pg_rls 1.0.2 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db02967ab12e8433f7e39680cfd25887676d84e6a3ce8cc00f53d3d46cba5720
-  data.tar.gz: 03d1f834b316efeaf14abf0ad071e9e750c9fd00d92ca7d7d789b456161763c3
+  metadata.gz: a75a646d5cd7efb87d4a4343d3577a307b2a4c8750a9a536d448205f3e4c59b8
+  data.tar.gz: 0b5f950a922336c4b8e343a21611dc1f299c934da8829a0b0d9f37862f04ef3e
 SHA512:
-  metadata.gz: 8a28cda116e949a2be70858c9f0902e280251fed6ae3677dfd6e6e0028771ccc4958eabb0f0594980850010ea04843ad4ea617052f5638750eee7c879b26a18d
-  data.tar.gz: fbd8bb581698f2936630053c1090f041922cc7e4ad9dbb3dc52058dd60daad51ab94895d123379e49dbcb5fd3ba7430b497d653d537cc744624910d805d49549
+  metadata.gz: 9697b3afdb0b1489fbcf349c44c751f5fc8c495a8a3e10f59c91f2d23be4cc7576f44960c21964817c3d1dea7dbef88954907fdb0fb3641c1ada2eb3f723742b
+  data.tar.gz: e8894ef39e132e970d7527ed01057e737900be8f44014331442eb2e4397aa6b805f563ff89c38c575b355a480258305c0a446fd890d707b34735f6dee9068579

data/CHANGELOG.md

@@ -1,6 +1,25 @@
 
 # [Released]
 
+## [1.0.3] - 2026-10-03
+
+### Fixes
+
+- **A connection handed between threads could keep another tenant.** `Tenant#set_rls` skipped the `SET` when the
+  thread had set that connection before, going by a per-thread record of the connections it had set. If a connection
+  changed threads while that record still listed it — released mid-request, or used across threads, as in system
+  tests where the test thread and the server's threads share a pool — the first thread got it back already switched
+  by another one and ran as that tenant. Apps that hold the connection for the whole request (pg_rls's own
+  `PgRls::Record.connection` calls lease it) were not exposed. The tenant is now recorded on the connection itself
+  (`rls_tenant_id`), so the `SET` is skipped only when the connection is already on that tenant: no more statements
+  than before, and none skipped that were needed.
+- A reconnect or a reset (`DISCARD ALL`) drops the session's tenant; the connection now knows it and sets it again.
+- `Tenant.reset_rls_used_connections` takes the tenant off the connection it is given, whichever thread set it.
+
+### Removed
+
+- `Tenant.rls_connection_object_cache_by_thread` and its writer, the per-thread record the fix replaces.
+
 ## [1.0.1] - 2024-10-10
 
 ### Major Changes

data/app/models/pg_rls/tenant/securable.rb

@@ -15,28 +15,23 @@ module PgRls
       end
 
       class_methods do
+        # Takes the tenant off a connection, when it has one (PgRls::ActiveRecord::ConnectionAdapters::RlsTenant).
         def reset_rls_used_connections(connection = PgRls::Record.connection)
-          return connection if rls_connection_object_cache_by_thread.nil?
+          return connection if connection.rls_tenant_id.nil?
 
           connection.exec_query("SET rls.tenant_id TO DEFAULT")
-          self.rls_connection_object_cache_by_thread = nil
+          connection.rls_tenant_id = nil
           connection
         end
-
-        def rls_connection_object_cache_by_thread=(value)
-          ::ActiveSupport::IsolatedExecutionState[:active_record_rls_used_connections] = value
-        end
-
-        def rls_connection_object_cache_by_thread
-          ::ActiveSupport::IsolatedExecutionState[:active_record_rls_used_connections]
-        end
       end
 
+      # Sets the connection's session to this tenant, unless it already is: what decides is the tenant the
+      # connection itself is on, never which thread set it last.
       def set_rls(connection = PgRls::Record.connection)
-        self.class.reset_rls_used_connections(connection) if new_tenant?
-        return self if reused_connection?(connection)
+        return self if connection.rls_tenant_id == tenant_id
 
         connection.exec_query("SET rls.tenant_id = '#{tenant_id}'")
+        connection.rls_tenant_id = tenant_id
 
         self
       end
@@ -44,24 +39,6 @@ module PgRls
       def readonly?
         true
       end
-
-      private
-
-      def new_tenant?
-        !rls_used_connections.add?(tenant_id).nil?
-      end
-
-      def reused_connection?(conn)
-        rls_used_connections.add?(conn.object_id).nil?
-      end
-
-      def rls_used_connections
-        if self.class.rls_connection_object_cache_by_thread.nil?
-          self.class.rls_connection_object_cache_by_thread = Set.new([tenant_id])
-        end
-
-        self.class.rls_connection_object_cache_by_thread
-      end
     end
   end
 end

data/lib/pg_rls/active_record/connection_adapters/rls_tenant.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module PgRls
+  module ActiveRecord
+    module ConnectionAdapters
+      # Which tenant a connection's session is set to.
+      #
+      # It belongs to the connection rather than to the thread that set it: a pooled connection moves between
+      # threads, and a thread going by its own record of what it once set would skip a connection another thread
+      # has since switched to another tenant — and run as that tenant.
+      module RlsTenant
+        attr_accessor :rls_tenant_id
+
+        private
+
+        # A new session has no tenant, whatever the connection's last one had: this runs on every connect,
+        # reconnect and reset (DISCARD ALL).
+        def configure_connection
+          super
+          self.rls_tenant_id = nil
+        end
+      end
+    end
+  end
+end
+
+ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.prepend(PgRls::ActiveRecord::ConnectionAdapters::RlsTenant)

data/lib/pg_rls/active_record/connection_adapters.rb

@@ -2,6 +2,7 @@
 
 require_relative "connection_adapters/postgre_sql"
 require_relative "connection_adapters/connection_pool"
+require_relative "connection_adapters/rls_tenant"
 
 module PgRls
   module ActiveRecord

data/lib/pg_rls/version.rb

@@ -2,6 +2,6 @@
 
 # :nocov:
 module PgRls
-  VERSION = "1.0.2"
+  VERSION = "1.0.3"
 end
 # :nocov:

data/sig/pg_rls/active_record/connection_adapters.rbs

@@ -3,6 +3,12 @@
 module PgRls
   module ActiveRecord
     module ConnectionAdapters
+      module RlsTenant
+        attr_accessor rls_tenant_id: String?
+
+        private def configure_connection: () -> void
+      end
+
       module ConnectionPool
         attr_reader checkout_timeout: untyped
 
@@ -23,15 +29,6 @@ module PgRls
 
     def set_rls: (ActiveRecord::ConnectionAdapters::PostgreSQLAdapter conn) -> Tenant
 
-    def new_tenant?: () -> bool
-
-    def reused_connection?: (ActiveRecord::ConnectionAdapters::PostgreSQLAdapter conn) -> bool
-
-    def rls_connection_object_cache_by_thread=: (untyped value) -> untyped
-
-    def rls_connection_object_cache_by_thread: () -> untyped
-
-    def rls_used_connections: () -> untyped
   end
 
   module Current

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pg_rls
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors:
 - Daniel Laloush
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-10-12 00:00:00.000000000 Z
+date: 2026-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -138,6 +138,7 @@ files:
 - lib/pg_rls/active_record/connection_adapters/postgre_sql/schema_dumper.rb
 - lib/pg_rls/active_record/connection_adapters/postgre_sql/schema_statements.rb
 - lib/pg_rls/active_record/connection_adapters/postgre_sql/sql_helper_method.rb
+- lib/pg_rls/active_record/connection_adapters/rls_tenant.rb
 - lib/pg_rls/active_record/database_shards.rb
 - lib/pg_rls/active_record/migration.rb
 - lib/pg_rls/active_record/migration/command_recorder.rb