aflib 0.0.7__tar.gz → 0.0.9__tar.gz

{aflib-0.0.7 → aflib-0.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: aflib
-Version: 0.0.7
+Version: 0.0.9
 Summary: Helper library for business logic inside Airflows plpython function bodies
 License: MIT
 License-File: LICENSE
@@ -19,23 +19,66 @@ same result envelope. aflib is that plumbing, written once.
 
 **Status: early, and deliberately so.** Nothing enters this library until it has run on a
 real Airflows instance — written first as a plain function body, deployed, called, and
-observed. One version corresponds to one proven capability, which is why the numbers start
+observed. A version ships only capabilities that have each run there, which is why the numbers start
 so low.
 
 ## Install
 
 Airflows resolves Python packages from public PyPI by name and version only; there is no
-local-import, git or private-index route. Declare it in
-`models/pythonPackages/pythonPackages.airflows` by pinning **name and version in
-separate fields** — never as a single `aflib==0.0.7` string (that form produced
-malformed `name==ver==ver` entries in a real instance's package list):
+local-import, git or private-index route. Declare `aflib` in the instance's Python packages
+pinned to an exact version (`0.0.9`). The exported package list may show the pin as
+`aflib==0.0.9==0.0.9`: that is how Airflows stores a pinned version, not an error.
+
+Then import it from a function body. To check which version a body really imports, return
+`aflib.__version__` from it.
+
+## What 0.0.9 gives you
+
+- **`config.get(plpy, name, required=False, secret=False)`** — a platform variable, read with
+  the name bound as a query parameter. The platform's own `get_env_variable` pastes the name
+  into the SQL text, so a name containing `'` breaks or changes the query. A missing variable
+  is `None`; `required=True` raises `config.MissingConfig`, which `errors.to_fail` reports
+  as a plain internal error (the variable's name goes to the log, not to the caller).
+  `secret=True` returns a `config.Secret`: its `str`, `repr` and `format` say
+  `Secret('***')`, `json` refuses it, and `reveal()` is the only way to the value.
+- **`http.request(method, url, *, timeout, headers=None, json_body=None, data=None)`** —
+  urllib with a **mandatory** timeout: nothing else can stop a body blocked on a socket, and
+  the socket has none by default. A 4xx/5xx comes back as a `Response` (`status`, `ok`,
+  `body`, `text`, `json()`); `raise_for_status()` and every network failure raise
+  `http.HttpError`, whose text names the method, host and status but **never the path or
+  query**, so a token in the URL cannot reach a log. Only `http://` and `https://` URLs.
+  Not built on the `requests` the platform bundles: its exceptions copy the full URL.
+- **`identity.unscoped(plpy, role="modelsadmin")`** — run a block as another role and
+  `SET ROLE` back to the caller in `finally`, also when the block raises. Never `RESET ROLE`:
+  the session user is the connection pool's superuser login. Take authorization decisions
+  before the block.
+- **`trigger.changed`** ignores the recursion flag under both spellings,
+  `update_by_trigger` and `updated_by_trigger`.
+
+All three ran on a real instance on 2026-10-20 before release, exact source, called by a
+non-admin user.
 
-```
-name:    aflib
-version: 0.0.7
+```python
+from aflib import config, http, identity
+
+base = config.get(plpy, "IAM_URL", required=True)
+password = config.get(plpy, "IAM_ADMIN_PASSWORD", required=True, secret=True)
+r = http.request("POST", base + "/token", timeout=10, json_body={"password": password.reveal()})
+r.raise_for_status()
+
+with identity.unscoped(plpy):
+    plpy.execute("...")      # as modelsadmin; back to the caller afterwards
 ```
 
-Then import it from a function body.
+`config` queries as the calling user, so the variables must be readable by that user's role.
+
+## What 0.0.8 fixes
+
+`Batch.run` accepts a predicate whose column name contains the letters `_t`.
+`id_tuition IS NOT NULL`, `start_time < now()` and `is_test = false` are
+predicates. 0.0.7 refused them, because the guard searched for `_t` as a
+substring. `_t.col` and `"_t".col` are still refused: that alias exists only on
+the outer `UPDATE`.
 
 ## What 0.0.7 gives you
 
@@ -91,10 +134,7 @@ the 2026-09 platform probes showed, plus two verified fixes:
   resolve.
 - **`identity.current_user(plpy)`** — `SELECT current_user`. Not a User id.
 
-Pin **name and version in separate fields** (`aflib` / `0.0.7`), not
-`aflib==0.0.7` as one string.
-
-## Core API (0.0.1–0.0.3, still in 0.0.7)
+## Core API (0.0.1–0.0.3, still in 0.0.9)
 
 ```python
 from aflib import Db, errors, fail, logging, ok, params

{aflib-0.0.7 → aflib-0.0.9}/README.md

@@ -10,23 +10,66 @@ same result envelope. aflib is that plumbing, written once.
 
 **Status: early, and deliberately so.** Nothing enters this library until it has run on a
 real Airflows instance — written first as a plain function body, deployed, called, and
-observed. One version corresponds to one proven capability, which is why the numbers start
+observed. A version ships only capabilities that have each run there, which is why the numbers start
 so low.
 
 ## Install
 
 Airflows resolves Python packages from public PyPI by name and version only; there is no
-local-import, git or private-index route. Declare it in
-`models/pythonPackages/pythonPackages.airflows` by pinning **name and version in
-separate fields** — never as a single `aflib==0.0.7` string (that form produced
-malformed `name==ver==ver` entries in a real instance's package list):
+local-import, git or private-index route. Declare `aflib` in the instance's Python packages
+pinned to an exact version (`0.0.9`). The exported package list may show the pin as
+`aflib==0.0.9==0.0.9`: that is how Airflows stores a pinned version, not an error.
+
+Then import it from a function body. To check which version a body really imports, return
+`aflib.__version__` from it.
+
+## What 0.0.9 gives you
+
+- **`config.get(plpy, name, required=False, secret=False)`** — a platform variable, read with
+  the name bound as a query parameter. The platform's own `get_env_variable` pastes the name
+  into the SQL text, so a name containing `'` breaks or changes the query. A missing variable
+  is `None`; `required=True` raises `config.MissingConfig`, which `errors.to_fail` reports
+  as a plain internal error (the variable's name goes to the log, not to the caller).
+  `secret=True` returns a `config.Secret`: its `str`, `repr` and `format` say
+  `Secret('***')`, `json` refuses it, and `reveal()` is the only way to the value.
+- **`http.request(method, url, *, timeout, headers=None, json_body=None, data=None)`** —
+  urllib with a **mandatory** timeout: nothing else can stop a body blocked on a socket, and
+  the socket has none by default. A 4xx/5xx comes back as a `Response` (`status`, `ok`,
+  `body`, `text`, `json()`); `raise_for_status()` and every network failure raise
+  `http.HttpError`, whose text names the method, host and status but **never the path or
+  query**, so a token in the URL cannot reach a log. Only `http://` and `https://` URLs.
+  Not built on the `requests` the platform bundles: its exceptions copy the full URL.
+- **`identity.unscoped(plpy, role="modelsadmin")`** — run a block as another role and
+  `SET ROLE` back to the caller in `finally`, also when the block raises. Never `RESET ROLE`:
+  the session user is the connection pool's superuser login. Take authorization decisions
+  before the block.
+- **`trigger.changed`** ignores the recursion flag under both spellings,
+  `update_by_trigger` and `updated_by_trigger`.
+
+All three ran on a real instance on 2026-10-20 before release, exact source, called by a
+non-admin user.
 
-```
-name:    aflib
-version: 0.0.7
+```python
+from aflib import config, http, identity
+
+base = config.get(plpy, "IAM_URL", required=True)
+password = config.get(plpy, "IAM_ADMIN_PASSWORD", required=True, secret=True)
+r = http.request("POST", base + "/token", timeout=10, json_body={"password": password.reveal()})
+r.raise_for_status()
+
+with identity.unscoped(plpy):
+    plpy.execute("...")      # as modelsadmin; back to the caller afterwards
 ```
 
-Then import it from a function body.
+`config` queries as the calling user, so the variables must be readable by that user's role.
+
+## What 0.0.8 fixes
+
+`Batch.run` accepts a predicate whose column name contains the letters `_t`.
+`id_tuition IS NOT NULL`, `start_time < now()` and `is_test = false` are
+predicates. 0.0.7 refused them, because the guard searched for `_t` as a
+substring. `_t.col` and `"_t".col` are still refused: that alias exists only on
+the outer `UPDATE`.
 
 ## What 0.0.7 gives you
 
@@ -82,10 +125,7 @@ the 2026-09 platform probes showed, plus two verified fixes:
   resolve.
 - **`identity.current_user(plpy)`** — `SELECT current_user`. Not a User id.
 
-Pin **name and version in separate fields** (`aflib` / `0.0.7`), not
-`aflib==0.0.7` as one string.
-
-## Core API (0.0.1–0.0.3, still in 0.0.7)
+## Core API (0.0.1–0.0.3, still in 0.0.9)
 
 ```python
 from aflib import Db, errors, fail, logging, ok, params

{aflib-0.0.7 → aflib-0.0.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "aflib"
-version = "0.0.7"
+version = "0.0.9"
 description = "Helper library for business logic inside Airflows plpython function bodies"
 readme = "README.md"
 # The platform runs Python 3.11.2 (observed, not assumed — see docs/platform-constraints.md).

{aflib-0.0.7 → aflib-0.0.9}/src/aflib/__init__.py

@@ -35,10 +35,12 @@ from aflib import (
     authz,
     batch,
     codec,
+    config,
     db,
     errors,
     events,
     functions,
+    http,
     identity,
     logging,
     params,
@@ -56,7 +58,7 @@ from aflib.result import fail, ok
 # Kept in step with `pyproject.toml` by hand. A deployed body returns this so a run can
 # prove which aflib it actually imported — a stale package otherwise looks exactly like a
 # working one.
-__version__ = "0.0.7"
+__version__ = "0.0.9"
 
 __all__ = [
     "BadParameter",
@@ -66,11 +68,13 @@ __all__ = [
     "authz",
     "batch",
     "codec",
+    "config",
     "db",
     "errors",
     "events",
     "fail",
     "functions",
+    "http",
     "identity",
     "logging",
     "ok",

{aflib-0.0.7 → aflib-0.0.9}/src/aflib/batch.py

@@ -54,6 +54,7 @@ inside the environment's `statement_timeout` — 180 s on PRO, no limit on PRE,
 cannot tell you whether a chunk fits**.
 """
 
+import re
 import time
 
 from aflib.db import Db
@@ -88,6 +89,18 @@ class Progress(object):
             self.done, self.remaining, self.complete)
 
 
+def _alias_as_qualifier(alias, pending):
+    """True when `pending` uses `alias` as a qualifier, not as letters inside a name.
+
+    Searching for the substring `_t` refuses `id_tuition IS NOT NULL`,
+    `start_time < now()` and `is_test = false`. Observed on PRE 2026-10-02,
+    acceptance probe `aflib-007-accept-r1`, case `batch`. The alias is a problem
+    only as `_t.col` or `"_t".col`, with optional space before the dot.
+    """
+    pattern = r'(?<![\w"])"?{0}"?\s*\.'.format(re.escape(alias))
+    return re.search(pattern, pending) is not None
+
+
 class Batch(object):
     """One committed chunk per call. `plpy` is injected, as everywhere in aflib."""
 
@@ -105,14 +118,16 @@ class Batch(object):
         the outer `WHERE`, where Postgres resolves it against the update target, and
         inside the subquery, where it resolves against the subquery's own `FROM`. Both
         resolutions are what we want, and either qualification breaks one of them. A
-        predicate mentioning the alias is rejected rather than silently misplaced.
+        predicate that qualifies a column with the alias (`_t.col` or `"_t".col`) is
+        rejected rather than silently misplaced. A column whose name merely contains
+        those letters — `id_tuition`, `start_time`, `is_test` — is not a qualification.
 
         `order` defaults to `key`, which makes the work deterministic and the chunks
         disjoint. Ordering by something non-unique would let two concurrent callers pick
         overlapping sets; the row-level guard still keeps them correct, but they would
         waste each other's work.
         """
-        if self.ALIAS in pending:
+        if _alias_as_qualifier(self.ALIAS, pending):
             raise ValueError(
                 "`pending` must be unqualified: it is placed both in the outer WHERE and "
                 "inside the subquery, and %r resolves in only one of them." % self.ALIAS)

aflib-0.0.9/src/aflib/config.py

@@ -0,0 +1,64 @@
+"""Platform variables, read with a bound query.
+
+    from aflib import config
+
+    base = config.get(plpy, "IAM_URL", required=True)
+    key = config.get(plpy, "IAM_ADMIN_PASSWORD", required=True, secret=True)
+    login(base, password=key.reveal())
+
+**Why not `airflows.get_env_variable`.** On the platform it is an f-string: the name is
+pasted inside the SQL text of a query on `"Models"."Variable"`, so a name containing `'`
+breaks the query or changes its meaning (observed source, PRE 2026-10-20, probe
+`aflib-edge-r1`). This module runs the same query with the name bound as a parameter.
+
+**It runs as the caller.** The query uses the connection role, which is the calling user. A
+director reads the variables (observed, same probe); other roles have not been tried.
+
+**A missing variable is `None`**, as on the platform. `required=True` turns a missing, NULL
+or blank value into `MissingConfig`, which `errors.to_fail` reports to the caller as a
+plain internal error: a misconfiguration is never the caller's fault, and the variable's
+name goes to the log, not to them.
+
+**`secret=True` returns a `Secret`.** Its `str` and `repr` say `Secret('***')`, so it cannot
+leak through a log line or an f-string; `json` and `codec` refuse to serialise it, so it
+cannot leak into a response either. `reveal()` is the one way to the value, and the place
+it is called is where the value leaves the body.
+"""
+
+_SQL = 'SELECT "value" FROM "Models"."Variable" WHERE "name" = $1'
+
+
+class MissingConfig(Exception):
+    """A required variable is absent, NULL or blank. Classified as an internal error."""
+
+
+class Secret(object):
+    """A value that must not be printed, logged or returned. `reveal()` gives it back."""
+
+    __slots__ = ("_value",)
+
+    def __init__(self, value):
+        self._value = value
+
+    def reveal(self):
+        return self._value
+
+    def __repr__(self):
+        return "Secret('***')"
+
+    __str__ = __repr__
+
+    def __format__(self, spec):
+        return repr(self)
+
+
+def get(plpy, name, required=False, secret=False):
+    """The value of variable `name`, or `None` when it does not exist."""
+    plan = plpy.prepare(_SQL, ["text"])
+    rows = plpy.execute(plan, [name])
+    value = rows[0]["value"] if len(rows) else None
+    if required and (value is None or not str(value).strip()):
+        raise MissingConfig("platform variable {!r} is missing or blank".format(name))
+    if value is None:
+        return None
+    return Secret(value) if secret else value

aflib-0.0.9/src/aflib/http.py

@@ -0,0 +1,113 @@
+"""Outbound HTTP from a function body: urllib, a mandatory timeout, errors without the URL.
+
+    from aflib import http
+
+    r = http.request("POST", url, timeout=10, headers={"Authorization": "Bearer " + tok},
+                     json_body={"id": 7})
+    r.raise_for_status()
+    data = r.json()
+
+**The timeout has no default.** Nothing else can stop a body waiting on a socket: Postgres
+cancels a statement only when the body calls back into `plpy`, so `statement_timeout` and
+`pg_cancel_backend` do not reach Python that is blocked or busy (G62). The socket's own
+default is no timeout at all (observed on PRE 2026-10-20, probe `aflib-edge-r1`).
+
+**urllib, not the `requests` bundled in `airflows`.** On the platform `requests` copies the
+full URL, query string and token included, into the text of its exceptions; urllib does not
+(same probe). Whatever an exception says ends up in a log line or, uncaught, in the HTTP
+response. `HttpError` names the method, the host and the status — never the path or query.
+
+**A 4xx/5xx is a `Response`, not an exception.** `raise_for_status()` turns it into an
+`HttpError` when the caller wants that. Network failures (timeout, DNS, refused, reset)
+always raise `HttpError`. `errors.to_fail` reports `HttpError` to the caller as a plain
+internal error and logs its text.
+
+**Only `http://` and `https://` URLs.** urllib also opens `file://` and `ftp://`, which from
+a function body would read the database server's own files.
+"""
+
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+
+# Module-level so tests can replace it; nothing else should.
+_urlopen = urllib.request.urlopen
+
+
+class HttpError(Exception):
+    """`kind` is `timeout`, `connection` or `status`. The message never holds path or query."""
+
+    def __init__(self, kind, method, host, status=None, reason=None):
+        self.kind = kind
+        self.status = status
+        text = "{} {}: {}".format(method, host, kind)
+        if status is not None:
+            text += " {}".format(status)
+        if reason:
+            text += " ({})".format(reason)
+        super().__init__(text)
+
+
+class Response(object):
+    def __init__(self, method, host, status, headers, body):
+        self._method = method
+        self._host = host
+        self.status = status
+        self.headers = headers
+        self.body = body
+
+    @property
+    def ok(self):
+        return 200 <= self.status < 300
+
+    @property
+    def text(self):
+        return self.body.decode("utf-8", "replace")
+
+    def json(self):
+        return json.loads(self.body)
+
+    def raise_for_status(self):
+        if not self.ok:
+            raise HttpError("status", self._method, self._host, status=self.status)
+        return self
+
+
+def request(method, url, *, timeout, headers=None, json_body=None, data=None):
+    """Send one request and return a `Response`. `timeout` is seconds per socket operation.
+
+    ponytail: the timeout bounds each connect/read, not the whole call; a server that
+    trickles bytes can exceed it. Add a total deadline if a real endpoint does that.
+    """
+    if timeout is None or timeout <= 0:
+        raise ValueError("timeout must be a positive number of seconds")
+    parts = urllib.parse.urlsplit(url)
+    if parts.scheme not in ("http", "https") or not parts.hostname:
+        raise ValueError("only absolute http:// or https:// URLs are allowed")
+    if json_body is not None and data is not None:
+        raise ValueError("pass json_body or data, not both")
+    method = method.upper()
+    host = parts.hostname
+    send = dict(headers or {})
+    if json_body is not None:
+        data = json.dumps(json_body).encode("utf-8")
+        send.setdefault("Content-Type", "application/json")
+    req = urllib.request.Request(url, data=data, headers=send, method=method)
+    try:
+        with _urlopen(req, timeout=timeout) as resp:
+            return Response(method, host, resp.status, dict(resp.headers), resp.read())
+    except urllib.error.HTTPError as exc:
+        # A status answer, not a failure to talk: hand it back like any other response.
+        return Response(method, host, exc.code, dict(exc.headers or {}), exc.read())
+    except (TimeoutError, OSError, urllib.error.URLError) as exc:
+        kind = "timeout" if _is_timeout(exc) else "connection"
+        # `from None`: the original's text is safe today, but a chained exception would be
+        # printed with any traceback, so it is dropped rather than trusted.
+        raise HttpError(kind, method, host, reason=type(exc).__name__) from None
+
+
+def _is_timeout(exc):
+    if isinstance(exc, TimeoutError):
+        return True
+    return isinstance(getattr(exc, "reason", None), TimeoutError)

aflib-0.0.9/src/aflib/identity.py

@@ -0,0 +1,53 @@
+"""Who is running this body.
+
+A plpython body has no request object. The platform sets the connection
+role to a Postgres role named after the caller's username — observed:
+`current_user` is the caller, not a GUC and not `getUserId()` (that
+name did not exist on the instance, 2026-09-17).
+
+    from aflib import identity
+
+    who = identity.current_user(plpy)
+
+This is the string. Mapping it to `Models.User` is a domain query, not
+this module. Do not cache it in `GD`/`SD`.
+
+`unscoped` runs a block as another role and always comes back:
+
+    with identity.unscoped(plpy) as caller:
+        plpy.execute(...)        # as modelsadmin
+    # back to the caller, also when the block raised
+
+Take every authorization decision **before** the block (`authz.snapshot`), while the
+connection is still the caller.
+"""
+
+import contextlib
+
+
+def current_user(plpy) -> str:
+    """`SELECT current_user` — the connection role for this call."""
+    row = plpy.execute("SELECT current_user AS u")[0]
+    return row["u"]
+
+
+@contextlib.contextmanager
+def unscoped(plpy, role="modelsadmin"):
+    """Run the block as `role`, then `SET ROLE` back to the caller, whatever happens.
+
+    `SET ROLE` lasts for the session, and an HTTP call runs on a pooled connection: a role
+    left behind is the role of the next request on that connection. So the restore is in
+    `finally`, and it names the caller captured on entry. Never `RESET ROLE`: the session
+    user is the pool's login role, `postgres` (G15), so a reset would leave a superuser.
+
+    Both names go through `plpy.quote_ident`. Observed on PRE 2026-10-20 (probe
+    `aflib-edge-r1`), called by a director: elevate and restore after a normal exit, a
+    Python error, an SQL error (the transaction stayed usable), nesting, and a hostile
+    role name, which became a role that does not exist.
+    """
+    caller = current_user(plpy)
+    plpy.execute("SET ROLE " + plpy.quote_ident(role))
+    try:
+        yield caller
+    finally:
+        plpy.execute("SET ROLE " + plpy.quote_ident(caller))

{aflib-0.0.7 → aflib-0.0.9}/src/aflib/trigger.py

@@ -9,13 +9,14 @@ This module does not dispatch. The function body (or a plpgsql stub that
 two things every UPDATE handler needs: which event fired, and which
 columns actually changed.
 
-Noise columns (`search`, `update_by_trigger`) are ignored by default so a
-search-index rewrite does not look like a business change.
+Noise columns (`search` and the recursion flag) are ignored by default so a
+search-index rewrite does not look like a business change. The flag is spelled
+`update_by_trigger` on some entities and `updated_by_trigger` on others; both are noise.
 """
 
 from __future__ import annotations
 
-DEFAULT_IGNORE = frozenset({"search", "update_by_trigger"})
+DEFAULT_IGNORE = frozenset({"search", "update_by_trigger", "updated_by_trigger"})
 
 
 def event(td: dict) -> str:

{aflib-0.0.7 → aflib-0.0.9}/tests/conftest.py

@@ -116,6 +116,18 @@ class FakePlpy:
         # make that mistake fail a test rather than pass one.
         raise FakeError(message)
 
+    def quote_ident(self, name):
+        """Postgres' rule: quote only when the name is not a plain lowercase identifier.
+
+        On PRE `quote_ident("modelsadmin; SELECT 1")` became a role name that does not
+        exist, so the statement failed instead of running (probe aflib-edge-r1).
+        """
+        import re
+
+        if re.fullmatch(r"[a-z_][a-z0-9_$]*", name):
+            return name
+        return '"' + name.replace('"', '""') + '"'
+
     def subtransaction(self):
         """Stands in for `PLySubtransaction`.
 

{aflib-0.0.7 → aflib-0.0.9}/tests/test_batch.py

@@ -66,13 +66,31 @@ class TestThePredicateIsPlacedTwice:
         where = sql.split("SET")[1].split("AND")[0]
         assert PENDING in where, "the first predicate must sit in the UPDATE's own WHERE"
 
-    def test_a_qualified_predicate_is_refused_rather_than_misplaced(self, make_plpy):
+    @pytest.mark.parametrize("pending", [
+        "_t.id_status = $1",
+        '"_t".estado = \'pending\'',
+        '"_t" . estado = \'pending\'',
+        "_t . id = 1",
+    ])
+    def test_a_qualified_predicate_is_refused_rather_than_misplaced(self, make_plpy, pending):
         # It would resolve in the outer WHERE and break inside the subquery, so the
         # helper must not accept it and quietly produce a statement that fails at runtime.
+        # The quoted form is what the PRE acceptance probe sends.
         with pytest.raises(ValueError) as exc:
-            Batch(make_plpy()).run(TABLE, SET, "_t.id_status = $1")
+            Batch(make_plpy()).run(TABLE, SET, pending)
         assert "unqualified" in str(exc.value)
 
+    @pytest.mark.parametrize("pending", [
+        "id_tuition IS NOT NULL", "start_time < now()", "is_test = false",
+    ])
+    def test_a_column_containing_the_alias_text_is_not_a_qualification(self, make_plpy, pending):
+        # Failing on 0.0.7: the guard looks for the substring "_t" anywhere, so every
+        # column containing it is refused. Observed on PRE 2026-10-02, probe
+        # aflib-007-accept-r1, case `batch`: `id_tuition IS NOT NULL` raised ValueError.
+        fake = _plpy(make_plpy, 0, 0)
+        Batch(fake).run(TABLE, SET, pending)
+        assert _sql(fake.executed[0]).count(pending) == 2
+
 
 class TestChunkBoundaries:
     def test_limit_bounds_the_subquery_not_the_update(self, make_plpy):

aflib-0.0.9/tests/test_config.py

@@ -0,0 +1,73 @@
+"""config.get reads a platform variable with a bound query. Observed on PRE, aflib-edge-r1."""
+
+import json
+
+import pytest
+
+from aflib import codec, config, errors, logging
+
+
+def test_reads_the_value_with_the_name_bound_not_interpolated(make_plpy):
+    fake = make_plpy(rows=[{"value": "https://iam.example"}])
+    assert config.get(fake, "IAM_URL") == "https://iam.example"
+    _, plan_sql, types = fake.prepared[0]
+    assert "$1" in plan_sql and '"Models"."Variable"' in plan_sql
+    assert types == ("text",)
+    assert fake.executed[0][1] == ["IAM_URL"]
+
+
+def test_a_name_with_a_quote_is_only_ever_a_bound_value(make_plpy):
+    # The platform's own get_env_variable puts the name inside the SQL text (G92).
+    fake = make_plpy(rows=[], colnames=["value"])
+    assert config.get(fake, "X' OR '1'='1") is None
+    _, plan_sql, _ = fake.prepared[0]
+    assert "OR" not in plan_sql
+    assert fake.executed[0][1] == ["X' OR '1'='1"]
+
+
+def test_a_missing_variable_is_none(make_plpy):
+    assert config.get(make_plpy(rows=[], colnames=["value"]), "NOPE") is None
+
+
+@pytest.mark.parametrize("rows", [[], [{"value": None}], [{"value": "  "}]])
+def test_required_refuses_missing_null_and_blank(make_plpy, rows):
+    fake = make_plpy(rows=rows, colnames=["value"])
+    with pytest.raises(config.MissingConfig) as info:
+        config.get(fake, "IAM_URL", required=True)
+    assert "IAM_URL" in str(info.value)
+
+
+def test_a_missing_required_variable_is_an_internal_error_for_the_caller(make_plpy):
+    # Misconfiguration is never the caller's fault, and the variable's name is not theirs
+    # to know: it goes to the log only.
+    fake = make_plpy(rows=[], colnames=["value"])
+    log = logging.logger(fake, source="Demo.fn")
+    try:
+        config.get(fake, "IAM_URL", required=True)
+    except Exception as exc:
+        envelope = errors.to_fail(exc, log=log)
+    assert json.loads(envelope)["error"]["code"] == "internal_error"
+    assert "IAM_URL" not in envelope
+    assert "IAM_URL" in fake.logged[0]
+
+
+def test_a_secret_hides_its_value_from_str_repr_and_logs(make_plpy):
+    fake = make_plpy(rows=[{"value": "s3cr3t"}])
+    key = config.get(fake, "API_KEY", secret=True)
+    assert key.reveal() == "s3cr3t"
+    assert "s3cr3t" not in str(key) and "s3cr3t" not in repr(key)
+    assert "s3cr3t" not in "{}".format(key) and "s3cr3t" not in "%s" % (key,)
+    logging.logger(fake, source="Demo.fn").info("called", key=key)
+    assert "s3cr3t" not in fake.logged[0]
+
+
+def test_a_secret_cannot_be_serialised_into_a_response(make_plpy):
+    key = config.get(make_plpy(rows=[{"value": "s3cr3t"}]), "API_KEY", secret=True)
+    with pytest.raises(TypeError):
+        codec.dumps({"key": key})
+    with pytest.raises(TypeError):
+        json.dumps({"key": key})
+
+
+def test_a_missing_secret_is_none_not_an_empty_secret(make_plpy):
+    assert config.get(make_plpy(rows=[], colnames=["value"]), "API_KEY", secret=True) is None

aflib-0.0.9/tests/test_http.py

@@ -0,0 +1,131 @@
+"""http: urllib with a mandatory timeout, and errors that never carry the URL. Probe aflib-edge-r1."""
+
+import io
+import json
+import urllib.error
+
+import pytest
+
+from aflib import errors, http, logging
+
+TOKEN = "s3cr3ttoken"
+URL = "https://api.example/v1/things?token=" + TOKEN
+
+
+class FakeResponse:
+    def __init__(self, status=200, body=b"", headers=None):
+        self.status = status
+        self.headers = headers or {}
+        self._body = body
+
+    def read(self):
+        return self._body
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+@pytest.fixture()
+def opened(monkeypatch):
+    """Records each urlopen call; `opened.reply` decides what it returns or raises."""
+    calls = []
+
+    def fake_urlopen(request, timeout=None):
+        calls.append({"request": request, "timeout": timeout})
+        reply = calls_reply[0]
+        if isinstance(reply, BaseException):
+            raise reply
+        return reply
+
+    calls_reply = [FakeResponse(200, b'{"a": 1}')]
+    monkeypatch.setattr(http, "_urlopen", fake_urlopen)
+
+    class Opened(list):
+        def reply(self, value):
+            calls_reply[0] = value
+
+    opened = Opened()
+    opened.calls = calls
+    return opened
+
+
+def test_the_timeout_is_mandatory(opened):
+    with pytest.raises(TypeError):
+        http.request("GET", URL)
+    for bad in (None, 0, -1):
+        with pytest.raises(ValueError):
+            http.request("GET", URL, timeout=bad)
+    assert opened.calls == []
+
+
+@pytest.mark.parametrize("url", ["file:///etc/passwd", "ftp://host/x", "/relative", "api.example/x"])
+def test_only_http_and_https_urls_are_opened(opened, url):
+    # urllib would open file:// and ftp:// too; from a body that reads the database server.
+    with pytest.raises(ValueError):
+        http.request("GET", url, timeout=5)
+    assert opened.calls == []
+
+
+def test_sends_method_headers_json_body_and_the_timeout(opened):
+    r = http.request("POST", URL, timeout=7, headers={"Authorization": "Bearer x"},
+                     json_body={"n": 1})
+    req = opened.calls[0]["request"]
+    assert opened.calls[0]["timeout"] == 7
+    assert req.get_method() == "POST"
+    assert req.get_header("Authorization") == "Bearer x"
+    assert req.get_header("Content-type") == "application/json"
+    assert json.loads(req.data) == {"n": 1}
+    assert (r.status, r.ok, r.json(), r.text) == (200, True, {"a": 1}, '{"a": 1}')
+
+
+def test_json_body_and_data_are_exclusive(opened):
+    with pytest.raises(ValueError):
+        http.request("POST", URL, timeout=5, json_body={}, data=b"x")
+
+
+def test_an_http_error_status_is_a_response_not_an_exception(opened):
+    opened.reply(urllib.error.HTTPError(URL, 503, "SERVICE UNAVAILABLE", {}, io.BytesIO(b"down")))
+    r = http.request("GET", URL, timeout=5)
+    assert (r.status, r.ok, r.body) == (503, False, b"down")
+
+
+def test_raise_for_status_names_status_and_host_only(opened):
+    opened.reply(urllib.error.HTTPError(URL, 503, "SERVICE UNAVAILABLE", {}, io.BytesIO(b"")))
+    r = http.request("GET", URL, timeout=5)
+    with pytest.raises(http.HttpError) as info:
+        r.raise_for_status()
+    text = str(info.value)
+    assert "503" in text and "api.example" in text
+    assert TOKEN not in text and "/v1/things" not in text
+    assert info.value.kind == "status" and info.value.status == 503
+    assert http.request("GET", URL, timeout=5).status == 503  # 2xx-only check is opt-in
+
+
+@pytest.mark.parametrize("raised, kind", [
+    (TimeoutError("The read operation timed out"), "timeout"),
+    (urllib.error.URLError("[Errno -2] Name or service not known"), "connection"),
+    (ConnectionResetError("reset by peer"), "connection"),
+])
+def test_network_failures_raise_http_error_without_the_url(opened, raised, kind):
+    opened.reply(raised)
+    with pytest.raises(http.HttpError) as info:
+        http.request("GET", URL, timeout=2)
+    assert info.value.kind == kind
+    assert TOKEN not in str(info.value) and "/v1/things" not in str(info.value)
+    # The original exception is dropped, so no traceback can print it either.
+    assert info.value.__cause__ is None and info.value.__suppress_context__
+
+
+def test_an_http_error_reaches_the_caller_as_an_internal_error(opened, make_plpy):
+    opened.reply(TimeoutError("timed out"))
+    fake = make_plpy()
+    try:
+        http.request("GET", URL, timeout=2)
+    except Exception as exc:
+        envelope = errors.to_fail(exc, log=logging.logger(fake, source="Demo.fn"))
+    assert json.loads(envelope)["error"]["code"] == "internal_error"
+    assert TOKEN not in envelope and TOKEN not in fake.logged[0]
+    assert "api.example" in fake.logged[0]

aflib-0.0.9/tests/test_identity.py

@@ -0,0 +1,57 @@
+"""current_user is the caller. Observed on PRE; getUserId() was absent."""
+
+import pytest
+
+from aflib import identity
+
+
+def test_current_user_reads_the_sql_builtin(make_plpy):
+    fake = make_plpy(rows=[{"u": "alice"}], colnames=["u"])
+    assert identity.current_user(fake) == "alice"
+    sql, args = fake.executed[0]
+    assert "current_user" in sql
+    assert args is None
+
+
+def _role_fake(make_plpy, caller="javier_director"):
+    # Each statement gets its own result: current_user, then the two SET ROLEs.
+    return make_plpy(results=[([{"u": caller}], ["u"])] + [([], [])] * 4)
+
+
+def _statements(fake):
+    return [sql for sql, _ in fake.executed]
+
+
+def test_unscoped_elevates_and_restores_the_caller(make_plpy):
+    fake = _role_fake(make_plpy)
+    with identity.unscoped(fake) as caller:
+        assert caller == "javier_director"
+        assert _statements(fake)[-1] == "SET ROLE modelsadmin"
+    assert _statements(fake)[-1] == "SET ROLE javier_director"
+
+
+@pytest.mark.parametrize("boom", [ValueError("python"), RuntimeError("sql stand-in")])
+def test_unscoped_restores_the_caller_when_the_block_raises(make_plpy, boom):
+    fake = _role_fake(make_plpy)
+    with pytest.raises(type(boom)) as info:
+        with identity.unscoped(fake):
+            raise boom
+    assert info.value is boom
+    assert _statements(fake)[-1] == "SET ROLE javier_director"
+
+
+def test_unscoped_never_resets_the_role(make_plpy):
+    # session_user is the pool's login role, postgres (G15): RESET ROLE would leave the
+    # connection as a superuser.
+    fake = _role_fake(make_plpy)
+    with identity.unscoped(fake):
+        pass
+    assert not any("RESET" in sql.upper() for sql in _statements(fake))
+
+
+def test_unscoped_quotes_both_role_names(make_plpy):
+    fake = _role_fake(make_plpy, caller='Odd"Name')
+    with identity.unscoped(fake, role="modelsadmin; SELECT 1"):
+        pass
+    assert _statements(fake)[1] == 'SET ROLE "modelsadmin; SELECT 1"'
+    assert _statements(fake)[-1] == 'SET ROLE "Odd""Name"'

{aflib-0.0.7 → aflib-0.0.9}/tests/test_trigger.py

@@ -37,6 +37,15 @@ def test_search_and_update_by_trigger_are_noise_by_default():
     assert changed(td) == set()
 
 
+def test_updated_by_trigger_spelling_is_noise_too():
+    # Both spellings exist in the consuming model, three entities each.
+    td = {
+        "old": {"id_status": 22, "updated_by_trigger": False},
+        "new": {"id_status": 22, "updated_by_trigger": True},
+    }
+    assert changed(td) == set()
+
+
 def test_insert_treats_new_columns_as_changed():
     td = {"event": "INSERT", "old": None, "new": {"id": 1, "search": "x"}}
     assert changed(td) == {"id"}

aflib-0.0.7/src/aflib/identity.py

@@ -1,20 +0,0 @@
-"""Who is running this body.
-
-A plpython body has no request object. The platform sets the connection
-role to a Postgres role named after the caller's username — observed:
-`current_user` is the caller, not a GUC and not `getUserId()` (that
-name did not exist on the instance, 2026-09-17).
-
-    from aflib import identity
-
-    who = identity.current_user(plpy)
-
-This is the string. Mapping it to `Models.User` is a domain query, not
-this module. Do not cache it in `GD`/`SD`.
-"""
-
-
-def current_user(plpy) -> str:
-    """`SELECT current_user` — the connection role for this call."""
-    row = plpy.execute("SELECT current_user AS u")[0]
-    return row["u"]

aflib-0.0.7/tests/test_identity.py

@@ -1,11 +0,0 @@
-"""current_user is the caller. Observed on PRE; getUserId() was absent."""
-
-from aflib import identity
-
-
-def test_current_user_reads_the_sql_builtin(make_plpy):
-    fake = make_plpy(rows=[{"u": "alice"}], colnames=["u"])
-    assert identity.current_user(fake) == "alice"
-    sql, args = fake.executed[0]
-    assert "current_user" in sql
-    assert args is None