vortexpy 4.3.0__tar.gz → 4.3.3__tar.gz

{vortexpy-4.3.0 → vortexpy-4.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vortexpy
-Version: 4.3.0
+Version: 4.3.3
 Summary: Flying Ion's observable, routable, data serialisation and transport code.
 Author-email: Flying Ion Pty Ltd <contact@flyingion.com>
 License: MIT
@@ -34,6 +34,8 @@ Flying Ion's observable, routable, data serialisation and transport code.
 See [README_PERMISSIONS.md](README_PERMISSIONS.md) for the two-level permission
 system (endpoint guards + access control context) introduced in v5.0.
 
+**Tuple and Payload tutorials:** [docs/README.md](docs/README.md) (simple → full features, encode/decode, threaded decode).
+
 Why PY at the end? To be consistent with VortexJS, which is the Browser side package.
 See https://gitlab.com/flyingion/vortexjs
 

{vortexpy-4.3.0 → vortexpy-4.3.3}/README.md

@@ -5,6 +5,8 @@ Flying Ion's observable, routable, data serialisation and transport code.
 See [README_PERMISSIONS.md](README_PERMISSIONS.md) for the two-level permission
 system (endpoint guards + access control context) introduced in v5.0.
 
+**Tuple and Payload tutorials:** [docs/README.md](docs/README.md) (simple → full features, encode/decode, threaded decode).
+
 Why PY at the end? To be consistent with VortexJS, which is the Browser side package.
 See https://gitlab.com/flyingion/vortexjs
 

{vortexpy-4.3.0 → vortexpy-4.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vortexpy"
-version = "4.3.0"
+version = "4.3.3"
 license = {text = "MIT"}
 authors = [{name = "Flying Ion Pty Ltd", email = "contact@flyingion.com"}]
 description = "Flying Ion's observable, routable, data serialisation and transport code."
@@ -53,3 +53,13 @@ namespaces = false
 
 [project.entry-points."mypy.plugins"]
 vortex_defer = "vortex.mypy_plugin:plugin"
+
+[tool.pytest.ini_options]
+testpaths = ["vortex"]
+python_files = ["*_test.py"]
+python_functions = ["test*"]
+norecursedirs = ["_trial_temp", "example", "old_fork"]
+markers = [
+    "trial: legacy Twisted Trial *Test.py modules (not collected; run with trial CLI)",
+    "slow: large payload or timing benchmarks",
+]

{vortexpy-4.3.0 → vortexpy-4.3.3}/vortex/DeferUtil.py

@@ -8,6 +8,7 @@
 
 import inspect
 import logging
+import time
 from collections.abc import Callable
 from typing import ParamSpec, TypeVar
 
@@ -209,7 +210,27 @@ def deferToThreadWrapWithLogger(
                     "Deferring to a thread can only be done from the main thread"
                 )
 
-            d: Deferred[_R] = deferToThread(funcToWrap, *args, **kwargs)
+            def timedFuncToRun(*runArgs: _P.args, **runKwargs: _P.kwargs) -> _R:
+                startMonotonic = time.monotonic()
+                try:
+                    return funcToWrap(*runArgs, **runKwargs)
+                finally:
+                    durationMs = (time.monotonic() - startMonotonic) * 1000.0
+                    from vortex.twisted_runtime_metrics import (
+                        STACK_CAPTURE_THRESHOLD_MS,
+                        TwistedRuntimeMetrics,
+                    )
+
+                    methodFrame = None
+                    if durationMs >= STACK_CAPTURE_THRESHOLD_MS:
+                        methodFrame = TwistedRuntimeMetrics._captureWorkerThreadFrame()
+                    TwistedRuntimeMetrics._collector()._recordThreadedCall(
+                        funcToWrap.__qualname__,
+                        durationMs,
+                        methodFrame,
+                    )
+
+            d: Deferred[_R] = deferToThread(timedFuncToRun, *args, **kwargs)
             d.addCallback(checkForInlineCallbackYield)
             d.addErrback(vortexLogFailure, loggerArg, consumeError=consumeError)
             return d
@@ -225,13 +246,9 @@ def isMainThread():
 
 def noMainThread():
     if isMainThread():
-        raise Exception(
-            "Blocking operations shouldn't occur in the reactors thread."
-        )
+        raise Exception("Blocking operations shouldn't occur in the reactors thread.")
 
 
 def yesMainThread():
     if not isMainThread():
-        raise Exception(
-            "Async operations must occur in the reactors main thread."
-        )
+        raise Exception("Async operations must occur in the reactors main thread.")

vortexpy-4.3.3/vortex/DeferUtil_test.py

@@ -0,0 +1,86 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+# See LICENSE for the full license text.
+
+from __future__ import annotations
+
+import logging
+import time
+from collections.abc import Generator
+
+import pytest
+from pytest_twisted import ensureDeferred  # type: ignore[import-untyped]
+
+from vortex.DeferUtil import deferToThreadWrapWithLogger
+from vortex.twisted_runtime_metrics import TwistedRuntimeMetrics
+from vortex.twisted_runtime_metrics_test import (
+    utilResetTwistedRuntimeMetricsSingletonForTests,
+)
+
+logger = logging.getLogger(__name__)
+
+
+@deferToThreadWrapWithLogger(logger)
+def _deferUtilTestBlockingWork() -> str:
+    time.sleep(0.01)
+    return "done"
+
+
+@deferToThreadWrapWithLogger(logger)
+def _deferUtilTestSlowBlockingWork() -> str:
+    time.sleep(0.06)
+    return "slow-done"
+
+
+@pytest.fixture(autouse=True)
+def resetMetricsSingleton() -> Generator[None, None, None]:
+    utilResetTwistedRuntimeMetricsSingletonForTests()
+    yield
+    utilResetTwistedRuntimeMetricsSingletonForTests()
+
+
+@pytest.mark.twisted
+@ensureDeferred
+async def testDeferToThreadWrapWithLoggerRecordsThreadedCallTiming() -> None:
+    result = await _deferUtilTestBlockingWork()
+    assert result == "done", "deferred thread call must return worker result"
+
+    snapshot = TwistedRuntimeMetrics.snapshotAndResetWindow()
+    assert snapshot.threadedCallCount == 1, (
+        "defer hook must record one threaded call per invocation"
+    )
+    assert snapshot.longestThreadedMethodName == "_deferUtilTestBlockingWork", (
+        "defer hook must record wrapped function qualname"
+    )
+    assert snapshot.longestThreadedMethodMs >= 10.0, (
+        "defer hook must record at least sleep duration in ms"
+    )
+    assert snapshot.longestThreadedMethodFrame is None, (
+        "fast defer hook must not capture worker thread frame"
+    )
+
+
+@pytest.mark.twisted
+@ensureDeferred
+async def testDeferToThreadWrapWithLoggerCapturesSlowCallFrame() -> None:
+    result = await _deferUtilTestSlowBlockingWork()
+    assert result == "slow-done", "deferred slow thread call must return worker result"
+
+    snapshot = TwistedRuntimeMetrics.snapshotAndResetWindow()
+    assert snapshot.threadedCallCount == 1, (
+        "slow defer hook must record one threaded call"
+    )
+    assert snapshot.longestThreadedMethodName == "_deferUtilTestSlowBlockingWork", (
+        "slow defer hook must record wrapped function qualname"
+    )
+    assert snapshot.longestThreadedMethodMs >= 50.0, (
+        "slow defer hook must exceed stack capture threshold in ms"
+    )
+    assert snapshot.longestThreadedMethodFrame is not None, (
+        "slow defer hook must capture worker thread frame"
+    )
+    assert "DeferUtil.py" not in snapshot.longestThreadedMethodFrame, (
+        "captured frame must skip defer hook internals"
+    )
+    assert "twisted_runtime_metrics.py" not in snapshot.longestThreadedMethodFrame, (
+        "captured frame must skip metrics collector internals"
+    )

vortexpy-4.3.3/vortex/MtlsAuthorizedClientRegistry.py

@@ -0,0 +1,150 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+"""Mutable authorized-client certificate set for mTLS server verification."""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import threading
+from typing import NamedTuple
+
+from OpenSSL import crypto
+from txhttputil.util.PemUtil import parsePemBundleForTrustedPeers
+
+logger = logging.getLogger(name=__name__)
+
+
+class AuthorizedClientIdentity(NamedTuple):
+    """Metadata for one authorized mTLS client certificate."""
+
+    fingerprint: str
+    publicKeyAsn1: bytes
+    instanceId: str
+    ownerUsername: str
+    commonName: str
+
+
+class MtlsAuthorizedClientRegistry:
+    """Runtime-mutable allowlist of client certificate public keys.
+
+    Static PEM bundles can be loaded at startup; ``addAuthorizedClientCertificate``
+    and ``revokeAuthorizedClientCertificate`` mutate the set without restarting
+    the TLS listener when used with ``buildMtlsServerCertificateOptions``.
+    """
+
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self._byPublicKey: dict[bytes, AuthorizedClientIdentity] = {}
+        self._byFingerprint: dict[str, AuthorizedClientIdentity] = {}
+
+    def loadTrustedPeerBundle(self, bundle_file_path: str) -> int:
+        """Load client certificates from a PEM bundle into the registry.
+
+        :param bundle_file_path: Path to a PEM file with one or more client certs.
+        :return: Number of certificates added.
+        """
+        trusted_peer_certificates = parsePemBundleForTrustedPeers(bundle_file_path)
+        added = 0
+        for trusted_peer in trusted_peer_certificates:
+            cert_pem = trusted_peer.as_bytes()
+            fingerprint = self.addAuthorizedClientCertificate(
+                cert_pem,
+                instanceId="",
+                ownerUsername="",
+            )
+            if fingerprint:
+                added += 1
+        return added
+
+    def addAuthorizedClientCertificate(
+        self,
+        certificate_pem: bytes | str,
+        *,
+        instanceId: str = "",
+        ownerUsername: str = "",
+    ) -> str:
+        """Authorize a client certificate for future mTLS handshakes.
+
+        :param certificate_pem: PEM-encoded X.509 client certificate.
+        :param instanceId: Codie instance id (CN when issued by hub CA).
+        :param ownerUsername: OAuth username or operator id for audit logs.
+        :return: SHA-256 fingerprint prefix (hex) for the certificate.
+        """
+        if isinstance(certificate_pem, str):
+            certificate_pem = certificate_pem.encode("utf-8")
+
+        x509_cert = crypto.load_certificate(crypto.FILETYPE_PEM, certificate_pem)
+        public_key_asn1 = crypto.dump_publickey(
+            crypto.FILETYPE_ASN1, x509_cert.get_pubkey()
+        )
+        fingerprint = hashlib.sha256(
+            crypto.dump_certificate(crypto.FILETYPE_ASN1, x509_cert)
+        ).hexdigest()[:16]
+        subject = x509_cert.get_subject()
+        common_name = (
+            subject.CN.decode("utf-8")
+            if isinstance(subject.CN, bytes)
+            else str(subject.CN or "")
+        )
+        resolved_instance_id = instanceId or common_name
+        identity = AuthorizedClientIdentity(
+            fingerprint=fingerprint,
+            publicKeyAsn1=public_key_asn1,
+            instanceId=resolved_instance_id,
+            ownerUsername=ownerUsername,
+            commonName=common_name,
+        )
+        with self._lock:
+            self._byPublicKey[public_key_asn1] = identity
+            self._byFingerprint[fingerprint] = identity
+        logger.info(
+            "Authorized mTLS client cert fingerprint=%s instanceId=%s owner=%s cn=%s",
+            fingerprint,
+            resolved_instance_id,
+            ownerUsername or "(unknown)",
+            common_name,
+        )
+        return fingerprint
+
+    def revokeAuthorizedClientCertificate(self, fingerprint: str) -> bool:
+        """Remove a client certificate from the authorized set.
+
+        :param fingerprint: Value returned from ``addAuthorizedClientCertificate``.
+        :return: ``True`` when a certificate was removed.
+        """
+        with self._lock:
+            identity = self._byFingerprint.pop(fingerprint, None)
+            if identity is None:
+                return False
+            self._byPublicKey.pop(identity.publicKeyAsn1, None)
+        logger.info(
+            "Revoked mTLS client cert fingerprint=%s instanceId=%s owner=%s",
+            identity.fingerprint,
+            identity.instanceId,
+            identity.ownerUsername or "(unknown)",
+        )
+        return True
+
+    def isPublicKeyAuthorized(self, public_key_asn1: bytes) -> bool:
+        """Return whether a TLS peer public key is currently authorized."""
+        with self._lock:
+            return public_key_asn1 in self._byPublicKey
+
+    def getIdentityForPublicKey(
+        self, public_key_asn1: bytes
+    ) -> AuthorizedClientIdentity | None:
+        """Return audit metadata for an authorized peer public key."""
+        with self._lock:
+            return self._byPublicKey.get(public_key_asn1)
+
+    def listAuthorizedIdentities(self) -> list[AuthorizedClientIdentity]:
+        """Return a snapshot of all authorized client identities."""
+        with self._lock:
+            return list(self._byFingerprint.values())

vortexpy-4.3.3/vortex/MtlsAuthorizedClientRegistry_test.py

@@ -0,0 +1,75 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+from __future__ import annotations
+
+import os
+
+import pytest
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import ExtendedKeyUsageOID, NameOID
+from datetime import datetime, timedelta, timezone
+from OpenSSL import crypto
+
+from vortex.MtlsAuthorizedClientRegistry import MtlsAuthorizedClientRegistry
+
+
+def _makeClientCertPem(common_name: str) -> bytes:
+    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    subject = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, common_name)])
+    now = datetime.now(timezone.utc)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(subject)
+        .public_key(private_key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now)
+        .not_valid_after(now + timedelta(days=30))
+        .add_extension(
+            x509.ExtendedKeyUsage([ExtendedKeyUsageOID.CLIENT_AUTH]),
+            critical=False,
+        )
+        .sign(private_key, hashes.SHA256())
+    )
+    return cert.public_bytes(serialization.Encoding.PEM)
+
+
+def test_add_and_revoke_client_certificate() -> None:
+    registry = MtlsAuthorizedClientRegistry()
+    cert_pem = _makeClientCertPem("local-mac")
+    fingerprint = registry.addAuthorizedClientCertificate(
+        cert_pem,
+        instanceId="local-mac",
+        ownerUsername="operator",
+    )
+    assert fingerprint
+    x509_cert = crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem)
+    public_key_asn1 = crypto.dump_publickey(
+        crypto.FILETYPE_ASN1, x509_cert.get_pubkey()
+    )
+    assert registry.isPublicKeyAuthorized(public_key_asn1)
+    identity = registry.getIdentityForPublicKey(public_key_asn1)
+    assert identity is not None
+    assert identity.instanceId == "local-mac"
+    assert identity.ownerUsername == "operator"
+    assert registry.revokeAuthorizedClientCertificate(fingerprint)
+    assert not registry.isPublicKeyAuthorized(public_key_asn1)
+
+
+def test_load_trusted_peer_bundle(tmp_path) -> None:
+    cert_pem = _makeClientCertPem("cloud-instance")
+    bundle_path = os.path.join(str(tmp_path), "trusted-peers.pem")
+    with open(bundle_path, "wb") as handle:
+        handle.write(cert_pem)
+    registry = MtlsAuthorizedClientRegistry()
+    added = registry.loadTrustedPeerBundle(bundle_path)
+    assert added == 1
+    assert len(registry.listAuthorizedIdentities()) == 1

vortexpy-4.3.3/vortex/MtlsServerSslOptions.py

@@ -0,0 +1,176 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+"""Build Twisted server SSL options with a dynamic mTLS client allowlist."""
+
+from __future__ import annotations
+
+import logging
+from typing import Optional
+
+from OpenSSL import SSL, crypto
+from twisted.internet._sslverify import Certificate, KeyPair, TLSVersion
+from twisted.internet.ssl import CertificateOptions
+from twisted.python.randbytes import secureRandom
+from txhttputil.util.PemUtil import PrivateKeyWithFullChain
+
+from vortex.MtlsAuthorizedClientRegistry import MtlsAuthorizedClientRegistry
+
+logger = logging.getLogger(name=__name__)
+
+
+class _MtlsServerCertificateOptions(CertificateOptions):
+    """Server ``CertificateOptions`` with registry-backed client verification."""
+
+    def __init__(
+        self,
+        *,
+        authorized_client_registry: MtlsAuthorizedClientRegistry,
+        **kwargs,
+    ) -> None:
+        self._authorizedClientRegistry = authorized_client_registry
+        super().__init__(**kwargs)
+
+    def _makeContext(self):
+        ctx = self._contextFactory(self.method)
+        ctx.set_options(self._options)
+        ctx.set_mode(self._mode)
+
+        if self.certificate is not None and self.privateKey is not None:
+            ctx.use_certificate(self.certificate)
+            ctx.use_privatekey(self.privateKey)
+            for extra_cert in self.extraCertChain:
+                ctx.add_extra_chain_cert(extra_cert)
+            ctx.check_privatekey()
+
+        verify_flags = SSL.VERIFY_NONE
+        if self.verify:
+            verify_flags = SSL.VERIFY_PEER
+            if self.requireCertificate:
+                verify_flags |= SSL.VERIFY_FAIL_IF_NO_PEER_CERT
+            if self.verifyOnce:
+                verify_flags |= SSL.VERIFY_CLIENT_ONCE
+            self.trustRoot._addCACertsToContext(ctx)
+
+        registry = self._authorizedClientRegistry
+
+        def verifyCallback(
+            conn: SSL.Connection,
+            cert: crypto.X509,
+            errno: int,
+            depth: int,
+            preverify_ok: int,
+        ) -> int:
+            fail = 0
+
+            if depth != 0:
+                return preverify_ok
+
+            if preverify_ok == fail:
+                return preverify_ok
+
+            session_peer_public_key_bytes = crypto.dump_publickey(
+                crypto.FILETYPE_ASN1, cert.get_pubkey()
+            )
+            if not registry.isPublicKeyAuthorized(session_peer_public_key_bytes):
+                subject = cert.get_subject()
+                logger.error(
+                    "mTLS peer verify failed: certificate not authorized subject=%s",
+                    subject,
+                )
+                return fail
+
+            identity = registry.getIdentityForPublicKey(
+                session_peer_public_key_bytes
+            )
+            if identity is not None:
+                logger.info(
+                    "mTLS peer verified instanceId=%s owner=%s fingerprint=%s",
+                    identity.instanceId or "(unknown)",
+                    identity.ownerUsername or "(unknown)",
+                    identity.fingerprint,
+                )
+            return preverify_ok
+
+        ctx.set_verify(verify_flags, verifyCallback)
+        if self.verifyDepth is not None:
+            ctx.set_verify_depth(self.verifyDepth)
+
+        from binascii import hexlify
+
+        session_id_context = hexlify(secureRandom(7))
+        ctx.set_session_id(session_id_context)
+
+        if self.enableSessions:
+            ctx.set_session_cache_mode(SSL.SESS_CACHE_SERVER)
+        else:
+            ctx.set_session_cache_mode(SSL.SESS_CACHE_OFF)
+
+        if self.dhParameters:
+            ctx.load_tmp_dh(self.dhParameters._dhFile.path)
+        ctx.set_cipher_list(self._cipherString.encode("ascii"))
+
+        self._ecChooser.configureECDHCurve(ctx)
+
+        if self._acceptableProtocols:
+            from twisted.internet._sslverify import _setAcceptableProtocols
+
+            _setAcceptableProtocols(ctx, self._acceptableProtocols)
+
+        return ctx
+
+
+def buildMtlsServerCertificateOptions(
+    private_key_with_full_chain: PrivateKeyWithFullChain,
+    trust_root,
+    authorized_client_registry: MtlsAuthorizedClientRegistry,
+    *,
+    acceptable_protocols: Optional[list[bytes]] = None,
+    dh_parameters=None,
+) -> CertificateOptions:
+    """Build server TLS options with dynamic authorized-client verification.
+
+    Existing callers that pass a static trusted-peer PEM bundle should load
+    that bundle into ``authorized_client_registry`` first; runtime ``add`` /
+    ``revoke`` on the registry updates verification without rebuilding options.
+
+    :param private_key_with_full_chain: Server key + certificate chain PEM bank.
+    :param trust_root: Twisted trust root for client certificate chain validation.
+    :param authorized_client_registry: Mutable authorized client public keys.
+    :return: Twisted ``CertificateOptions`` for ``reactor.listenSSL``.
+    """
+    if acceptable_protocols is None:
+        acceptable_protocols = [b"http/1.1"]
+
+    twisted_loaded_chain = PrivateKeyWithFullChain(
+        privateKey=KeyPair.load(
+            private_key_with_full_chain.privateKey.as_bytes(), crypto.FILETYPE_PEM
+        ).original,
+        certificate=Certificate.loadPEM(
+            private_key_with_full_chain.certificate.as_bytes()
+        ).original,
+        intermediateCAs=[
+            Certificate.loadPEM(intermediate_ca.as_bytes()).original
+            for intermediate_ca in private_key_with_full_chain.intermediateCAs
+        ],
+        rootCA=Certificate.loadPEM(
+            private_key_with_full_chain.rootCA.as_bytes()
+        ).original,
+    )
+
+    return _MtlsServerCertificateOptions(
+        authorized_client_registry=authorized_client_registry,
+        privateKey=twisted_loaded_chain.privateKey,
+        certificate=twisted_loaded_chain.certificate,
+        extraCertChain=twisted_loaded_chain.intermediateCAs,
+        trustRoot=trust_root,
+        raiseMinimumTo=TLSVersion.TLSv1_2,
+        lowerMaximumSecurityTo=TLSVersion.TLSv1_3,
+        acceptableProtocols=acceptable_protocols,
+        dhParameters=dh_parameters,
+    )

{vortexpy-4.3.0 → vortexpy-4.3.3}/vortex/PayloadResponse.py

@@ -151,7 +151,14 @@ class PayloadResponse(Deferred):
         self._status = self.TIMED_OUT
         return failure
 
-    def _process(self, payloadEnvelope: PayloadEnvelope, vortexName, **kwargs):
+    def _process(
+        self,
+        payloadEnvelope: PayloadEnvelope,
+        vortexUuid: str,
+        vortexName: str,
+        sendResponse=None,
+        vortexSession=None,
+    ):
         if self._endpoint:
             self._endpoint.shutdown()
             self._endpoint = None

{vortexpy-4.3.0 → vortexpy-4.3.3}/vortex/SerialiseUtil.py

@@ -11,7 +11,7 @@ import enum
 import logging
 from base64 import b64encode, b64decode
 from collections import defaultdict
-from datetime import datetime, date
+from datetime import UTC, datetime, date
 
 import pytz
 from sqlalchemy.orm.collections import InstrumentedList
@@ -124,6 +124,35 @@ def deserialiseWkb(wkbB64Data: str) -> WKBElement:
     return from_shape(shapely.wkb.loads(b64decode(wkbB64Data)))
 
 
+def requireAwareDatetime(value: datetime) -> datetime:
+    """Require a timezone-aware datetime for BSON serialisation."""
+    if value.tzinfo is None:
+        raise TypeError(
+            "datetime must be timezone-aware for BSON serialisation,"
+            f" got naive {value!r}"
+        )
+    return value
+
+
+def datetimeToBson(value: datetime) -> int:
+    """Serialise a datetime to UTC epoch milliseconds for BSON storage."""
+    aware = requireAwareDatetime(value)
+    return int(aware.timestamp() * 1000)
+
+
+def datetimeFromBson(value: object) -> datetime:
+    """Deserialise a BSON datetime field from UTC epoch milliseconds."""
+    if isinstance(value, datetime):
+        return requireAwareDatetime(value)
+    if isinstance(value, int) and not isinstance(value, bool):
+        return datetime.fromtimestamp(value / 1000, tz=UTC)
+    if isinstance(value, float):
+        return datetime.fromtimestamp(value / 1000, tz=UTC)
+    raise TypeError(
+        f"Expected BSON datetime or epoch milliseconds, got {type(value).__name__}"
+    )
+
+
 TYPE_MAP_RAPUI_TO_PY = {
     T_FLOAT: float,
     T_STR: str,
@@ -220,13 +249,12 @@ def fromStr(val: str, typeName: str):
             )
 
         if len(val) <= len("2017-06-06 09:40:37.097068"):
-            logger.warning(
-                "Parsing date time with no timezone: %s Setting TZ to UTC",
-                val,
+            raise ValueError(
+                f"datetime string must include timezone information, got {val!r}"
             )
-            return datetime.strptime(val, ISO8601_NOTZ).replace(tzinfo=pytz.UTC)
 
-        return datetime.strptime(val, ISO8601)
+        parsed = datetime.strptime(val, ISO8601)
+        return requireAwareDatetime(parsed)
 
     if typeName == T_BOOL:
         return val == V_TRUE

{vortexpy-4.3.0 → vortexpy-4.3.3}/vortex/SerialiseUtil_test.py

@@ -9,7 +9,7 @@
 import json
 from enum import Enum, IntEnum, StrEnum
 
-from twisted.trial import unittest
+import unittest
 
 from vortex.SerialiseUtil import T_INT, T_STR, fromStr, toRapuiType, toStr
 from vortex.TupleSelector import TupleSelector