AWS powertools documentation change
Summary
Added new OpenAPI merge functionality with configure_openapi_merge, get_openapi_merge_json_schema, and get_openapi_merge_schema methods. Added decode_query_parameters parameter to ALBResolver. Added enable_validation parameter to route decorators and Route class. Updated resolve method signature to accept Mapping instead of dict. Various line number updates throughout the documentation.
Security assessment
The changes primarily add new features for OpenAPI schema merging and configuration options. The decode_query_parameters parameter for ALBResolver could have security implications if URL-decoding exposes previously encoded malicious input, but there's no evidence this addresses a specific security vulnerability. The changes are feature additions and documentation updates without explicit security context.
Diff
diff --git a/powertools/python/latest/api_doc/event_handler/api_gateway.md b/powertools/python/latest/api_doc/event_handler/api_gateway.md index dfc3658d6..6bc6c698e 100644 --- a//powertools/python/latest/api_doc/event_handler/api_gateway.md +++ b//powertools/python/latest/api_doc/event_handler/api_gateway.md @@ -107,0 +108 @@ Build recipes + * configure_openapi_merge @@ -109,0 +111,2 @@ Build recipes + * get_openapi_merge_json_schema + * get_openapi_merge_schema @@ -188,0 +192 @@ Table of contents + * configure_openapi_merge @@ -190,0 +195,2 @@ Table of contents + * get_openapi_merge_json_schema + * get_openapi_merge_schema @@ -243 +249 @@ CLASS | DESCRIPTION - ALBResolver(cors: CORSConfig | None = None, debug: bool | None = None, serializer: Callable[[dict], str] | None = None, strip_prefixes: list[str | Pattern] | None = None, enable_validation: bool = False, response_validation_error_http_code: HTTPStatus | int | None = None, json_body_deserializer: Callable[[str], dict] | None = None) + ALBResolver(cors: CORSConfig | None = None, debug: bool | None = None, serializer: Callable[[dict], str] | None = None, strip_prefixes: list[str | Pattern] | None = None, enable_validation: bool = False, response_validation_error_http_code: HTTPStatus | int | None = None, json_body_deserializer: Callable[[str], dict] | None = None, decode_query_parameters: bool = False) @@ -249,0 +256,10 @@ Amazon Application Load Balancer (ALB) resolver +PARAMETER | DESCRIPTION +---|--- +`cors` | Optionally configure and enabled CORS. Not each route will need to have to cors=True **TYPE:** `CORSConfig | None` **DEFAULT:** `None` +`debug` | Enables debug mode, by default False. Can be also be enabled by "POWERTOOLS_DEV" environment variable **TYPE:** `[bool](https://docs.python.org/3/library/functions.html#bool) | None` **DEFAULT:** `None` +`serializer` | function to serialize `obj` to a JSON formatted `str`, by default json.dumps **TYPE:** `[Callable](https://docs.python.org/3/library/collections.abc.html#collections.abc.Callable "collections.abc.Callable")[[[dict](https://docs.python.org/3/library/stdtypes.html#dict)], [str](https://docs.python.org/3/library/stdtypes.html#str)] | None` **DEFAULT:** `None` +`strip_prefixes` | optional list of prefixes to be removed from the request path before doing the routing. This is often used with api gateways with multiple custom mappings. Each prefix can be a static string or a compiled regex pattern **TYPE:** `[list](https://docs.python.org/3/library/stdtypes.html#list)[[str](https://docs.python.org/3/library/stdtypes.html#str) | [Pattern](https://docs.python.org/3/library/typing.html#typing.Pattern "typing.Pattern")] | None` **DEFAULT:** `None` +`enable_validation` | Enables validation of the request body against the route schema, by default False. **TYPE:** `[bool](https://docs.python.org/3/library/functions.html#bool)` **DEFAULT:** `False` +`response_validation_error_http_code` | Sets the returned status code if response is not validated. enable_validation must be True. **TYPE:** `[HTTPStatus](https://docs.python.org/3/library/http.html#http.HTTPStatus "http.HTTPStatus") | [int](https://docs.python.org/3/library/functions.html#int) | None` **DEFAULT:** `None` +`json_body_deserializer` | function to deserialize `str`, `bytes`, `bytearray` containing a JSON document to a Python `dict`, by default json.loads when integrating with EventSource data class **TYPE:** `[Callable](https://docs.python.org/3/library/collections.abc.html#collections.abc.Callable "collections.abc.Callable")[[[str](https://docs.python.org/3/library/stdtypes.html#str)], [dict](https://docs.python.org/3/library/stdtypes.html#dict)] | None` **DEFAULT:** `None` +`decode_query_parameters` | Enables URL-decoding of query parameters (both keys and values), by default False. **TYPE:** `[bool](https://docs.python.org/3/library/functions.html#bool)` **DEFAULT:** `False` @@ -253,21 +269,48 @@ Source code in `aws_lambda_powertools/event_handler/api_gateway.py` - 3146 - 3147 - 3148 - 3149 - 3150 - 3151 - 3152 - 3153 - 3154 - 3155 - 3156 - 3157 - 3158 - 3159 - 3160 - 3161 - 3162 - 3163 - 3164 - 3165 - 3166 + 3367 + 3368 + 3369 + 3370 + 3371 + 3372 + 3373 + 3374 + 3375 + 3376 + 3377 + 3378 + 3379 + 3380 + 3381 + 3382 + 3383 + 3384 + 3385 + 3386 + 3387 + 3388 + 3389 + 3390 + 3391 + 3392 + 3393 + 3394 + 3395 + 3396 + 3397 + 3398 + 3399 + 3400 + 3401 + 3402 + 3403 + 3404 + 3405 + 3406 + 3407 + 3408 + 3409 + 3410 + 3411 + 3412 + 3413 + 3414 @@ -286,0 +330 @@ Source code in `aws_lambda_powertools/event_handler/api_gateway.py` + decode_query_parameters: bool = False, @@ -288 +332,26 @@ Source code in `aws_lambda_powertools/event_handler/api_gateway.py` - """Amazon Application Load Balancer (ALB) resolver""" + """Amazon Application Load Balancer (ALB) resolver + + + Parameters + ---------- + cors: CORSConfig + Optionally configure and enabled CORS. Not each route will need to have to cors=True + debug: bool | None + Enables debug mode, by default False. Can be also be enabled by "POWERTOOLS_DEV" + environment variable + serializer: Callable, optional + function to serialize `obj` to a JSON formatted `str`, by default json.dumps + strip_prefixes: list[str | Pattern], optional + optional list of prefixes to be removed from the request path before doing the routing. + This is often used with api gateways with multiple custom mappings. + Each prefix can be a static string or a compiled regex pattern + enable_validation: bool | None + Enables validation of the request body against the route schema, by default False. + response_validation_error_http_code + Sets the returned status code if response is not validated. enable_validation must be True. + json_body_deserializer: Callable[[str], dict], optional + function to deserialize `str`, `bytes`, `bytearray` containing a JSON document to a Python `dict`, + by default json.loads when integrating with EventSource data class + decode_query_parameters: bool | None + Enables URL-decoding of query parameters (both keys and values), by default False. + """ @@ -298,0 +368 @@ Source code in `aws_lambda_powertools/event_handler/api_gateway.py` + self.decode_query_parameters = decode_query_parameters @@ -316,21 +386,21 @@ Source code in `aws_lambda_powertools/event_handler/api_gateway.py` - 3105 - 3106 - 3107 - 3108 - 3109 - 3110 - 3111 - 3112 - 3113 - 3114 - 3115 - 3116 - 3117 - 3118 - 3119 - 3120 - 3121 - 3122 - 3123 - 3124 - 3125 + 3326 + 3327 + 3328 + 3329 + 3330 + 3331 + 3332 + 3333 + 3334 + 3335 + 3336 + 3337 + 3338 + 3339 + 3340 + 3341 + 3342 + 3343 + 3344 + 3345 + 3346 @@ -379,21 +449,21 @@ Source code in `aws_lambda_powertools/event_handler/api_gateway.py` - 3017 - 3018 - 3019 - 3020 - 3021 - 3022 - 3023 - 3024 - 3025 - 3026 - 3027 - 3028 - 3029 - 3030 - 3031 - 3032 - 3033 - 3034 - 3035 - 3036 - 3037 + 3236 + 3237 + 3238 + 3239 + 3240