auditrum 0.3.0__tar.gz → 0.3.2__tar.gz

{auditrum-0.3.0 → auditrum-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auditrum
-Version: 0.3.0
+Version: 0.3.2
 Summary: Auditrum — a PostgreSQL audit system with rich contextual logging and Django integration
 Author-email: Andrei Karbanovich <andrey.karbanovich@icloud.com>
 License: MIT
@@ -39,8 +39,14 @@ Requires-Dist: prometheus-client>=0.17; extra == "observability"
 Requires-Dist: sentry-sdk>=1.30; extra == "observability"
 Provides-Extra: test
 Requires-Dist: pytest>=7.0; extra == "test"
+Requires-Dist: pytest-cov>=5.0; extra == "test"
 Requires-Dist: pytest-django>=4.5; extra == "test"
 Requires-Dist: testcontainers[postgres]>=4.0; extra == "test"
+Requires-Dist: hypothesis>=6.100; extra == "test"
+Requires-Dist: pglast>=6.0; extra == "test"
+Provides-Extra: typecheck
+Requires-Dist: ty==0.0.31; extra == "typecheck"
+Requires-Dist: django-stubs<6,>=5.0; extra == "typecheck"
 Dynamic: license-file
 
 <file name=0 path=README.md>#auditrum
@@ -331,6 +337,7 @@ directly on GitHub. Start with:
 - [Architecture](docs/architecture.md) — schema, indexes, trigger flow, concurrency
 
 Changelog: [CHANGELOG.md](CHANGELOG.md)
+Roadmap to 1.0: [ROADMAP.md](ROADMAP.md)
 
 ---
 

{auditrum-0.3.0 → auditrum-0.3.2}/README.md

@@ -286,6 +286,7 @@ directly on GitHub. Start with:
 - [Architecture](docs/architecture.md) — schema, indexes, trigger flow, concurrency
 
 Changelog: [CHANGELOG.md](CHANGELOG.md)
+Roadmap to 1.0: [ROADMAP.md](ROADMAP.md)
 
 ---
 

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/blame.py

@@ -26,6 +26,12 @@ from psycopg import sql as pg_sql
 
 from auditrum.tracking.spec import validate_identifier
 
+__all__ = [
+    "BlameEntry",
+    "fetch_blame",
+    "format_blame",
+]
+
 
 @dataclass(frozen=True)
 class BlameEntry:

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/cli.py

@@ -1,5 +1,6 @@
 from collections.abc import Callable
 from functools import lru_cache
+from typing import Literal, cast
 
 import structlog
 import typer
@@ -21,6 +22,8 @@ from auditrum.settings import PgAuditSettings
 from auditrum.timetravel import reconstruct_row, reconstruct_table
 from auditrum.triggers import generate_trigger_sql
 
+__all__ = ["app"]
+
 load_dotenv()
 
 log = structlog.get_logger()
@@ -249,7 +252,12 @@ def run_static_sql(
 
     try:
         with connect(dsn=db_dsn) as conn, conn.cursor() as cur:
-            cur.execute(sql)
+            # Trust boundary: `sql` is produced by auditrum's own
+            # generators (schema/triggers/hardening/...), each of which
+            # pipes every identifier through `validate_identifier` before
+            # it reaches an f-string. pglast round-trip fuzzing planned
+            # in ROADMAP 0.4 is the stronger long-term guard.
+            cur.execute(sql)  # ty: ignore[invalid-argument-type]
             conn.commit()
             log.info("SQL successfully executed")
     except Exception as e:
@@ -275,7 +283,9 @@ def execute_or_print_sql(
                 return
 
             with conn.cursor() as cur:
-                cur.execute(sql)
+                # Same trust boundary as run_static_sql: `sql_fn` is one
+                # of auditrum's validated generators.
+                cur.execute(sql)  # ty: ignore[invalid-argument-type]
             conn.commit()
             log.info("SQL successfully executed")
     except Exception as e:
@@ -455,6 +465,7 @@ def blame(
     if fmt not in ("rich", "text", "json"):
         log.error("format must be one of rich/text/json", got=fmt)
         return
+    fmt_choice = cast(Literal["rich", "text", "json"], fmt)
 
     try:
         with connect(dsn=db_dsn) as conn:
@@ -473,7 +484,7 @@ def blame(
     output = format_blame(
         entries,
         field=field,
-        fmt=fmt,  # type: ignore[arg-type]
+        fmt=fmt_choice,
         table=table,
         object_id=object_id,
     )

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/context.py

@@ -7,6 +7,13 @@ from typing import Any
 
 from auditrum.executor import ConnectionExecutor, NullExecutor
 
+__all__ = [
+    "AuditContext",
+    "audit_context",
+    "with_change_reason",
+    "with_context",
+]
+
 _IDENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 
 

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/executor.py

@@ -19,6 +19,13 @@ from collections.abc import Iterator
 from contextlib import contextmanager
 from typing import Any, Protocol, runtime_checkable
 
+__all__ = [
+    "ConnectionExecutor",
+    "CursorProtocol",
+    "NullExecutor",
+    "PsycopgExecutor",
+]
+
 
 class CursorProtocol(Protocol):
     def execute(self, query: Any, params: Any = ...) -> Any: ...

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/hardening.py

@@ -30,6 +30,11 @@ See :doc:`../../docs/hardening.md` for the full deployment guide.
 
 from auditrum.tracking.spec import validate_identifier
 
+__all__ = [
+    "generate_grant_admin_sql",
+    "generate_revoke_sql",
+]
+
 
 def generate_revoke_sql(
     table_name: str = "auditlog",
@@ -78,9 +83,14 @@ def generate_grant_admin_sql(
     retention jobs, while the regular app role can only append new
     entries through the trigger functions.
 
-    The granted privileges include ``INSERT`` so the admin role is the
-    owner of the trigger functions (which run ``SECURITY DEFINER``),
+    The granted privileges include ``INSERT`` so the admin role can be
+    the owner of the trigger functions (which run ``SECURITY DEFINER``),
     and ``UPDATE, DELETE, TRUNCATE`` for maintenance.
+
+    Also grants ``USAGE`` on ``<table>_id_seq`` so the admin role can
+    actually INSERT — direct INSERTs into ``auditlog`` consume the
+    serial-PK sequence, and Postgres requires ``USAGE`` on it
+    independently of the table-level grant.
     """
     validate_identifier(table_name, "table_name")
     validate_identifier(context_table, "context_table")
@@ -91,5 +101,6 @@ def generate_grant_admin_sql(
             f"ON {table_name} TO {admin_role};",
             f"GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER "
             f"ON {context_table} TO {admin_role};",
+            f"GRANT USAGE, SELECT ON SEQUENCE {table_name}_id_seq TO {admin_role};",
         ]
     )

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/hash_chain.py

@@ -55,6 +55,12 @@ Caveats:
 
 from auditrum.tracking.spec import validate_identifier
 
+__all__ = [
+    "generate_hash_chain_sql",
+    "get_chain_tip",
+    "verify_chain",
+]
+
 # The shared SQL fragment that produces the canonical bytes hashed by both
 # the insert trigger and the server-side verify query. Keeping this in one
 # constant guarantees that the two SQL paths cannot drift.
@@ -133,6 +139,10 @@ BEGIN
     -- legacy rows that pre-date the chain_seq column (chain_seq IS NULL,
     -- ordered by id) so chain continuity is preserved across the
     -- migration boundary.
+    --
+    -- Ordering picks the *most recent* row to chain to:
+    -- chain_seq DESC (newest first) with NULLs sorted last, then id
+    -- DESC as the tiebreaker for legacy rows. LIMIT 1 takes the head.
     SELECT row_hash INTO last_hash
     FROM {table_name}
     WHERE row_hash IS NOT NULL
@@ -140,7 +150,7 @@ BEGIN
           (chain_seq IS NOT NULL AND chain_seq < NEW.chain_seq)
           OR chain_seq IS NULL
       )
-    ORDER BY chain_seq NULLS FIRST, id DESC
+    ORDER BY chain_seq DESC NULLS LAST, id DESC
     LIMIT 1;
 
     NEW.prev_hash := last_hash;

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/__init__.py

@@ -12,6 +12,13 @@ specific conveniences so apps can write::
         ...
 """
 
+__all__ = [
+    "AuditContext",
+    "AuditLog",
+    "register",
+    "track",
+]
+
 default_app_config = "auditrum.integrations.django.apps.PgAuditIntegrationConfig"
 
 

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/admin.py

@@ -3,6 +3,11 @@ from django.utils.html import format_html
 
 from auditrum.integrations.django.models import AuditContext, AuditLog
 
+__all__ = [
+    "AuditContextAdmin",
+    "AuditLogAdmin",
+]
+
 
 @admin.register(AuditContext)
 class AuditContextAdmin(admin.ModelAdmin):
@@ -11,11 +16,10 @@ class AuditContextAdmin(admin.ModelAdmin):
     ordering = ("-created_at",)
     search_fields = ("id",)
 
+    @admin.display(description="Events")
     def event_count(self, obj):
         return obj.events.count()
 
-    event_count.short_description = "Events"
-
 
 @admin.register(AuditLog)
 class AuditLogAdmin(admin.ModelAdmin):
@@ -33,6 +37,7 @@ class AuditLogAdmin(admin.ModelAdmin):
     readonly_fields = [f.name for f in AuditLog._meta.fields]
     ordering = ("-changed_at",)
 
+    @admin.display(description="Linked Object")
     def linked_object(self, obj):
         try:
             target = obj.content_object
@@ -47,5 +52,3 @@ class AuditLogAdmin(admin.ModelAdmin):
             except Exception:
                 return str(target)
         return str(target)
-
-    linked_object.short_description = "Linked Object"

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/apps.py

@@ -5,6 +5,8 @@ from django.apps import AppConfig, apps
 from auditrum.context import audit_context
 from auditrum.integrations.django.executor import DjangoExecutor
 
+__all__ = ["PgAuditIntegrationConfig"]
+
 
 class PgAuditIntegrationConfig(AppConfig):
     default_auto_field = "django.db.models.BigAutoField"

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/audit.py

@@ -22,6 +22,11 @@ from auditrum.integrations.django.tracking import (
     register as _imperative_register,
 )
 
+__all__ = [
+    "register",
+    "registry",
+]
+
 
 def register(model_cls: type[Model], **kwargs: Any) -> None:
     """Legacy imperative register. See ``integrations.django.tracking.register``."""

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/executor.py

@@ -2,6 +2,8 @@ from collections.abc import Iterator
 from contextlib import contextmanager
 from typing import Any
 
+__all__ = ["DjangoExecutor"]
+
 
 class DjangoExecutor:
     """ConnectionExecutor backed by a Django database wrapper.

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/management/commands/audit_add_partitions.py

@@ -35,5 +35,8 @@ class Command(BaseCommand):
         )
 
         with psycopg.connect(db_dsn) as conn, conn.cursor() as cur:
-            cur.execute(sql)
+            # `sql` comes from generate_auditlog_partitions_sql, whose
+            # table name is validated via validate_identifier. See
+            # auditrum/schema.py:151 for the trust boundary.
+            cur.execute(sql)  # ty: ignore[invalid-argument-type]
         self.stdout.write(self.style.SUCCESS("Partitions created successfully."))

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/middleware.py

@@ -8,6 +8,11 @@ from django.conf import settings as django_settings
 from auditrum.integrations.django.runtime import auditrum_context
 from auditrum.integrations.django.settings import audit_settings
 
+__all__ = [
+    "AuditrumMiddleware",
+    "RequestIDMiddleware",
+]
+
 
 def _hash_session_key(session_key: str | None) -> str | None:
     """One-way HMAC of the session key keyed by the project ``SECRET_KEY``.

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/mixins.py

@@ -1,5 +1,6 @@
 from collections.abc import Iterator
 from datetime import datetime
+from typing import TYPE_CHECKING
 
 from django.contrib.contenttypes.models import ContentType
 from django.core.paginator import EmptyPage, PageNotAnInteger, Paginator
@@ -15,8 +16,30 @@ from auditrum.timetravel import (
     reconstruct_table,
 )
 
-
-class AuditedModelMixin:
+# The mixins below are designed to be combined with Django classes at the
+# call-site (AuditedModelMixin with models.Model, AuditHistoryMixin with
+# admin.ModelAdmin). We swap the base under TYPE_CHECKING so a type checker
+# sees the attributes those parent classes provide (_meta, pk, admin_site,
+# model, get_object, get_urls...) while at runtime the mixin stays a plain
+# object base — so `class Foo(MyMixin, models.Model)` still gives models.Model
+# metaclass precedence, not a MRO conflict.
+if TYPE_CHECKING:
+    from django.contrib.admin import ModelAdmin
+    from django.db.models import Model
+
+    _ModelBase = Model
+    _ModelAdminBase = ModelAdmin
+else:
+    _ModelBase = object
+    _ModelAdminBase = object
+
+__all__ = [
+    "AuditHistoryMixin",
+    "AuditedModelMixin",
+]
+
+
+class AuditedModelMixin(_ModelBase):
     """Model mixin exposing per-instance audit history, time-travel, and field timelines.
 
     All methods are read-only helpers built on top of the framework-agnostic
@@ -107,7 +130,7 @@ class AuditedModelMixin:
             )
 
 
-class AuditHistoryMixin:
+class AuditHistoryMixin(_ModelAdminBase):
     def get_urls(self):
         urls = super().get_urls()
         custom_urls = [

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/models.py

@@ -11,6 +11,13 @@ if TYPE_CHECKING:
     from django.contrib.auth.models import AbstractBaseUser
     from django.db.models import Model
 
+__all__ = [
+    "AuditContext",
+    "AuditLog",
+    "AuditLogManager",
+    "AuditLogQuerySet",
+]
+
 
 class AuditLogQuerySet(models.QuerySet):
     """QuerySet with single-table-aware helpers for audit history lookups.
@@ -57,7 +64,12 @@ class AuditLogQuerySet(models.QuerySet):
         return self.order_by("-changed_at")[:limit]
 
 
-class AuditLogManager(models.Manager.from_queryset(AuditLogQuerySet)):  # type: ignore[misc]
+class AuditLogManager(models.Manager.from_queryset(AuditLogQuerySet)):  # ty: ignore[unsupported-base]
+    # Manager.from_queryset() returns a dynamically-built subclass whose
+    # identity type checkers can't statically infer. The pattern is the
+    # standard Django idiom for copying queryset methods onto a manager,
+    # so we accept the base-class unknown here rather than duplicate
+    # every QuerySet method on the manager by hand.
     """Default manager for :class:`AuditLog` exposing the queryset helpers."""
 
     def get_queryset(self) -> AuditLogQuerySet:

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/operations.py

@@ -20,6 +20,11 @@ from django.db.migrations.operations.base import Operation
 
 from auditrum.tracking import FieldFilter, TrackSpec, TriggerManager
 
+__all__ = [
+    "InstallTrigger",
+    "UninstallTrigger",
+]
+
 
 def _spec_to_deconstruct_kwargs(spec: TrackSpec) -> dict[str, Any]:
     kwargs: dict[str, Any] = {"table": spec.table}

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/runtime.py

@@ -43,6 +43,11 @@ from django.db import connection
 
 from auditrum.integrations.django.settings import audit_settings
 
+__all__ = [
+    "auditrum_context",
+    "current_context",
+]
+
 
 @dataclass(frozen=True)
 class _Context:

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/settings.py

@@ -2,6 +2,11 @@ import re
 
 from django.conf import settings
 
+__all__ = [
+    "AuditSettings",
+    "audit_settings",
+]
+
 # Postgres custom GUCs are required to have the form `<class>.<name>` where
 # both halves are simple identifiers. We validate user-supplied GUC names
 # against this regex before they are interpolated into PL/pgSQL function

auditrum-0.3.2/auditrum/integrations/django/shell_context.py

@@ -0,0 +1,23 @@
+import atexit
+import contextlib
+
+from .utils import audit_tracked
+
+# Bind the context manager to a module-level name so CPython's
+# refcount-driven GC doesn't immediately reclaim it — when the
+# manager goes out of scope its generator is closed, which triggers
+# __exit__, which pops the audit context and resets "source". Holding
+# a reference here keeps the shell session's source="shell" stamp on
+# every audit row written from the REPL.
+_shell_ctx = audit_tracked(source="shell")
+_shell_ctx.__enter__()
+
+
+@atexit.register
+def _release_shell_ctx() -> None:
+    # Run cleanup before interpreter shutdown so the generator's
+    # finally block runs while its transitive imports (the executor
+    # chain in auditrum.context) are still importable. Swallow any
+    # late shutdown races — the process is going away either way.
+    with contextlib.suppress(Exception):
+        _shell_ctx.__exit__(None, None, None)

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/tracking.py

@@ -25,6 +25,14 @@ from typing import TYPE_CHECKING, Any, TypeVar
 
 from auditrum.tracking import FieldFilter, TrackSpec
 
+__all__ = [
+    "clear_registry",
+    "get_registered_specs",
+    "register",
+    "specs_by_app_label",
+    "track",
+]
+
 if TYPE_CHECKING:
     from django.db.models import Model
 

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/django/utils.py

@@ -1,13 +1,19 @@
+from datetime import datetime
+from typing import Any, Protocol
+
 from django.contrib.admin.templatetags.admin_urls import admin_urlname
 from django.db import models
 from django.shortcuts import resolve_url
-from django.utils import timezone
 from django.utils.formats import date_format
 from django.utils.html import format_html
 from django.utils.safestring import mark_safe
 
 from auditrum.utils import audit_tracked  # re-exported for backwards compatibility
 
+
+class _ExecuteCursor(Protocol):
+    def execute(self, query: str, params: Any = ..., /) -> Any: ...
+
 __all__ = [
     "audit_tracked",
     "link",
@@ -23,8 +29,8 @@ def link(href: str, text: str) -> str:
     return format_html('<a href="{}">{}</a>', href, text)
 
 
-def link_to_related_object(obj: models.Model, name: str = None) -> str:
-    url = resolve_url(admin_urlname(obj._meta, "change"), obj.pk)
+def link_to_related_object(obj: models.Model, name: str | None = None) -> str:
+    url = resolve_url(admin_urlname(obj._meta, "change"), obj.pk)  # ty: ignore[invalid-argument-type]
     return link(url, name or str(obj))
 
 
@@ -49,7 +55,7 @@ def resolve_field_value(model_class, field_name, value):
             try:
                 parsed = value
                 if isinstance(value, str):
-                    parsed = timezone.datetime.fromisoformat(value)
+                    parsed = datetime.fromisoformat(value)
                 if isinstance(field, models.DateTimeField):
                     value = date_format(parsed, format="DATETIME_FORMAT")
                 elif isinstance(field, models.DateField):
@@ -124,6 +130,11 @@ def render_log_changes(log):
     return mark_safe("<em class='text-gray-500'>No changes</em>")
 
 
-def set_var(cursor, key: str, value) -> None:
+def set_var(cursor: _ExecuteCursor, key: str, value: Any) -> None:
+    # set_config(name, value, is_local=false) is the parameterised form
+    # of SET — both the GUC name and value go through psycopg's binding
+    # layer, so an attacker-controlled `key` can't break out into DDL.
+    # The f-string version that used to live here was a real injection
+    # surface any time `key` wasn't a compile-time constant.
     if value is not None:
-        cursor.execute(f"SET {key} = %s", [str(value)])
+        cursor.execute("SELECT set_config(%s, %s, false)", [key, str(value)])

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/integrations/sqlalchemy/core.py

@@ -17,6 +17,15 @@ from auditrum.schema import (
 )
 from auditrum.tracking import FieldFilter, SyncReport, TrackSpec, TriggerManager
 
+__all__ = [
+    "SQLAlchemyExecutor",
+    "bootstrap_schema",
+    "clear_registry",
+    "registered_specs",
+    "sync",
+    "track_table",
+]
+
 if TYPE_CHECKING:
     from sqlalchemy import Table
     from sqlalchemy.engine import Connection, Engine

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/observability/otel.py

@@ -16,6 +16,8 @@ from __future__ import annotations
 
 from typing import Any
 
+__all__ = ["enrich_metadata"]
+
 
 def enrich_metadata(metadata: dict[str, Any]) -> dict[str, Any]:
     """Merge OTel trace identifiers into ``metadata`` if possible.

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/observability/prometheus.py

@@ -34,6 +34,8 @@ from psycopg import sql as pg_sql
 
 from auditrum.tracking.spec import validate_identifier
 
+__all__ = ["AuditrumCollector"]
+
 
 class AuditrumCollector:
     """prometheus_client collector exposing audit event counts.

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/observability/sentry.py

@@ -11,6 +11,8 @@ from __future__ import annotations
 import contextlib
 from typing import Any
 
+__all__ = ["add_breadcrumb_for_context"]
+
 
 def add_breadcrumb_for_context(
     metadata: dict[str, Any], *, category: str = "auditrum"

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/retention.py

@@ -25,6 +25,11 @@ from psycopg import sql
 
 from auditrum.tracking.spec import validate_identifier
 
+__all__ = [
+    "drop_old_partitions",
+    "generate_purge_sql",
+]
+
 _INTERVAL_RE = re.compile(
     r"^\s*(\d+)\s*(day|days|week|weeks|month|months|year|years)\s*$", re.IGNORECASE
 )
@@ -54,7 +59,10 @@ def _parse_interval(expr: str) -> relativedelta:
         return relativedelta(months=n)
     if unit.startswith("year"):
         return relativedelta(years=n)
-    raise ValueError(f"Unsupported unit: {unit}")
+    raise ValueError(
+        f"Unsupported retention interval unit: {unit!r}. Supported units are "
+        f"'day'/'days', 'week'/'weeks', 'month'/'months', 'year'/'years'."
+    )
 
 
 def _cutoff_for(expr: str) -> datetime:

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/revert.py

@@ -2,8 +2,21 @@ from psycopg import sql
 
 from auditrum.tracking.spec import validate_identifier
 
+__all__ = [
+    "generate_revert_sql",
+    "generate_revert_sql_from_log",
+    "get_revert_columns_from_log",
+]
+
 
 def get_revert_columns_from_log(conn, audit_table: str, log_id: int) -> list[str]:
+    """Return the column names that should be restored when reverting a log entry.
+
+    Skips ``id`` because the primary key is invariant — the revert is
+    keyed *by* it, restoring it would be a no-op at best and a type
+    mismatch at worst (jsonb ``->>`` always returns ``text``, but most
+    primary keys are ``integer`` or ``bigint``).
+    """
     validate_identifier(audit_table, "audit_table")
     query = sql.SQL("SELECT jsonb_object_keys(old_data) FROM {} WHERE id = %s").format(
         sql.Identifier(audit_table)
@@ -11,7 +24,7 @@ def get_revert_columns_from_log(conn, audit_table: str, log_id: int) -> list[str
     with conn.cursor() as cur:
         cur.execute(query, (int(log_id),))
         keys = cur.fetchall()
-    return [row[0] for row in keys]
+    return [row[0] for row in keys if row[0] != "id"]
 
 
 def generate_revert_sql(

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/schema.py

@@ -4,6 +4,16 @@ from dateutil.relativedelta import relativedelta
 
 from auditrum.tracking.spec import validate_identifier
 
+__all__ = [
+    "generate_audit_attach_context_sql",
+    "generate_audit_context_table_sql",
+    "generate_audit_current_user_id_sql",
+    "generate_audit_reconstruct_sql",
+    "generate_auditlog_partitions_sql",
+    "generate_auditlog_table_sql",
+    "generate_jsonb_diff_function_sql",
+]
+
 
 def generate_audit_context_table_sql(context_table: str = "audit_context") -> str:
     """Generate SQL for the context table that groups events by request/job/command.

{auditrum-0.3.0 → auditrum-0.3.2}/auditrum/settings.py

@@ -2,6 +2,8 @@
 from pydantic import Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
+__all__ = ["PgAuditSettings"]
+
 
 class PgAuditSettings(BaseSettings):
     model_config = SettingsConfigDict(env_file=".env", case_sensitive=False, extra="ignore")