keepup-admin 0.1.1__tar.gz → 0.2.0__tar.gz

{keepup_admin-0.1.1/keepup_admin.egg-info → keepup_admin-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keepup-admin
-Version: 0.1.1
+Version: 0.2.0
 Summary: An admin framework over FastAPI: plugins, panel, users, replicas
 Author-email: Fedor Sergeev <fksergeev@gmail.com>
 License-Expression: Apache-2.0
@@ -42,10 +42,24 @@ Dynamic: license-file
 
 # keepup
 
+[![tests](https://github.com/FedorSergeev/keepup-admin/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/FedorSergeev/keepup-admin/actions/workflows/tests.yml)
+[![security](https://github.com/FedorSergeev/keepup-admin/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/FedorSergeev/keepup-admin/actions/workflows/security.yml)
+[![PyPI](https://img.shields.io/pypi/v/keepup-admin)](https://pypi.org/project/keepup-admin/)
+[![licence](https://img.shields.io/pypi/l/keepup-admin)](LICENSE)
+
 [Project page](https://fedorsergeev.github.io/keepup-admin/) ·
 [Package](https://pypi.org/project/keepup-admin/) ·
 [Changes](CHANGELOG.md)
 
+Four badges, not six checks. These answer what somebody deciding whether to
+install asks: does it run on my Python, is there a known vulnerability in what
+it pulls in, what will I get, and may I use it. `quality`, `build` and `codeql`
+are housekeeping and live on the Actions page -- six badges in a row stop being
+read at all.
+
+A badge shows; it does not require. What keeps a red check from being merged is
+a branch rule, not a picture -- see `doc/keepup.md`.
+
 An admin framework over FastAPI. You give it settings; it gives you an
 application with a panel, a plugin runtime, users, a database layer, an audit,
 metrics and coordination between replicas already wired.
@@ -73,7 +87,7 @@ so the import name is free.
 | **Panel** | the shell, visual themes, and the catalogue of sections with role grants |
 | **Users** | local accounts, roles, panel sessions, sign-in through an external provider |
 | **Database** | a SQLAlchemy layer with a pool, table declarations for two dialects |
-| **Replicas** | distributed locks, leader election, a message bus, a cluster registry |
+| **Replicas** | distributed locks, a message bus, a cluster registry, performance settings in one place |
 | **Observability** | audit of incoming requests, an event log, metrics, log shipping |
 
 ## What it does not decide for you

{keepup_admin-0.1.1 → keepup_admin-0.2.0}/README.md

@@ -1,9 +1,23 @@
 # keepup
 
+[![tests](https://github.com/FedorSergeev/keepup-admin/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/FedorSergeev/keepup-admin/actions/workflows/tests.yml)
+[![security](https://github.com/FedorSergeev/keepup-admin/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/FedorSergeev/keepup-admin/actions/workflows/security.yml)
+[![PyPI](https://img.shields.io/pypi/v/keepup-admin)](https://pypi.org/project/keepup-admin/)
+[![licence](https://img.shields.io/pypi/l/keepup-admin)](LICENSE)
+
 [Project page](https://fedorsergeev.github.io/keepup-admin/) ·
 [Package](https://pypi.org/project/keepup-admin/) ·
 [Changes](CHANGELOG.md)
 
+Four badges, not six checks. These answer what somebody deciding whether to
+install asks: does it run on my Python, is there a known vulnerability in what
+it pulls in, what will I get, and may I use it. `quality`, `build` and `codeql`
+are housekeeping and live on the Actions page -- six badges in a row stop being
+read at all.
+
+A badge shows; it does not require. What keeps a red check from being merged is
+a branch rule, not a picture -- see `doc/keepup.md`.
+
 An admin framework over FastAPI. You give it settings; it gives you an
 application with a panel, a plugin runtime, users, a database layer, an audit,
 metrics and coordination between replicas already wired.
@@ -31,7 +45,7 @@ so the import name is free.
 | **Panel** | the shell, visual themes, and the catalogue of sections with role grants |
 | **Users** | local accounts, roles, panel sessions, sign-in through an external provider |
 | **Database** | a SQLAlchemy layer with a pool, table declarations for two dialects |
-| **Replicas** | distributed locks, leader election, a message bus, a cluster registry |
+| **Replicas** | distributed locks, a message bus, a cluster registry, performance settings in one place |
 | **Observability** | audit of incoming requests, an event log, metrics, log shipping |
 
 ## What it does not decide for you

{keepup_admin-0.1.1 → keepup_admin-0.2.0}/audit.py

@@ -17,7 +17,6 @@ recorded says so by name -- ``configure(redaction=keep_as_is)``.
 import asyncio
 import json
 import logging
-import os
 import time
 from contextlib import asynccontextmanager
 from datetime import datetime
@@ -26,8 +25,8 @@ from typing import Any, Dict, Optional
 from sqlalchemy import CheckConstraint, Column, DateTime, Index, Integer, Text, UniqueConstraint
 from sqlalchemy.dialects import postgresql
 
-from keepup import tables
-from keepup.db import DatabaseManager, DatabaseManagerV2, db_config
+from keepup import retention, tables
+from keepup.db import DatabaseManagerV2, db_config
 from keepup.instance import get_instance_id
 
 #: What an application may import from this module. Everything else is
@@ -132,6 +131,15 @@ incoming_requests_lock = asyncio.Lock()
 
 BUFFER_FLUSH_INTERVAL = 125
 BUFFER_MAX_SIZE = 100
+#: A request running this long is written without its outcome (keepup-41): the
+#: process that would have finished it has most likely gone.
+IN_FLIGHT_STALE_SECONDS = 3600
+
+
+def _as_datetime(value) -> datetime:
+    if isinstance(value, str):
+        return datetime.fromisoformat(value.replace('Z', ''))
+    return value
 
 
 class IncomingRequestLogger:
@@ -211,103 +219,86 @@ class IncomingRequestLogger:
             return True
 
     @staticmethod
-    async def flush_buffer() -> int:
-        """Write the buffered requests to the database."""
-
+    async def flush_buffer(include_in_flight: bool = False, now: Optional[datetime] = None) -> int:
+        """Write the finished requests of the buffer to the database.
+
+        A request still running stays in the buffer (keepup-41): written by a
+        timed flush and dropped from the buffer, it could no longer receive its
+        outcome -- end_request found nothing, logged "not found", and the table
+        kept a request with no status. Two exceptions: a request running longer
+        than IN_FLIGHT_STALE_SECONDS is written without an outcome, since the
+        process that would finish it has most likely gone and the buffer must
+        not grow forever; and at shutdown (``include_in_flight``) everything is
+        written -- nothing will finish afterwards.
+        """
+        now = now or datetime.utcnow()
+        # The buffer lock is taken by the start and the end of every request, so
+        # it is held only to pick the rows and take them out -- never across the
+        # write, which runs in a worker thread and may take as long as the
+        # database does (keepup-44).
         async with incoming_requests_lock:
-            if not incoming_requests_buffer:
-                return 0
-
-            requests_to_insert = list(incoming_requests_buffer.values())
-            inserted_count = 0
-
-            try:
-                values = []
-                for req in requests_to_insert:
-                    values.append((
-                        req['instance_id'],
-                        req['method'],
-                        req['endpoint'],
-                        req['host'],
-                        json.dumps(req['request_data']) if req['request_data'] else None,
-                        req['request_start_at'],
-                        req.get('request_end_at'),
-                        req.get('duration_ms'),
-                        req.get('http_status'),
-                        json.dumps(req.get('response_data')) if req.get('response_data') else None,
-                        req.get('error_message'),
-                        req['created_at']
-                    ))
-
-                if values:
-                    if db_config.is_postgres():
-                        query = '''
-                        INSERT INTO incoming_requests 
-                        (instance_id, method, endpoint, host, request_data, request_start_at, 
-                         request_end_at, duration_ms, http_status, response_data, error_message, created_at)
-                        VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
-                        ON CONFLICT (instance_id, method, endpoint, request_start_at) 
-                        DO NOTHING
-                        '''
-                    else:
-                        query = '''
-                        INSERT OR IGNORE INTO incoming_requests 
-                        (instance_id, method, endpoint, host, request_data, request_start_at, 
-                         request_end_at, duration_ms, http_status, response_data, error_message, created_at)
-                        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-                        '''
-
-                    if db_config.is_postgres():
-                        conn = DatabaseManager.get_connection()
-                        cursor = conn.cursor()
-                        try:
-                            cursor.executemany(query, values)
-                            inserted_count = cursor.rowcount
-                            conn.commit()
-                        finally:
-                            cursor.close()
-                            conn.close()
-                    else:
-                        conn = DatabaseManager.get_connection()
-                        cursor = conn.cursor()
-                        try:
-                            cursor.executemany(query, values)
-                            inserted_count = cursor.rowcount
-                            conn.commit()
-                        finally:
-                            cursor.close()
-                            conn.close()
-
-                    if inserted_count > 0:
-                        inserted_ids = []
-                        for req_id, req_data in incoming_requests_buffer.items():
-                            for v in values:
-                                if (req_data['instance_id'] == v[0] and
-                                        req_data['method'] == v[1] and
-                                        req_data['endpoint'] == v[2] and
-                                        req_data['request_start_at'] == v[5]):
-                                    inserted_ids.append(req_id)
-                                    break
-
-                        for req_id in inserted_ids:
-                            incoming_requests_buffer.pop(req_id, None)
-
-                        logger.info(f"Flushed {inserted_count} incoming requests to database")
-
-            except Exception as e:
-                logger.error(f"Error flushing incoming requests buffer: {str(e)}")
-
-            return inserted_count
+            chosen = {
+                request_id: req for request_id, req in incoming_requests_buffer.items()
+                if include_in_flight or 'request_end_at' in req
+                or (now - _as_datetime(req['request_start_at'])).total_seconds()
+                >= IN_FLIGHT_STALE_SECONDS
+            }
+            for request_id in chosen:
+                incoming_requests_buffer.pop(request_id, None)
+        if not chosen:
+            return 0
+
+        rows = [{
+            'instance_id': req['instance_id'],
+            'method': req['method'],
+            'endpoint': req['endpoint'],
+            'host': req['host'],
+            'request_data': json.dumps(req['request_data']) if req['request_data'] else None,
+            'request_start_at': req['request_start_at'],
+            'request_end_at': req.get('request_end_at'),
+            'duration_ms': req.get('duration_ms'),
+            'http_status': req.get('http_status'),
+            'response_data': (json.dumps(req.get('response_data'))
+                              if req.get('response_data') else None),
+            'error_message': req.get('error_message'),
+            'created_at': req['created_at'],
+        } for req in chosen.values()]
+        columns = ("instance_id, method, endpoint, host, request_data, request_start_at, "
+                   "request_end_at, duration_ms, http_status, response_data, error_message, "
+                   "created_at")
+        placeholders = ", ".join(":" + c.strip() for c in columns.split(","))
+        if db_config.is_postgres():
+            query = (f"INSERT INTO incoming_requests ({columns}) VALUES ({placeholders}) "
+                     f"ON CONFLICT (instance_id, method, endpoint, request_start_at) DO NOTHING")
+        else:
+            query = f"INSERT OR IGNORE INTO incoming_requests ({columns}) VALUES ({placeholders})"
+
+        try:
+            inserted_count = await DatabaseManagerV2.execute_many_async(query, rows)
+        except Exception as e:
+            # Back into the buffer: the next flush tries again. A request that
+            # somehow reappeared meanwhile keeps its newer entry.
+            logger.error(f"Error flushing incoming requests buffer: {str(e)}")
+            async with incoming_requests_lock:
+                for request_id, req in chosen.items():
+                    incoming_requests_buffer.setdefault(request_id, req)
+            return 0
+
+        # Every chosen request is gone from the buffer, written or ignored as a
+        # duplicate alike: an ignored one is already in the table.
+        if inserted_count:
+            logger.info(f"Flushed {inserted_count} incoming requests to database")
+        return inserted_count
 
 
 #: What PostgreSQL enforces with named constraints, SQLite held as a unique
 #: index of the same name and no checks at all; each dialect keeps what it had.
 # --- how long a row lives ----------------------------------------------------
 
-#: How many days an audit row is kept. The table used to have no sweep at all,
-#: while metric snapshots and application events both had one: it grew for as
-#: long as the deployment ran, and every row in it was a second place a value
-#: from a query string lived.
+#: How many days an audit row is kept. The table used to have no sweep at all:
+#: it grew for as long as the deployment ran, and every row in it was a second
+#: place a value from a query string lived. The event log is swept the same way
+#: (keepup/retention.py).
 DEFAULT_AUDIT_RETENTION_DAYS = 30
 #: How often the sweep runs.
 AUDIT_SWEEP_INTERVAL_SECONDS = 3600
@@ -324,35 +315,12 @@ AUDIT_RETENTION_LOCK = "incoming_requests_retention"
 
 
 def retention_days():
-    """How many days rows are kept, from the environment or the default.
-
-    Returns:
-        A positive number of days; rubbish in the variable means the default
-        and a line in the log, because a sweep that switched itself off
-        silently would be worse than one that swept too much.
-    """
-    raw = os.getenv("AUDIT_RETENTION_DAYS")
-    if raw in (None, ""):
-        return DEFAULT_AUDIT_RETENTION_DAYS
-    try:
-        value = int(raw)
-    except (TypeError, ValueError):
-        logger.warning("AUDIT_RETENTION_DAYS=%r is not a number, using %s",
-                       raw, DEFAULT_AUDIT_RETENTION_DAYS)
-        return DEFAULT_AUDIT_RETENTION_DAYS
-    if value <= 0:
-        logger.warning("AUDIT_RETENTION_DAYS=%s must be positive, using %s",
-                       value, DEFAULT_AUDIT_RETENTION_DAYS)
-        return DEFAULT_AUDIT_RETENTION_DAYS
-    return value
+    """How many days audit rows are kept (``AUDIT_RETENTION_DAYS``, 30 by default)."""
+    return retention.retention_days("AUDIT_RETENTION_DAYS", DEFAULT_AUDIT_RETENTION_DAYS)
 
 
 def purge_old_requests(days=None, now=None):
-    """Delete audit rows older than the retention period.
-
-    The boundary is computed here rather than in the statement: the interval
-    syntax differs between the engines, and a query written for one does not
-    run on the other.
+    """Delete audit rows older than the retention period, in chunks.
 
     Args:
         days: how many days to keep; read from the environment when omitted.
@@ -361,27 +329,10 @@ def purge_old_requests(days=None, now=None):
     Returns:
         How many rows were deleted.
     """
-    from datetime import timedelta
-
-    keep_days = days if days is not None else retention_days()
-    cutoff = (now or datetime.utcnow()) - timedelta(days=keep_days)
-
-    removed = 0
-    for _ in range(AUDIT_MAX_CHUNKS_PER_PASS):
-        rows = DatabaseManagerV2.execute(
-            "SELECT id FROM incoming_requests WHERE created_at < :cutoff "
-            "ORDER BY created_at ASC LIMIT :limit",
-            {"cutoff": cutoff, "limit": AUDIT_DELETE_CHUNK_ROWS})
-        if not rows:
-            break
-        ids = {f"i{index}": row["id"] for index, row in enumerate(rows)}
-        placeholders = ", ".join(f":{key}" for key in ids)
-        DatabaseManagerV2.execute_commit(
-            f"DELETE FROM incoming_requests WHERE id IN ({placeholders})", ids)
-        removed += len(rows)
-        if len(rows) < AUDIT_DELETE_CHUNK_ROWS:
-            break
-    return removed
+    return retention.purge_older_than(
+        "incoming_requests", "created_at",
+        days if days is not None else retention_days(),
+        AUDIT_DELETE_CHUNK_ROWS, AUDIT_MAX_CHUNKS_PER_PASS, now=now)
 
 
 async def audit_retention_background():

{keepup_admin-0.1.1 → keepup_admin-0.2.0}/auth/dependencies.py

@@ -27,7 +27,7 @@ from keepup.auth.factory import AuthProviderFactory
 from keepup.auth.providers.base import AuthProvider, ALGORITHM, oauth2_scheme
 from keepup.auth.signing_key import resolve_signing_key
 from keepup.roles import ROLE_ADMIN, ROLE_CLIENT
-from keepup.db import DatabaseManager, db_config
+from keepup.db import DatabaseManagerV2
 
 #: What an application may import from this module. Everything else is
 #: internal and may change without notice -- see doc/keepup.md.
@@ -56,70 +56,21 @@ async def get_user_by_username_async(username: str):
 
 
 def get_user_by_username(username: str):
-    """Return a user by name, including the extra fields."""
-    try:
-        loop = asyncio.get_event_loop()
-    except RuntimeError:
-        loop = asyncio.new_event_loop()
-        asyncio.set_event_loop(loop)
-
-    if loop.is_running():
-        import asyncio as async_module
-        import threading
-
-        result = None
-        event = threading.Event()
-
-        def run_in_thread():
-            nonlocal result
-            new_loop = async_module.new_event_loop()
-            try:
-                async_module.set_event_loop(new_loop)
-                result = new_loop.run_until_complete(
-                    auth_provider.get_user_info(username)
-                )
-            except Exception as e:
-                logger.error(f"Error in thread: {e}")
-            finally:
-                # Closed on every path, including the failing one: a loop holds
-                # an epoll descriptor and a self-pipe, and this runs once per
-                # authenticated call. Left open, a long-lived process reaches its
-                # descriptor limit and then cannot open anything at all -- which
-                # surfaces as "database connection failed", not as a leak.
-                try:
-                    new_loop.close()
-                except Exception as e:
-                    logger.warning(f"Could not close the worker event loop: {e}")
-                async_module.set_event_loop(None)
-                event.set()
-
-        thread = threading.Thread(target=run_in_thread)
-        thread.start()
-        thread.join(timeout=10)
-
-        if event.is_set() and result is not None:
-            return result
-        else:
-            logger.warning(f"Async call failed, falling back to DB for user {username}")
-            return None
+    """Return a user by name, including the extra fields.
 
-    user_info = loop.run_until_complete(
-        auth_provider.get_user_info(username)
-    )
-
-    return user_info
+    Synchronous, for plugins and background jobs that cannot await. It used to
+    wrap the provider's coroutine -- and, called from a running loop, ran it on a
+    loop of its own in a thread that the caller waited for, holding the loop.
+    The provider answers synchronously itself now.
+    """
+    return auth_provider.lookup_user(username)
 
 
 def get_user_by_id(user_id: int):
     """Return a user by id, for any configured auth provider."""
     # TODO: auth_provider needs a lookup by id as well; without it this only
     # works against the local database.
-    result = DatabaseManager.execute_query(
-        "SELECT * FROM users WHERE id = ?",
-        (user_id,),
-        fetch_one=True
-    )
-    return result
+    return DatabaseManagerV2.execute_one("SELECT * FROM users WHERE id = :id", {"id": user_id})
 
 
 def get_system_user_id():
@@ -147,7 +98,7 @@ def get_system_user_id():
 
 def get_all_users():
     """Return every user, for any configured auth provider."""
-    return DatabaseManager.execute_query(
+    return DatabaseManagerV2.execute(
         "SELECT id, username, status, role, created_at FROM users ORDER BY created_at DESC"
     )
 
@@ -158,18 +109,15 @@ def save_user_to_db(username: str, password: str):
 
     query = """
     INSERT INTO users (username, password_hash, status, role) 
-    VALUES (?, ?, ?, ?)
+    VALUES (:username, :password_hash, :status, :role)
     """
 
-    if db_config.is_postgres():
-        query += " RETURNING id"
-
     try:
-        user_id = DatabaseManager.execute_commit(
+        row = DatabaseManagerV2.execute_commit_returning(
             query,
-            (username, password_hash, "blocked", ROLE_CLIENT)
-        )
-        return user_id
+            {"username": username, "password_hash": password_hash, "status": "blocked",
+             "role": ROLE_CLIENT})
+        return row["id"] if row else None
 
     except Exception as e:
         if "unique constraint" in str(e).lower() or "duplicate" in str(e).lower():
@@ -202,47 +150,17 @@ async def create_user(
 def update_user(user_id: int, status: Optional[str] = None, role: Optional[str] = None,
                 email: Optional[str] = None, phone: Optional[str] = None, full_name: Optional[str] = None):
     """Update a user, including the extra fields."""
-    conn = DatabaseManager.get_connection()
-    cursor = conn.cursor()
-
-    update_fields = []
-    params = []
-
-    if status is not None:
-        update_fields.append("status = ?")
-        params.append(status)
-
-    if role is not None:
-        update_fields.append("role = ?")
-        params.append(role)
-
-    if email is not None:
-        update_fields.append("email = ?")
-        params.append(email)
-
-    if phone is not None:
-        update_fields.append("phone = ?")
-        params.append(phone)
-
-    if full_name is not None:
-        update_fields.append("full_name = ?")
-        params.append(full_name)
-
-    if not update_fields:
+    changes = {"status": status, "role": role, "email": email, "phone": phone,
+               "full_name": full_name}
+    changes = {column: value for column, value in changes.items() if value is not None}
+    if not changes:
         return
 
-    update_fields.append("updated_at = CURRENT_TIMESTAMP")
-    params.append(user_id)
-
-    query = f"UPDATE users SET {', '.join(update_fields)} WHERE id = ?"
-
-    if db_config.is_postgres():
-        query = query.replace('?', '%s')
-
-    cursor.execute(query, params)
-    conn.commit()
-    cursor.close()
-    conn.close()
+    # The column names come from the fixed set above, never from the caller.
+    assignments = ", ".join(f"{column} = :{column}" for column in changes)
+    DatabaseManagerV2.execute_commit(
+        f"UPDATE users SET {assignments}, updated_at = CURRENT_TIMESTAMP WHERE id = :id",
+        {**changes, "id": user_id})
 
 
 async def authenticate(username: str, password: str):
@@ -334,6 +252,13 @@ def _session_is_live(payload: dict) -> bool:
         return False
 
 
+def _session_and_user(payload: dict, username: str):
+    """Whether the token's session is live and, only if it is, whose account it is."""
+    if not _session_is_live(payload):
+        return False, None
+    return True, auth_provider.lookup_user(username)
+
+
 async def get_current_user(token: str = Depends(request_token)):
     """Return the current user of this token.
 
@@ -387,15 +312,15 @@ async def _get_local_user(token: Optional[str], ignore_empty_user: bool = False)
             return None
         raise credentials_exception
 
-    if not _session_is_live(payload):
-        raise credentials_exception
-
-    user = get_user_by_username(token_data.username)
-    if user is None:
+    # Both reads are blocking queries, so they leave the loop together: one hop
+    # to a worker thread per request, and the account is read once -- it used
+    # to be read twice, each time on a new event loop in a thread the request
+    # waited for while holding the loop (keepup-43).
+    live, user = await asyncio.to_thread(_session_and_user, payload, token_data.username)
+    if not live or user is None:
         raise credentials_exception
 
-    fresh_user = get_user_by_username(token_data.username)
-    if fresh_user["status"] != "active":
+    if user["status"] != "active":
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="User account is blocked",
@@ -405,12 +330,12 @@ async def _get_local_user(token: Optional[str], ignore_empty_user: bool = False)
     # the token is decoded is the only place that knows -- and a handler that
     # needs to warn about the end (or record it alongside a websocket key)
     # cannot decode the token itself: it never sees it.
-    fresh_user = dict(fresh_user)
-    fresh_user["token_expires_at"] = _token_expiry(payload)
-    fresh_user["session_started_at"] = _session_start(payload)
-    fresh_user["session_id"] = payload.get(panel_session.SESSION_CLAIM)
+    user = dict(user)
+    user["token_expires_at"] = _token_expiry(payload)
+    user["session_started_at"] = _session_start(payload)
+    user["session_id"] = payload.get(panel_session.SESSION_CLAIM)
 
-    return fresh_user
+    return user
 
 
 async def get_optional_user(token: Optional[str]):

{keepup_admin-0.1.1 → keepup_admin-0.2.0}/auth/login_throttle.py

@@ -106,34 +106,35 @@ def locked_until(username: str, now: Optional[datetime] = None) -> Optional[date
     return until if until > now else None
 
 
+#: One statement, the same on both dialects (PostgreSQL 9.5+, SQLite 3.24+), so
+#: the count is kept by the database rather than read, incremented here and
+#: written back. The read-modify-write lost attempts: failures arriving at once
+#: on several replicas read the same number and each wrote it plus one, and two
+#: first failures both tried to insert, the loser's error swallowed -- so the
+#: lockout came later than the setting said, which is the one thing a throttle
+#: against guessing must not do (keepup-48). A name whose window has passed
+#: starts its count again, so old failures do not add up to a lockout weeks later.
+_RECORD_FAILURE = (
+    "INSERT INTO login_attempts (username, failures, last_failure_at) "
+    "VALUES (:username, 1, :now) "
+    "ON CONFLICT (username) DO UPDATE SET "
+    "failures = CASE WHEN login_attempts.last_failure_at IS NOT NULL "
+    "AND login_attempts.last_failure_at <= :window_start "
+    "THEN 1 ELSE login_attempts.failures + 1 END, "
+    "last_failure_at = :now"
+)
+
+
 def record_failure(username: str, now: Optional[datetime] = None) -> None:
-    """Count one failed attempt against this name."""
+    """Count one failed attempt against this name, atomically."""
     if not username:
         return
 
     now = now or datetime.utcnow()
     try:
-        row = _row(username)
-        if row is None:
-            DatabaseManagerV2.execute_commit(
-                "INSERT INTO login_attempts (username, failures, last_failure_at) "
-                "VALUES (:username, 1, :now)",
-                {"username": username, "now": now}
-            )
-            return
-
-        # A name whose window has already passed starts its count again, so old
-        # failures do not add up to a lockout weeks later.
-        failures = (row.get("failures") or 0)
-        last_failure = _as_datetime(row.get("last_failure_at"))
-        if last_failure is not None and last_failure + lockout_window() <= now:
-            failures = 0
-
         DatabaseManagerV2.execute_commit(
-            "UPDATE login_attempts SET failures = :failures, last_failure_at = :now "
-            "WHERE username = :username",
-            {"failures": failures + 1, "now": now, "username": username}
-        )
+            _RECORD_FAILURE,
+            {"username": username, "now": now, "window_start": now - lockout_window()})
     except Exception as error:
         logger.warning(f"Could not record a failed login of {username}: {error}")