vortexpy 4.3.1__tar.gz → 4.3.4__tar.gz

{vortexpy-4.3.1 → vortexpy-4.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vortexpy
-Version: 4.3.1
+Version: 4.3.4
 Summary: Flying Ion's observable, routable, data serialisation and transport code.
 Author-email: Flying Ion Pty Ltd <contact@flyingion.com>
 License: MIT

{vortexpy-4.3.1 → vortexpy-4.3.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vortexpy"
-version = "4.3.1"
+version = "4.3.4"
 license = {text = "MIT"}
 authors = [{name = "Flying Ion Pty Ltd", email = "contact@flyingion.com"}]
 description = "Flying Ion's observable, routable, data serialisation and transport code."

{vortexpy-4.3.1 → vortexpy-4.3.4}/vortex/VortexSession.py

@@ -154,7 +154,7 @@ def checkAccessControlContextSignature(
     if expectedPosition is not None:
         paramNames = [
             p.name
-            for p in params
+            for p in sig.parameters.values()
             if p.kind
             not in (
                 inspect.Parameter.VAR_POSITIONAL,

{vortexpy-4.3.1 → vortexpy-4.3.4}/vortex/__init__.py

@@ -6,4 +6,4 @@
 # Website : https://flyingion.com
 # Support : contact@flyingion.com
 
-__version__ = '4.3.1'
+__version__ = '4.3.4'

{vortexpy-4.3.1 → vortexpy-4.3.4}/vortex/handler/TupleActionProcessor.py

@@ -188,7 +188,10 @@ class TupleActionProcessor:
         return tupleName in self._tupleProcessorsByTupleName
 
     def shutdown(self):
-        self._endpoint.shutdown()
+        endpoint = getattr(self, "_endpoint", None)
+        if endpoint is not None:
+            endpoint.shutdown()
+            self._endpoint = None
 
     def _denyDelegate(
         self, log_fn, log_msg, error_msg, filt, tupleName, sendResponse

{vortexpy-4.3.1 → vortexpy-4.3.4}/vortex/handler/TupleDataAccessGranterABC.py

@@ -17,16 +17,16 @@ from vortex.VortexAccessControlContextABC import VortexAccessControlContextABC
 
 
 class TupleDataAccessGranterABC(ABC):
-    """Abstract base class for per-observer Level 2 push access control.
+    """Abstract base class for per-observer Level 2 tuple data access control.
 
     Register a concrete implementation via
     :meth:`~vortex.handler.TupleDataObservableHandler.TupleDataObservableHandler.addTupleProvider`
     (``accessGranter=`` parameter) or via
     :meth:`~vortex.handler.TupleDataObservableProxyHandler.TupleDataObservableProxyHandler.addTupleAccessGranter`.
 
-    Called for each subscribed observer before a server-push update is sent.
-    Return ``True`` (or a Deferred that fires with ``True``) to allow delivery,
-    ``False`` to silently skip that observer.
+    Called before a client subscribes (initial response) and for each subscribed
+    observer before a server-push update is sent.  Return ``True`` (or a Deferred
+    that fires with ``True``) to allow delivery, ``False`` to deny that observer.
     """
 
     @abstractmethod

{vortexpy-4.3.1 → vortexpy-4.3.4}/vortex/handler/TupleDataObservableHandler.py

@@ -28,14 +28,12 @@ from vortex.PayloadEndpoint import PayloadEndpoint
 from vortex.PayloadEnvelope import PayloadEnvelope
 from vortex.TupleSelector import TupleSelector
 from vortex.VortexABC import SendVortexMsgResponseCallable
+from vortex.VortexAccessControlContextABC import NO_AUTH_ACCESS_CONTROL_CONTEXT
 from vortex.VortexFactory import VortexFactory
 from twisted.internet.defer import maybeDeferred as _maybeDeferred
 
 from vortex.handler.TupleDataProviderABC import TupleDataProviderABC
 from vortex.handler.TupleDataAccessGranterABC import TupleDataAccessGranterABC
-from vortex.VortexEndpointPermission import (
-    EndpointPermissionsType as PermissionsType,
-)
 from vortex.VortexSession import checkNoHttpSessionInSignature
 from vortex.VortexUtil import limitConcurrency, _dedupProcessorCallKeys
 
@@ -65,9 +63,7 @@ class TupleSelectorUpdateMapperABC(metaclass=ABCMeta):
         """
 
 
-_ObserverDetails = namedtuple(
-    "_ObserverDetails", ["vortexUuid", "observerName"]
-)
+_ObserverDetails = namedtuple("_ObserverDetails", ["vortexUuid", "observerName"])
 
 
 class _ObserverData:
@@ -114,9 +110,7 @@ class TupleDataObservableHandler:
         self._observerDataByTupleSelector = {}
 
         self._tupleProvidersByTupleName = {}
-        self._accessGrantersByTupleName: Dict[
-            str, TupleDataAccessGranterABC
-        ] = {}
+        self._accessGrantersByTupleName: Dict[str, TupleDataAccessGranterABC] = {}
         self._tupleSelectorUpdateMappers = []
 
     def addTupleProvider(
@@ -126,7 +120,7 @@ class TupleDataObservableHandler:
         accessGranter: Optional[TupleDataAccessGranterABC] = None,
     ):
         """Add Tuple Provider"""
-        assert not tupleName in self._tupleProvidersByTupleName, (
+        assert tupleName not in self._tupleProvidersByTupleName, (
             "Observable:%s, Tuple name %s is already registered"
             % (
                 self._observableName,
@@ -150,16 +144,13 @@ class TupleDataObservableHandler:
             self._accessGrantersByTupleName[tupleName] = accessGranter
 
         providerDesc = (
-            f"{type(provider).__module__}."
-            f"{type(provider).__qualname__}.makeVortexMsg"
+            f"{type(provider).__module__}.{type(provider).__qualname__}.makeVortexMsg"
         )
         checkNoHttpSessionInSignature(provider.makeVortexMsg, providerDesc)
 
         self._tupleProvidersByTupleName[tupleName] = provider
 
-    def addTupleSelectorUpdateMapper(
-        self, mapper: TupleSelectorUpdateMapperABC
-    ):
+    def addTupleSelectorUpdateMapper(self, mapper: TupleSelectorUpdateMapperABC):
         """Add Tuple Selector Update Mapper
 
         This mapper will be called every time a tuple selector is notified of an update.
@@ -180,9 +171,7 @@ class TupleDataObservableHandler:
             for jsonStr in self._observerDataByTupleSelector
         ]
 
-    def tupleSubscriberCount(
-        self, tupleNames: Optional[frozenset[str]] = None
-    ) -> int:
+    def tupleSubscriberCount(self, tupleNames: Optional[frozenset[str]] = None) -> int:
         subscriberVortexUuids: set[str] = set()
         for observerData in self._observerDataByTupleSelector.values():
             if (
@@ -255,9 +244,7 @@ class TupleDataObservableHandler:
         if d:
             d.addErrback(vortexLogFailure, logger, consumeError=True)
 
-    @limitConcurrency(
-        logger, 25, deduplicateBasedOnKwArgsKey=_dedupProcessorCallKeys
-    )
+    @limitConcurrency(logger, 25, deduplicateBasedOnKwArgsKey=_dedupProcessorCallKeys)
     def _processLimitedDecorated(
         self,
         payloadEnvelope: PayloadEnvelope,
@@ -286,9 +273,7 @@ class TupleDataObservableHandler:
         _ = vortexName
 
         if not VortexFactory.isVortexUuidOnline(vortexUuid):
-            logger.debug(
-                "Vortex %s is no longer online, skipping reply", vortexUuid
-            )
+            logger.debug("Vortex %s is no longer online, skipping reply", vortexUuid)
             return
 
         # logger.debug(
@@ -319,12 +304,8 @@ class TupleDataObservableHandler:
                     tupleSelector.name,
                 )
                 return
-            endpointPermissions = yield _maybeDeferred(
-                auth.getEndpointPermissions, vs
-            )
-            if not tupleProvider.requiredPermissions.issubset(
-                endpointPermissions
-            ):
+            endpointPermissions = yield _maybeDeferred(auth.getEndpointPermissions, vs)
+            if not tupleProvider.requiredPermissions.issubset(endpointPermissions):
                 logger.warning(
                     "Observable:%s permission denied for %s",
                     self._observableName,
@@ -360,18 +341,50 @@ class TupleDataObservableHandler:
 
             return
 
+        granter = self._accessGrantersByTupleName.get(tupleSelector.name)
+        if granter:
+            filt = dict(tupleSelector=tupleSelector)
+            filt.update(self._filt)
+            auth = VortexFactory.getAuthenticator()
+            ctx = NO_AUTH_ACCESS_CONTROL_CONTEXT
+            if auth:
+                if not vs:
+                    logger.warning(
+                        "Observable:%s access denied for %s:"
+                        " no VortexSession for access control context.",
+                        self._observableName,
+                        tupleSelector.name,
+                    )
+                    return
+                ctx = yield _maybeDeferred(
+                    auth.getAccessControlContext,
+                    vs,
+                    vs.vortexName,
+                    vortexUuid,
+                )
+                if ctx is None:
+                    logger.warning(
+                        "Observable:%s access denied for %s:"
+                        " access control context unavailable.",
+                        self._observableName,
+                        tupleSelector.name,
+                    )
+                    return
+            granted = yield granter.isAccessGranted(filt, tupleSelector, ctx)
+            if not granted:
+                logger.warning(
+                    "Observable:%s access denied for %s",
+                    self._observableName,
+                    tupleSelector.name,
+                )
+                return
+
         # Add support for just getting data, no subscription.
-        if self._subscriptionsEnabled and payloadEnvelope.filt.get(
-            "subscribe", True
-        ):
+        if self._subscriptionsEnabled and payloadEnvelope.filt.get("subscribe", True):
             if tsStr not in self._observerDataByTupleSelector:
-                self._observerDataByTupleSelector[tsStr] = _ObserverData(
-                    tupleSelector
-                )
+                self._observerDataByTupleSelector[tsStr] = _ObserverData(tupleSelector)
 
-            self._observerDataByTupleSelector[tsStr].observers.add(
-                observerDetails
-            )
+            self._observerDataByTupleSelector[tsStr].observers.add(observerDetails)
             self._observerDataByTupleSelector[tsStr].vortexSessionByVortexUuid[
                 vortexUuid
             ] = vs
@@ -395,8 +408,7 @@ class TupleDataObservableHandler:
     ) -> List[TupleSelector]:
         # Get all tuple selectors
         allTupleSelectors = [
-            data.tupleSelector
-            for data in self._observerDataByTupleSelector.values()
+            data.tupleSelector for data in self._observerDataByTupleSelector.values()
         ]
 
         # Create a dict so we end up with only unique ones
@@ -404,9 +416,7 @@ class TupleDataObservableHandler:
 
         # Run through the mappers
         for mapper in self._tupleSelectorUpdateMappers:
-            mappedSelectors = mapper.mapTupleSelector(
-                tupleSelector, allTupleSelectors
-            )
+            mappedSelectors = mapper.mapTupleSelector(tupleSelector, allTupleSelectors)
             if mappedSelectors:
                 tupleSelectorByStr.update(
                     {ts.toJsonStr(): ts for ts in mappedSelectors}
@@ -498,9 +508,7 @@ class TupleDataObservableHandler:
         # Send the vortex messages, checking access per observer if a granter is set
         for destVortexUuid in destVortexUuids:
             if granter:
-                sessionVs = observerData.vortexSessionByVortexUuid.get(
-                    destVortexUuid
-                )
+                sessionVs = observerData.vortexSessionByVortexUuid.get(destVortexUuid)
                 ctx = None
                 if auth and sessionVs:
                     ctx = yield _maybeDeferred(
@@ -509,8 +517,8 @@ class TupleDataObservableHandler:
                         sessionVs.vortexName,
                         destVortexUuid,
                     )
-                granted = yield _maybeDeferred(
-                    granter.isAccessGranted, filt, tupleSelector, ctx
+                granted = yield granter.isAccessGranted(
+                    filt, tupleSelector, ctx
                 )
                 if not granted:
                     continue

vortexpy-4.3.4/vortex/handler/TupleDataObservableHandler_test.py

@@ -0,0 +1,264 @@
+# ruff: noqa: N999
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+from __future__ import annotations
+
+from typing import Any
+from unittest.mock import MagicMock, patch
+
+import pytest
+from pytest_twisted import ensureDeferred  # type: ignore[import-untyped]
+from twisted.internet.defer import Deferred, succeed
+
+from vortex.PayloadEnvelope import PayloadEnvelope
+from vortex.TupleSelector import TupleSelector
+from vortex.VortexAccessControlContextABC import VortexAccessControlContextABC
+from vortex.VortexSession import VortexSession
+from vortex.handler.TupleDataAccessGranterABC import TupleDataAccessGranterABC
+from vortex.handler.TupleDataObservableHandler import TupleDataObservableHandler
+from vortex.handler.TupleDataProviderABC import TupleDataProviderABC
+
+_TUPLE_NAME = "testTuples"
+_TUPLE_SELECTOR = TupleSelector(_TUPLE_NAME, {"count": 2})
+_VORTEX_UUID = "client-vortex-uuid-1"
+
+
+class _TestAccessControlContext(VortexAccessControlContextABC):
+    def __init__(self) -> None:
+        super().__init__(
+            vortexName="client-vortex",
+            vortexUuid=_VORTEX_UUID,
+        )
+
+
+class _RecordingGranter(TupleDataAccessGranterABC):
+    def __init__(self, granted: bool) -> None:
+        self.granted = granted
+        self.calls: list[tuple[dict, TupleSelector, Any]] = []
+
+    def isAccessGranted(
+        self,
+        filt: dict,
+        tupleSelector: TupleSelector,
+        accessControlContext: VortexAccessControlContextABC,
+    ) -> bool:
+        self.calls.append((filt, tupleSelector, accessControlContext))
+        return self.granted
+
+
+class _StubProvider(TupleDataProviderABC):
+    requiredPermissions = frozenset()
+
+    def __init__(self) -> None:
+        self.makeVortexMsgCalls = 0
+
+    def makeVortexMsg(
+        self,
+        filt: dict,
+        tupleSelector: TupleSelector,
+    ) -> bytes:
+        self.makeVortexMsgCalls += 1
+        return b"stub-vortex-msg"
+
+
+def _makeHandler(
+    granter: TupleDataAccessGranterABC | None = None,
+) -> tuple[TupleDataObservableHandler, _StubProvider]:
+    handler = TupleDataObservableHandler("testObservable")
+    provider = _StubProvider()
+    handler.addTupleProvider(_TUPLE_NAME, provider, accessGranter=granter)
+    return handler, provider
+
+
+def _subscribeEnvelope() -> PayloadEnvelope:
+    return PayloadEnvelope(
+        filt=dict(
+            tupleSelector=_TUPLE_SELECTOR,
+            subscribe=True,
+            observerName="testObserver",
+        )
+    )
+
+
+@pytest.mark.twisted
+@ensureDeferred
+async def test_subscribe_granter_grants_registers_observer_and_responds() -> None:
+    granter = _RecordingGranter(granted=True)
+    handler, provider = _makeHandler(granter)
+    vortexSession = VortexSession(ip="127.0.0.1", vortexName="client-vortex")
+    accessControlContext = _TestAccessControlContext()
+    auth = MagicMock()
+    auth.getAccessControlContext.return_value = succeed(accessControlContext)
+    sendResponseCalls: list[bytes] = []
+
+    def sendResponse(vortexMsg: bytes) -> Deferred[None]:
+        sendResponseCalls.append(vortexMsg)
+        return succeed(None)
+
+    with (
+        patch(
+            "vortex.handler.TupleDataObservableHandler.VortexFactory.isVortexUuidOnline",
+            return_value=True,
+        ),
+        patch(
+            "vortex.handler.TupleDataObservableHandler.VortexFactory.getAuthenticator",
+            return_value=auth,
+        ),
+    ):
+        await handler._process(
+            _subscribeEnvelope(),
+            _VORTEX_UUID,
+            "client-vortex",
+            sendResponse,
+            vortexSession=vortexSession,
+        )
+
+    assert len(granter.calls) == 1, "granter should run once on subscribe"
+    assert granter.calls[0][2] is accessControlContext, (
+        "granter should receive resolved access control context"
+    )
+    assert handler.hasTupleSubscribers(_TUPLE_SELECTOR) is True, (
+        "granted subscribe should register observer"
+    )
+    assert provider.makeVortexMsgCalls == 1, "granted subscribe should fetch tuple data"
+    assert len(sendResponseCalls) == 1, "granted subscribe should send initial response"
+    auth.getAccessControlContext.assert_called_once_with(
+        vortexSession,
+        vortexSession.vortexName,
+        _VORTEX_UUID,
+    )
+
+
+@pytest.mark.twisted
+@ensureDeferred
+async def test_subscribe_granter_denies_without_observer_or_response() -> None:
+    granter = _RecordingGranter(granted=False)
+    handler, provider = _makeHandler(granter)
+    vortexSession = VortexSession(ip="127.0.0.1", vortexName="client-vortex")
+    auth = MagicMock()
+    auth.getAccessControlContext.return_value = succeed(_TestAccessControlContext())
+    sendResponseCalls: list[bytes] = []
+
+    def sendResponse(vortexMsg: bytes) -> Deferred[None]:
+        sendResponseCalls.append(vortexMsg)
+        return succeed(None)
+
+    with (
+        patch(
+            "vortex.handler.TupleDataObservableHandler.VortexFactory.isVortexUuidOnline",
+            return_value=True,
+        ),
+        patch(
+            "vortex.handler.TupleDataObservableHandler.VortexFactory.getAuthenticator",
+            return_value=auth,
+        ),
+    ):
+        await handler._process(
+            _subscribeEnvelope(),
+            _VORTEX_UUID,
+            "client-vortex",
+            sendResponse,
+            vortexSession=vortexSession,
+        )
+
+    assert len(granter.calls) == 1, "denied subscribe should still consult granter"
+    assert handler.hasTupleSubscribers(_TUPLE_SELECTOR) is False, (
+        "denied subscribe must not register observer"
+    )
+    assert provider.makeVortexMsgCalls == 0, (
+        "denied subscribe must not call makeVortexMsg"
+    )
+    assert sendResponseCalls == [], "denied subscribe must not send response"
+
+
+@pytest.mark.twisted
+@ensureDeferred
+async def test_subscribe_granter_denies_when_auth_required_without_session() -> None:
+    granter = _RecordingGranter(granted=True)
+    handler, provider = _makeHandler(granter)
+    auth = MagicMock()
+    sendResponseCalls: list[bytes] = []
+
+    def sendResponse(vortexMsg: bytes) -> Deferred[None]:
+        sendResponseCalls.append(vortexMsg)
+        return succeed(None)
+
+    with (
+        patch(
+            "vortex.handler.TupleDataObservableHandler.VortexFactory.isVortexUuidOnline",
+            return_value=True,
+        ),
+        patch(
+            "vortex.handler.TupleDataObservableHandler.VortexFactory.getAuthenticator",
+            return_value=auth,
+        ),
+    ):
+        await handler._process(
+            _subscribeEnvelope(),
+            _VORTEX_UUID,
+            "client-vortex",
+            sendResponse,
+            vortexSession=None,
+        )
+
+    assert granter.calls == [], (
+        "missing session with auth registered must deny before granter"
+    )
+    auth.getAccessControlContext.assert_not_called()
+    assert handler.hasTupleSubscribers(_TUPLE_SELECTOR) is False, (
+        "missing session must not register observer"
+    )
+    assert provider.makeVortexMsgCalls == 0, (
+        "missing session must not call makeVortexMsg"
+    )
+    assert sendResponseCalls == [], "missing session must not send response"
+
+
+@pytest.mark.twisted
+@ensureDeferred
+async def test_subscribe_granter_denies_when_context_unavailable() -> None:
+    granter = _RecordingGranter(granted=True)
+    handler, provider = _makeHandler(granter)
+    vortexSession = VortexSession(ip="127.0.0.1", vortexName="client-vortex")
+    auth = MagicMock()
+    auth.getAccessControlContext.return_value = succeed(None)
+    sendResponseCalls: list[bytes] = []
+
+    def sendResponse(vortexMsg: bytes) -> Deferred[None]:
+        sendResponseCalls.append(vortexMsg)
+        return succeed(None)
+
+    with (
+        patch(
+            "vortex.handler.TupleDataObservableHandler.VortexFactory.isVortexUuidOnline",
+            return_value=True,
+        ),
+        patch(
+            "vortex.handler.TupleDataObservableHandler.VortexFactory.getAuthenticator",
+            return_value=auth,
+        ),
+    ):
+        await handler._process(
+            _subscribeEnvelope(),
+            _VORTEX_UUID,
+            "client-vortex",
+            sendResponse,
+            vortexSession=vortexSession,
+        )
+
+    assert granter.calls == [], (
+        "unavailable access control context must deny before granter"
+    )
+    assert handler.hasTupleSubscribers(_TUPLE_SELECTOR) is False, (
+        "unavailable context must not register observer"
+    )
+    assert provider.makeVortexMsgCalls == 0, (
+        "unavailable context must not call makeVortexMsg"
+    )
+    assert sendResponseCalls == [], "unavailable context must not send response"

{vortexpy-4.3.1 → vortexpy-4.3.4}/vortexpy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vortexpy
-Version: 4.3.1
+Version: 4.3.4
 Summary: Flying Ion's observable, routable, data serialisation and transport code.
 Author-email: Flying Ion Pty Ltd <contact@flyingion.com>
 License: MIT

{vortexpy-4.3.1 → vortexpy-4.3.4}/vortexpy.egg-info/SOURCES.txt

@@ -88,6 +88,7 @@ vortex/handler/TupleDataAccessGranterABC.py
 vortex/handler/TupleDataActionClient.py
 vortex/handler/TupleDataObservableCache.py
 vortex/handler/TupleDataObservableHandler.py
+vortex/handler/TupleDataObservableHandler_test.py
 vortex/handler/TupleDataObservableProxyHandler.py
 vortex/handler/TupleDataObservableTestHandler.py
 vortex/handler/TupleDataObserverClient.py