GeneralManager 0.91.0__tar.gz → 0.91.1__tar.gz

{generalmanager-0.91.0/src/GeneralManager.egg-info → generalmanager-0.91.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.91.0
+Version: 0.91.1
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.91.0 → generalmanager-0.91.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "GeneralManager"
-version = "0.91.0"
+version = "0.91.1"
 description = "Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching."
 readme = "README.md"
 authors = [{ name = "Tim Kleindick", email = "tkleindick@yahoo.de" }]

{generalmanager-0.91.0 → generalmanager-0.91.1/src/GeneralManager.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.91.0
+Version: 0.91.1
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.91.0 → generalmanager-0.91.1}/src/general_manager/api/graphql_query_permissions.py

@@ -661,3 +661,136 @@ def authorize_query_fields(
                 check(candidate, normalized_parts)
     if isinstance(candidates, RequestBucket) and not candidates.response_is_complete:
         raise GraphQLError(INCOMPLETE_ERROR)
+
+
+def _prepare_pushdown_structure(
+    manager: type[GeneralManager],
+) -> _NativeQueryStructure | None:
+    """Attest native construction before statically interpreting field policies."""
+    from general_manager.utils.executable_contract import executable_matches
+
+    if type(manager) is not GeneralManagerMeta:
+        return None
+    from general_manager.manager.general_manager import (
+        _QUERY_PUSHDOWN_MANAGER_METHODS,
+        _COMMON_MANAGER_IDENTIFICATION,
+    )
+    from general_manager.interface.orm_interface import (
+        _QUERY_PUSHDOWN_INTERFACE_METHODS,
+    )
+
+    if not _unchanged_metadata_methods(manager, _QUERY_PUSHDOWN_MANAGER_METHODS):
+        return None
+    identification, signature = _COMMON_MANAGER_IDENTIFICATION
+    if getattr_static(
+        manager, "identification"
+    ) is not identification or not executable_matches(identification.fget, signature):
+        return None
+    interface = getattr_static(manager, "Interface", None)
+    if not _unchanged_metadata_methods(interface, _QUERY_PUSHDOWN_INTERFACE_METHODS):
+        return None
+    for owner in (manager, interface):
+        if any(
+            getattr_static(owner, name, None) is not getattr_static(object, name)
+            for name in ("__new__", "__getattribute__", "__setattr__")
+        ):
+            return None
+    structure = _prepare_native_query_structure(manager)
+    if structure is None:
+        return None
+    return structure
+
+
+def can_filter_before_query_authorization(
+    candidates: Bucket[GeneralManager],
+    paths: Iterable[str],
+    info: ResolveInfo | None = None,
+) -> bool:
+    """Prove predicates harmless once, before narrowing a native row domain.
+
+    Permission declarations remain stable during a query. Every relation hop
+    must be readable, and each traversed target must have an unconditional row
+    read plan for this actor; otherwise membership could reveal hidden targets.
+    Unknown/custom policies retain full-domain runtime authorization.
+    """
+    from general_manager.bucket.database_bucket import DatabaseBucket
+    from general_manager.api.graphql_errors import get_read_permission_filter
+    from general_manager.api.graphql_relations import (
+        get_graphql_manager_registry,
+        resolve_general_manager_type,
+    )
+    from general_manager.permission.manager_based_permission import (
+        additional_local_read_permission,
+    )
+
+    if type(candidates) is not DatabaseBucket:
+        return False
+    structures: dict[type[GeneralManager], _NativeQueryStructure | None] = {}
+    readable_targets: dict[type[GeneralManager], bool] = {}
+
+    def safe_path(manager: type[GeneralManager], parts: tuple[str, ...]) -> bool:
+        if manager not in structures:
+            structures[manager] = _prepare_pushdown_structure(manager)
+        structure = structures[manager]
+        if structure is None or not parts:
+            return False
+        prepared = structure.flat_field(parts)
+        if prepared is not None:
+            return not prepared.additional
+        field_name, *rest = parts
+        aliases, names, _ = _operand_field_names(
+            manager, field_name, structure.attributes, native_paths=False
+        )
+        if (
+            len(aliases) > 1
+            or not names.intersection(structure.attributes)
+            or names.intersection(structure.properties)
+            or any(
+                additional_local_read_permission(
+                    structure.permission, name, manager=manager
+                )
+                is not False
+                for name in names
+            )
+        ):
+            return False
+        metadata: dict[str, object] = dict(
+            structure.attributes.get(aliases[0] if aliases else field_name, {})
+        )
+        target = resolve_general_manager_type(
+            metadata.get("type"), get_graphql_manager_registry()
+        )
+        if target is None or not rest:
+            return False
+        if target not in structures:
+            structures[target] = _prepare_pushdown_structure(target)
+        target_structure = structures[target]
+        if target_structure is None:
+            return False
+        # A target field called e.g. "contains" wins over lookup spelling,
+        # matching the existing runtime authorization grammar.
+        if (
+            len(rest) == 1
+            and rest[0] in _LOOKUPS
+            and rest[0]
+            not in (
+                set(target_structure.attributes)
+                | set(target_structure.properties)
+                | set(target_structure.interface.get_attributes())
+            )
+        ):
+            return True
+        if info is None:
+            return False
+        if target not in readable_targets:
+            plan = get_read_permission_filter(target, info)
+            readable_targets[target] = (
+                plan.decision == "allow_all"
+                and not plan.requires_instance_check
+                and not plan.filters
+            )
+        return readable_targets[target] and safe_path(target, tuple(rest))
+
+    return all(
+        safe_path(candidates._manager_class, tuple(path.split("__"))) for path in paths
+    )

{generalmanager-0.91.0 → generalmanager-0.91.1}/src/general_manager/api/graphql_resolvers.py

@@ -1184,6 +1184,12 @@ def check_read_permission(
     return check_read_permission_for_user(instance, info.context.user, field_name)
 
 
+_QUERY_PUSHDOWN_CHECKS = tuple(
+    (function, executable_signature(function))
+    for function in (check_read_permission, check_read_permission_for_user)
+)
+
+
 def resolve_with_read_permission(
     instance: GeneralManager,
     info: GraphQLResolveInfo,
@@ -2114,6 +2120,24 @@ def create_list_resolver(
                     # requests nor validate the remote lookup vocabulary.
                     qs = MaterializedBucket(manager_class, qs)
         else:
+            from general_manager.api.graphql_query_permissions import (
+                can_filter_before_query_authorization,
+            )
+
+            filter_first = all(
+                current is original and executable_matches(original, signature)
+                for current, (original, signature) in zip(
+                    (check_read_permission, check_read_permission_for_user),
+                    _QUERY_PUSHDOWN_CHECKS,
+                    strict=True,
+                )
+            ) and can_filter_before_query_authorization(
+                base_queryset,
+                set(plan.filters) | set(plan.excludes) | set(plan.normalized_excludes),
+                info,
+            )
+            if filter_first:
+                base_queryset = apply_query_parameter_plan(base_queryset, plan, None)
             authorization_result = apply_read_authorization(
                 base_queryset,
                 manager_class,
@@ -2130,7 +2154,8 @@ def create_list_resolver(
                 budget_additional_permissions_only=True,
                 prepare_native_structure=isinstance(qs, DatabaseBucket),
             )
-            qs = apply_query_parameter_plan(qs, plan, None)
+            if not filter_first:
+                qs = apply_query_parameter_plan(qs, plan, None)
         if grouping_validator is not None:
             grouping_validator(qs, group_by, order_by, info)
         qs_grouped = apply_grouping(qs, group_by)

{generalmanager-0.91.0 → generalmanager-0.91.1}/src/general_manager/interface/orm_interface.py

@@ -189,3 +189,18 @@ class OrmInterfaceBase(InterfaceBase, Generic[HistoryModelT]):
             ),
         )
         return lifecycle.describe_custom_fields(model)
+
+
+from general_manager.utils.executable_contract import executable_signature as _signature
+
+_QUERY_PUSHDOWN_INTERFACE_METHODS = tuple(
+    (
+        name,
+        descriptor,
+        _signature(
+            descriptor.__func__ if isinstance(descriptor, classmethod) else descriptor
+        ),
+    )
+    for name in ("__init__", "_from_trusted_orm_instance")
+    for descriptor in (OrmInterfaceBase.__dict__[name],)
+)

{generalmanager-0.91.0 → generalmanager-0.91.1}/src/general_manager/manager/general_manager.py

@@ -920,3 +920,22 @@ _COMMON_MANAGER_EXECUTABLES = tuple(
         _COMMON_MANAGER_GETATTR,
     )
 )
+
+
+# Native filter pushdown may not erase observable custom hydration behavior.
+_QUERY_PUSHDOWN_MANAGER_METHODS = tuple(
+    (
+        name,
+        descriptor,
+        executable_signature(
+            descriptor.__func__ if isinstance(descriptor, classmethod) else descriptor
+        ),
+    )
+    for name in (
+        "__init__",
+        "__getattr__",
+        "_from_trusted_orm_instance",
+        "_track_identification_dependency",
+    )
+    for descriptor in (GeneralManager.__dict__[name],)
+)