loom-kernel 2.9.0__tar.gz → 2.11.0__tar.gz

{loom_kernel-2.9.0 → loom_kernel-2.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: loom-kernel
-Version: 2.9.0
+Version: 2.11.0
 Summary: Loom Python project
 License-File: LICENSE
 Classifier: Programming Language :: Python :: 3

{loom_kernel-2.9.0 → loom_kernel-2.11.0}/pyproject.toml

@@ -224,6 +224,7 @@ mcp-tests = [
 dev = [
     "aiocache>=0.12,<1.0",
     "aiosqlite>=0.20.0",
+    "asyncpg>=0.30",
     # Declared, not merely transitive: one cache test pins what the key renderer
     # cannot separate inside an object msgspec expands itself, and an attrs class
     # is the only such object the stdlib can build.
@@ -477,6 +478,7 @@ prerelease_ignore = [
     "ci/.*",
     "test/.*",
     "build/.*",
+    "dependabot/.*",
 ]
 release_ignore = [
     "wip/.*",
@@ -485,4 +487,5 @@ release_ignore = [
     "ci/.*",
     "test/.*",
     "build/.*",
+    "dependabot/.*",
 ]

{loom_kernel-2.9.0 → loom_kernel-2.11.0}/src/loom/core/authz/_decide.py

@@ -4,8 +4,9 @@ from __future__ import annotations
 
 from collections.abc import Iterable
 from dataclasses import dataclass
+from datetime import datetime
 
-from loom.core.authz._grants import Grant
+from loom.core.authz._grants import Grant, require_aware
 from loom.core.authz._roles import Permission, RoleCatalog
 from loom.core.authz._scope import Scope
 
@@ -54,8 +55,41 @@ class GrantCheck:
         return self.allowed
 
 
-def _specificity(grant: Grant) -> tuple[int, str, str]:
-    return (-len(grant.scope.path), grant.role, grant.subject)
+_FOREVER = float("-inf")
+
+
+def _rank(grant: Grant) -> tuple[int, str, str, float]:
+    lifetime = _FOREVER if grant.expires_at is None else -grant.expires_at.timestamp()
+    return (-len(grant.scope.path), grant.role, grant.subject, lifetime)
+
+
+def _check_now(now: datetime | None) -> None:
+    if now is not None:
+        require_aware("now", now)
+
+
+def _require_now_for_expiring(grants: tuple[Grant, ...], now: datetime | None) -> None:
+    expiry = next((grant.expires_at for grant in grants if grant.expires_at is not None), None)
+    if now is None and expiry is not None:
+        raise ValueError(
+            f"A grant expires at {expiry.isoformat()}; pass now= to decide whether it is alive."
+        )
+
+
+def _alive(grant: Grant, now: datetime | None) -> bool:
+    return grant.expires_at is None or (now is not None and now < grant.expires_at)
+
+
+def _covering_paths(scope: Scope) -> frozenset[tuple[str, ...]]:
+    return frozenset(scope.path[:depth] for depth in range(len(scope.path) + 1))
+
+
+def _outermost(scopes: set[Scope]) -> frozenset[Scope]:
+    return frozenset(
+        scope
+        for scope in scopes
+        if not any(other != scope and other.covers(scope) for other in scopes)
+    )
 
 
 def evaluate(
@@ -63,6 +97,8 @@ def evaluate(
     grants: Iterable[Grant],
     permission: Permission,
     scope: Scope,
+    *,
+    now: datetime | None = None,
 ) -> Decision:
     """Decide whether a subject holds *permission* on *scope*.
 
@@ -70,30 +106,38 @@ def evaluate(
     scope covering *scope*.  A grant whose role the catalog does not declare
     allows nothing.  When several grants allow, the decision names the one on
     the deepest scope, then the first by role name and subject, regardless of
-    the order of *grants*.
+    the order of *grants*; among grants that tie there, the one that lives
+    longest.  A grant is alive while *now* is before its expiry; an expired
+    grant counts as absent.
 
     Args:
         catalog: The product's roles.
         grants: The grants of one subject.
         permission: The capability being exercised.
         scope: Where it is exercised.
+        now: The timezone-aware instant of the decision; needed only when
+            some grant carries an expiry.
 
     Returns:
         The decision, carrying the grant that allowed it.
 
     Raises:
         UnknownPermission: When *permission* is not declared in the catalog.
+        TypeError: When *now* is not a datetime.
+        ValueError: When *now* is naive, or is ``None`` while some grant
+            carries an expiry.
     """
+    _check_now(now)
+    held = tuple(grants)
+    _require_now_for_expiring(held, now)
     roles = catalog.roles_with(permission)
-    covering = {scope.path[:depth] for depth in range(len(scope.path) + 1)}
-    winner: Grant | None = None
-    for grant in grants:
-        if (
-            grant.role in roles
-            and grant.scope.path in covering
-            and (winner is None or _specificity(grant) < _specificity(winner))
-        ):
-            winner = grant
+    covering = _covering_paths(scope)
+    allowing = [
+        grant
+        for grant in held
+        if grant.role in roles and grant.scope.path in covering and _alive(grant, now)
+    ]
+    winner = min(allowing, key=_rank, default=None)
     return Decision(winner is not None, winner)
 
 
@@ -101,28 +145,36 @@ def scopes_with(
     catalog: RoleCatalog,
     grants: Iterable[Grant],
     permission: Permission,
+    *,
+    now: datetime | None = None,
 ) -> frozenset[Scope]:
     """Return the outermost scopes on which a subject holds *permission*.
 
     A scope covered by another returned scope is left out, so a listing can
-    be filtered with one :meth:`Scope.covers` test per returned scope.
+    be filtered with one :meth:`Scope.covers` test per returned scope.  An
+    expired grant counts as absent.
 
     Args:
         catalog: The product's roles.
         grants: The grants of one subject.
         permission: The capability being listed.
+        now: The timezone-aware instant of the listing; needed only when
+            some grant carries an expiry.
 
     Returns:
         The minimal set of scopes covering everything the subject may reach.
 
     Raises:
         UnknownPermission: When *permission* is not declared in the catalog.
+        TypeError: When *now* is not a datetime.
+        ValueError: When *now* is naive, or is ``None`` while some grant
+            carries an expiry.
     """
+    _check_now(now)
+    held = tuple(grants)
+    _require_now_for_expiring(held, now)
     roles = catalog.roles_with(permission)
-    held = {grant.scope for grant in grants if grant.role in roles}
-    return frozenset(
-        scope for scope in held if not any(other != scope and other.covers(scope) for other in held)
-    )
+    return _outermost({grant.scope for grant in held if grant.role in roles and _alive(grant, now)})
 
 
 def _delegation_check(
@@ -130,10 +182,13 @@ def _delegation_check(
     granter_grants: Iterable[Grant],
     needed: Iterable[Permission],
     scope: Scope,
+    now: datetime | None,
 ) -> GrantCheck:
     held = tuple(granter_grants)
     missing = frozenset(
-        permission for permission in needed if not evaluate(catalog, held, permission, scope)
+        permission
+        for permission in needed
+        if not evaluate(catalog, held, permission, scope, now=now)
     )
     return GrantCheck(not missing, missing)
 
@@ -145,11 +200,12 @@ def can_grant(
     scope: Scope,
     *,
     delegate: Permission,
+    now: datetime | None = None,
 ) -> GrantCheck:
     """Decide whether a granter may assign *role* on *scope*.
 
     The granter needs *delegate* and every permission of *role*, each held on
-    a scope covering *scope*.
+    a scope covering *scope* by a grant that is alive at *now*.
 
     Args:
         catalog: The product's roles.
@@ -157,6 +213,8 @@ def can_grant(
         role: Name of the role to assign.
         scope: Where it would apply.
         delegate: The permission that allows assigning roles at all.
+        now: The timezone-aware instant of the check; needed only when some
+            of the granter's grants carry an expiry.
 
     Returns:
         The check, listing the permissions the granter lacks there.
@@ -164,9 +222,13 @@ def can_grant(
     Raises:
         UnknownRole: When *role* is not declared in the catalog.
         UnknownPermission: When *delegate* is not declared in the catalog.
+        TypeError: When *now* is not a datetime.
+        ValueError: When *now* is naive, or is ``None`` while some of the
+            granter's grants carry an expiry.
     """
+    _check_now(now)
     needed = {delegate, *catalog.role(role).permissions}
-    return _delegation_check(catalog, granter_grants, needed, scope)
+    return _delegation_check(catalog, granter_grants, needed, scope, now)
 
 
 def can_revoke(
@@ -175,23 +237,31 @@ def can_revoke(
     grant: Grant,
     *,
     delegate: Permission,
+    now: datetime | None = None,
 ) -> GrantCheck:
     """Decide whether a granter may remove *grant*.
 
-    Revoking needs what granting it would.  A grant whose role the code does
-    not declare allows nothing, so removing it needs *delegate* only.
+    Revoking needs what granting it would, whether or not *grant* has
+    expired.  A grant whose role the code does not declare allows nothing, so
+    removing it needs *delegate* only.
 
     Args:
         catalog: The product's roles.
         granter_grants: The granter's grants.
         grant: The assignment to remove.
         delegate: The permission that allows assigning roles at all.
+        now: The timezone-aware instant of the check; needed only when some
+            of the granter's grants carry an expiry.
 
     Returns:
         The check, listing the permissions the granter lacks there.
 
     Raises:
         UnknownPermission: When *delegate* is not declared in the catalog.
+        TypeError: When *now* is not a datetime.
+        ValueError: When *now* is naive, or is ``None`` while some of the
+            granter's grants carry an expiry.
     """
+    _check_now(now)
     needed = {delegate, *(catalog.permissions_of(grant.role) or frozenset())}
-    return _delegation_check(catalog, granter_grants, needed, grant.scope)
+    return _delegation_check(catalog, granter_grants, needed, grant.scope, now)

loom_kernel-2.11.0/src/loom/core/authz/_grants.py

@@ -0,0 +1,135 @@
+"""Who holds which role where, and where those assignments come from."""
+
+from __future__ import annotations
+
+import functools
+from collections.abc import Collection, Iterable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from typing import Protocol
+
+from loom.core.authz._roles import require_name
+from loom.core.authz._scope import Scope
+
+
+def require_aware(name: str, moment: datetime) -> None:
+    """Reject a moment that does not name a single instant.
+
+    Args:
+        name: What the moment is, for the error message.
+        moment: The moment to check.
+
+    Raises:
+        TypeError: When *moment* is not a datetime.
+        ValueError: When *moment* is naive.
+    """
+    if not isinstance(moment, datetime):
+        raise TypeError(f"{name} must be a datetime, not {type(moment).__name__}.")
+    if moment.utcoffset() is None:
+        raise ValueError(f"{name} must be timezone-aware: {moment!r}.")
+
+
+def _require_subject(subject: str) -> None:
+    if not subject:
+        raise ValueError("A grant needs a subject.")
+
+
+def _require_scope(scope: object) -> None:
+    if not isinstance(scope, Scope):
+        raise TypeError(f"A grant scope must be a Scope, not {type(scope).__name__}.")
+
+
+def _utc_or_none(name: str, moment: datetime | None) -> datetime | None:
+    if moment is None:
+        return None
+    require_aware(name, moment)
+    return moment.astimezone(UTC)
+
+
+_NEVER = (0,)
+
+
+@functools.total_ordering
+@dataclass(frozen=True, slots=True)
+class Grant:
+    """An assignment of a role to a subject on a scope, possibly until a moment.
+
+    Grants order by subject, role, scope and then expiry, with grants that
+    never expire before those that do, soonest first.
+
+    Attributes:
+        subject: Opaque identifier of the holder, such as an identity subject
+            or a service account id.
+        role: Name of the role; its permissions are looked up in the catalog
+            at decision time.
+        scope: Where the role applies, including everything below it.
+        expires_at: The timezone-aware instant from which the grant allows
+            nothing; ``None`` when it never expires.
+    """
+
+    subject: str
+    role: str
+    scope: Scope
+    expires_at: datetime | None = None
+
+    def __post_init__(self) -> None:
+        """Reject a grant with no holder, an unusable role name, no scope or a naive expiry."""
+        _require_subject(self.subject)
+        require_name("role", self.role)
+        _require_scope(self.scope)
+        object.__setattr__(self, "expires_at", _utc_or_none("A grant expiry", self.expires_at))
+
+    @property
+    def _sort_key(self) -> tuple[str, str, Scope, tuple[int] | tuple[int, datetime]]:
+        expiry = _NEVER if self.expires_at is None else (1, self.expires_at)
+        return (self.subject, self.role, self.scope, expiry)
+
+    def __lt__(self, other: object) -> bool:
+        """Order by subject, role, scope, then expiry."""
+        if not isinstance(other, Grant):
+            return NotImplemented
+        return self._sort_key < other._sort_key
+
+
+class GrantSource(Protocol):
+    """Where the grants of a subject are loaded from.
+
+    Any class with this method satisfies the protocol structurally, with no
+    inheritance required.
+    """
+
+    async def grants_for(self, subject: str) -> Collection[Grant]:
+        """Return every grant held by *subject*.
+
+        Args:
+            subject: Identifier of the holder.
+
+        Returns:
+            The subject's grants; empty when it holds none.
+        """
+        ...
+
+
+class InMemoryGrantSource:
+    """A :class:`GrantSource` over a fixed list, for tests and examples."""
+
+    __slots__ = ("_grants",)
+
+    def __init__(self, grants: Iterable[Grant]) -> None:
+        """Hold *grants*, deduplicated in their original order.
+
+        Args:
+            grants: Grants of any number of subjects.
+        """
+        self._grants = tuple(dict.fromkeys(grants))
+
+    async def grants_for(self, subject: str) -> Collection[Grant]:  # NOSONAR S7503 - protocol
+        """Return the grants of *subject*, in the order they were given.
+
+        Args:
+            subject: Identifier of the holder.
+
+        Returns:
+            The subject's grants.
+        """
+        return tuple(grant for grant in self._grants if grant.subject == subject)

{loom_kernel-2.9.0 → loom_kernel-2.11.0}/src/loom/core/authz/_scope.py

@@ -8,6 +8,22 @@ from dataclasses import dataclass
 _SEPARATOR = "/"
 
 
+def _segments_of(path: Iterable[str]) -> tuple[str, ...]:
+    if isinstance(path, str):
+        raise TypeError("A scope path is a sequence of segments, not a string; use Scope.parse().")
+    return tuple(map(_segment, path))
+
+
+def _segment(value: object) -> str:
+    if not isinstance(value, str):
+        raise TypeError(f"A scope segment must be a string: {value!r}.")
+    if not value or _SEPARATOR in value:
+        raise ValueError(
+            f"A scope segment must be non-empty and free of {_SEPARATOR!r}: {value!r}."
+        )
+    return value
+
+
 @dataclass(frozen=True, slots=True, order=True, init=False)
 class Scope:
     """A node in the product's resource hierarchy.
@@ -43,19 +59,7 @@ class Scope:
             TypeError: When *path* is a single string or holds a non-string.
             ValueError: When a segment is empty or contains ``/``.
         """
-        if isinstance(path, str):
-            raise TypeError(
-                "A scope path is a sequence of segments, not a string; use Scope.parse()."
-            )
-        segments = tuple(path)
-        for segment in segments:
-            if not isinstance(segment, str):
-                raise TypeError(f"A scope segment must be a string: {segment!r}.")
-            if not segment or _SEPARATOR in segment:
-                raise ValueError(
-                    f"A scope segment must be non-empty and free of {_SEPARATOR!r}: {segment!r}."
-                )
-        object.__setattr__(self, "path", segments)
+        object.__setattr__(self, "path", _segments_of(path))
 
     @classmethod
     def root(cls) -> Scope:

{loom_kernel-2.9.0 → loom_kernel-2.11.0}/src/loom/core/repository/sqlalchemy/__init__.py

@@ -13,6 +13,7 @@ from loom.core.repository.sqlalchemy.registry import (
 )
 from loom.core.repository.sqlalchemy.repository import RepositorySQLAlchemy, with_session_scope
 from loom.core.repository.sqlalchemy.session_manager import SessionManager
+from loom.core.repository.sqlalchemy.session_settings import SessionSettings
 from loom.core.repository.sqlalchemy.transactional import SupportsPostCommit, transactional
 
 __all__ = [
@@ -24,6 +25,7 @@ __all__ = [
     "Projection",
     "RepositorySQLAlchemy",
     "SessionManager",
+    "SessionSettings",
     "SupportsPostCommit",
     "TimestampMixin",
     "SQLAlchemyDefaultRepositoryBuilder",

{loom_kernel-2.9.0 → loom_kernel-2.11.0}/src/loom/core/repository/sqlalchemy/session_manager.py

@@ -5,14 +5,20 @@ from contextlib import asynccontextmanager
 from typing import Any
 
 from sqlalchemy import event
+from sqlalchemy.engine import make_url
 from sqlalchemy.ext.asyncio import (
     AsyncEngine,
     AsyncSession,
     async_sessionmaker,
     create_async_engine,
 )
+from sqlalchemy.orm import Session
 
 from loom.core.logger import get_logger
+from loom.core.repository.sqlalchemy.session_settings import (
+    SessionSettings,
+    install_session_settings,
+)
 from loom.core.tracing import get_trace_id
 
 
@@ -25,6 +31,7 @@ class SessionManager:
         config: Mapping[str, Any],
         *,
         inject_trace_id: bool = True,
+        session_settings: SessionSettings | None = None,
         **engine_kwargs: object,
     ) -> SessionManager:
         """Build a session manager from a resolved SQLAlchemy config mapping.
@@ -34,6 +41,8 @@ class SessionManager:
                 optional pool tuning keys.
             inject_trace_id: When ``True``, prefixes SQL statements with the
                 active trace id when available.
+            session_settings: Optional provider of transaction-local Postgres
+                settings; see :meth:`SessionManager.__init__` for the contract.
             **engine_kwargs: Additional keyword arguments forwarded to the
                 async engine constructor.
 
@@ -41,7 +50,8 @@ class SessionManager:
             A configured :class:`SessionManager`.
 
         Raises:
-            ValueError: If ``url`` is missing or empty.
+            ValueError: If ``url`` is missing or empty, or if ``session_settings``
+                is given and ``url`` is not a Postgres URL.
         """
         url = config.get("url")
         if not url:
@@ -56,6 +66,7 @@ class SessionManager:
             pool_recycle=_optional_int(config.get("pool_recycle"), 1800),
             connect_args=dict(config.get("connect_args") or {}),
             inject_trace_id=inject_trace_id,
+            session_settings=session_settings,
             **engine_kwargs,
         )
 
@@ -71,6 +82,7 @@ class SessionManager:
         pool_recycle: int | None = 1800,
         connect_args: dict[str, object] | None = None,
         inject_trace_id: bool = True,
+        session_settings: SessionSettings | None = None,
         **engine_kwargs: object,
     ) -> None:
         """Create a session manager backed by an async SQLAlchemy engine.
@@ -88,8 +100,32 @@ class SessionManager:
                 ``/* trace_id=<id> */`` comment when a trace identifier is active
                 in the current async context.  Visible in database slow-query logs
                 and ``pg_stat_activity``.  Defaults to ``True``.
+            session_settings: When given, a callable that returns the settings for
+                the transaction about to start, or ``None`` to apply none. Each
+                outer transaction then begins with one ``SELECT`` that calls
+                ``set_config(key, value, true)`` once per entry, with keys and
+                values bound as parameters. The settings are local to the
+                transaction, so the connection returns to the pool clean. Postgres
+                only, and incompatible with ``isolation_level="AUTOCOMMIT"``, which
+                would discard the settings after each statement; when ``None``,
+                the manager behaves exactly as it does without this option.
             **engine_kwargs: Additional keyword arguments forwarded to ``create_async_engine``.
+
+        Raises:
+            ValueError: If ``session_settings`` is given and ``url`` is not a
+                Postgres URL, or the engine is configured with
+                ``isolation_level="AUTOCOMMIT"``.
         """
+        if session_settings is not None:
+            backend = make_url(url).get_backend_name()
+            if backend != "postgresql":
+                raise ValueError(
+                    f"session_settings requires a postgresql URL, got backend {backend!r}"
+                )
+            if _autocommit(engine_kwargs):
+                raise ValueError(
+                    "session_settings is incompatible with isolation_level='AUTOCOMMIT'"
+                )
         engine_config: dict[str, object] = {
             "echo": echo,
             "pool_pre_ping": pool_pre_ping,
@@ -108,10 +144,16 @@ class SessionManager:
 
         self._log = get_logger(__name__).bind(module="session_manager")
         self._engine = create_async_engine(url, **engine_config)
+        factory_kwargs: dict[str, Any] = {}
+        if session_settings is not None:
+            session_class = type("SettingsSession", (Session,), {})
+            install_session_settings(session_class, session_settings)
+            factory_kwargs["sync_session_class"] = session_class
         self._session_factory = async_sessionmaker(
             bind=self._engine,
             class_=AsyncSession,
             expire_on_commit=False,
+            **factory_kwargs,
         )
         if inject_trace_id:
             _register_trace_id_listener(self._engine)
@@ -120,6 +162,7 @@ class SessionManager:
             backend=self._engine.url.get_backend_name(),
             driver=self._engine.url.get_driver_name(),
             inject_trace_id=inject_trace_id,
+            session_settings=session_settings is not None,
         )
 
     @asynccontextmanager
@@ -181,6 +224,17 @@ def _register_trace_id_listener(async_engine: AsyncEngine) -> None:
         return statement, parameters
 
 
+def _autocommit(engine_kwargs: Mapping[str, object]) -> bool:
+    execution_options = engine_kwargs.get("execution_options")
+    levels = (
+        engine_kwargs.get("isolation_level"),
+        execution_options.get("isolation_level")
+        if isinstance(execution_options, Mapping)
+        else None,
+    )
+    return any(isinstance(level, str) and level.upper() == "AUTOCOMMIT" for level in levels)
+
+
 def _optional_int(value: Any, default: int) -> int:
     if value is None:
         return default

loom_kernel-2.11.0/src/loom/core/repository/sqlalchemy/session_settings.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+import re
+from collections.abc import Callable, Mapping
+from typing import Any
+
+from sqlalchemy import TextClause, event, text
+from sqlalchemy.orm import Session
+
+SessionSettings = Callable[[], Mapping[str, str] | None]
+"""Returns the settings to apply to the transaction about to start, or ``None`` to apply none.
+
+loom does not interpret the keys or values. A product returns, for example, the tenant
+and the subject of the current request, and writes its Postgres policies against
+``current_setting(key, true)``.
+"""
+
+_KEY = re.compile(r"[A-Za-z_]\w*\.[A-Za-z_]\w*")
+
+
+def settings_statement(
+    values: Mapping[str, str] | None,
+) -> tuple[TextClause, dict[str, str]] | None:
+    """Build the one statement that sets *values* for the current transaction.
+
+    Every key and value is bound as a parameter: the compiled SQL carries only
+    placeholders. Keys must be application-prefixed identifiers, ``prefix.name``,
+    which is what Postgres requires of a custom setting.
+
+    Args:
+        values: The settings to apply, or ``None``.
+
+    Returns:
+        The ``SELECT set_config(...)`` clause with its parameters, or ``None``
+        when there is nothing to set.
+
+    Raises:
+        ValueError: If a key is not a string of the form ``prefix.name``.
+        TypeError: If a value is not a ``str``.
+    """
+    if not values:
+        return None
+    calls: list[str] = []
+    params: dict[str, str] = {}
+    for index, (key, value) in enumerate(values.items()):
+        if not isinstance(key, str) or _KEY.fullmatch(key) is None:
+            raise ValueError(
+                f"session setting key must be a str of the form 'prefix.name', got {key!r}"
+            )
+        if not isinstance(value, str):
+            raise TypeError(
+                f"session setting value for {key!r} must be str, got {type(value).__name__}"
+            )
+        calls.append(f"set_config(:k{index}, :v{index}, true)")
+        params[f"k{index}"] = key
+        params[f"v{index}"] = value
+    return text("SELECT " + ", ".join(calls)), params
+
+
+def install_session_settings(session_class: type[Session], provider: SessionSettings) -> None:
+    """Apply *provider*'s settings at the start of every outer transaction of *session_class*.
+
+    The listener runs once per outer transaction and not for savepoints. A provider
+    that raises, an invalid key, or a non-``str`` value fails the transaction before
+    its first product statement reaches the database, and invalidates its connection,
+    so the session refuses further statements until it is rolled back.
+
+    Args:
+        session_class: The synchronous ``Session`` subclass the listener is bound to.
+        provider: The settings provider called at the start of each transaction.
+    """
+
+    @event.listens_for(session_class, "after_begin")
+    def _apply_session_settings(_session: Session, transaction: Any, connection: Any) -> None:
+        if transaction.nested:
+            return
+        try:
+            statement = settings_statement(provider())
+            if statement is not None:
+                connection.execute(*statement)
+        except BaseException:
+            connection.invalidate()
+            raise