parts[:-1]:
+        child = node.get(part)
+        child = dict(child) if isinstance(child, dict) else {}
+        node[part] = child
+        node = child
+    node[parts[-1]] = copy.deepcopy(value)
+    return out
+
+
+def unset_at(document, path):
+    """``document`` without ``path``; parents left empty are removed too.
+    Removing what is not there changes nothing. The argument is not changed."""
+    parts = split(path)
+    out = dict(document or {})
+    trail = [out]
+    node = out
+    for part in parts[:-1]:
+        child = node.get(part)
+        if not isinstance(child, dict):
+            return out
+        child = dict(child)
+        node[part] = child
+        node = child
+        trail.append(child)
+    if parts[-1] not in node:
+        return out
+    del node[parts[-1]]
+    for depth in range(len(trail) - 1, 0, -1):
+        if trail[depth]:
+            break
+        del trail[depth - 1][parts[depth - 1]]
+    return out
+
+
+def size(document):
+    """The document's size as stored, in bytes."""
+    return len(json.dumps(document or {}, separators=(",", ":")).encode("utf-8"))
+
+
+def apply_operations(document, operations, *, max_bytes=MAX_BYTES):
+    """``document`` after ``operations``, in order: ``("set", path, value)``
+    and ``("unset", path)``. Refuses a result over ``max_bytes``."""
+    operations = list(operations or ())
+    if len(operations) > MAX_OPERATIONS:
+        raise UserDataError(f"At most {MAX_OPERATIONS} settings can change at once.")
+    out = dict(document or {})
+    for operation in operations:
+        kind = operation[0] if operation else None
+        if kind == SET and len(operation) == 3:
+            out = set_at(out, operation[1], operation[2])
+        elif kind == UNSET and len(operation) == 2:
+            out = unset_at(out, operation[1])
+        else:
+            raise UserDataError("That is not a settings change.")
+    if size(out) > max_bytes:
+        raise UserDataError(
+            f"Your saved settings would be larger than {max_bytes // 1024} KB. "
+            "Reset something you no longer need."
+        )
+    return out
+
+
+# ── the wire format, old key names included ────────────────────────────────
+
+
+def _leaves(value, base):
+    """``(path, leaf)`` for every non-object value under ``value``."""
+    if isinstance(value, dict) and value:
+        for key, child in value.items():
+            yield from _leaves(child, f"{base}.{key}")
+    else:
+        yield base, value
+
+
+def translate(key, value):
+    """One ``userData`` entry as operations.
+
+    * a path under a namespace: ``set`` (``None`` is ``unset``);
+    * ``toolbarShortcuts`` / ``userSettings`` / ``filter_presets_<table>``:
+      the names used before the document, moved to their branch;
+    * anything else is a store fragment from ``setUserData`` — the key is the
+      fragment's path and the value the whole nested fragment. Each leaf under
+      it becomes its own ``set``, which is the deep merge the browser meant
+      (the old row store kept only the last fragment written under a key).
+      ``config.<table>…`` lands in ``grids.<table>…``, the rest in ``state``.
+    """
+    if not isinstance(key, str) or not key:
+        raise UserDataError("A setting needs a name.")
+    if key in _LEGACY_KEYS:
+        path = _LEGACY_KEYS[key]
+    elif key.startswith(_LEGACY_PRESETS):
+        path = f"grids.{key[len(_LEGACY_PRESETS):]}.presets"
+    elif key.split(".", 1)[0] in NAMESPACES:
+        path = key
+    else:
+        return _fragment(key, value)
+    return [(UNSET, path)] if value is None else [(SET, path, value)]
+
+
+def _fragment(key, value):
+    parts = key.split(".")
+    node = value
+    for part in parts:  # the value repeats the key path: step inside it
+        if isinstance(node, dict) and part in node:
+            node = node[part]
+        else:
+            node = value
+            break
+    if parts[0] == "config" and len(parts) > 1:
+        base = "grids." + ".".join(parts[1:])
+    elif parts[0] == "config":
+        base = "grids"
+    else:
+        base = "state." + key
+    if node is None:
+        return [(UNSET, base)]
+    return [(SET, path, leaf) for path, leaf in _leaves(node, base)]
+
+
+def patch_from_payload(user_data):
+    """The ``userData`` object of a ``store-user-data`` request as operations."""
+    if not isinstance(user_data, dict):
+        raise UserDataError("That is not a settings change.")
+    operations = []
+    for key, value in user_data.items():
+        operations += translate(key, value)
+    return operations
+
+
+# ── the row ────────────────────────────────────────────────────────────────
+
+
+def _owner(user_sys_id):
+    try:
+        owner = int(user_sys_id)
+    except (TypeError, ValueError):
+        owner = 0
+    if owner <= 0:
+        raise UserDataError("There is no signed-in user to keep settings for.")
+    return owner
+
+
+# Engines whose database is known to have the table (it is never dropped).
+_PRESENT = set()
+
+
+def _table(tx, *, create=False):
+    """The table, or ``None`` when it does not exist yet and ``create`` is
+    off: a site that has never saved a setting reads as "no settings" instead
+    of a missing-relation error, which would abort the transaction.
+
+    On the first save the table is created FROM THE DECLARATION, so ``data``
+    is JSONB whatever the first value written (velocity's create-on-write
+    would infer TEXT from the JSON text). Under a locked schema that raises:
+    the table is then the schema step's to create
+    (``velocity.aws.schema.ensure_infrastructure``)."""
+    table = tx.table(TABLE)
+    key = id(getattr(tx, "engine", None) or tx)
+    if key in _PRESENT:
+        return table
+    if not table.exists():
+        if not create:
+            return None
+        table.ensure_schema(**SCHEMA[TABLE])
+    _PRESENT.add(key)
+    return table
+
+
+def _find(tx, owner, *, lock=False, create=False):
+    table = _table(tx, create=create)
+    if table is None:
+        return None
+    if lock:
+        return table.find({"user_sys_id": owner}, lock=True)
+    return table.find({"user_sys_id": owner})
+
+
+def _document(row):
+    if row is None:
+        return {}, 0
+    row = row.to_dict() if hasattr(row, "to_dict") else dict(row)
+    data = row.get("data")
+    if isinstance(data, (str, bytes, bytearray)):
+        try:
+            data = json.loads(data)
+        except ValueError:
+            data = {}
+    return (dict(data) if isinstance(data, dict) else {}), int(row.get("revision") or 0)
+
+
+def read(tx, user_sys_id, path=None, default=None):
+    """A user's whole document, or the value at ``path``.
+
+    For server code that needs a setting (a working context, a default) and
+    for the sign-in response. A user with no document yet reads as ``{}``."""
+    document, _revision = _document(_find(tx, _owner(user_sys_id)))
+    if path is None:
+        return document
+    return get_at(document, path, default)
+
+
+def load(tx, user_sys_id):
+    """The whole document with its revision, ``{"data", "revision"}``, in one
+    read: what the sign-in response sends."""
+    document, current = _document(_find(tx, _owner(user_sys_id)))
+    return {"data": document, "revision": current}
+
+
+def revision(tx, user_sys_id):
+    """How many times the user's document has changed (0 = never saved)."""
+    return _document(_find(tx, _owner(user_sys_id)))[1]
+
+
+def apply(tx, user_sys_id, operations, *, by=None, max_bytes=MAX_BYTES):
+    """Apply ``operations`` to the user's document, under a row lock.
+
+    Creates the row on the first save. Returns ``{"data", "revision"}``.
+    Nothing is written when ``operations`` is empty or changes nothing."""
+    owner = _owner(user_sys_id)
+    operations = list(operations or ())
+    row = _find(tx, owner, lock=True, create=bool(operations))
+    if row is None and operations:
+        row = _create(tx, owner, by)
+    document, current = _document(row)
+    if not operations:
+        return {"data": document, "revision": current}
+    changed = apply_operations(document, operations, max_bytes=max_bytes)
+    if changed == document:
+        return {"data": document, "revision": current}
+    data = {"data": to_json(changed), "revision": current + 1}
+    if by:
+        data["sys_modified_by"] = by
+    tx.table(TABLE).update(data, where={"user_sys_id": owner})
+    return {"data": changed, "revision": current + 1}
+
+
+def _create(tx, owner, by):
+    """The user's first row. Two tabs can both find none: the unique index
+    lets one insert win, and the other reads the winner's row, locked."""
+    table = tx.table(TABLE)
+    data = {"user_sys_id": owner, "data": to_json({}), "revision": 0}
+    if by:
+        data["sys_modified_by"] = by
+    try:
+        with tx.savepoint():
+            table.insert(data)
+    except DbDuplicateKeyError:
+        pass
+    return table.find({"user_sys_id": owner}, lock=True)

{velocity_python-0.2.1.dist-info → velocity_python-0.2.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.2.1
+Version: 0.2.2
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.2.1.dist-info → velocity_python-0.2.2.dist-info}/RECORD

@@ -1,8 +1,9 @@
-velocity/__init__.py,sha256=ROwehP7Mjif9OFSrkh6l4SY3F-xpEbiCJ3U_XmKHIoA,362
+velocity/__init__.py,sha256=Y8EFFkNo93OQ4ORDUsf6N52SBq6qZUuDXw5LdDBL4fU,362
 velocity/cache.py,sha256=pthvw7gDVEXRzkTcQtA5YVf4Q1IxAamWsba4UReT0RE,8933
 velocity/logging.py,sha256=MAsZap1cDSdOBNRc_9ezQxup5dHOS0ARxU9NI_-UK3E,4037
 velocity/aws/__init__.py,sha256=XJJ79gnPlhg3aJij713PB8-vjQOt-BkqxYeGCBOxAu8,3460
 velocity/aws/amplify.py,sha256=N_763LiraJfuLYSllGKG6jfP2oyCJgtrK_wI2UZKv1E,8852
+velocity/aws/authz.py,sha256=Mx8Dmnz_SogLCihqvxaqJKsFt3NxiNTMVoNu3fRQHTI,15230
 velocity/aws/blobs.py,sha256=2TlTZ3KPxBdXDJ99aVSgDLR11wPQ8O3BbtNbY8mFQ28,9691
 velocity/aws/dirty_pipeline.py,sha256=DQHsCPQPWwiy_E7nxX8kO3DgvQTFkVDaDOjlBcmblyE,3331
 velocity/aws/email.py,sha256=CAvXTAUxJqMaT8ylpRwRcVEA4YLFMUuHCrwYLVE4G1E,6243
@@ -15,9 +16,10 @@ velocity/aws/mirror.py,sha256=8Ik1_GVCcD7E2nCe1ci6sp56PEVBMYZF-alkMFlP4O4,8858
 velocity/aws/ops.py,sha256=re8e3LkkQwgNS1ZjtaZMPnKyPbi4PuUC4YeS0wZwg_Q,18701
 velocity/aws/queue_defaults.py,sha256=480V3pDvWBBamJ6hIJyVtPGJKMVmnP43otl3E9qnwfs,479
 velocity/aws/s3.py,sha256=Mn6rlK6sXykx32EjptFK2IRRBQZ9xijl9r33DUnKDzQ,30277
-velocity/aws/schema.py,sha256=7KLMjXjblOAhkarMlixPqrnqoHOrXze0MGASEfx65ok,4694
+velocity/aws/schema.py,sha256=QhaPtwECSthtGBb_w4cle4lddFpd2BIgY2rNsB3CYJM,4728
 velocity/aws/sms.py,sha256=2CdcLlIEy_V5K5Qx_pZ2vrakvEK7IhP7y1JUttBgyG4,16253
 velocity/aws/ssm_config.py,sha256=xkcBxPuCcdjpeArxdcGnSBiuyG2txlUraSqtCtb_kIo,7987
+velocity/aws/user_data.py,sha256=WFIfy7g-o6nubrzQP4ODAGbEdYVOHA1oYxtGLbGVkyQ,15145
 velocity/aws/assets/__init__.py,sha256=2R9LUShtaqkyRbMhxj8IL1JMP80H4iBfqaQflK38KXI,1709
 velocity/aws/assets/backfill.py,sha256=ybbD5vqpmr6vTIue8HDRkNVJwfCdTFHzBeq91nmwtTg,4679
 velocity/aws/assets/indexing.py,sha256=6sihNC6cPfhdNpPcNppucs9kSaV-HjCH1QsgSK7XFEA,8799
@@ -55,11 +57,11 @@ velocity/aws/handlers/mixins/__init__.py,sha256=rA_0YlKiRL5YU6JOZhVGC_7nY_p96dDG
 velocity/aws/handlers/mixins/audit_trail.py,sha256=D8BHuBfa2EXAcC4NtV_0Gie22zshhalcscf7L1MEDVw,16873
 velocity/aws/handlers/mixins/client_errors.py,sha256=0LqIRm1gZRwzHH32ravGHAgcQqJzjh5p6M_ptuL2Tto,20105
 velocity/aws/handlers/mixins/client_input.py,sha256=UhfwsRiztOYDrJnQPZhQ6J71NAmCyrXjMgxbko2rnfQ,24225
-velocity/aws/handlers/mixins/data_service.py,sha256=Q6sLjMZaXyc0ixMFSwqlwk6SbwZdiRqD4oJZQuCzHH8,89016
+velocity/aws/handlers/mixins/data_service.py,sha256=aEdSMpPZw3evhD7QecVT6_xKNrW6BsgebHmwalUpclI,93892
 velocity/aws/handlers/mixins/job_handler.py,sha256=yIbNcIg5pKXtZeQFNW7B4xqJJTjtjIxI8HRQsbMWixA,8095
 velocity/aws/handlers/mixins/row_scoped.py,sha256=f7N70RjzlHIVyjDsEI1oImCdjyFsgoP9aIvYXUXD5-Q,12967
 velocity/aws/handlers/mixins/session_control.py,sha256=w2wGC_XiM-W-tL5mhZvVCt_GiQjE3Gao0Ut7tx6JdLk,12937
-velocity/aws/handlers/mixins/web_handler.py,sha256=00h3jL3cIqMX2m54GEhX893DtvlHnsTxZEN7mtjbltw,31482
+velocity/aws/handlers/mixins/web_handler.py,sha256=6hA7GUSj_6y0U2fnhGFvuzHRH73RUOdvjxaH3ZZZ-Qg,36549
 velocity/aws/tests/__init__.py,sha256=hk-efPTkFb_py5ouA5d1OuPVQzaa5Wa01Wsc1oQ9dhY,19
 velocity/aws/tests/test_base_handler_error_response.py,sha256=CgnTMzxGkd4ArUHvsuiO_iQsiQMSlZSX_fM0YrMVRrc,2408
 velocity/aws/tests/test_deploy_least_privilege.py,sha256=ShdsbNwl2qzPaeQp2ZcMqtWRSoIB0DM0GmX0EUGJOUk,15947
@@ -215,9 +217,9 @@ velocity/payment/stripe_adapter.py,sha256=6EmVBZZchg2s3Teya0eQGA_8pvSK_teizr036U
 velocity/payment/stripe_mirror.py,sha256=6GKJk_PjAgySqFEuxbcuV423OfuGXupVTiGu9QwS5W8,12320
 velocity/testing/__init__.py,sha256=WtYMDHgCLxOq6mlemcOYV5Y9HqF_2QQgSfuAjFRg69Q,731
 velocity/testing/fake_db.py,sha256=phgdulk5owf3noUDpEfI7yFsVcKxRGZ82f2BJPYnaiU,53226
-velocity_python-0.2.1.dist-info/licenses/LICENSE,sha256=aoN245GG8s9oRUU89KNiGTU4_4OtnNmVi4hQeChg6rM,1076
-velocity_python-0.2.1.dist-info/METADATA,sha256=1fdxJ_-DEUkiOBQ2E6DXclQdmLHZS71fsYaXb3GxVrs,17782
-velocity_python-0.2.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-velocity_python-0.2.1.dist-info/entry_points.txt,sha256=nXUKJHkOGQCSPoagdmMNd_qycrle1LVU-GhYknLGM1M,56
-velocity_python-0.2.1.dist-info/top_level.txt,sha256=JW2vJPmodgdgSz7H6yoZvnxF8S3fTMIv-YJWCT1sNW0,9
-velocity_python-0.2.1.dist-info/RECORD,,
+velocity_python-0.2.2.dist-info/licenses/LICENSE,sha256=aoN245GG8s9oRUU89KNiGTU4_4OtnNmVi4hQeChg6rM,1076
+velocity_python-0.2.2.dist-info/METADATA,sha256=AyF5g7y_NQgfh4ywOlwkZX-cxnrmtGFom8Kp7oMznts,17782
+velocity_python-0.2.2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+velocity_python-0.2.2.dist-info/entry_points.txt,sha256=nXUKJHkOGQCSPoagdmMNd_qycrle1LVU-GhYknLGM1M,56
+velocity_python-0.2.2.dist-info/top_level.txt,sha256=JW2vJPmodgdgSz7H6yoZvnxF8S3fTMIv-YJWCT1sNW0,9
+velocity_python-0.2.2.dist-info/RECORD,,