GeneralManager 0.90.0__tar.gz → 0.91.1__tar.gz

{generalmanager-0.90.0/src/GeneralManager.egg-info → generalmanager-0.91.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.90.0
+Version: 0.91.1
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.90.0 → generalmanager-0.91.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "GeneralManager"
-version = "0.90.0"
+version = "0.91.1"
 description = "Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching."
 readme = "README.md"
 authors = [{ name = "Tim Kleindick", email = "tkleindick@yahoo.de" }]

{generalmanager-0.90.0 → generalmanager-0.91.1/src/GeneralManager.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.90.0
+Version: 0.91.1
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.90.0 → generalmanager-0.91.1}/src/GeneralManager.egg-info/SOURCES.txt

@@ -53,6 +53,7 @@ src/general_manager/api/graphql_view.py
 src/general_manager/api/graphql_warmup.py
 src/general_manager/api/graphql_warmup_registry.py
 src/general_manager/api/graphql_warmup_tasks.py
+src/general_manager/api/graphql_work_limits.py
 src/general_manager/api/mutation.py
 src/general_manager/api/mutation_controls.py
 src/general_manager/api/notification_batching.py

{generalmanager-0.90.0 → generalmanager-0.91.1}/src/general_manager/api/graphql_query_permissions.py

@@ -9,6 +9,7 @@ from typing import TYPE_CHECKING
 
 from graphql import GraphQLError
 
+from general_manager.api.graphql_work_limits import get_graphql_work_limit
 from general_manager.bucket.base_bucket import Bucket
 from general_manager.bucket.request_bucket import RequestBucket
 from general_manager.manager.general_manager import GeneralManager
@@ -47,7 +48,7 @@ CUSTOM_PROJECTION_ERROR = (
 )
 
 # Bound field/path decisions; bucket materialization and row checks precede this.
-MAX_QUERY_PERMISSION_CANDIDATES = 1000
+MAX_QUERY_PERMISSION_CANDIDATES: int | None = None
 _LOOKUPS = {
     "exact",
     "iexact",
@@ -79,11 +80,16 @@ class QueryFieldAuthorizationBudget:
     """Share only accounting across authorization calls in one operation."""
 
     decisions: int = 0
+    limit: int | None = field(
+        default_factory=lambda: get_graphql_work_limit(
+            "GRAPHQL_QUERY_PERMISSION_LIMIT", MAX_QUERY_PERMISSION_CANDIDATES
+        )
+    )
 
     def charge(self) -> None:
         """Reject work exceeding the operation's field/path decision limit."""
         self.decisions += 1
-        if self.decisions > MAX_QUERY_PERMISSION_CANDIDATES:
+        if self.limit is not None and self.decisions > self.limit:
             raise GraphQLError(_LIMIT_ERROR)
 
 
@@ -655,3 +661,136 @@ def authorize_query_fields(
                 check(candidate, normalized_parts)
     if isinstance(candidates, RequestBucket) and not candidates.response_is_complete:
         raise GraphQLError(INCOMPLETE_ERROR)
+
+
+def _prepare_pushdown_structure(
+    manager: type[GeneralManager],
+) -> _NativeQueryStructure | None:
+    """Attest native construction before statically interpreting field policies."""
+    from general_manager.utils.executable_contract import executable_matches
+
+    if type(manager) is not GeneralManagerMeta:
+        return None
+    from general_manager.manager.general_manager import (
+        _QUERY_PUSHDOWN_MANAGER_METHODS,
+        _COMMON_MANAGER_IDENTIFICATION,
+    )
+    from general_manager.interface.orm_interface import (
+        _QUERY_PUSHDOWN_INTERFACE_METHODS,
+    )
+
+    if not _unchanged_metadata_methods(manager, _QUERY_PUSHDOWN_MANAGER_METHODS):
+        return None
+    identification, signature = _COMMON_MANAGER_IDENTIFICATION
+    if getattr_static(
+        manager, "identification"
+    ) is not identification or not executable_matches(identification.fget, signature):
+        return None
+    interface = getattr_static(manager, "Interface", None)
+    if not _unchanged_metadata_methods(interface, _QUERY_PUSHDOWN_INTERFACE_METHODS):
+        return None
+    for owner in (manager, interface):
+        if any(
+            getattr_static(owner, name, None) is not getattr_static(object, name)
+            for name in ("__new__", "__getattribute__", "__setattr__")
+        ):
+            return None
+    structure = _prepare_native_query_structure(manager)
+    if structure is None:
+        return None
+    return structure
+
+
+def can_filter_before_query_authorization(
+    candidates: Bucket[GeneralManager],
+    paths: Iterable[str],
+    info: ResolveInfo | None = None,
+) -> bool:
+    """Prove predicates harmless once, before narrowing a native row domain.
+
+    Permission declarations remain stable during a query. Every relation hop
+    must be readable, and each traversed target must have an unconditional row
+    read plan for this actor; otherwise membership could reveal hidden targets.
+    Unknown/custom policies retain full-domain runtime authorization.
+    """
+    from general_manager.bucket.database_bucket import DatabaseBucket
+    from general_manager.api.graphql_errors import get_read_permission_filter
+    from general_manager.api.graphql_relations import (
+        get_graphql_manager_registry,
+        resolve_general_manager_type,
+    )
+    from general_manager.permission.manager_based_permission import (
+        additional_local_read_permission,
+    )
+
+    if type(candidates) is not DatabaseBucket:
+        return False
+    structures: dict[type[GeneralManager], _NativeQueryStructure | None] = {}
+    readable_targets: dict[type[GeneralManager], bool] = {}
+
+    def safe_path(manager: type[GeneralManager], parts: tuple[str, ...]) -> bool:
+        if manager not in structures:
+            structures[manager] = _prepare_pushdown_structure(manager)
+        structure = structures[manager]
+        if structure is None or not parts:
+            return False
+        prepared = structure.flat_field(parts)
+        if prepared is not None:
+            return not prepared.additional
+        field_name, *rest = parts
+        aliases, names, _ = _operand_field_names(
+            manager, field_name, structure.attributes, native_paths=False
+        )
+        if (
+            len(aliases) > 1
+            or not names.intersection(structure.attributes)
+            or names.intersection(structure.properties)
+            or any(
+                additional_local_read_permission(
+                    structure.permission, name, manager=manager
+                )
+                is not False
+                for name in names
+            )
+        ):
+            return False
+        metadata: dict[str, object] = dict(
+            structure.attributes.get(aliases[0] if aliases else field_name, {})
+        )
+        target = resolve_general_manager_type(
+            metadata.get("type"), get_graphql_manager_registry()
+        )
+        if target is None or not rest:
+            return False
+        if target not in structures:
+            structures[target] = _prepare_pushdown_structure(target)
+        target_structure = structures[target]
+        if target_structure is None:
+            return False
+        # A target field called e.g. "contains" wins over lookup spelling,
+        # matching the existing runtime authorization grammar.
+        if (
+            len(rest) == 1
+            and rest[0] in _LOOKUPS
+            and rest[0]
+            not in (
+                set(target_structure.attributes)
+                | set(target_structure.properties)
+                | set(target_structure.interface.get_attributes())
+            )
+        ):
+            return True
+        if info is None:
+            return False
+        if target not in readable_targets:
+            plan = get_read_permission_filter(target, info)
+            readable_targets[target] = (
+                plan.decision == "allow_all"
+                and not plan.requires_instance_check
+                and not plan.filters
+            )
+        return readable_targets[target] and safe_path(target, tuple(rest))
+
+    return all(
+        safe_path(candidates._manager_class, tuple(path.split("__"))) for path in paths
+    )

{generalmanager-0.90.0 → generalmanager-0.91.1}/src/general_manager/api/graphql_resolvers.py

@@ -1184,6 +1184,12 @@ def check_read_permission(
     return check_read_permission_for_user(instance, info.context.user, field_name)
 
 
+_QUERY_PUSHDOWN_CHECKS = tuple(
+    (function, executable_signature(function))
+    for function in (check_read_permission, check_read_permission_for_user)
+)
+
+
 def resolve_with_read_permission(
     instance: GeneralManager,
     info: GraphQLResolveInfo,
@@ -2114,6 +2120,24 @@ def create_list_resolver(
                     # requests nor validate the remote lookup vocabulary.
                     qs = MaterializedBucket(manager_class, qs)
         else:
+            from general_manager.api.graphql_query_permissions import (
+                can_filter_before_query_authorization,
+            )
+
+            filter_first = all(
+                current is original and executable_matches(original, signature)
+                for current, (original, signature) in zip(
+                    (check_read_permission, check_read_permission_for_user),
+                    _QUERY_PUSHDOWN_CHECKS,
+                    strict=True,
+                )
+            ) and can_filter_before_query_authorization(
+                base_queryset,
+                set(plan.filters) | set(plan.excludes) | set(plan.normalized_excludes),
+                info,
+            )
+            if filter_first:
+                base_queryset = apply_query_parameter_plan(base_queryset, plan, None)
             authorization_result = apply_read_authorization(
                 base_queryset,
                 manager_class,
@@ -2130,7 +2154,8 @@ def create_list_resolver(
                 budget_additional_permissions_only=True,
                 prepare_native_structure=isinstance(qs, DatabaseBucket),
             )
-            qs = apply_query_parameter_plan(qs, plan, None)
+            if not filter_first:
+                qs = apply_query_parameter_plan(qs, plan, None)
         if grouping_validator is not None:
             grouping_validator(qs, group_by, order_by, info)
         qs_grouped = apply_grouping(qs, group_by)

{generalmanager-0.90.0 → generalmanager-0.91.1}/src/general_manager/api/graphql_search.py

@@ -10,7 +10,6 @@ from __future__ import annotations
 from dataclasses import replace
 
 import json
-import os
 from collections.abc import Callable, Generator, Iterable, Mapping
 from datetime import date, datetime
 from decimal import Decimal
@@ -28,6 +27,7 @@ from graphql import GraphQLError, GraphQLID
 from django.core.exceptions import FieldDoesNotExist
 from django.db import models
 
+from general_manager.api.graphql_work_limits import get_graphql_work_limit
 from general_manager.conf import get_setting
 from general_manager.api.graphql_identifiers import property_identifier_type
 from general_manager.api.graphql_ordering import (
@@ -101,15 +101,11 @@ SearchTotalMode = Literal["exact", "bounded"]
 _BAD_USER_INPUT_CODE = "BAD_USER_INPUT"
 _PAGE_MUST_BE_POSITIVE = "page must be a positive integer."
 _PAGE_SIZE_MUST_BE_POSITIVE = "pageSize must be a positive integer."
-DEFAULT_GRAPHQL_SEARCH_TOTAL_SCAN_LIMIT = 1000
-_SEARCH_TOTAL_SCAN_LIMIT_UNSET = object()
+DEFAULT_GRAPHQL_SEARCH_TOTAL_SCAN_LIMIT: int | None = None
 SEARCH_SOURCE_AUTHORIZATION_LIMIT_ERROR = (
     "Search source authorization candidate limit exceeded."
 )
 SEARCH_TOTAL_MODE_ERROR = "must be one of: exact, bounded."
-SEARCH_TOTAL_SCAN_LIMIT_ERROR = (
-    "GRAPHQL_SEARCH_TOTAL_SCAN_LIMIT must be a positive integer."
-)
 _MALFORMED_NATIVE_ID = object()
 
 _SEARCH_SCAN_LIMIT_EXCEEDED = (
@@ -204,24 +200,11 @@ def normalize_search_total_mode(total_mode: str | None = None) -> SearchTotalMod
     return cast(SearchTotalMode, normalized)
 
 
-def get_graphql_search_total_scan_limit() -> int:
-    """Resolve the shared candidate budget from Django settings, then the env."""
-    raw_limit = get_setting(
-        "GRAPHQL_SEARCH_TOTAL_SCAN_LIMIT",
-        _SEARCH_TOTAL_SCAN_LIMIT_UNSET,
+def get_graphql_search_total_scan_limit() -> int | None:
+    """Resolve the optional shared candidate budget from settings, then env."""
+    return get_graphql_work_limit(
+        "GRAPHQL_SEARCH_TOTAL_SCAN_LIMIT", DEFAULT_GRAPHQL_SEARCH_TOTAL_SCAN_LIMIT
     )
-    if raw_limit is _SEARCH_TOTAL_SCAN_LIMIT_UNSET:
-        env_limit = os.environ.get("GENERAL_MANAGER_GRAPHQL_SEARCH_TOTAL_SCAN_LIMIT")
-        if env_limit is None:
-            raw_limit = DEFAULT_GRAPHQL_SEARCH_TOTAL_SCAN_LIMIT
-        else:
-            try:
-                raw_limit = int(env_limit)
-            except ValueError:
-                raise _bad_user_input_error(SEARCH_TOTAL_SCAN_LIMIT_ERROR) from None
-    if not isinstance(raw_limit, int) or isinstance(raw_limit, bool) or raw_limit <= 0:
-        raise _bad_user_input_error(SEARCH_TOTAL_SCAN_LIMIT_ERROR)
-    return raw_limit
 
 
 def sort_search_hit_entries(
@@ -1569,6 +1552,9 @@ def register_search_query(
             QueryFieldAuthorizationBudget,
         )
 
+        source_limit = get_graphql_work_limit(
+            "GRAPHQL_SEARCH_SOURCE_AUTHORIZATION_LIMIT", MAX_QUERY_PERMISSION_CANDIDATES
+        )
         source_candidate_count = 0
         authorization_budget = QueryFieldAuthorizationBudget()
 
@@ -1577,7 +1563,7 @@ def register_search_query(
         ) -> Generator[GeneralManager, None, None]:
             nonlocal source_candidate_count
             for candidate in source:
-                if source_candidate_count >= MAX_QUERY_PERMISSION_CANDIDATES:
+                if source_limit is not None and source_candidate_count >= source_limit:
                     raise GraphQLError(SEARCH_SOURCE_AUTHORIZATION_LIMIT_ERROR)
                 source_candidate_count += 1
                 if passes_permission_filters(candidate, info, permission_plan=plan):
@@ -1804,11 +1790,19 @@ def register_search_query(
                 fast_source is not None and common_filter_execution_valid()
             )
             while True:
-                remaining_scan_budget = total_scan_limit - scanned_hits
-                if remaining_scan_budget <= 0:
+                remaining_scan_budget = (
+                    None
+                    if total_scan_limit is None
+                    else total_scan_limit - scanned_hits
+                )
+                if remaining_scan_budget is not None and remaining_scan_budget <= 0:
                     manager_total_is_exact = False
                     break
-                query_limit = min(fetch_limit, remaining_scan_budget)
+                query_limit = (
+                    fetch_limit
+                    if remaining_scan_budget is None
+                    else min(fetch_limit, remaining_scan_budget)
+                )
                 result = backend.search(
                     index_name,
                     query,
@@ -1981,7 +1975,7 @@ def register_search_query(
                     break
                 if len(result.hits) < query_limit and not can_continue_page:
                     break
-                if scanned_hits >= total_scan_limit:
+                if total_scan_limit is not None and scanned_hits >= total_scan_limit:
                     manager_total_is_exact = False
                     break
             total += total_hits_for_manager

generalmanager-0.91.1/src/general_manager/api/graphql_work_limits.py

@@ -0,0 +1,35 @@
+"""Server-owned optional GraphQL workload budgets, independent of permissions."""
+
+from __future__ import annotations
+
+import os
+
+from graphql import GraphQLError
+
+from general_manager.conf import get_setting
+
+_UNSET = object()
+
+
+def get_graphql_work_limit(name: str, default: int | None = None) -> int | None:
+    """Resolve Django settings before environment; explicit None means unlimited."""
+    value = get_setting(name, _UNSET)
+    if value is _UNSET:
+        raw = os.environ.get(f"GENERAL_MANAGER_{name}")
+        if raw is None:
+            return default
+        if raw.strip().lower() in {"none", "unlimited"}:
+            return None
+        try:
+            value = int(raw)
+        except ValueError:
+            value = raw
+    if value is None:
+        return None
+    if isinstance(value, int) and not isinstance(value, bool) and value > 0:
+        return value
+    message = f"{name} must be a positive integer or None (unlimited)."
+    raise GraphQLError(
+        message,
+        extensions={"code": "BAD_USER_INPUT"},
+    )

{generalmanager-0.90.0 → generalmanager-0.91.1}/src/general_manager/interface/orm_interface.py

@@ -189,3 +189,18 @@ class OrmInterfaceBase(InterfaceBase, Generic[HistoryModelT]):
             ),
         )
         return lifecycle.describe_custom_fields(model)
+
+
+from general_manager.utils.executable_contract import executable_signature as _signature
+
+_QUERY_PUSHDOWN_INTERFACE_METHODS = tuple(
+    (
+        name,
+        descriptor,
+        _signature(
+            descriptor.__func__ if isinstance(descriptor, classmethod) else descriptor
+        ),
+    )
+    for name in ("__init__", "_from_trusted_orm_instance")
+    for descriptor in (OrmInterfaceBase.__dict__[name],)
+)

{generalmanager-0.90.0 → generalmanager-0.91.1}/src/general_manager/manager/general_manager.py

@@ -920,3 +920,22 @@ _COMMON_MANAGER_EXECUTABLES = tuple(
         _COMMON_MANAGER_GETATTR,
     )
 )
+
+
+# Native filter pushdown may not erase observable custom hydration behavior.
+_QUERY_PUSHDOWN_MANAGER_METHODS = tuple(
+    (
+        name,
+        descriptor,
+        executable_signature(
+            descriptor.__func__ if isinstance(descriptor, classmethod) else descriptor
+        ),
+    )
+    for name in (
+        "__init__",
+        "__getattr__",
+        "_from_trusted_orm_instance",
+        "_track_identification_dependency",
+    )
+    for descriptor in (GeneralManager.__dict__[name],)
+)

{generalmanager-0.90.0 → generalmanager-0.91.1}/src/general_manager/permission/permission_data_manager.py

@@ -45,6 +45,20 @@ class PermissionRelationResolutionError(PermissionError):
         )
 
 
+def _resolved_relation_model(
+    field: models.ForeignKey[models.Model],
+) -> type[models.Model]:
+    """Use Django's resolved relation owner, not an early cached string reference."""
+    # RelatedField.related_model is cached; inspecting it during model assembly
+    # can retain a string even after Django resolves remote_field.model.
+    related_model = getattr(field.remote_field, "model", None)
+    if not isinstance(related_model, type) or not issubclass(
+        related_model, models.Model
+    ):
+        raise PermissionRelationResolutionError(field.name)
+    return related_model
+
+
 GeneralManagerData = TypeVar("GeneralManagerData", bound=GeneralManager)
 
 
@@ -299,7 +313,7 @@ class PermissionDataManager(Generic[GeneralManagerData]):
         if identifier is None or name == field.attname:
             return identifier
 
-        related_type = field.related_model
+        related_type = _resolved_relation_model(field)
         manager_type = getattr(related_type, "_general_manager_class", None)
         # A write check needs the target on the write database even if a read
         # router would select a replica. Standalone checks retain Django hints.
@@ -342,7 +356,7 @@ class PermissionDataManager(Generic[GeneralManagerData]):
         backing = getattr(getattr(manager, "_interface", None), "_instance", None)
         if (
             manager.identification.get("id") != related.pk
-            or not isinstance(backing, field.related_model)
+            or not isinstance(backing, _resolved_relation_model(field))
             or backing.pk != related.pk
             or backing._state.db != related._state.db
             or getattr(backing, field.target_field.attname)