matrx-orm 3.1.151__tar.gz → 3.1.153__tar.gz

{matrx_orm-3.1.151 → matrx_orm-3.1.153}/.gitignore

@@ -262,6 +262,16 @@ packages/matrx-utils/matrx_utils/data_in_code/data_history.json
 # audit trail is the `metadata.migrations` stamp on the row itself.
 .matrx-migrations/
 
+# Trial Bench records written on THIS machine — the trial's JSON record, its §8
+# report and the index that finds them (aidream/services/masterworks/bench/index.py,
+# and the runs a product-started trial writes beside it). They are never repo
+# content: a record carries every arm's full text INCLUDING the expert's ground
+# truth, which is material deliberately withheld from the Rulebook, and a trial
+# that matters is published deliberately under common-docs/projects/<its trial>/.
+# Untracked-but-not-ignored meant one `git add -A` away from committing an
+# expert's withheld work.
+.matrx/bench/
+
 # macOS Finder metadata
 .DS_Store
 **/.DS_Store

{matrx_orm-3.1.151 → matrx_orm-3.1.153}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: matrx-orm
-Version: 3.1.151
+Version: 3.1.153
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current
@@ -25,7 +25,7 @@ Requires-Python: >=3.13
 Requires-Dist: asyncpg>=0.31.0
 Requires-Dist: cryptography>=43.0
 Requires-Dist: gitpython>=3.1.40
-Requires-Dist: matrx-utils>=2.0.41
+Requires-Dist: matrx-utils>=2.0.42
 Requires-Dist: psycopg-pool>=3.2.5
 Requires-Dist: psycopg[binary]>=3.2.5
 Requires-Dist: python-dotenv>=1.0

{matrx_orm-3.1.151 → matrx_orm-3.1.153}/matrx_orm/client/supabase_auth.py

@@ -198,12 +198,29 @@ class SupabaseAuth:
         self._session = AuthSession.from_response(data)
         return self._session
 
-    async def sign_out(self, access_token: str | None = None) -> None:
-        """Sign out and invalidate the session."""
+    async def sign_out(
+        self, access_token: str | None = None, *, scope: str = "local"
+    ) -> None:
+        """Sign out THIS session only (``scope="local"``) — never the account.
+
+        GoTrue's ``POST /logout`` defaults to ``scope=global``, which deletes
+        EVERY session the account holds: the web app's, the desktop app's, and
+        every OAuth-client session (Claude Code, claude.ai, Codex hold their
+        AI Dream MCP sign-in as one of these). 2026-09-15: the admin operator
+        account was signed out ~30 times a day by browser tests, and each one
+        took the MCP session with it — Claude Code then reported "requires
+        authentication" and every agent lost its tools. A sign-out ends only
+        the session that asked; ``scope="global"`` must be an explicit,
+        user-facing "sign out everywhere" decision, never a default.
+        """
+        if scope not in {"local", "others", "global"}:
+            raise ValueError(f"invalid sign-out scope: {scope!r}")
         token = access_token or (self._session.access_token if self._session else None)
         if token:
             try:
-                await self._auth_request("POST", "/logout", {}, access_token=token)
+                await self._auth_request(
+                    "POST", f"/logout?scope={scope}", {}, access_token=token
+                )
             except SupabaseAuthError:
                 pass  # Sign-out failures are not critical
         self._session = None

{matrx_orm-3.1.151 → matrx_orm-3.1.153}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "matrx-orm"
-version = "3.1.151"
+version = "3.1.153"
 description = "Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching"
 readme = "README.md"
 license = { text = "MIT" }
@@ -41,7 +41,7 @@ dependencies = [
     "gitpython>=3.1.40",
     "psycopg[binary]>=3.2.5",
     "psycopg-pool>=3.2.5",
-    "matrx-utils>=2.0.41",
+    "matrx-utils>=2.0.42",
     "pyyaml>=6.0.3",
     "python-dotenv>=1.0",
     "cryptography>=43.0",

{matrx_orm-3.1.151 → matrx_orm-3.1.153}/tests/level1/test_supabase_auth.py

@@ -81,3 +81,46 @@ class TestSupabaseAuthError:
         assert err.message == "Invalid credentials"
         assert err.status == 401
         assert str(err) == "Invalid credentials"
+
+
+class TestSignOutScope:
+    """A sign-out ends only the session that asked — never the whole account.
+
+    Forcing function for the 2026-09-15 MCP sign-in loss: a scope-less GoTrue
+    ``POST /logout`` is ``scope=global`` and deletes every session the account
+    holds, including the OAuth-client session Claude Code uses for AI Dream MCP.
+    This test fails on the old body (bare ``/logout``) and passes on the fix.
+    """
+
+    def _auth(self):
+        import asyncio
+
+        from matrx_orm.client.supabase_auth import SupabaseAuth
+
+        auth = SupabaseAuth.__new__(SupabaseAuth)
+        auth._session = None
+        calls: list[tuple[str, str]] = []
+
+        async def fake_request(method, path, body=None, access_token=None):
+            calls.append((method, path))
+            return {}
+
+        auth._auth_request = fake_request  # type: ignore[method-assign]
+        return auth, calls, asyncio
+
+    def test_default_sign_out_is_local(self) -> None:
+        auth, calls, asyncio = self._auth()
+        asyncio.run(auth.sign_out("tok"))
+        assert calls == [("POST", "/logout?scope=local")]
+
+    def test_global_sign_out_must_be_explicit(self) -> None:
+        auth, calls, asyncio = self._auth()
+        asyncio.run(auth.sign_out("tok", scope="global"))
+        assert calls == [("POST", "/logout?scope=global")]
+
+    def test_unknown_scope_is_refused(self) -> None:
+        import pytest
+
+        auth, _calls, asyncio = self._auth()
+        with pytest.raises(ValueError):
+            asyncio.run(auth.sign_out("tok", scope="everything"))