fix(idempotency): is_missing_idempotency_key iterates dict keys instead of values (#8391)

* fix(idempotency): is_missing_idempotency_key iterates dict keys instead of values

is_missing_idempotency_key iterated `data` directly for dict input, which
walks its keys, not its values. For a dict whose values are all None but
whose keys are ordinary non-None strings -- exactly what a JMESPath
multi-select expression like '{user: headers.user_id, order: body.order_id}'
produces when the referenced event fields are absent -- this returns False
("not missing") when it should return True.

With raise_on_no_idempotency_key=True, the safety check that's supposed to
raise IdempotencyKeyError in this situation silently doesn't fire. With the
default False, no warning is emitted and the persistence layer hashes the
all-None dict into a real idempotency key, so unrelated invocations that
both fail to populate those fields collapse onto the same idempotency key
and get incorrectly deduplicated against each other.

The existing test only covered a dict of {None: None} (None as the key),
which happens to still pass under the old key-iterating behavior and so
never caught this. Iterate data.values() for dict input instead, and add
a test covering the realistic non-None-keys/all-None-values case.

* test(idempotency): cover missing dictionary keys

---------

Co-authored-by: Leandro <lcdama@amazon.pt>

Author: Adityaj0

aws_lambda_powertools/utilities/idempotency/persistence/base.py

@@ -131,7 +131,10 @@ def _get_hashed_idempotency_key(self, data: dict[str, Any]) -> str | None:
 
     @staticmethod
     def is_missing_idempotency_key(data) -> bool:
-        if isinstance(data, (tuple, list, dict)):
+        if isinstance(data, dict):
+            # JMESPath multi-select dicts retain their keys when all selected values are missing.
+            return all(x is None for x in data.values())
+        elif isinstance(data, (tuple, list)):
             return all(x is None for x in data)
         elif isinstance(data, (int, float, bool)):
             return False

tests/functional/idempotency/_boto3/test_idempotency.py

@@ -1046,6 +1046,10 @@ def test_is_missing_idempotency_key():
     assert BasePersistenceLayer.is_missing_idempotency_key((None, None))
     # GIVEN a dict of Nones THEN is_missing_idempotency_key is True
     assert BasePersistenceLayer.is_missing_idempotency_key({None: None})
+    # GIVEN a dict with all-None values THEN is_missing_idempotency_key is True
+    assert BasePersistenceLayer.is_missing_idempotency_key({"user": None, "order": None})
+    # GIVEN a dict with a non-None value THEN is_missing_idempotency_key is False
+    assert BasePersistenceLayer.is_missing_idempotency_key({"user": "abc"}) is False
 
     # GIVEN True THEN is_missing_idempotency_key is False
     assert BasePersistenceLayer.is_missing_idempotency_key(True) is False
@@ -1114,6 +1118,19 @@ def test_raise_on_no_idempotency_key(
     assert "No data found to create a hashed idempotency_key" in str(excinfo.value)
 
 
+def test_raise_on_no_idempotency_key_for_dict_jmespath(persistence_store: DynamoDBPersistenceLayer):
+    # GIVEN a dict multi-select expression whose values are missing
+    idempotency_config = IdempotencyConfig(
+        event_key_jmespath="{user: headers.user_id, order: body.order_id}",
+        raise_on_no_idempotency_key=True,
+    )
+    persistence_store.configure(idempotency_config)
+
+    # WHEN extracting the idempotency key THEN raise IdempotencyKeyError
+    with pytest.raises(IdempotencyKeyError, match="No data found to create a hashed idempotency_key"):
+        persistence_store._get_hashed_idempotency_key({"headers": {}, "body": {}})
+
+
 @pytest.mark.parametrize(
     "idempotency_config",
     [