Create initial public access logic/datamanager CLI#607
Conversation
WalkthroughThis update introduces a new CLI tool for interacting with a secured financial data API, adds infrastructure code for deploying an ALB and authenticated API Gateway, and updates configuration files to support these features. New Pulumi functions and tasks are included for managing ingress, API access policies, and workspace dependencies. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant CLI
participant API Gateway
participant ALB
participant Datamanager Service
participant AWS IAM
User->>CLI: Run command (e.g., bars, health, fetch)
CLI->>AWS IAM: Sign request with credentials
CLI->>API Gateway: Send signed HTTP request
API Gateway->>ALB: Forward request (if authorized)
ALB->>Datamanager Service: Proxy request
Datamanager Service-->>ALB: Respond with data
ALB-->>API Gateway: Return response
API Gateway-->>CLI: Return API response
CLI-->>User: Display result or error
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (8)
🚧 Files skipped from review as they are similar to previous changes (8)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
Adds an initial public access workflow for the datamanager service via a new CLI and infrastructure updates for ALB, ingress, and API Gateway.
- Include a new
cliworkspace member and set up its dependencies and CLI commands. - Extend infrastructure dependencies and implement ALB controller, service ingress, API Gateway with IAM auth, and access policy.
- Wire up the Pulumi stack in
infrastructure/__main__.pyto provision the ingress and export outputs for the CLI, and add a MISE task for CLI authorization.
Reviewed Changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| pyproject.toml | Added "cli" to workspace members to include the new CLI project. |
| infrastructure/pyproject.toml | Added boto3, requests, and botocore dependencies for ingress and API Gateway logic. |
| infrastructure/ingress.py | New module implementing ALB controller role, service ingress, API Gateway, and IAM policy. |
| infrastructure/main.py | Registered ALB controller and datamanager ingress/API flows in the Pulumi main stack. |
| cli/pyproject.toml | Defined cli project metadata, pinned Python version, and declared its dependencies. |
| cli/datamanager.py | CLI implementation for health, equity-bars, metrics, and fetch endpoints with SigV4 signing. |
| .mise.toml | Added cli:datamanager:authorize task to attach the generated IAM policy to a user. |
Comments suppressed due to low confidence (1)
.mise.toml:112
- [nitpick] The task templating syntax for
--user-nameis overly verbose. Simplify to--user-name {{arg("user-name")}}and verify the$templating for Pulumi output matches MISE's expected syntax.
"""
Graphite Automations"Assign author to pull request" took an action on this PR • (07/14/25)1 assignee was added to this PR based on John Forstmeier's automation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
♻️ Duplicate comments (1)
cli/pyproject.toml (1)
1-10: Well-structured project configuration.The project setup is consistent with workspace conventions:
- Python version matches other projects (3.12.10)
- Dependencies align with infrastructure requirements
- Standard project metadata structure
Note: The dependency versions should be verified as mentioned in the infrastructure/pyproject.toml review to ensure they're current and secure.
🧹 Nitpick comments (4)
.mise.toml (1)
108-112: LGTM! Good adherence to coding guidelines.The task properly uses mise for CLI operations as specified in the coding guidelines. The command syntax appears correct for both the mise argument substitution and pulumi stack output reference.
Consider adding error handling to ensure the pulumi stack output exists before attempting to use it:
[tasks."cli:datamanager:authorize"] description = "Authorize the CLI with AWS credentials" run = """ +set -e +cd infrastructure aws iam attach-user-policy --user-name {{arg(user-name="user-name")}} --policy-arn $(pulumi stack output DATAMANAGER_API_ACCESS_POLICY_ARN) """cli/datamanager.py (2)
30-33: Remove redundant Content-Type assignment.The Content-Type header is already set to "application/json" on line 25, making the assignment on line 32 redundant.
if data: request_payload["data"] = json.dumps(data) - request_payload["headers"]["Content-Type"] = "application/json"
45-75: Consider adding retry logic for transient failures.The API interaction functions could benefit from retry logic to handle transient network failures or temporary API issues. Consider using a library like
tenacityorurllib3.util.retryfor robust retry handling.Would you like me to generate an implementation with retry logic for these API functions?
infrastructure/ingress.py (1)
202-211: Consider more specific route configuration.The current route uses
ANY /{proxy+}which forwards all methods and paths. Consider defining specific routes for better security and API documentation.For better API governance, consider creating specific routes:
# Define specific routes for each endpoint routes = [ ("GET /health", "AWS_IAM"), ("GET /metrics", "AWS_IAM"), ("GET /equity-bars", "AWS_IAM"), ("POST /equity-bars/fetch", "AWS_IAM"), ] for route_key, auth_type in routes: aws.apigatewayv2.Route( resource_name=f"pocketsizefund-{service_name}-route-{route_key.replace(' ', '-').replace('/', '-')}", api_id=api.id, route_key=route_key, target=integration.id.apply(lambda id: f"integrations/{id}"), authorization_type=auth_type, authorizer_id=authorizer.id, )
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (7)
.mise.toml(1 hunks)cli/datamanager.py(1 hunks)cli/pyproject.toml(1 hunks)infrastructure/__main__.py(3 hunks)infrastructure/ingress.py(1 hunks)infrastructure/pyproject.toml(1 hunks)pyproject.toml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
.mise.toml
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- CLAUDE.md
🧠 Learnings (1)
.mise.toml (1)
Learnt from: CR
PR: pocketsizefund/pocketsizefund#0
File: CLAUDE.md:0-0
Timestamp: 2025-07-13T00:52:51.429Z
Learning: Applies to .mise.toml : Always use mise tasks for running tests, linting, formatting. If there is not a command already present in .mise.toml, suggest creating one.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Run Python tests
🔇 Additional comments (4)
pyproject.toml (1)
14-14: Proper workspace integration.The addition of "cli" to workspace members correctly integrates the new CLI project into the workspace management system.
infrastructure/__main__.py (3)
4-4: Clean import organization.The imports are well-organized and only import the necessary functions for the new ingress functionality.
Also applies to: 12-18
53-59: Proper ALB controller setup.The ALB controller creation follows a logical sequence:
- Create the IAM role
- Deploy the controller with the role
The dependency chain is correctly established.
181-183: Well-structured Pulumi exports.The exports provide the necessary outputs for:
- ALB URL for direct access
- API Gateway URL for authenticated access
- Policy ARN for CLI authorization
This aligns well with the
.mise.tomltask that uses the policy ARN.
forstmeier
force-pushed
the
07-14-create_initial_public_access_logic_datamanager_cli
branch
from
59f308b to
6f2e5b5
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
cli/pyproject.toml (1)
4-4: Use a version range instead of exact Python version pinning.The exact Python version requirement (==3.12.10) is overly restrictive and can prevent users on minor updates from installing the project.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (8)
.mise.toml(1 hunks)application/datamanager/pyproject.toml(1 hunks)cli/datamanager.py(1 hunks)cli/pyproject.toml(1 hunks)infrastructure/__main__.py(3 hunks)infrastructure/ingress.py(1 hunks)infrastructure/pyproject.toml(1 hunks)pyproject.toml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- application/datamanager/pyproject.toml
🚧 Files skipped from review as they are similar to previous changes (5)
- pyproject.toml
- infrastructure/pyproject.toml
- .mise.toml
- cli/datamanager.py
- infrastructure/ingress.py
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Run Python tests
🔇 Additional comments (6)
cli/pyproject.toml (1)
5-10: Dependencies are well-chosen for CLI functionality.The selected dependencies align well with the CLI's purpose:
requestsfor HTTP API callslogurufor structured loggingboto3/botocorefor AWS service interactions and request signingThe minimum version constraints provide good compatibility while allowing updates.
infrastructure/__main__.py (5)
12-18: Import structure is well-organized.The new imports from the
ingressmodule are logically grouped and provide the necessary functions for ALB controller, API Gateway, and ingress management.
53-59: ALB controller setup follows proper dependency management.The ALB controller role creation and controller deployment are correctly structured with proper dependencies and resource references.
160-165: Service ingress configuration is properly implemented.The ingress creation correctly specifies dependencies on both the ALB controller and the datamanager service, ensuring proper deployment order.
176-179: IAM policy creation follows least-privilege principles.The API access policy creation is properly scoped to the specific API Gateway and service, which is good for security.
181-183: Pulumi exports provide necessary integration points.The exported values (ALB URL, API Gateway URL, and IAM policy ARN) are appropriate for CLI integration and the authorize command functionality mentioned in the PR objectives.
forstmeier
force-pushed
the
07-14-create_initial_public_access_logic_datamanager_cli
branch
from
6f2e5b5 to
ca5aa31
Compare
forstmeier
deleted the
07-14-create_initial_public_access_logic_datamanager_cli
branch
Overview
Changes
datamanagerCLI for example usageComments
Basically, the Mise command authorizes the local AWS user to make requests against the public endpoint. The CLI is more for example purposes but could be repurposed as a tool for
workflowsor something. This has not yet been tested fully.Summary by CodeRabbit
New Features
Chores