policy-pattern 0.2.5__tar.gz → 0.4.0__tar.gz

{policy_pattern-0.2.5 → policy_pattern-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: policy-pattern
-Version: 0.2.5
+Version: 0.4.0
 Summary: A minimal, embeddable ReBAC authorization engine for Python, inspired by Google Zanzibar.
 Keywords: python,authorization,access-control,rebac,zanzibar,security
 Author: Guillem Pozo Sebastián

policy_pattern-0.4.0/policy_pattern/adapters/__init__.py

@@ -0,0 +1,7 @@
+from .memory import MemoryTupleStore
+from .postgres import PostgresTupleStore
+
+__all__ = [
+    "MemoryTupleStore",
+    "PostgresTupleStore",
+]

policy_pattern-0.4.0/policy_pattern/adapters/_db_protocols.py

@@ -0,0 +1,90 @@
+"""
+Common interface shapes for DB-API 2.0 (https://peps.python.org/pep-0249/) connections, cursors, and connection pools.
+"""
+
+from abc import abstractmethod
+from collections.abc import Sequence
+from contextlib import AbstractContextManager
+from typing import Any, Protocol
+
+
+class Cursor(Protocol):
+    """
+    Structural shape of a DB-API 2.0 cursor — satisfied by psycopg's real Cursor, with no import or inheritance.
+    """
+
+    @abstractmethod
+    def execute(self, query: str, params: Sequence[Any] = ()) -> object:
+        """
+        Executes a SQL statement with optional parameters.
+        """
+        raise NotImplementedError
+
+    @abstractmethod
+    def executemany(self, query: str, params_seq: Sequence[Sequence[Any]]) -> None:
+        """
+        Executes the same SQL statement for each sequence of parameters in the sequence.
+        """
+        raise NotImplementedError
+
+    @abstractmethod
+    def fetchone(self) -> tuple[Any, ...] | None:
+        """
+        Fetches the next row of a query result, returning a single tuple, or None when
+        no more rows are available.
+        """
+        raise NotImplementedError
+
+    @abstractmethod
+    def fetchall(self) -> list[tuple[Any, ...]]:
+        """
+        Fetches all remaining rows of a query result, returning a list of tuples.
+        """
+        raise NotImplementedError
+
+
+class Connection(Protocol):
+    """
+    Structural shape of a DB-API 2.0 connection.
+
+    Deliberately plain commit()/rollback(), not psycopg3's own
+    transaction() context-manager convenience — that sugar is
+    psycopg3-specific and would narrow this Protocol to one driver.
+    """
+
+    @abstractmethod
+    def cursor(self) -> Cursor:
+        """
+        Returns a new Cursor object using the connection.
+        """
+        raise NotImplementedError
+
+    @abstractmethod
+    def commit(self) -> None:
+        """
+        Commits the current transaction.
+        """
+        raise NotImplementedError
+
+    @abstractmethod
+    def rollback(self) -> None:
+        """
+        Rolls back the current transaction.
+        """
+        raise NotImplementedError
+
+
+class ConnectionPool(Protocol):
+    """
+    Structural shape of a connection pool — satisfied by psycopg_pool.ConnectionPool, with no import.
+    """
+
+    @abstractmethod
+    def connection(self) -> AbstractContextManager[Connection]:
+        """
+        Returns a context manager that yields a Connection from the pool.
+
+        returns:
+            An AbstractContextManager that yields a Connection object.
+        """
+        raise NotImplementedError

policy_pattern-0.4.0/policy_pattern/adapters/_tuple_mapping.py

@@ -0,0 +1,44 @@
+"""
+Data decomposition and recomposition functions for the TupleStore adapters.
+"""
+
+from policy_pattern.models import DirectSubject, ObjectReference, Subject, SubjectSet, Tuple
+
+
+def columns(t: Tuple) -> tuple[str, str, str, str, str, str]:
+    """
+    Decomposes a Tuple into the six column values this adapter stores.
+    """
+    if isinstance(t.subject, DirectSubject):
+        subject_type, subject_id, subject_relation = t.subject.object.type, t.subject.object.id, ""
+    else:
+        subject_type, subject_id, subject_relation = (
+            t.subject.object.type,
+            t.subject.object.id,
+            t.subject.relation,
+        )
+    return (t.object.type, t.object.id, t.relation, subject_type, subject_id, subject_relation)
+
+
+def decompose(subject: Subject) -> tuple[str, str, str]:
+    """
+    Decomposes a Subject into (subject_type, subject_id, subject_relation).
+    """
+    if isinstance(subject, DirectSubject):
+        return (subject.object.type, subject.object.id, "")
+
+    return (subject.object.type, subject.object.id, subject.relation)
+
+
+def compose(row: tuple[str, str, str], relation: str, object: ObjectReference) -> Tuple:
+    """
+    Reconstructs a Tuple from one (subject_type, subject_id, subject_relation) row.
+    """
+    subject_type, subject_id, subject_relation = row
+    subject: Subject
+    if subject_relation == "":
+        subject = DirectSubject(object=ObjectReference(type=subject_type, id=subject_id))
+    else:
+        subject = SubjectSet(object=ObjectReference(type=subject_type, id=subject_id), relation=subject_relation)
+
+    return Tuple(subject=subject, relation=relation, object=object)

policy_pattern-0.4.0/policy_pattern/adapters/postgres.py

@@ -0,0 +1,257 @@
+"""
+PostgreSQL TupleStore adapter — typed against a stdlib Protocol, no database driver import.
+"""
+
+from collections.abc import Generator
+from contextlib import contextmanager
+from importlib.resources import files
+from typing import Any, override
+
+from policy_pattern.errors import IndexEntryTooLargeError
+from policy_pattern.models import Mutation, ObjectReference, Subject
+from policy_pattern.ports import ReadResult, TupleStore, View
+
+from ._db_protocols import Connection, ConnectionPool, Cursor
+from ._tuple_mapping import columns, compose, decompose
+
+MIGRATION_RESOURCE: tuple[str, str, str] = ("sql", "postgres", "0001_create_policy_tuples.sql")
+
+# PostgreSQL's B-tree index entry limit for the default 8KB page size
+# (BLCKSZ). Identifier bounds a value to 255 code points, any printable
+# Unicode — not encoded bytes — so a value valid by its own contract can
+# still make the composite primary key exceed this limit once UTF-8
+# encoded.
+#
+# BLCKSZ is a compile-time option (--with-blocksize, 1KB-32KB); no
+# packaged distribution (apt/yum/Docker/RDS/Cloud SQL/...) ever changes
+# it from 8KB, only a from-source build with a non-default flag would.
+# This adapter does not detect that case — it would need to query
+# `block_size` at runtime to compute the real limit, which this constant
+# deliberately skips. If it ever happens: a *smaller* BLCKSZ makes this
+# check too permissive (the real Postgres limit drops below 2704, so
+# some additions this check lets through still fail server-side with
+# the driver's own cryptic error); a *larger* BLCKSZ makes it too
+# strict (the real limit rises above 2704, so some additions that would
+# have succeeded get rejected here instead).
+#
+# The check below sums only the six columns' raw UTF-8 byte length — it
+# does not add PostgreSQL's own per-entry overhead (an IndexTupleData
+# header plus a varlena length header per long TEXT column, roughly
+# 30-40 bytes total for six columns this long). The margin subtracted
+# here covers that, so this check triggers slightly before the real
+# server-side limit rather than slightly after.
+_BTREE_MAX_INDEX_ENTRY_BYTES: int = 2640  # 2704 minus a 64-byte margin for overhead not counted above
+
+_INSERT_SQL: str = """
+    INSERT INTO "authz_tuples"
+    (object_type, object_id, relation, subject_type, subject_id, subject_relation)
+    VALUES (%s, %s, %s, %s, %s, %s)
+    ON CONFLICT (object_type, object_id, relation, subject_type, subject_id, subject_relation)
+    DO NOTHING
+    """
+
+_DELETE_SQL: str = """
+    DELETE FROM "authz_tuples"
+    WHERE object_type=%s AND object_id=%s AND relation=%s
+    AND subject_type=%s AND subject_id=%s AND subject_relation=%s
+    """
+
+_READ_TUPLE_SQL: str = """
+    SELECT 1 FROM "authz_tuples"
+    WHERE object_type=%s AND object_id=%s AND relation=%s
+    AND subject_type=%s AND subject_id=%s AND subject_relation=%s
+    """
+
+_READ_RELATION_SQL: str = """
+    SELECT subject_type, subject_id, subject_relation FROM "authz_tuples"
+    WHERE object_type=%s AND object_id=%s AND relation=%s
+    ORDER BY subject_type, subject_id, subject_relation LIMIT %s
+    """
+
+
+class PostgresTupleStore(TupleStore):
+    """
+    PostgreSQL-backed TupleStore — typed against a structural Protocol, no database driver import.
+
+    Stores tuples in the fixed table `authz_tuples`. The matching schema ships as a versioned SQL
+    resource (`policy_pattern/sql/postgres/0001_create_policy_tuples.sql`)
+    for the consuming service's own migration tooling to apply — this
+    adapter never creates or migrates schema itself, unless `auto_create_schema=True`.
+
+    Precondition (documented, not runtime-checked): every connection
+    `pool` hands out must have `autocommit=False` (DB-API 2.0's own
+    required default). If violated, write_tuples() loses atomicity and
+    snapshot()'s isolation-level statement has no transaction to apply to.
+
+    `auto_create_schema` (default False): when True, runs the packaged
+    migration (`CREATE TABLE IF NOT EXISTS`) once at construction time,
+    using a connection from `pool`. Requires that connection's role to
+    have `CREATE` privilege — stricter than the default
+    (`SELECT`/`INSERT`/`DELETE` only). Not a substitute for a real
+    migration history: concurrent process startup may run this
+    concurrently across instances — Postgres serializes the DDL
+    internally so this does not corrupt the schema, but it is not
+    tracked by any migration tool either. See `docs/usage/README.md`
+    for when this trade-off is worth taking.
+    """
+
+    def __init__(self, pool: ConnectionPool, *, auto_create_schema: bool = False) -> None:
+        """
+        Stores the pool for later use. Never opens a connection or touches the
+        database, unless `auto_create_schema=True`.
+        """
+        self._pool = pool
+        if auto_create_schema:
+            self._create_schema()
+
+    def _create_schema(self) -> None:
+        """
+        Applies the packaged migration directly. Only reachable when
+        `auto_create_schema=True` — never part of the default construction path.
+
+        try/except/rollback, same reason as write_tuples(): the pool's
+        connection() context manager does not roll back on its own, so a
+        failed execute() would otherwise return an aborted transaction to
+        the pool for the next caller to trip over.
+        """
+        migration_sql = files("policy_pattern").joinpath(*MIGRATION_RESOURCE).read_text(encoding="utf-8")
+        with self._pool.connection() as conn:
+            cursor = conn.cursor()
+            try:
+                cursor.execute(migration_sql)
+            except Exception:
+                conn.rollback()
+                raise
+            else:
+                conn.commit()
+
+    @override
+    def write_tuples(self, mutation: Mutation) -> None:
+        """
+        Atomically applies additions/deletions; commit() is the visibility point.
+
+        Empty mutations short-circuit before acquiring a connection. Uses
+        cursor()/commit()/rollback() explicitly — plain DB-API 2.0, not
+        psycopg3's own transaction() convenience, so this stays portable
+        to any driver satisfying Connection.
+
+        Raises:
+            IndexEntryTooLargeError: An addition's encoded primary key
+                would exceed PostgreSQL's B-tree index entry limit —
+                checked before acquiring any connection, turning the
+                driver's own cryptic "index row size exceeds btree ...
+                maximum" error into one naming the offending tuple.
+        """
+        if not mutation.additions and not mutation.deletions:
+            return
+
+        for t in mutation.additions:
+            encoded_size = sum(len(column.encode("utf-8")) for column in columns(t))
+            if encoded_size > _BTREE_MAX_INDEX_ENTRY_BYTES:
+                raise IndexEntryTooLargeError(
+                    message=(
+                        f"tuple's encoded primary key is {encoded_size!r} bytes, exceeding "
+                        f"PostgreSQL's {_BTREE_MAX_INDEX_ENTRY_BYTES!r}-byte B-tree index entry limit"
+                    ),
+                    related=f"tuple={t!r}",
+                )
+
+        with self._pool.connection() as conn:
+            cursor = conn.cursor()
+            try:
+                if mutation.deletions:
+                    cursor.executemany(_DELETE_SQL, [columns(t) for t in mutation.deletions])
+
+                if mutation.additions:
+                    cursor.executemany(_INSERT_SQL, [columns(t) for t in mutation.additions])
+            except Exception:
+                conn.rollback()
+                raise
+            else:
+                conn.commit()
+
+    @override
+    @contextmanager
+    def snapshot(self) -> Generator[View, None, None]:
+        """
+        Opens a REPEATABLE READ, READ ONLY transaction held for the view's lifetime.
+
+        SET TRANSACTION, not a literal BEGIN — with autocommit=False (the
+        documented pool precondition), psycopg already opens a
+        transaction implicitly before the first statement on a fresh
+        connection; a literal BEGIN here would be a redundant, nested
+        BEGIN, which Postgres warns about and simply ignores outright —
+        its isolation-level clause never runs, leaving the already-open
+        transaction at the default READ COMMITTED. SET TRANSACTION sets
+        the characteristics of the already-open transaction directly
+        instead, which Postgres requires as the first statement inside
+        it — satisfied here since this is literally the first
+        cursor.execute() call after checkout. The pool's own
+        connection() context manager returns the connection to the pool
+        on __exit__ regardless of exception; the inner try/finally
+        guarantees rollback() runs on both normal completion and an
+        exception raised while the view is open.
+        """
+        with self._pool.connection() as conn:
+            cursor = conn.cursor()
+            cursor.execute("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ READ ONLY")
+            try:
+                yield _PostgresView(conn)
+            finally:
+                conn.rollback()
+
+
+class _PostgresView(View):
+    """
+    Read-only view over one REPEATABLE READ Postgres transaction.
+
+    Private: nothing outside PostgresTupleStore.snapshot() ever
+    constructs one directly — same convention as _MemoryView.
+    """
+
+    def __init__(self, connection: Connection) -> None:
+        """
+        Wraps the already-open, already-in-transaction connection.
+        """
+        self._connection = connection
+
+    @property
+    def connection(self) -> Connection:
+        """
+        Returns the already-open, already-in-transaction connection.
+
+        Private: nothing outside PostgresTupleStore.snapshot() ever
+        needs to see this.
+        """
+        return self._connection
+
+    @override
+    def read_tuple(self, subject: Subject, relation: str, object: ObjectReference) -> bool:
+        """
+        Returns whether the exact tuple `(subject, relation, object)` exists in this view.
+        """
+        subject_type, subject_id, subject_relation = decompose(subject)
+        cursor: Cursor = self.connection.cursor()
+
+        cursor.execute(
+            _READ_TUPLE_SQL,
+            (object.type, object.id, relation, subject_type, subject_id, subject_relation),
+        )
+
+        return cursor.fetchone() is not None
+
+    @override
+    def read_relation(self, object: ObjectReference, relation: str, limit: int) -> ReadResult:
+        """
+        Returns up to `limit` tuples matching the given object and relation, in a single query.
+        """
+        cursor: Cursor = self.connection.cursor()
+        cursor.execute(
+            _READ_RELATION_SQL,
+            (object.type, object.id, relation, limit + 1),
+        )
+
+        rows: list[tuple[Any, ...]] = cursor.fetchall()
+        tuples = frozenset(compose(r, relation, object) for r in rows[:limit])
+
+        return ReadResult(tuples=tuples, complete=len(rows) <= limit)

{policy_pattern-0.2.5 → policy_pattern-0.4.0}/policy_pattern/errors/__init__.py

@@ -1,6 +1,7 @@
 from .base_error import BaseError
 from .evaluation_error import EvaluationError
 from .identifier_error import InvalidIdentifierError
+from .index_entry_too_large_error import IndexEntryTooLargeError
 from .model_validation_error import ModelValidationError
 from .mutation_error import InvalidMutationError
 from .relation_error import InvalidRelationError
@@ -10,6 +11,7 @@ from .unknown_type_error import UnknownTypeError
 __all__ = [
     "BaseError",
     "EvaluationError",
+    "IndexEntryTooLargeError",
     "InvalidIdentifierError",
     "InvalidMutationError",
     "InvalidRelationError",

policy_pattern-0.4.0/policy_pattern/errors/index_entry_too_large_error.py

@@ -0,0 +1,16 @@
+"""
+Set of errors related to storage adapters rejecting an oversized index entry.
+"""
+
+from .base_error import BaseError
+
+
+class IndexEntryTooLargeError(BaseError):
+    """
+    Error raised when a tuple's encoded primary key would exceed a storage
+    backend's index entry size limit.
+    Attributes:
+        code (ClassVar[str]): A unique error code for the specific error type.
+    """
+
+    code = "PP900"

{policy_pattern-0.2.5 → policy_pattern-0.4.0}/policy_pattern/evaluator.py

@@ -2,6 +2,7 @@
 Evaluator: resolves check() over a CompiledModel and a TupleStore.
 """
 
+from collections.abc import Sequence
 from dataclasses import dataclass, field
 
 from .errors import EvaluationError, UnknownNameError, UnknownTypeError
@@ -24,7 +25,11 @@ from .ports import TupleStore, View
 @dataclass(frozen=True, slots=True)
 class EvaluationBudget:
     """
-    Per-`check()` resource limits.
+    Resource limits for one `check()` or `check_many()` call.
+
+    `max_nodes` and `max_store_reads` accumulate across a `check_many()` call.
+    `max_depth` bounds the live `context.visited` frontier and resets as each
+    request finishes, so it does not accumulate across the batch.
 
     No `__post_init__` validation — a degenerate value (e.g. `max_depth=0`)
     is well-defined without a guard: it simply fails on the first node
@@ -35,16 +40,16 @@ class EvaluationBudget:
         EvaluationBudget(max_depth=10, max_nodes=500, max_store_reads=100)
     """
 
-    # Maximum recursion depth for a single `check()` call. Each recursive call
+    # Maximum recursion depth for one call. Each recursive call
     # to `_check_name()` adds one to the depth; exceeding this limit raises an
     # `EvaluationError`.
     max_depth: int = 25
 
-    # Maximum number of nodes visited during a single `check()` call. Each
+    # Maximum number of nodes visited during one call. Each
     # call to `_check_name()` increments this count; exceeding this limit raises an `EvaluationError`.
     max_nodes: int = 10_000
 
-    # Maximum number of store reads during a single `check()` call. Each call
+    # Maximum number of store reads during one call. Each call
     # to `_charge_read()` increments this count; exceeding this limit raises an `EvaluationError`.
     max_store_reads: int = 1_000
 
@@ -52,7 +57,7 @@ class EvaluationBudget:
 @dataclass(slots=True)
 class EvaluationContext:
     """
-    Live bookkeeping for exactly one `check()` call.
+    Live bookkeeping for exactly one `check()` or `check_many()` call.
 
     Deliberately mutable, unlike almost everything else in this package —
     this is not a domain value, it is the in-flight state of one
@@ -63,13 +68,19 @@ class EvaluationContext:
     (added before recursing, discarded after returning) — anything
     permanently resolved lives in `memo` instead, so the two never overlap
     in meaning.
+
+    The key carries the subject because one `check()` has a constant subject,
+    while `check_many()` can mix subjects; a narrower key could reuse one
+    subject's cached decision for another and cause a false allow.
     """
 
     view: View
     budget: EvaluationBudget
-    visited: set[tuple[ObjectReference, str]] = field(default_factory=lambda: set[tuple[ObjectReference, str]]())
-    memo: dict[tuple[ObjectReference, str], bool] = field(
-        default_factory=lambda: dict[tuple[ObjectReference, str], bool]()
+    visited: set[tuple[Subject, ObjectReference, str]] = field(
+        default_factory=lambda: set[tuple[Subject, ObjectReference, str]]()
+    )
+    memo: dict[tuple[Subject, ObjectReference, str], bool] = field(
+        default_factory=lambda: dict[tuple[Subject, ObjectReference, str], bool]()
     )
     node_count: int = 0
     store_read_count: int = 0
@@ -120,11 +131,28 @@ class Evaluator:
             context = EvaluationContext(view=view, budget=budget)
             return self._check_name(subject, name, object, context)
 
+    def check_many(
+        self,
+        requests: Sequence[tuple[Subject, str, ObjectReference]],
+        budget: EvaluationBudget | None = None,
+    ) -> list[bool]:
+        """
+        Returns one decision per request, preserving input order and duplicates.
+
+        The whole batch shares one snapshot, context, and budget. An error on
+        any request aborts the call and propagates without partial results.
+        """
+        if budget is None:
+            budget = EvaluationBudget()
+        with self._store.snapshot() as view:
+            context = EvaluationContext(view=view, budget=budget)
+            return [self._check_name(subject, name, object, context) for subject, name, object in requests]
+
     def _check_name(self, subject: Subject, name: str, object: ObjectReference, context: EvaluationContext) -> bool:
         """
         Dispatches (object, name) to a relation or permission check, with cycle/memo/budget bookkeeping.
         """
-        key = (object, name)
+        key = (subject, object, name)
         if key in context.memo:
             return context.memo[key]
         if key in context.visited:

{policy_pattern-0.2.5 → policy_pattern-0.4.0}/policy_pattern/models/identifier.py

@@ -5,7 +5,7 @@ Value Object representing an entity identifier.
 from dataclasses import dataclass
 from typing import ClassVar
 
-from ..errors import InvalidIdentifierError
+from policy_pattern.errors import InvalidIdentifierError
 
 
 @dataclass(frozen=True, slots=True)

{policy_pattern-0.2.5 → policy_pattern-0.4.0}/policy_pattern/models/type.py

@@ -7,7 +7,8 @@ from dataclasses import dataclass
 from types import MappingProxyType
 from typing import ClassVar
 
-from ..errors import InvalidIdentifierError
+from policy_pattern.errors import InvalidIdentifierError
+
 from .identifier import Identifier
 from .operators import PermissionExpression
 from .relation import Relation

policy_pattern-0.4.0/policy_pattern/sql/postgres/0001_create_policy_tuples.sql

@@ -0,0 +1,16 @@
+-- Initial schema for PostgresTupleStore (policy_pattern/adapters/postgres.py).
+--
+-- By default, apply this through your own migration tooling (Alembic, a
+-- raw-SQL migration step, etc.). PostgresTupleStore can optionally run
+-- this statement at construction with auto_create_schema=True. See
+-- docs/architecture.md's "Database Adapters" section.
+
+CREATE TABLE IF NOT EXISTS "authz_tuples" (
+    object_type       TEXT NOT NULL COLLATE "C",
+    object_id         TEXT NOT NULL COLLATE "C",
+    relation          TEXT NOT NULL COLLATE "C",
+    subject_type      TEXT NOT NULL COLLATE "C",
+    subject_id        TEXT NOT NULL COLLATE "C",
+    subject_relation  TEXT NOT NULL DEFAULT '' COLLATE "C",
+    PRIMARY KEY (object_type, object_id, relation, subject_type, subject_id, subject_relation)
+);

{policy_pattern-0.2.5 → policy_pattern-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "policy-pattern"
-version = "0.2.5"
+version = "0.4.0"
 description = "A minimal, embeddable ReBAC authorization engine for Python, inspired by Google Zanzibar."
 readme = "README.md"
 license = "Apache-2.0"
@@ -52,9 +52,10 @@ addopts = [
     "--color=yes",
 ]
 markers = [
-    "unit: relation rewrite / evaluator logic, no storage",
+    "unit: fast, deterministic tests with no live external service (no real database, no network call)",
     "contract: shared TupleStore contract, runs against every adapter",
     "integration: real PostgreSQL via testcontainers",
+    "slow: performance-sensitive tests that may take longer to run",
 ]
 xfail_strict = true
 
@@ -196,12 +197,14 @@ format = ["ruff>=0.16.7"]
 lint = [
     "ruff>=0.16.7",
     "ty>=0.0.80",
-    { include-group = "test" },
 ]
 release = ["python-semantic-release>=9.15.0"]
 test = [
+    "psycopg-pool>=3.3.3",
+    "psycopg[binary]>=3.3.6",
     "pytest>=9.1.1",
-    "testcontainers>=4.15.0",
+    "pytest-randomly>=5.0.0",
+    "testcontainers[postgres]>=4.15.0",
     { include-group = "coverage" },
 ]
 

{policy_pattern-0.2.5 → policy_pattern-0.4.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "policy-pattern"
-version = "0.2.5"
+version = "0.4.0"
 description = "A minimal, embeddable ReBAC authorization engine for Python, inspired by Google Zanzibar."
 readme = "README.md"
 authors = [
@@ -49,9 +49,16 @@ module-root = "."
 coverage = ["coverage[toml]>=7.0.0"]
 develop = ["pre-commit>=4.0.0"]
 format = ["ruff>=0.16.7"]
-lint = ["ruff>=0.16.7", "ty>=0.0.80", { include-group = "test" }]
+lint = ["ruff>=0.16.7", "ty>=0.0.80"]
 release = ["python-semantic-release>=9.15.0"]
-test = ["pytest>=9.1.1", "testcontainers>=4.15.0", { include-group = "coverage" }]
+test = [
+    "psycopg-pool>=3.3.3",
+    "psycopg[binary]>=3.3.6",
+    "pytest>=9.1.1",
+    "pytest-randomly>=5.0.0",
+    "testcontainers[postgres]>=4.15.0",
+    { include-group = "coverage" },
+]
 all = [
     { include-group = "coverage" },
     { include-group = "develop" },
@@ -73,9 +80,10 @@ addopts = [
     "--color=yes",      # color the output
 ]
 markers = [
-    "unit: relation rewrite / evaluator logic, no storage",
+    "unit: fast, deterministic tests with no live external service (no real database, no network call)",
     "contract: shared TupleStore contract, runs against every adapter",
     "integration: real PostgreSQL via testcontainers",
+    "slow: performance-sensitive tests that may take longer to run",
 ]
 xfail_strict = true
 

policy_pattern-0.2.5/policy_pattern/adapters/__init__.py

@@ -1,3 +0,0 @@
-from .memory import MemoryTupleStore
-
-__all__ = ["MemoryTupleStore"]