altcodepro-polydb-python 2.5.20__tar.gz → 2.5.22__tar.gz

{altcodepro_polydb_python-2.5.20/src/altcodepro_polydb_python.egg-info → altcodepro_polydb_python-2.5.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altcodepro-polydb-python
-Version: 2.5.20
+Version: 2.5.22
 Summary: Production-ready multi-cloud database abstraction layer with connection pooling, retry logic, and thread safety
 Author: AltCodePro
 Project-URL: Homepage, https://github.com/altcodepro/polydb-python

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "altcodepro-polydb-python"
-version = "2.5.20"
+version = "2.5.22"
 description = "Production-ready multi-cloud database abstraction layer with connection pooling, retry logic, and thread safety"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.11"

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22/src/altcodepro_polydb_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altcodepro-polydb-python
-Version: 2.5.20
+Version: 2.5.22
 Summary: Production-ready multi-cloud database abstraction layer with connection pooling, retry logic, and thread safety
 Author: AltCodePro
 Project-URL: Homepage, https://github.com/altcodepro/polydb-python

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22}/src/altcodepro_polydb_python.egg-info/SOURCES.txt

@@ -78,6 +78,7 @@ src/polydb/base/QueueAdapter.py
 src/polydb/base/SecretsAdapter.py
 src/polydb/base/SharedFilesAdapter.py
 src/polydb/base/__init__.py
+src/polydb/base/constraints.py
 src/polydb/observability/__init__.py
 src/polydb/observability/logging.py
 src/polydb/services/__init__.py
@@ -90,11 +91,13 @@ tests/test_audit_chain_cutover.py
 tests/test_audit_hmac.py
 tests/test_aws.py
 tests/test_azure.py
+tests/test_azure_keyvault_credential.py
 tests/test_azure_queue_receipt_handle.py
 tests/test_azure_table_empty_filter.py
 tests/test_azure_table_id_property_persisted.py
 tests/test_azure_table_id_return_value_sanitization_mismatch.py
 tests/test_azure_table_large_record_patch_roundtrip.py
+tests/test_azure_table_self_heal.py
 tests/test_azure_table_unpack_entity.py
 tests/test_blockchain.py
 tests/test_blockchain_overflow_guard.py
@@ -108,6 +111,7 @@ tests/test_mongodb.py
 tests/test_monitoring_health.py
 tests/test_multi_engine.py
 tests/test_multitenancy_ddl_injection.py
+tests/test_nosql_constraints.py
 tests/test_nosql_kv_overflow_write_path.py
 tests/test_nosql_operator_injection.py
 tests/test_observability.py

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22}/src/polydb/__init__.py

@@ -4,7 +4,7 @@ PolyDB - Enterprise Cloud-Independent Database Abstraction
 Full LINQ support, field-level audit, cache, soft delete, overflow storage
 """
 
-__version__ = "2.5.20"
+__version__ = "2.5.22"
 
 from .aio import AsyncDatabaseFactory, AsyncPolyDB
 from .audit.context import AuditContext

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22}/src/polydb/adapters/AzureKeyVaultAdapter.py

@@ -19,10 +19,24 @@ class AzureKeyVaultAdapter(SecretsAdapter):
         self._initialize_client()
 
     def _initialize_client(self) -> None:
-        from azure.identity import DefaultAzureCredential
         from azure.keyvault.secrets import SecretClient
 
-        self._client = SecretClient(vault_url=self.vault_url, credential=DefaultAzureCredential())
+        self._client = SecretClient(vault_url=self.vault_url, credential=self._build_credential())
+
+    @staticmethod
+    def _build_credential():
+        """Inside Azure Container Apps / App Service / Functions a managed identity is available
+        (IDENTITY_ENDPOINT / MSI_ENDPOINT). DefaultAzureCredential tries EnvironmentCredential FIRST, and a deployment that
+        also exports AZURE_CLIENT_ID + AZURE_CLIENT_SECRET (for some other purpose) then fails with AADSTS7000232
+        "MSI identity should not use ClientSecretCredential". So when a managed identity exists it goes first
+        (AZURE_CLIENT_ID, if set, names a user-assigned identity); the normal chain stays as the fallback, so local
+        development (az login, environment variables) behaves as before."""
+        from azure.identity import ChainedTokenCredential, DefaultAzureCredential, ManagedIdentityCredential
+
+        if os.getenv("IDENTITY_ENDPOINT") or os.getenv("MSI_ENDPOINT"):
+            client_id = os.getenv("AZURE_CLIENT_ID") or None
+            return ChainedTokenCredential(ManagedIdentityCredential(client_id=client_id), DefaultAzureCredential())
+        return DefaultAzureCredential()
 
     # Key Vault secret names may only contain alphanumerics and dashes --
     # our secret keys (e.g. "tenant-42/stripe/api_key") use slashes, so

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22}/src/polydb/adapters/AzureTableStorageAdapter.py

@@ -40,6 +40,10 @@ _BASE64_RE = re.compile(r"^[A-Za-z0-9+/]*={0,2}$")
 # ensures model isolation across the same table
 _MODEL_FIELD = "__polydb_model__"
 
+
+class _AlreadyExists(Exception):
+    """create_entity found the (PartitionKey, RowKey) taken. Deliberately NOT a NoSQLError so `@retry` does not retry it."""
+
 _CONNECT_TIMEOUT = float(os.getenv("AZURE_TABLE_CONNECT_TIMEOUT", "10"))
 _READ_TIMEOUT = float(os.getenv("AZURE_TABLE_READ_TIMEOUT", "30"))
 _RETRY_TOTAL = int(os.getenv("AZURE_TABLE_RETRY_TOTAL", "3"))
@@ -47,6 +51,59 @@ _RETRY_TOTAL = int(os.getenv("AZURE_TABLE_RETRY_TOTAL", "3"))
 logging.getLogger("azure").setLevel(logging.ERROR)
 
 
+
+def _is_table_missing(exc: BaseException) -> bool:
+    text = f"{type(exc).__name__} {exc}"
+    return "TableNotFound" in text or "The table specified does not exist" in text
+
+
+class _SelfHealingTableClient:
+    """Wraps an Azure TableClient so a table that disappears while the process is running (deleted by hand, a data
+    reset, a restore) is created again and the operation retried once, instead of failing with TableNotFound until
+    the process restarts. Lazy iterators (query_entities / list_entities) are healed only if the failure happens
+    before the first row was produced."""
+
+    _LAZY = ("query_entities", "list_entities")
+
+    def __init__(self, adapter: "AzureTableStorageAdapter", table_name: str, client: Any):
+        self._adapter = adapter
+        self._table_name = table_name
+        self._client = client
+
+    def _heal(self) -> None:
+        self._adapter._ensured_tables.discard(self._table_name)
+        self._adapter._client.create_table_if_not_exists(self._table_name)
+        self._adapter._ensured_tables.add(self._table_name)
+        logger.warning(f"Azure Table {self._table_name} was missing; created it again")
+
+    def __getattr__(self, name: str):
+        target = getattr(self._client, name)
+        if not callable(target):
+            return target
+        if name in self._LAZY:
+            def lazy(*args, **kwargs):
+                produced = False
+                try:
+                    for item in target(*args, **kwargs):
+                        produced = True
+                        yield item
+                except Exception as exc:  # noqa: BLE001
+                    if produced or not _is_table_missing(exc):
+                        raise
+                    self._heal()
+                    yield from getattr(self._client, name)(*args, **kwargs)
+            return lazy
+
+        def call(*args, **kwargs):
+            try:
+                return target(*args, **kwargs)
+            except Exception as exc:  # noqa: BLE001
+                if not _is_table_missing(exc):
+                    raise
+                self._heal()
+                return getattr(self._client, name)(*args, **kwargs)
+        return call
+
 class AzureTableStorageAdapter(NoSQLKVAdapter):
     """
     Azure Table Storage adapter with:
@@ -441,17 +498,21 @@ class AzureTableStorageAdapter(NoSQLKVAdapter):
                 try:
                     self._client.create_table_if_not_exists(table_name)
                     logger.info(f"✅ Azure Table ensured/created: {table_name}")
+                    self._ensured_tables.add(table_name)
                 except Exception as e:
                     msg = str(e)
-                    if "TableAlreadyExists" not in msg and "already exists" not in msg.lower():
-                        logger.warning(f"Could not create table {table_name}: {e}")
-                self._ensured_tables.add(table_name)
+                    if "TableAlreadyExists" in msg or "already exists" in msg.lower():
+                        self._ensured_tables.add(table_name)
+                    else:
+                        # Do NOT remember a failed creation as "ensured": the next call tries again instead of
+                        # failing with TableNotFound for the rest of the process's life.
+                        logger.error(f"Could not create table {table_name}: {e}")
 
             if cached is None:
                 cached = self._client.get_table_client(table_name=table_name)
                 self._table_clients_cache[table_name] = cached
 
-            return cached
+            return _SelfHealingTableClient(self, table_name, cached)
 
     def _restore_overflow_properties(self, entity_dict: JsonDict) -> JsonDict:
         restored = {}
@@ -500,7 +561,9 @@ class AzureTableStorageAdapter(NoSQLKVAdapter):
         return restored
 
     @retry(max_attempts=3, delay=1.0, exceptions=(NoSQLError,))
-    def _put_raw(self, model: type, pk: str, rk: str, data: JsonDict) -> JsonDict:
+    def _put_raw(
+        self, model: type, pk: str, rk: str, data: JsonDict, *, _insert_only: bool = False
+    ) -> JsonDict:
         try:
             table_client = self._get_table_client(model)
             safe_pk = self._sanitize_pk_rk(pk)
@@ -575,7 +638,10 @@ class AzureTableStorageAdapter(NoSQLKVAdapter):
                 else:
                     reference_entity[k] = v
 
-            table_client.upsert_entity(reference_entity)
+            if _insert_only:
+                table_client.create_entity(reference_entity)  # 409 when the key is taken: atomic claim
+            else:
+                table_client.upsert_entity(reference_entity)
 
             restored = self._unpack_entity(model, entity)
             # Mirror the write-side condition above (line ~521): only
@@ -602,11 +668,27 @@ class AzureTableStorageAdapter(NoSQLKVAdapter):
             return restored
 
         except Exception as e:
+            if _insert_only and (
+                type(e).__name__ == "ResourceExistsError" or "EntityAlreadyExists" in str(e)
+            ):
+                raise _AlreadyExists() from e
             if "PropertyValueTooLarge" in str(e):
                 raise NoSQLError("Azure Table limit exceeded → must use blob overflow") from e
 
             raise NoSQLError(f"Azure Table put failed: {str(e)}")
 
+    def _put_new_raw(self, model: type, pk: str, rk: str, data: JsonDict) -> bool:
+        """Atomic insert-if-absent via Table Storage's `create_entity` (HTTP 409 when the key exists)."""
+        try:
+            self._put_raw(model, pk, rk, data, _insert_only=True)
+            return True
+        except _AlreadyExists:
+            return False
+
+    def _query_partition_raw(self, model: type, partition: str, limit: Optional[int]) -> List[JsonDict]:
+        """One partition -- a PartitionKey filter, not a table scan."""
+        return self._query_raw(model, {"partition_key": partition}, limit)
+
     @retry(max_attempts=3, delay=1.0, exceptions=(NoSQLError,))
     def _get_raw(self, model: type, pk: str, rk: str) -> Optional[JsonDict]:
         try:

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22}/src/polydb/base/NoSQLKVAdapter.py

@@ -12,6 +12,7 @@ from ..json_safe import json_safe
 from ..query import Operator, QueryBuilder
 from ..retry import retry
 from ..types import JsonDict, Lookup
+from .constraints import NoSQLConstraintsMixin, UniqueConstraintError  # noqa: F401  (re-exported)
 
 if TYPE_CHECKING:
     from ..models import PartitionConfig
@@ -46,7 +47,7 @@ def select_columns(
     return None
 
 
-class NoSQLKVAdapter:
+class NoSQLKVAdapter(NoSQLConstraintsMixin):
     """Base with auto-overflow and LINQ support"""
 
     # An adapter sets this True when its `_query_raw` accepts `select=[property names]` and really sends it to the store (Azure
@@ -266,8 +267,16 @@ class NoSQLKVAdapter:
     # Protocol implementation
     def put(self, model: type, data: JsonDict) -> JsonDict:
         pk, rk = self._get_pk_rk(model, data)
-        store_data, _ = self._check_overflow(data)
-        return self._put_raw(model, pk, rk, store_data)
+
+        def _write() -> JsonDict:
+            store_data, _ = self._check_overflow(data)
+            return self._put_raw(model, pk, rk, store_data)
+
+        uq, ix = self._constraint_fields(model)
+        if not (uq or ix):
+            return _write()
+        previous = self._get_raw(model, pk, rk)
+        return self._constrained_write(model, pk, rk, previous, {**(previous or {}), **data}, _write)
 
     def query(
         self,
@@ -279,6 +288,9 @@ class NoSQLKVAdapter:
         fields: Optional[List[str]] = None,
         omit: Optional[List[str]] = None,
     ) -> List[JsonDict]:
+        indexed = self._indexed_query(model, query or {}, limit)
+        if indexed is not None:
+            return project_rows([self._retrieve_overflow(r) for r in indexed], fields, omit)
         select = select_columns(fields, omit, getattr(model, "__polydb__", {}).get("columns"))
         if select is not None and self.SUPPORTS_SELECT_PUSHDOWN:
             results = self._query_raw(model, query or {}, limit, select=select)
@@ -318,15 +330,25 @@ class NoSQLKVAdapter:
         else:
             pk, rk = self._get_pk_rk(model, {"id": entity_id, **data})
 
-        if not replace:
+        uq, ix = self._constraint_fields(model)
+        constrained = bool(uq or ix) and pk is not None
+        previous: Optional[JsonDict] = None
+        if not replace or constrained:
             existing = self._get_raw(model, pk, rk)  # type: ignore
             if existing:
                 existing = self._retrieve_overflow(existing)
-                existing.update(data)
-                data = existing
+                previous = dict(existing)
+                if not replace:
+                    existing.update(data)
+                    data = existing
+
+        def _write() -> JsonDict:
+            store_data, _ = self._check_overflow(data)
+            return self._put_raw(model, pk, rk, store_data)  # type: ignore
 
-        store_data, _ = self._check_overflow(data)
-        return self._put_raw(model, pk, rk, store_data)  # type: ignore
+        if not constrained:
+            return _write()
+        return self._constrained_write(model, pk, rk, previous, data, _write)  # type: ignore[arg-type]
 
     def upsert(self, model: type, data: JsonDict, *, replace: bool = False) -> JsonDict:
         return self.put(model, data)
@@ -340,7 +362,13 @@ class NoSQLKVAdapter:
         else:
             pk, rk = self._get_pk_rk(model, {"id": entity_id})
 
-        return self._delete_raw(model, pk, rk, etag)  # type: ignore
+        uq, ix = self._constraint_fields(model)
+        if not (uq or ix) or pk is None:
+            return self._delete_raw(model, pk, rk, etag)  # type: ignore
+        existing = self._get_raw(model, pk, rk)  # type: ignore
+        result = self._delete_raw(model, pk, rk, etag)  # type: ignore
+        self._release_all(model, pk, rk, existing)
+        return result
 
     def query_linq_rows(self, model: type, builder: QueryBuilder) -> List[JsonDict]:
         """

altcodepro_polydb_python-2.5.22/src/polydb/base/constraints.py

@@ -0,0 +1,260 @@
+# src/polydb/base/constraints.py
+"""
+Unique constraints and equality lookup indexes for key/value NoSQL stores.
+
+Table Storage (and every other KV backend here) enforces uniqueness only for the (PartitionKey, RowKey) pair and can only be
+queried efficiently by those two keys. A model that declares `unique_fields` / `index_fields` in `__polydb__` gets both from this
+mixin, on every NoSQL adapter, with no per-provider code beyond one primitive (`_put_new_raw`, insert-if-absent).
+
+How it works -- two hidden side tables per model (`<table>uq`, `<table>ix`):
+
+* UNIQUE   one "claim" row per (field, value): PartitionKey = u<2 hex of the hash>, RowKey = sha256(field, value). The claim is
+           written with an INSERT-IF-ABSENT before the entity, so two writers racing for one value cannot both succeed. A
+           duplicate raises UniqueConstraintError. The claim names its owner entity; a claim whose owner no longer exists, or
+           whose owner moved to another value (a crash between the claim and the entity write), is taken over.
+* INDEX    one row per (field, value, entity): PartitionKey = i<hash of (field, value)>, RowKey = hash of the entity key. An
+           equality query on an indexed field reads that one partition, then point-reads each owner and re-checks every filter,
+           so a stale index row can never produce a wrong result (it is skipped).
+
+Ordering: claims and index rows are written BEFORE the entity and removed AFTER a delete / value change, so a visible entity
+always has its rows. The residue of a crash is a stale row, which is harmless (verified on read, taken over on the next claim).
+
+Not covered: rows written before a field was declared have no claim/index row -- run `rebuild_constraints()` once. Backends
+without a native conditional insert fall back to a non-atomic get-then-put (documented on `_put_new_raw`).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+from typing import Any, Dict, List, Optional, Tuple
+
+from ..errors import NoSQLError
+from ..types import JsonDict
+
+_UNSAFE_KEY = re.compile(r"[\\/#\?\x00-\x1f\x7f:+ ]")
+_UQ, _IX = "uq", "ix"
+
+
+class UniqueConstraintError(NoSQLError):
+    """A write would create a second row with a value a `unique_fields` field already holds."""
+
+    def __init__(self, field: str, value: Any):
+        super().__init__(f"unique constraint violated on {field!r}")
+        self.field = field
+        self.value = value
+
+
+def normalize_value(value: Any) -> Optional[str]:
+    """The string two values are compared as. None/empty/containers carry no constraint."""
+    if value is None or isinstance(value, (dict, list, tuple, set)):
+        return None
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    text = str(value)
+    return text if text != "" else None
+
+
+def _digest(*parts: str) -> str:
+    return hashlib.sha256("\x1f".join(parts).encode("utf-8")).hexdigest()
+
+
+class NoSQLConstraintsMixin:
+    """Mixed into NoSQLKVAdapter. Needs `_get_raw`, `_put_raw`, `_delete_raw`, `_query_raw`, `_get_pk_rk`."""
+
+    # -- metadata ---------------------------------------------------------------------------------------------------------
+
+    @staticmethod
+    def _constraint_fields(model: type) -> Tuple[Tuple[str, ...], Tuple[str, ...]]:
+        meta = getattr(model, "__polydb__", None) or {}
+        return tuple(meta.get("unique_fields") or ()), tuple(meta.get("index_fields") or ())
+
+    def _side_model(self, model: type, suffix: str) -> type:
+        cache = self.__dict__.setdefault("_side_models", {})
+        meta = getattr(model, "__polydb__", None) or {}
+        base = meta.get("collection") or meta.get("collection_name") or meta.get("table") or getattr(model, "__name__", "model")
+        base = re.sub(r"[^A-Za-z0-9]", "", str(base)).lower()[:58] or "model"
+        key = (base, suffix)
+        if key not in cache:
+            name = f"{base}{suffix}"
+            cache[key] = type(name, (), {"__polydb__": {"storage": "nosql", "table": name, "pk_field": "bucket", "rk_field": "id"}})
+        return cache[key]
+
+    # -- insert-if-absent primitive ----------------------------------------------------------------------------------------
+
+    def _put_new_raw(self, model: type, pk: str, rk: str, data: JsonDict) -> bool:
+        """Insert only when (pk, rk) is absent. True = inserted, False = already there. This default is get-then-put and is NOT
+        atomic; an adapter with a native conditional create (Azure `create_entity`, Dynamo `attribute_not_exists`, ...) overrides."""
+        if self._get_raw(model, pk, rk) is not None:  # type: ignore[attr-defined]
+            return False
+        self._put_raw(model, pk, rk, data)  # type: ignore[attr-defined]
+        return True
+
+    def _query_partition_raw(self, model: type, partition: str, limit: Optional[int]) -> List[JsonDict]:
+        """Every row of one partition. Portable default: a property equality on the mirrored `ix_bucket` field."""
+        return self._query_raw(model, {"ix_bucket": partition}, limit)  # type: ignore[attr-defined]
+
+    # -- side-row helpers --------------------------------------------------------------------------------------------------
+
+    def _safe_delete(self, model: type, pk: str, rk: str) -> None:
+        try:
+            self._delete_raw(model, pk, rk, None)  # type: ignore[attr-defined]
+        except Exception:  # already gone, or the row was never written
+            pass
+
+    def _claim(self, model: type, pk: str, rk: str, field: str, value: str) -> None:
+        side = self._side_model(model, _UQ)
+        h = _digest(field, value)
+        spk = f"u{h[:2]}"
+        row = {"bucket": spk, "ix_bucket": spk, "id": h, "field": field, "owner_pk": pk, "owner_rk": rk}
+        for _ in range(4):
+            if self._put_new_raw(side, spk, h, row):
+                return
+            cur = self._get_raw(side, spk, h)  # type: ignore[attr-defined]
+            if cur is None:  # released between our insert and our read
+                continue
+            if (cur.get("owner_pk"), cur.get("owner_rk")) == (pk, rk):
+                return  # our own claim (an idempotent retry)
+            owner = self._get_raw(model, cur.get("owner_pk"), cur.get("owner_rk"))  # type: ignore[attr-defined]
+            if owner is not None and normalize_value(owner.get(field)) == value:
+                raise UniqueConstraintError(field, value)
+            self._safe_delete(side, spk, h)  # orphaned or moved-on claim: take it over
+        raise UniqueConstraintError(field, value)
+
+    def _release(self, model: type, pk: str, rk: str, field: str, value: str) -> None:
+        side = self._side_model(model, _UQ)
+        h = _digest(field, value)
+        spk = f"u{h[:2]}"
+        cur = self._get_raw(side, spk, h)  # type: ignore[attr-defined]
+        if cur is not None and (cur.get("owner_pk"), cur.get("owner_rk")) == (pk, rk):
+            self._safe_delete(side, spk, h)
+
+    def _index_key(self, field: str, value: str, pk: str, rk: str) -> Tuple[str, str]:
+        return f"i{_digest(field, value)}", _digest(str(pk), str(rk))
+
+    def _index_put(self, model: type, pk: str, rk: str, field: str, value: str) -> None:
+        side = self._side_model(model, _IX)
+        spk, srk = self._index_key(field, value, pk, rk)
+        row = {"bucket": spk, "ix_bucket": spk, "id": srk, "field": field, "owner_pk": pk, "owner_rk": rk}
+        self._put_raw(side, spk, srk, row)  # type: ignore[attr-defined]
+
+    def _index_del(self, model: type, pk: str, rk: str, field: str, value: str) -> None:
+        spk, srk = self._index_key(field, value, pk, rk)
+        self._safe_delete(self._side_model(model, _IX), spk, srk)
+
+    # -- write path --------------------------------------------------------------------------------------------------------
+
+    def _constrained_write(self, model: type, pk: str, rk: str, previous: Optional[JsonDict], new: JsonDict, write):
+        """Claim -> index -> entity write -> release/remove the old rows. `new` is the row as it will exist afterwards."""
+        uq, ix = self._constraint_fields(model)
+        prev = previous or {}
+        claimed: List[Tuple[str, str]] = []
+        try:
+            for f in uq:
+                nv, ov = normalize_value(new.get(f)), normalize_value(prev.get(f))
+                if nv is not None and nv != ov:
+                    self._claim(model, pk, rk, f, nv)
+                    claimed.append((f, nv))
+            for f in ix:
+                nv, ov = normalize_value(new.get(f)), normalize_value(prev.get(f))
+                if nv is not None and nv != ov:
+                    self._index_put(model, pk, rk, f, nv)
+            result = write()
+        except Exception:
+            for f, v in claimed:
+                self._release(model, pk, rk, f, v)
+            raise
+        for f in uq:
+            nv, ov = normalize_value(new.get(f)), normalize_value(prev.get(f))
+            if ov is not None and ov != nv:
+                self._release(model, pk, rk, f, ov)
+        for f in ix:
+            nv, ov = normalize_value(new.get(f)), normalize_value(prev.get(f))
+            if ov is not None and ov != nv:
+                self._index_del(model, pk, rk, f, ov)
+        return result
+
+    def _release_all(self, model: type, pk: str, rk: str, row: Optional[JsonDict]) -> None:
+        if not row:
+            return
+        uq, ix = self._constraint_fields(model)
+        for f in uq:
+            v = normalize_value(row.get(f))
+            if v is not None:
+                self._release(model, pk, rk, f, v)
+        for f in ix:
+            v = normalize_value(row.get(f))
+            if v is not None:
+                self._index_del(model, pk, rk, f, v)
+
+    # -- read path ---------------------------------------------------------------------------------------------------------
+
+    def _lookup_owners(self, model: type, field: str, value: str, limit: Optional[int]) -> List[Tuple[str, str]]:
+        uq, _ = self._constraint_fields(model)
+        h = _digest(field, value)
+        if field in uq:
+            cur = self._get_raw(self._side_model(model, _UQ), f"u{h[:2]}", h)  # type: ignore[attr-defined]
+            return [(cur["owner_pk"], cur["owner_rk"])] if cur else []
+        rows = self._query_partition_raw(self._side_model(model, _IX), f"i{h}", limit)
+        return [(r["owner_pk"], r["owner_rk"]) for r in rows if r.get("owner_pk") is not None]
+
+    @staticmethod
+    def _filter_matches(row: JsonDict, query: Dict[str, Any], pk: str, rk: str) -> bool:
+        for k, want in query.items():
+            if k in ("partition_key", "PartitionKey"):
+                if _UNSAFE_KEY.sub("_", str(pk)) != str(want):
+                    return False
+            elif k in ("row_key", "RowKey"):
+                if _UNSAFE_KEY.sub("_", str(rk)) != str(want):
+                    return False
+            elif want is None:
+                if row.get(k) is not None:
+                    return False
+            elif normalize_value(row.get(k)) != normalize_value(want):
+                return False
+        return True
+
+    def _indexed_query(self, model: type, query: Dict[str, Any], limit: Optional[int]) -> Optional[List[JsonDict]]:
+        """Rows for a query that has an equality on a unique/indexed field, or None when the index cannot serve it."""
+        uq, ix = self._constraint_fields(model)
+        if not query or not (uq or ix):
+            return None
+        if any(isinstance(v, (dict, list, tuple, set)) for v in query.values()):
+            return None
+        for f in (*uq, *ix):
+            nv = normalize_value(query.get(f)) if f in query else None
+            if nv is None:
+                continue
+            out: List[JsonDict] = []
+            for opk, ork in self._lookup_owners(model, f, nv, None):
+                row = self._get_raw(model, opk, ork)  # type: ignore[attr-defined]
+                if row is not None and self._filter_matches(row, query, opk, ork):
+                    out.append(row)
+                    if limit and len(out) >= limit:
+                        break
+            return out
+        return None
+
+    def rebuild_constraints(self, model: type) -> Dict[str, int]:
+        """One-off backfill for rows written before a field was declared unique/indexed. Claims every existing value (the
+        first holder keeps it; a duplicate is reported, not overwritten) and writes every index row."""
+        uq, ix = self._constraint_fields(model)
+        done = {"rows": 0, "claims": 0, "indexed": 0, "duplicates": 0}
+        for row in self._query_raw(model, {}, None):  # type: ignore[attr-defined]
+            pk, rk = self._get_pk_rk(model, row)  # type: ignore[attr-defined]
+            done["rows"] += 1
+            for f in uq:
+                v = normalize_value(row.get(f))
+                if v is None:
+                    continue
+                try:
+                    self._claim(model, pk, rk, f, v)
+                    done["claims"] += 1
+                except UniqueConstraintError:
+                    done["duplicates"] += 1
+            for f in ix:
+                v = normalize_value(row.get(f))
+                if v is not None:
+                    self._index_put(model, pk, rk, f, v)
+                    done["indexed"] += 1
+        return done

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22}/src/polydb/databaseFactory.py

@@ -167,6 +167,8 @@ def _extract_meta(model: Union[type, str]) -> ModelMeta:
                 cache=raw.get("cache", False),
                 cache_ttl=raw.get("cache_ttl"),
                 encrypted_fields=tuple(raw.get("encrypted_fields") or ()),
+                unique_fields=tuple(raw.get("unique_fields") or ()),
+                index_fields=tuple(raw.get("index_fields") or ()),
             )
     return ModelMeta(storage="nosql", table=None, collection=None)
 

{altcodepro_polydb_python-2.5.20 → altcodepro_polydb_python-2.5.22}/src/polydb/types.py

@@ -26,6 +26,9 @@ class ModelMeta:
     cache_ttl: Optional[int] = None
     # Fields stored encrypted when the factory has encryption enabled (a tuple: the dataclass is frozen/hashable).
     encrypted_fields: Tuple[str, ...] = ()
+    # NoSQL: fields that must stay unique across the model / that get an equality lookup index (see base/constraints.py).
+    unique_fields: Tuple[str, ...] = ()
+    index_fields: Tuple[str, ...] = ()
 
 
 @runtime_checkable

altcodepro_polydb_python-2.5.22/tests/test_azure_keyvault_credential.py

@@ -0,0 +1,34 @@
+"""Inside a managed-identity host the managed identity is tried first, so a stray AZURE_CLIENT_SECRET cannot break Key Vault."""
+import sys
+import types
+from unittest.mock import MagicMock
+
+import pytest
+
+
+@pytest.fixture
+def fake_identity(monkeypatch):
+    mod = types.ModuleType("azure.identity")
+    mod.ChainedTokenCredential = MagicMock(name="Chained")
+    mod.DefaultAzureCredential = MagicMock(name="Default")
+    mod.ManagedIdentityCredential = MagicMock(name="MI")
+    monkeypatch.setitem(sys.modules, "azure.identity", mod)
+    return mod
+
+
+def test_a_managed_identity_host_puts_the_managed_identity_first(fake_identity, monkeypatch):
+    from polydb.adapters.AzureKeyVaultAdapter import AzureKeyVaultAdapter
+    monkeypatch.setenv("IDENTITY_ENDPOINT", "http://169.254.0.1/msi")
+    monkeypatch.setenv("AZURE_CLIENT_ID", "mi-client-id")
+    AzureKeyVaultAdapter._build_credential()
+    fake_identity.ManagedIdentityCredential.assert_called_once_with(client_id="mi-client-id")
+    chain_args = fake_identity.ChainedTokenCredential.call_args.args
+    assert chain_args[0] is fake_identity.ManagedIdentityCredential.return_value and chain_args[1] is fake_identity.DefaultAzureCredential.return_value
+
+
+def test_elsewhere_the_default_chain_is_unchanged(fake_identity, monkeypatch):
+    from polydb.adapters.AzureKeyVaultAdapter import AzureKeyVaultAdapter
+    monkeypatch.delenv("IDENTITY_ENDPOINT", raising=False)
+    monkeypatch.delenv("MSI_ENDPOINT", raising=False)
+    assert AzureKeyVaultAdapter._build_credential() is fake_identity.DefaultAzureCredential.return_value
+    fake_identity.ManagedIdentityCredential.assert_not_called()