pg_rls 1.0.2 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db02967ab12e8433f7e39680cfd25887676d84e6a3ce8cc00f53d3d46cba5720
-  data.tar.gz: 03d1f834b316efeaf14abf0ad071e9e750c9fd00d92ca7d7d789b456161763c3
+  metadata.gz: 8a6d6413f258e20cc03352e1327614f91bb5bcba00ce958a9a9082115e803d18
+  data.tar.gz: a89ecb17edd4fda275f660560fa33f3c15de9b7cb96e0ffdd9cb226a952d7ce4
 SHA512:
-  metadata.gz: 8a28cda116e949a2be70858c9f0902e280251fed6ae3677dfd6e6e0028771ccc4958eabb0f0594980850010ea04843ad4ea617052f5638750eee7c879b26a18d
-  data.tar.gz: fbd8bb581698f2936630053c1090f041922cc7e4ad9dbb3dc52058dd60daad51ab94895d123379e49dbcb5fd3ba7430b497d653d537cc744624910d805d49549
+  metadata.gz: 9c749cc2d7a7f88f5ae996d8b24b30589f3329cd156cd7900600a5be0ae45766408e5d870eb042819a5a4548b02ac4f865685b6829ea9d77792fd56a4944d02f
+  data.tar.gz: 4a9fd2b0b6c4dee5a458d6871bb6c51f27ff6a88fefa22ef1aba94504a3c44d3020728a75ff9b59488a42dd36e1ac95e23dfe14d7c4e61771f5e5fe40402c7e9

data/CHANGELOG.md

@@ -1,6 +1,50 @@
 
 # [Released]
 
+## [1.0.4] - 2026-10-06
+
+### Fixes
+
+- **A rolled-back transaction could leave a connection on another tenant than pg_rls recorded.** Postgres undoes a
+  `SET` made inside a transaction or a savepoint that rolls back, but `rls_tenant_id` kept the tenant set inside it.
+  The next switch to that tenant skipped its `SET` and ran on whatever tenant the session had before the
+  transaction, and a reset after it was skipped as if the connection had none. Only a tenant switched without being
+  restored inside a transaction that then rolls back is affected (`run_within` restores its own before the
+  rollback); a transactional test switching the tenant is exactly that, and a concurrency test then read nothing.
+  After anything that rolls back — `ROLLBACK`, `ROLLBACK TO SAVEPOINT`, `ROLLBACK AND CHAIN` (Rails restarting a
+  transaction that had not written), and a `COMMIT` of a transaction that had already failed, which Postgres turns
+  into a rollback — the connection's tenant is now unknown (`RlsTenant::UNKNOWN`): the next switch sets it, and a
+  reset resets it. The cost is one `SET` after a rollback; whether a transaction had failed is asked of the client
+  library, with no round trip. The rollback cases and the CI matrix below come from #42 (@david-pulgarin-skydropx).
+- **Parallel tests on Rails 8.1.** `PgRls::ActiveRecord::TestDatabases` named every worker's RLS databases after it,
+  but Rails 8.1 names hidden configurations itself, so they were named twice (`test_db_1-1`) and no worker came up.
+  It now names only the ones Rails left alone, on every version.
+
+### Compatibility
+
+- The suite runs in CI on Rails 7.2, 8.0 and 8.1 — every version the gemspec allows — with parallel workers
+  (`gemfiles/`, not packaged). On Rails 8.1 the suite's coverage report is written again: the workers' teardown
+  had stopped SimpleCov in the main process too.
+
+## [1.0.3] - 2026-10-03
+
+### Fixes
+
+- **A connection handed between threads could keep another tenant.** `Tenant#set_rls` skipped the `SET` when the
+  thread had set that connection before, going by a per-thread record of the connections it had set. If a connection
+  changed threads while that record still listed it — released mid-request, or used across threads, as in system
+  tests where the test thread and the server's threads share a pool — the first thread got it back already switched
+  by another one and ran as that tenant. Apps that hold the connection for the whole request (pg_rls's own
+  `PgRls::Record.connection` calls lease it) were not exposed. The tenant is now recorded on the connection itself
+  (`rls_tenant_id`), so the `SET` is skipped only when the connection is already on that tenant: no more statements
+  than before, and none skipped that were needed.
+- A reconnect or a reset (`DISCARD ALL`) drops the session's tenant; the connection now knows it and sets it again.
+- `Tenant.reset_rls_used_connections` takes the tenant off the connection it is given, whichever thread set it.
+
+### Removed
+
+- `Tenant.rls_connection_object_cache_by_thread` and its writer, the per-thread record the fix replaces.
+
 ## [1.0.1] - 2024-10-10
 
 ### Major Changes

data/app/models/pg_rls/tenant/securable.rb

@@ -15,28 +15,23 @@ module PgRls
       end
 
       class_methods do
+        # Takes the tenant off a connection, when it has one (PgRls::ActiveRecord::ConnectionAdapters::RlsTenant).
         def reset_rls_used_connections(connection = PgRls::Record.connection)
-          return connection if rls_connection_object_cache_by_thread.nil?
+          return connection if connection.rls_tenant_id.nil?
 
           connection.exec_query("SET rls.tenant_id TO DEFAULT")
-          self.rls_connection_object_cache_by_thread = nil
+          connection.rls_tenant_id = nil
           connection
         end
-
-        def rls_connection_object_cache_by_thread=(value)
-          ::ActiveSupport::IsolatedExecutionState[:active_record_rls_used_connections] = value
-        end
-
-        def rls_connection_object_cache_by_thread
-          ::ActiveSupport::IsolatedExecutionState[:active_record_rls_used_connections]
-        end
       end
 
+      # Sets the connection's session to this tenant, unless it already is: what decides is the tenant the
+      # connection itself is on, never which thread set it last.
       def set_rls(connection = PgRls::Record.connection)
-        self.class.reset_rls_used_connections(connection) if new_tenant?
-        return self if reused_connection?(connection)
+        return self if connection.rls_tenant_id == tenant_id
 
         connection.exec_query("SET rls.tenant_id = '#{tenant_id}'")
+        connection.rls_tenant_id = tenant_id
 
         self
       end
@@ -44,24 +39,6 @@ module PgRls
       def readonly?
         true
       end
-
-      private
-
-      def new_tenant?
-        !rls_used_connections.add?(tenant_id).nil?
-      end
-
-      def reused_connection?(conn)
-        rls_used_connections.add?(conn.object_id).nil?
-      end
-
-      def rls_used_connections
-        if self.class.rls_connection_object_cache_by_thread.nil?
-          self.class.rls_connection_object_cache_by_thread = Set.new([tenant_id])
-        end
-
-        self.class.rls_connection_object_cache_by_thread
-      end
     end
   end
 end

data/lib/pg_rls/active_record/connection_adapters/rls_tenant.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module PgRls
+  module ActiveRecord
+    module ConnectionAdapters
+      # Which tenant a connection's session is set to.
+      #
+      # It belongs to the connection rather than to the thread that set it: a pooled connection moves between
+      # threads, and a thread going by its own record of what it once set would skip a connection another thread
+      # has since switched to another tenant — and run as that tenant.
+      module RlsTenant
+        # What the connection's tenant is after a rollback: nobody knows. Postgres undoes a SET made inside a
+        # transaction or savepoint that rolls back, so the session is back on whatever tenant it had before —
+        # which may be another tenant than the one recorded here. It equals no tenant, so the next switch sets
+        # the session again, and it is not nil, so a reset resets it.
+        UNKNOWN = Object.new.freeze
+
+        attr_accessor :rls_tenant_id
+
+        # A COMMIT rolls back instead when the transaction has already failed; whether it has is the client library's
+        # answer, with no round trip. (A COMMIT that fails is rolled back by Rails, which the hook below hears.)
+        def commit_db_transaction
+          rolls_back = aborted_transaction?
+          super
+        ensure
+          self.rls_tenant_id = UNKNOWN if rolls_back
+        end
+
+        private
+
+        # A new session has no tenant, whatever the connection's last one had: this runs on every connect,
+        # reconnect and reset (DISCARD ALL).
+        def configure_connection
+          super
+          self.rls_tenant_id = nil
+        end
+
+        def exec_rollback_db_transaction
+          super
+        ensure
+          self.rls_tenant_id = UNKNOWN
+        end
+
+        # ROLLBACK AND CHAIN: a nested transaction rolled back in one that had not written yet.
+        def exec_restart_db_transaction
+          super
+        ensure
+          self.rls_tenant_id = UNKNOWN
+        end
+
+        def exec_rollback_to_savepoint(name = nil)
+          super
+        ensure
+          self.rls_tenant_id = UNKNOWN
+        end
+
+        # A connection the client library cannot ask is left to the COMMIT, which raises the real error.
+        def aborted_transaction?
+          @raw_connection&.transaction_status == ::PG::PQTRANS_INERROR
+        rescue ::PG::Error
+          false
+        end
+      end
+    end
+  end
+end
+
+ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.prepend(PgRls::ActiveRecord::ConnectionAdapters::RlsTenant)

data/lib/pg_rls/active_record/connection_adapters.rb

@@ -2,6 +2,7 @@
 
 require_relative "connection_adapters/postgre_sql"
 require_relative "connection_adapters/connection_pool"
+require_relative "connection_adapters/rls_tenant"
 
 module PgRls
   module ActiveRecord

data/lib/pg_rls/active_record/test_databases.rb

@@ -3,13 +3,19 @@
 module PgRls
   module ActiveRecord
     module TestDatabases # :nodoc:
+      # Each parallel worker gets databases of its own. Rails names them, but before 8.1 only the configurations it
+      # does not hide, and pg_rls's are hidden: those are named here — and only those Rails left alone, because from
+      # 8.1 on it names hidden ones too (`<database>_<i>`), and naming them again pointed every worker at a database
+      # that does not exist.
       def create_and_load_schema(i, env_name:)
-        super
+        configs = PgRls::Record.configurations.configs_for(env_name: env_name, include_hidden: true)
+                                              .reject { |db_config| db_config.name == "primary" }
+        named = configs.to_h { |db_config| [db_config, db_config.database] }
 
-        PgRls::Record.configurations.configs_for(env_name: env_name, include_hidden: true).each do |db_config|
-          next if db_config.name == "primary"
+        super
 
-          db_config._database = "#{db_config.database}-#{i}"
+        configs.each do |db_config|
+          db_config._database = "#{db_config.database}-#{i}" if db_config.database == named[db_config]
         end
       end
     end

data/lib/pg_rls/version.rb

@@ -2,6 +2,6 @@
 
 # :nocov:
 module PgRls
-  VERSION = "1.0.2"
+  VERSION = "1.0.4"
 end
 # :nocov:

data/sig/pg_rls/active_record/connection_adapters.rbs

@@ -3,6 +3,24 @@
 module PgRls
   module ActiveRecord
     module ConnectionAdapters
+      module RlsTenant
+        UNKNOWN: Object
+
+        attr_accessor rls_tenant_id: String | Object | nil
+
+        private def configure_connection: () -> void
+
+        def commit_db_transaction: () -> void
+
+        private def exec_rollback_db_transaction: () -> void
+
+        private def exec_restart_db_transaction: () -> void
+
+        private def exec_rollback_to_savepoint: (?String? name) -> void
+
+        private def aborted_transaction?: () -> bool
+      end
+
       module ConnectionPool
         attr_reader checkout_timeout: untyped
 
@@ -23,15 +41,6 @@ module PgRls
 
     def set_rls: (ActiveRecord::ConnectionAdapters::PostgreSQLAdapter conn) -> Tenant
 
-    def new_tenant?: () -> bool
-
-    def reused_connection?: (ActiveRecord::ConnectionAdapters::PostgreSQLAdapter conn) -> bool
-
-    def rls_connection_object_cache_by_thread=: (untyped value) -> untyped
-
-    def rls_connection_object_cache_by_thread: () -> untyped
-
-    def rls_used_connections: () -> untyped
   end
 
   module Current

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pg_rls
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.4
 platform: ruby
 authors:
 - Daniel Laloush
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-10-12 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -138,6 +138,7 @@ files:
 - lib/pg_rls/active_record/connection_adapters/postgre_sql/schema_dumper.rb
 - lib/pg_rls/active_record/connection_adapters/postgre_sql/schema_statements.rb
 - lib/pg_rls/active_record/connection_adapters/postgre_sql/sql_helper_method.rb
+- lib/pg_rls/active_record/connection_adapters/rls_tenant.rb
 - lib/pg_rls/active_record/database_shards.rb
 - lib/pg_rls/active_record/migration.rb
 - lib/pg_rls/active_record/migration/command_recorder.rb