pgbus 0.9.9 → 0.9.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9848fb03a422ec1c28eda5f7c021ae41ecbdba5a9d4b8246635e14ea10d32213
-  data.tar.gz: 766159bb02748854335f90fac50b5fa4bbae82307bcbeacea366d3428a5b6c75
+  metadata.gz: 26160848a1d65cad46065b62fb4b5df79a18756514a39f86b5c074d1a1fc4dad
+  data.tar.gz: f3c1551c80e1a2fce0188a20e732e3a84c57628abf18a3239569863cde546f56
 SHA512:
-  metadata.gz: 6da2678bd4e68b0d18fd264af33f9bb463b1944b33db8ec4ecfc0dfdf20167275b7b8067fa9c5b082e3ff9294185c6ea8a9c71538c63704b03165e6d85690e07
-  data.tar.gz: c39c733fe2c91107adedd58d1ae27b94123681e87cb7ec3ab15d60338f7b99b49fe05152f07ece13ab1a94efca4a68bdfce8a234bdbffe87ebd51fc153185135
+  metadata.gz: 856d96cd1085bbc88c96ad6528417fdea7227918c883af4395c1bbf9b8610bb786326bff3793fbb29f0fea8615d16a5661b782dd38e9a02bdf55748c03074e0a
+  data.tar.gz: c7b2061b500ad2d5e7e5bba04e9de24ec397006112e0102d9778f2d9114d9802d1467ad285d211183965b8f1cfb551271a265b8402b577a313f19a5410e35db0

data/CHANGELOG.md

@@ -14,6 +14,9 @@
 
 ### Fixed
 
+- **Durable stream `q_` queues no longer leak — the orphan sweep is now age-based, as its `streams_orphan_threshold` config always implied.** A durable stream's live `pgmq.q_<name>` table is never drained by normal delivery: the streamer peeks (`read_after` UNIONs `q_`+`a_` without claiming rows), so `queue_length` stays `> 0` for any durable stream ever broadcast to, and retention only prunes `a_` (which stays empty for streams). The orphan sweep dropped only *empty* queues, so it never collected a durable stream — a permanent leak of the queue table, archive table, indexes, and a `pgmq.meta` row, at worst one leaked queue *per request* for per-render/one-shot durable keys. `streams_orphan_threshold` (default 24h) was named and defaulted as an age but wired only as an on/off gate. `sweep_orphan_streams` now reads each queue's `pgmq.meta.created_at` (no schema change) and drops when the queue is empty **or** has aged past the threshold. Idempotent re-creation (`ensure_stream_queue`) plus the existing missing-queue tolerance in `read_after` keep it safe; a genuinely long-lived stream only loses replay history past the threshold, well clear of normal reconnect windows. A `nil` `created_at` is treated as young (never dropped on age). Refs #306.
+- **`Pgbus::MCP.rack_app` now returns a clean 401 on auth failure instead of a 500.** The `RackApp` auth gate returned a *frozen* `UNAUTHORIZED` response triple; once mounted in Rails, response-mutating middleware downstream (`Rack::TempfileReaper` assigns `response[2]`, `Rack::ETag` adds a header) raised `FrozenError`, so every request with a missing/mismatched `PGBUS_MCP_TOKEN` surfaced as an opaque 500 in the host app's error tracker rather than the intended 401. The gate now builds a fresh, mutable array and headers hash per call (only the JSON body string stays memoized+frozen). A request-level spec drives the app through the real `TempfileReaper`/`ETag` stack to guard against regression. Refs #304.
+
 ### Security
 
 ## [0.9.8.1] - 2026-07-04

data/lib/pgbus/mcp/rack_app.rb

@@ -22,11 +22,12 @@ module Pgbus
     # / behind your VPN, never internet-exposed.
     class RackApp
       BEARER_PREFIX = "Bearer "
-      UNAUTHORIZED = [
-        401,
-        { "Content-Type" => "application/json", "WWW-Authenticate" => "Bearer" },
-        [{ jsonrpc: "2.0", id: nil, error: { code: -32_001, message: "Unauthorized" } }.to_json]
-      ].freeze
+      # Only the JSON body string is frozen and reused. The outer response triple
+      # and its headers hash MUST be built fresh per call (#unauthorized) so
+      # downstream Rack middleware can mutate them — Rack::TempfileReaper assigns
+      # response[2] and Rack::ETag adds headers. Returning a frozen array/hash
+      # raised FrozenError → 500 instead of 401 (issue #304).
+      UNAUTHORIZED_BODY = { jsonrpc: "2.0", id: nil, error: { code: -32_001, message: "Unauthorized" } }.to_json.freeze
 
       # @param data_source [Pgbus::Web::DataSource] read layer the tools query.
       #   Built once and shared: DataSource acquires Pgbus::BusRecord.connection
@@ -55,13 +56,24 @@ module Pgbus
       # the gem's transport has no auth of its own.
       def call(env)
         request = Rack::Request.new(env)
-        return UNAUTHORIZED unless authorized?(request)
+        return unauthorized unless authorized?(request)
 
         @transport.handle_request(request)
       end
 
       private
 
+      # A fresh, mutable 401 response triple each call. See UNAUTHORIZED_BODY.
+      # Header keys are lowercase per the Rack 3 SPEC (matches stream_app.rb and
+      # prometheus_exporter.rb); Rack::Headers looks them up case-insensitively.
+      def unauthorized
+        [
+          401,
+          { "content-type" => "application/json", "www-authenticate" => "Bearer" },
+          [UNAUTHORIZED_BODY]
+        ]
+      end
+
       # An explicit auth callable wins; otherwise fall back to the bearer token;
       # otherwise (neither configured) allow — the constructor already warned.
       def authorized?(request)

data/lib/pgbus/process/dispatcher.rb

@@ -539,17 +539,29 @@ module Pgbus
           break if interrupted?("Orphan stream sweep", index, queue_names.size)
           next unless full_name.start_with?("#{prefix}_")
 
+          safe_name = QueueNameValidator.sanitize!(full_name)
           row = conn.select_one(<<~SQL, "Pgbus Orphan Check")
-            SELECT count(*) AS queue_length
-            FROM pgmq.q_#{QueueNameValidator.sanitize!(full_name)}
+            SELECT
+              (SELECT count(*) FROM pgmq.q_#{safe_name}) AS queue_length,
+              (SELECT EXTRACT(epoch FROM (NOW() - created_at))::int
+                 FROM pgmq.meta WHERE queue_name = '#{safe_name}') AS age_sec
           SQL
 
           next unless row
-          next if row["queue_length"].to_i.positive?
+
+          empty = !row["queue_length"].to_i.positive?
+          # Durable stream q_ tables are never drained by delivery (non-consuming
+          # peek), so a non-empty queue that has aged past the threshold is a
+          # leak, not a live stream — drop it. A nil age_sec (unknown created_at)
+          # is treated as young, never as infinitely old.
+          age_sec = row["age_sec"]
+          stale = !age_sec.nil? && age_sec.to_i >= threshold.to_i
+          next unless empty || stale
 
           Pgbus.client.drop_queue(full_name, prefixed: false)
           dropped += 1
-          Pgbus.logger.info { "[Pgbus] Dropped orphan stream queue: #{full_name}" }
+          reason = empty ? "empty" : "aged past #{threshold.to_i}s threshold"
+          Pgbus.logger.info { "[Pgbus] Dropped orphan stream queue (#{reason}): #{full_name}" }
           outcome.record_success
         rescue StandardError => e
           Pgbus.logger.warn { "[Pgbus] Orphan stream sweep failed for #{full_name}: #{e.message}" }

data/lib/pgbus/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pgbus
-  VERSION = "0.9.9"
+  VERSION = "0.9.10"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pgbus
 version: !ruby/object:Gem::Version
-  version: 0.9.9
+  version: 0.9.10
 platform: ruby
 authors:
 - Mikael Henriksson