dbzero 0.4.1__tar.gz → 0.4.2__tar.gz

{dbzero-0.4.1 → dbzero-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dbzero
-Version: 0.4.1
+Version: 0.4.2
 Summary: A state management system for Python 3.x that unifies your applications business logic, data persistence, and caching into a single, efficient layer.
 Author-Email: "DBZero Software sp. z o.o" <info@dbzero.io>
 License:                   GNU LESSER GENERAL PUBLIC LICENSE

{dbzero-0.4.1 → dbzero-0.4.2}/dbzero/dbzero/dbzero.pyi

@@ -30,6 +30,7 @@ def open(prefix_name: str, open_mode: str = "rw", **kwargs: Any) -> None:
         
         * autocommit (bool) to disable automatic commits for this prefix
         * restricted (bool) to restrict memo reflection access for this prefix
+        * restricted_context (ContextVar) to dynamically restrict memo reflection access for this prefix
         * slab_size (int) for memory slab allocation size in bytes
         * meta_io_step_size (int) for metadata I/O operation chunk size
         * lock_flags (dict) to change locking behavior when opening the prefix for read-write
@@ -55,6 +56,14 @@ def open(prefix_name: str, open_mode: str = "rw", **kwargs: Any) -> None:
     """
     ...
 
+def set_restricted(*, restricted: Optional[bool] = None, restricted_context: Any = None,
+                   prefix: Optional[str] = None) -> None:
+    """Increase memo restricted-access mode globally or for an open prefix.
+
+    The restriction level can only increase: unrestricted -> restricted_context -> restricted.
+    """
+    ...
+
 def close(prefix_name: Optional[str] = None) -> None:
     """Gracefully shut down dbzero, persisting changes and releasing resources.
 
@@ -1545,7 +1554,7 @@ def get_config() -> Dict[str, Any]:
         
         * autocommit (bool): True if autocommit enabled. Defaults to True.
         * autocommit_interval (int): Milliseconds between commits. Defaults to 250.
-        * restricted (bool): True if future opened prefixes default to restricted mode.
+        * restricted (bool): True if future opened prefixes default to static restricted mode.
 
     Raises
     ------

{dbzero-0.4.1 → dbzero-0.4.2}/dbzero/dbzero/initialization.py

@@ -26,6 +26,7 @@ def init(dbzero_root: str, **kwargs: Any) -> None:
         
         Configure global dbzero behavior:
         * restricted (bool, default False) to restrict memo reflection access for future opened prefixes
+        * restricted_context (ContextVar) to dynamically restrict memo reflection access
         * autocommit (bool, default True) to enable automatic commits
         * autocommit_interval (int, default 367) for commit interval in milliseconds
         * cache_size (int, default 2 GiB) for main object cache size in bytes
@@ -56,6 +57,9 @@ def init(dbzero_root: str, **kwargs: Any) -> None:
     if "restricted" in kwargs:
         init_kwargs["restricted"] = kwargs["restricted"]
 
+    if "restricted_context" in kwargs:
+        init_kwargs["restricted_context"] = kwargs["restricted_context"]
+
     rpc = kwargs.get("rpc")
     if rpc is not None and not isinstance(rpc, Mapping):
         raise TypeError("rpc must be a mapping")
@@ -71,4 +75,6 @@ def init(dbzero_root: str, **kwargs: Any) -> None:
         open_kwargs = {}
         if "restricted" in kwargs:
             open_kwargs["restricted"] = kwargs["restricted"]
+        if "restricted_context" in kwargs:
+            open_kwargs["restricted_context"] = kwargs["restricted_context"]
         dbzero_open(kwargs["prefix"], open_mode=open_mode, **open_kwargs)

{dbzero-0.4.1 → dbzero-0.4.2}/dbzero/setup.py

@@ -10,7 +10,7 @@ if sys.byteorder == 'big':
 
 setup(
     name='dbzero',
-    version='0.4.1',
+    version='0.4.2',
     description='DBZero community edition',
     packages=['dbzero'],
     python_requires='>=3.9',

{dbzero-0.4.1 → dbzero-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ requires = ['meson-python']
 
 [project]
 name = 'dbzero'
-version = '0.4.1'
+version = '0.4.2'
 description = 'A state management system for Python 3.x that unifies your applications business logic, data persistence, and caching into a single, efficient layer.'
 readme = 'README.md'
 requires-python = '>=3.9'

dbzero-0.4.2/python_tests/test_restricted_memo_access.py

@@ -0,0 +1,408 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# Copyright (c) 2025 DBZero Software sp. z o.o.
+
+import gc
+import os
+import shutil
+import subprocess
+import sys
+import textwrap
+from contextvars import ContextVar
+
+import pytest
+import dbzero as db0
+
+from .conftest import DB0_DIR
+
+
+@db0.memo
+class RestrictedMemoAccessData:
+    def __init__(self, value):
+        self.value = value
+
+    def get_value(self):
+        return self.value
+
+    def set_value(self, value):
+        self.value = value
+
+
+def _clean_db0_dir():
+    if os.path.exists(DB0_DIR):
+        shutil.rmtree(DB0_DIR)
+    os.mkdir(DB0_DIR)
+
+
+@pytest.fixture()
+def db0_restricted_root():
+    if "D" in db0.build_flags():
+        db0.reset_test_params()
+    _clean_db0_dir()
+    yield
+    gc.collect()
+    db0.close()
+    if os.path.exists(DB0_DIR):
+        shutil.rmtree(DB0_DIR)
+
+
+def _assert_restricted(obj, *, writable=True):
+    assert obj.value == 123
+    if writable:
+        obj.value = 456
+        assert obj.value == 456
+        obj.new_value = 789
+        assert obj.new_value == 789
+
+    for attr_name in (
+        "__class__",
+        "__dict__",
+        "__mro__",
+        "__subclasses__",
+        "_private",
+    ):
+        with pytest.raises(AttributeError):
+            getattr(obj, attr_name)
+
+
+def _assert_restricted_method_not_introspectable(method):
+    assert callable(method)
+    with pytest.raises(AttributeError):
+        dir(method)
+    for attr_name in ("__class__", "__dict__", "__func__", "__self__", "__globals__", "__closure__"):
+        with pytest.raises(AttributeError):
+            getattr(method, attr_name)
+
+
+def test_restricted_memo_methods_can_be_called(db0_restricted_root):
+    db0.init(DB0_DIR)
+    db0.open("restricted-method-prefix", restricted=True)
+    obj = RestrictedMemoAccessData(123)
+
+    assert obj.get_value() == 123
+    obj.set_value(456)
+    assert obj.value == 456
+    assert obj.get_value() == 456
+    _assert_restricted_method_not_introspectable(obj.get_value)
+    _assert_restricted_method_not_introspectable(obj.set_value)
+
+
+def test_init_restricted_applies_to_future_prefixes(db0_restricted_root):
+    db0.init(DB0_DIR, restricted=True)
+    assert db0.get_config()["restricted"] is True
+    db0.open("restricted-by-init")
+    assert db0.get_prefix_stats()["restricted"] is True
+
+    _assert_restricted(RestrictedMemoAccessData(123))
+
+
+def test_open_restricted_is_scoped_to_prefix(db0_restricted_root):
+    db0.init(DB0_DIR)
+    assert db0.get_config()["restricted"] is False
+
+    db0.open("restricted-prefix", restricted=True)
+    assert db0.get_prefix_stats("restricted-prefix")["restricted"] is True
+    restricted = RestrictedMemoAccessData(123)
+    _assert_restricted(restricted)
+
+    db0.open("unrestricted-prefix")
+    assert db0.get_prefix_stats("unrestricted-prefix")["restricted"] is False
+    unrestricted = RestrictedMemoAccessData(123)
+    assert unrestricted.get_value() == 123
+    assert unrestricted.__class__ is RestrictedMemoAccessData
+    assert unrestricted.get_value.__self__ is unrestricted
+
+
+def test_unrestricted_memo_access_before_restricted_mode_is_ever_used():
+    code = textwrap.dedent(
+        """
+        import gc
+        import os
+        import shutil
+
+        import dbzero as db0
+
+        from python_tests.conftest import DB0_DIR
+        from python_tests.test_restricted_memo_access import (
+            RestrictedMemoAccessData,
+            _clean_db0_dir,
+        )
+
+        if "D" in db0.build_flags():
+            db0.reset_test_params()
+        _clean_db0_dir()
+        try:
+            db0.init(DB0_DIR)
+            db0.open("never-restricted-prefix")
+            obj = RestrictedMemoAccessData(123)
+
+            assert obj.value == 123
+            assert obj.get_value() == 123
+            assert obj.__class__ is RestrictedMemoAccessData
+            assert obj.get_value.__self__ is obj
+        finally:
+            gc.collect()
+            db0.close()
+            if os.path.exists(DB0_DIR):
+                shutil.rmtree(DB0_DIR)
+        """
+    )
+    result = subprocess.run(
+        [sys.executable, "-c", code],
+        cwd=os.getcwd(),
+        capture_output=True,
+        text=True,
+        timeout=20,
+        check=False,
+    )
+    assert result.returncode == 0, (
+        "restricted memo fast-path fresh-process child failed with code "
+        f"{result.returncode}\nstdout:\n{result.stdout}\nstderr:\n{result.stderr}"
+    )
+
+
+def test_unrestricted_prefix_stays_unrestricted_after_default_restricted_was_enabled(db0_restricted_root):
+    db0.init(DB0_DIR, restricted=True)
+    assert db0.get_config()["restricted"] is True
+    db0.open("explicitly-unrestricted-prefix", restricted=False)
+    assert db0.get_prefix_stats("explicitly-unrestricted-prefix")["restricted"] is False
+
+    obj = RestrictedMemoAccessData(123)
+    assert obj.value == 123
+    assert obj.get_value() == 123
+    assert obj.__class__ is RestrictedMemoAccessData
+    assert obj.get_value.__self__ is obj
+
+
+def test_prefix_can_be_reopened_as_restricted(db0_restricted_root):
+    db0.init(DB0_DIR)
+    db0.open("reopen-prefix", restricted=False)
+    obj = RestrictedMemoAccessData(123)
+    obj_uuid = db0.uuid(obj)
+    assert obj.get_value() == 123
+    db0.commit()
+    db0.close("reopen-prefix")
+
+    db0.open("reopen-prefix", "r", restricted=True)
+    assert db0.get_prefix_stats("reopen-prefix")["restricted"] is True
+    reopened = db0.fetch(obj_uuid)
+    _assert_restricted(reopened, writable=False)
+
+
+def test_global_restricted_applies_to_auto_opened_prefix(db0_restricted_root):
+    db0.init(DB0_DIR)
+    db0.open("auto-open-prefix")
+    obj = RestrictedMemoAccessData(123)
+    obj_uuid = db0.uuid(obj)
+    db0.commit()
+    db0.close()
+
+    db0.init(DB0_DIR, restricted=True)
+    fetched = db0.fetch(obj_uuid)
+    assert db0.get_config()["restricted"] is True
+    assert db0.get_prefix_stats("auto-open-prefix")["restricted"] is True
+    _assert_restricted(fetched, writable=False)
+
+
+def test_global_restricted_context_controls_existing_objects(db0_restricted_root):
+    restricted_context = ContextVar("restricted_context", default=False)
+    db0.init(DB0_DIR, restricted_context=restricted_context)
+    assert db0.get_config()["restricted"] is False
+    db0.open("dynamic-global-prefix")
+    assert db0.get_prefix_stats("dynamic-global-prefix")["restricted"] is False
+    obj = RestrictedMemoAccessData(123)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+    assert obj.get_value.__self__ is obj
+
+    token = restricted_context.set(True)
+    try:
+        _assert_restricted(obj)
+    finally:
+        restricted_context.reset(token)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+    assert obj.get_value.__self__ is obj
+
+
+def test_prefix_restricted_context_overrides_global_context(db0_restricted_root):
+    global_context = ContextVar("global_context", default=True)
+    prefix_context = ContextVar("prefix_context", default=False)
+    db0.init(DB0_DIR, restricted_context=global_context)
+
+    db0.open("global-dynamic-prefix")
+    global_obj = RestrictedMemoAccessData(123)
+
+    db0.open("prefix-dynamic-prefix", restricted_context=prefix_context)
+    prefix_obj = RestrictedMemoAccessData(123)
+
+    _assert_restricted(global_obj)
+    assert prefix_obj.__class__ is RestrictedMemoAccessData
+    assert prefix_obj.get_value.__self__ is prefix_obj
+
+    token = prefix_context.set(True)
+    try:
+        _assert_restricted(prefix_obj)
+    finally:
+        prefix_context.reset(token)
+
+
+def test_prefix_restricted_context_none_cannot_replace_existing_context(db0_restricted_root):
+    global_context = ContextVar("global_context", default=True)
+    prefix_context = ContextVar("prefix_context", default=False)
+    db0.init(DB0_DIR, restricted_context=global_context)
+    db0.open("prefix-reset-dynamic-prefix", restricted_context=prefix_context)
+    obj = RestrictedMemoAccessData(123)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+    assert obj.get_value.__self__ is obj
+
+    with pytest.raises(RuntimeError):
+        db0.open("prefix-reset-dynamic-prefix", restricted_context=None)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+
+
+def test_static_restricted_without_restricted_context_remains_restricted(db0_restricted_root):
+    db0.init(DB0_DIR)
+    db0.open("static-restricted-prefix", restricted=True)
+    assert db0.get_prefix_stats("static-restricted-prefix")["restricted"] is True
+
+    _assert_restricted(RestrictedMemoAccessData(123))
+
+
+def test_static_restricted_object_does_not_resolve_later_restricted_context(db0_restricted_root):
+    class ExplodingContext:
+        def get(self):
+            raise AssertionError("restricted_context should not be resolved")
+
+    db0.init(DB0_DIR)
+    db0.open("static-no-context-prefix", restricted=True)
+    obj = RestrictedMemoAccessData(123)
+
+    with pytest.raises(RuntimeError):
+        db0.open("static-no-context-prefix", restricted_context=ExplodingContext())
+
+    _assert_restricted(obj)
+
+
+def test_unset_restricted_context_is_treated_as_false(db0_restricted_root):
+    restricted_context = ContextVar("restricted_context")
+    db0.init(DB0_DIR, restricted_context=restricted_context)
+    db0.open("unset-dynamic-prefix")
+    obj = RestrictedMemoAccessData(123)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+    assert obj.get_value.__self__ is obj
+
+
+def test_restricted_context_uses_python_truthiness(db0_restricted_root):
+    restricted_context = ContextVar("restricted_context", default=[])
+    db0.init(DB0_DIR, restricted_context=restricted_context)
+    db0.open("truthy-dynamic-prefix")
+    obj = RestrictedMemoAccessData(123)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+
+    token = restricted_context.set([object()])
+    try:
+        _assert_restricted(obj)
+    finally:
+        restricted_context.reset(token)
+
+
+def test_init_prefix_shortcut_forwards_restricted_context(db0_restricted_root):
+    restricted_context = ContextVar("restricted_context", default=True)
+    db0.init(DB0_DIR, prefix="shortcut-dynamic-prefix", restricted_context=restricted_context)
+    assert db0.get_prefix_stats("shortcut-dynamic-prefix")["restricted"] is False
+
+    _assert_restricted(RestrictedMemoAccessData(123))
+
+
+def test_set_restricted_context_upgrades_existing_and_future_prefixes(db0_restricted_root):
+    restricted_context = ContextVar("restricted_context", default=False)
+    db0.init(DB0_DIR)
+    db0.open("dynamic-upgrade-prefix")
+    obj = RestrictedMemoAccessData(123)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+    db0.set_restricted(restricted_context=restricted_context)
+    assert db0.get_config()["restricted"] is False
+
+    assert obj.__class__ is RestrictedMemoAccessData
+    token = restricted_context.set(True)
+    try:
+        _assert_restricted(obj)
+        db0.open("future-dynamic-upgrade-prefix")
+        _assert_restricted(RestrictedMemoAccessData(123))
+    finally:
+        restricted_context.reset(token)
+
+
+def test_set_restricted_static_upgrades_dynamic_context(db0_restricted_root):
+    restricted_context = ContextVar("restricted_context", default=False)
+    db0.init(DB0_DIR)
+    db0.set_restricted(restricted_context=restricted_context)
+    db0.open("dynamic-to-static-prefix")
+    obj = RestrictedMemoAccessData(123)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+    db0.set_restricted(restricted=True)
+
+    _assert_restricted(obj)
+    db0.open("future-static-upgrade-prefix")
+    assert db0.get_prefix_stats("future-static-upgrade-prefix")["restricted"] is True
+    _assert_restricted(RestrictedMemoAccessData(123))
+
+
+def test_set_restricted_rejects_context_after_static_restricted(db0_restricted_root):
+    restricted_context = ContextVar("restricted_context", default=False)
+    db0.init(DB0_DIR, restricted=True)
+    db0.open("static-terminal-prefix")
+    obj = RestrictedMemoAccessData(123)
+
+    with pytest.raises(RuntimeError):
+        db0.set_restricted(restricted_context=restricted_context)
+
+    _assert_restricted(obj)
+
+
+def test_set_restricted_rejects_context_replacement(db0_restricted_root):
+    first_context = ContextVar("first_context", default=False)
+    second_context = ContextVar("second_context", default=True)
+    db0.init(DB0_DIR)
+    db0.set_restricted(restricted_context=first_context)
+    db0.open("context-replacement-prefix")
+    obj = RestrictedMemoAccessData(123)
+
+    with pytest.raises(RuntimeError):
+        db0.set_restricted(restricted_context=second_context)
+
+    assert obj.__class__ is RestrictedMemoAccessData
+    token = first_context.set(True)
+    try:
+        _assert_restricted(obj)
+    finally:
+        first_context.reset(token)
+
+
+def test_set_restricted_rejects_false(db0_restricted_root):
+    db0.init(DB0_DIR)
+
+    with pytest.raises(RuntimeError):
+        db0.set_restricted(restricted=False)
+
+
+def test_set_restricted_prefix_only_upgrades_target_prefix(db0_restricted_root):
+    restricted_context = ContextVar("restricted_context", default=True)
+    db0.init(DB0_DIR)
+
+    db0.open("target-prefix")
+    target = RestrictedMemoAccessData(123)
+    db0.open("other-prefix")
+    other = RestrictedMemoAccessData(123)
+
+    db0.set_restricted(prefix="target-prefix", restricted_context=restricted_context)
+
+    _assert_restricted(target)
+    assert other.__class__ is RestrictedMemoAccessData
+    assert other.get_value.__self__ is other

{dbzero-0.4.1 → dbzero-0.4.2}/src/dbzero/bindings/python/Memo.cpp

@@ -71,17 +71,16 @@ namespace db0::python
         MemoImplT *memo_obj = reinterpret_cast<MemoImplT*>(py_type->tp_alloc(py_type, 0));
         
         // if type cannot be retrieved due to access mode then defer this operation (fallback)
-        auto restricted = fixture->isRestricted();
         if (type) {
             // prepare a new dbzero instance of a known db0 class
-            memo_obj->makeNew(type, restricted);
+            memo_obj->makeNew(type);
         } else {
             auto type_initializer = [py_type](db0::swine_ptr<Fixture> &fixture) {
                 auto &class_factory = fixture->get<db0::object_model::ClassFactory>();
                 return class_factory.getOrCreateType(py_type);
             };
             // prepare a new db0 instance of a known db0 class
-            memo_obj->makeNew(std::move(type_initializer), restricted);
+            memo_obj->makeNew(std::move(type_initializer));
         }
         
         return memo_obj;
@@ -192,10 +191,9 @@ namespace db0::python
         // find py type associated dbzero class with the ClassFactory
         auto type = class_factory.tryGetOrCreateType(py_type);
         MemoObject *memo_obj = nullptr;
-        auto restricted = fixture->isRestricted();
         if (type) {
             memo_obj = reinterpret_cast<MemoObject*>(py_type->tp_alloc(py_type, 0));
-            memo_obj->makeNew(type, restricted);
+            memo_obj->makeNew(type);
         } else {
             // if type cannot be retrieved due to access mode then deferr this operation (fallback)
             auto type_initializer = [py_type](db0::swine_ptr<Fixture> &fixture) {
@@ -203,7 +201,7 @@ namespace db0::python
                 return class_factory.getOrCreateType(py_type);
             };
             memo_obj = reinterpret_cast<MemoObject*>(py_type->tp_alloc(py_type, 0));
-            memo_obj->makeNew(std::move(type_initializer), restricted);
+            memo_obj->makeNew(std::move(type_initializer));
         }
         
         return memo_obj;
@@ -260,7 +258,18 @@ namespace db0::python
             return false;
         }
 
-        return memo_obj->ext().isRestricted();
+        auto fixture = memo_obj->ext().tryGetFixture();
+        if (!fixture) {
+            return false;
+        }
+
+        if (fixture->isRestricted()) {
+            return true;
+        }
+        if (!fixture->isRestrictedCtx()) {
+            return false;
+        }
+        return resolveRestrictedCtx(*fixture);
     }
 
     template <typename MemoImplT>
@@ -404,7 +413,18 @@ namespace db0::python
             return false;
         }
 
-        return memo_obj->ext().isRestricted() || isRestrictedMemoContextActive();
+        auto fixture = memo_obj->ext().tryGetFixture();
+        if (!fixture) {
+            return false;
+        }
+
+        if (fixture->isRestricted()) {
+            return true;
+        }
+        if (!fixture->isRestrictedCtx()) {
+            return false;
+        }
+        return resolveRestrictedCtx(*fixture);
     }
 
     template <typename MemoImplT>

{dbzero-0.4.1 → dbzero-0.4.2}/src/dbzero/bindings/python/PyAPI.cpp

@@ -173,7 +173,7 @@ namespace db0::python
         // prefix_name, open_mode, autocommit (bool)
         static const char *kwlist[] = {
             "prefix_name", "open_mode", "autocommit", "slab_size", "lock_flags", "meta_io_step_size", 
-            "page_io_step_size", "restricted", NULL
+            "page_io_step_size", "restricted", "restricted_context", NULL
         };
         const char *prefix_name = nullptr;
         const char *open_mode = nullptr;
@@ -183,9 +183,10 @@ namespace db0::python
         PyObject *py_meta_io_step_size = nullptr;
         PyObject *py_page_io_step_size = nullptr;
         PyObject *py_restricted = nullptr;
-        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|sOOOOOO:open", const_cast<char**>(kwlist),
+        PyObject *py_restricted_context = nullptr;
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|sOOOOOOO:open", const_cast<char**>(kwlist),
             &prefix_name, &open_mode, &py_autocommit, &py_slab_size, &py_lock_flags, &py_meta_io_step_size,
-            &py_page_io_step_size, &py_restricted))
+            &py_page_io_step_size, &py_restricted, &py_restricted_context))
         {
             return NULL;
         }
@@ -248,7 +249,7 @@ namespace db0::python
         auto access_type = open_mode ? parseAccessType(open_mode) : db0::AccessType::READ_WRITE;
         PyToolkit::getPyWorkspace().open(
             prefix_name, access_type, autocommit, slab_size, py_lock_flags, meta_io_step_size, page_io_step_size,
-            restricted
+            restricted, py_restricted_context, py_restricted_context != nullptr
         );
         Py_RETURN_NONE;
     }
@@ -258,6 +259,48 @@ namespace db0::python
         PY_API_FUNC
         return runSafe(tryOpen, self, args, kwargs);
     }
+
+    PyObject *trySetRestricted(PyObject *, PyObject *args, PyObject *kwargs)
+    {
+        PyObject *py_restricted = nullptr;
+        PyObject *py_restricted_context = nullptr;
+        PyObject *py_prefix = nullptr;
+        static const char *kwlist[] = {"restricted", "restricted_context", "prefix", NULL};
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OOO:set_restricted", const_cast<char**>(kwlist),
+            &py_restricted, &py_restricted_context, &py_prefix))
+        {
+            return NULL;
+        }
+
+        std::optional<bool> restricted;
+        if (py_restricted && py_restricted != Py_None) {
+            auto is_restricted = PyObject_IsTrue(py_restricted);
+            if (is_restricted < 0) {
+                return NULL;
+            }
+            restricted = is_restricted;
+        }
+
+        std::optional<std::string> prefix_name;
+        if (py_prefix && py_prefix != Py_None) {
+            if (!PyUnicode_Check(py_prefix)) {
+                PyErr_SetString(PyExc_TypeError, "Invalid argument type: prefix");
+                return NULL;
+            }
+            prefix_name = PyUnicode_AsUTF8(py_prefix);
+        }
+
+        PyToolkit::getPyWorkspace().setRestricted(
+            restricted, py_restricted_context, py_restricted_context != nullptr, prefix_name
+        );
+        Py_RETURN_NONE;
+    }
+
+    PyObject *PyAPI_setRestricted(PyObject *self, PyObject *args, PyObject *kwargs)
+    {
+        PY_API_FUNC
+        return runSafe(trySetRestricted, self, args, kwargs);
+    }
     
     PyObject *tryInit(PyObject *self, PyObject *args, PyObject *kwargs)
     {        
@@ -265,10 +308,11 @@ namespace db0::python
         PyObject *py_config = nullptr;
         PyObject *py_flags = nullptr;
         PyObject *py_restricted = nullptr;
+        PyObject *py_restricted_context = nullptr;
         // extract optional "path" string argument and "autcommit_interval" keyword argument
-        static const char *kwlist[] = {"path", "config", "lock_flags", "restricted", NULL};
-        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OOOO:init", const_cast<char**>(kwlist), &py_path, &py_config,
-            &py_flags, &py_restricted)) {
+        static const char *kwlist[] = {"path", "config", "lock_flags", "restricted", "restricted_context", NULL};
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OOOOO:init", const_cast<char**>(kwlist), &py_path, &py_config,
+            &py_flags, &py_restricted, &py_restricted_context)) {
             return NULL;
         }
 
@@ -346,7 +390,7 @@ namespace db0::python
         if (PyDict_SetItemString(*config_obj, "restricted", restricted ? Py_True : Py_False)) {
             return nullptr;
         }
-        PyToolkit::getPyWorkspace().initWorkspace(str_path, *config_obj, py_flags, restricted);
+        PyToolkit::getPyWorkspace().initWorkspace(str_path, *config_obj, py_flags, restricted, py_restricted_context);
         Py_RETURN_NONE;
     }
     

{dbzero-0.4.1 → dbzero-0.4.2}/src/dbzero/bindings/python/PyAPI.hpp

@@ -52,6 +52,7 @@ namespace db0::python
      * Opens or creates a prefix for read or read/write
     */
     PyObject *PyAPI_open(PyObject *self, PyObject *args, PyObject *kwargs);
+    PyObject *PyAPI_setRestricted(PyObject *self, PyObject *args, PyObject *kwargs);
     
     PyObject *PyAPI_drop(PyObject *self, PyObject *args);