postkit 0.4.0__tar.gz → 0.5.0__tar.gz

{postkit-0.4.0 → postkit-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: postkit
-Version: 0.4.0
+Version: 0.5.0
 Summary: PostgreSQL-native auth, permissions, versioned config, usage tracking, and job queues
 Project-URL: Homepage, https://github.com/varunchopra/postkit
 Project-URL: Repository, https://github.com/varunchopra/postkit
@@ -65,6 +65,14 @@ user_id = authn.create_user("alice@example.com", password_hash="argon2...")
 session_id = authn.create_session(user_id, token_hash="sha256...")
 ```
 
+## Tenant Context and Transactions
+
+Constructing a client calls `{module}.set_tenant(namespace)` immediately. The setting is transaction-scoped, so inside an open transaction the constructor taints that transaction's context for the module until commit or rollback; an unrelated client built mid-transaction can therefore change which rows a later raw SQL statement sees.
+
+Every SDK call needs a transaction for that context. On autocommit connections each call runs in its own transaction and commits immediately. On non-autocommit connections each call joins the connection's open transaction: nothing is durable until you commit, and a rollback takes it all with it, including a queue claim from `pull()`. That is the intended model for transactional consumers; `nack`/`fail` accept the pending job a rollback leaves behind.
+
+In CI, call `client.assert_rls_active()` during setup. A suite connecting as a superuser or `BYPASSRLS` role (the docker default) bypasses every RLS policy and exercises none of the tenancy model.
+
 ## Requirements
 
 - PostgreSQL 14+

postkit-0.5.0/README.md

@@ -0,0 +1,47 @@
+# postkit SDK
+
+Python client for postkit.
+
+## Installation
+
+```bash
+pip install postkit
+```
+
+## Usage
+
+```python
+import psycopg
+from postkit.authz import AuthzClient
+from postkit.authn import AuthnClient
+
+conn = psycopg.connect("postgresql://...")
+cursor = conn.cursor()
+
+# Authorization
+authz = AuthzClient(cursor, namespace="my-app")
+authz.set_hierarchy("repo", "admin", "write", "read")
+authz.grant("admin", resource=("repo", "api"), subject=("user", "alice"))
+if authz.check(("user", "alice"), "read", ("repo", "api")):
+    print("Access granted")
+
+# Authentication
+authn = AuthnClient(cursor, namespace="my-app")
+user_id = authn.create_user("alice@example.com", password_hash="argon2...")
+session_id = authn.create_session(user_id, token_hash="sha256...")
+```
+
+## Tenant Context and Transactions
+
+Constructing a client calls `{module}.set_tenant(namespace)` immediately. The setting is transaction-scoped, so inside an open transaction the constructor taints that transaction's context for the module until commit or rollback; an unrelated client built mid-transaction can therefore change which rows a later raw SQL statement sees.
+
+Every SDK call needs a transaction for that context. On autocommit connections each call runs in its own transaction and commits immediately. On non-autocommit connections each call joins the connection's open transaction: nothing is durable until you commit, and a rollback takes it all with it, including a queue claim from `pull()`. That is the intended model for transactional consumers; `nack`/`fail` accept the pending job a rollback leaves behind.
+
+In CI, call `client.assert_rls_active()` during setup. A suite connecting as a superuser or `BYPASSRLS` role (the docker default) bypasses every RLS policy and exercises none of the tenancy model.
+
+## Requirements
+
+- PostgreSQL 14+
+- The postkit SQL schema installed in your database
+
+See the [main repository](https://github.com/varunchopra/postkit) for SQL installation instructions.

{postkit-0.4.0 → postkit-0.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "postkit"
-version = "0.4.0"
+version = "0.5.0"
 description = "PostgreSQL-native auth, permissions, versioned config, usage tracking, and job queues"
 readme = "README.md"
 license = "Apache-2.0"

{postkit-0.4.0 → postkit-0.5.0}/src/postkit/base.py

@@ -399,6 +399,29 @@ class BaseClient(ABC):
         self._on_behalf_of = None
         self._reason = None
 
+    def assert_rls_active(self) -> None:
+        """Raise unless row-level security applies to the connection's role.
+
+        Call from CI setup: a suite connecting as a superuser or BYPASSRLS
+        role bypasses every policy and exercises none of the tenancy model.
+
+        Raises:
+            The module's error class with error_code BIZ_RLS_NOT_ACTIVE
+            when the current role bypasses RLS.
+        """
+
+        def execute() -> None:
+            try:
+                self.cursor.execute(
+                    sql.SQL("SELECT {}.assert_rls_active()").format(
+                        sql.Identifier(self._schema)
+                    )
+                )
+            except psycopg.Error as e:
+                self._handle_error(e)
+
+        self._with_context(execute)
+
     @staticmethod
     def _encode_cursor(event_time: datetime, event_id: int) -> str:
         """Encode pagination cursor as opaque string.

{postkit-0.4.0 → postkit-0.5.0}/src/postkit/errors.py

@@ -64,6 +64,7 @@ class AuthnErrorCode:
     # Business logic errors (BIZ_)
     BIZ_IMPERSONATE_SELF = "BIZ_IMPERSONATE_SELF"
     BIZ_IMPERSONATE_CHAIN = "BIZ_IMPERSONATE_CHAIN"
+    BIZ_RLS_NOT_ACTIVE = "BIZ_RLS_NOT_ACTIVE"
 
     # Credential state errors (CRED_)
     CRED_NO_MATERIAL = "CRED_NO_MATERIAL"
@@ -109,6 +110,7 @@ class AuthzErrorCode:
     BIZ_BULK_GROUP_MEMBERSHIP = "BIZ_BULK_GROUP_MEMBERSHIP"
     BIZ_BULK_PARENT_RELATION = "BIZ_BULK_PARENT_RELATION"
     BIZ_GRANT_NO_EXPIRATION = "BIZ_GRANT_NO_EXPIRATION"
+    BIZ_RLS_NOT_ACTIVE = "BIZ_RLS_NOT_ACTIVE"
 
     # Data state errors (DATA_)
     DATA_GRANT_NOT_FOUND = "DATA_GRANT_NOT_FOUND"
@@ -140,6 +142,7 @@ class ConfigErrorCode:
 
     # Business logic errors (BIZ_)
     BIZ_DELETE_ACTIVE_VERSION = "BIZ_DELETE_ACTIVE_VERSION"
+    BIZ_RLS_NOT_ACTIVE = "BIZ_RLS_NOT_ACTIVE"
 
 
 class LeaseErrorCode:
@@ -173,6 +176,9 @@ class LeaseErrorCode:
     # Internal errors (INT_)
     INT_COUNTER_MISSING = "INT_COUNTER_MISSING"
 
+    # Business logic errors (BIZ_)
+    BIZ_RLS_NOT_ACTIVE = "BIZ_RLS_NOT_ACTIVE"
+
 
 class MeterErrorCode:
     """Error codes for the meter module."""
@@ -200,6 +206,8 @@ class MeterErrorCode:
 
     # Business logic errors (BIZ_)
     BIZ_LEDGER_IMMUTABLE = "BIZ_LEDGER_IMMUTABLE"
+    BIZ_RLS_NOT_ACTIVE = "BIZ_RLS_NOT_ACTIVE"
+    BIZ_ALL_NAMESPACES_REQUIRES_BYPASS = "BIZ_ALL_NAMESPACES_REQUIRES_BYPASS"
 
     # Data state errors (DATA_)
     DATA_ACCOUNT_NOT_FOUND = "DATA_ACCOUNT_NOT_FOUND"
@@ -238,6 +246,8 @@ class OutboxErrorCode:
     BIZ_CONSUMER_UNKNOWN = "BIZ_CONSUMER_UNKNOWN"
     BIZ_CURSOR_LOST = "BIZ_CURSOR_LOST"
     BIZ_POSITION_BEYOND_HEAD = "BIZ_POSITION_BEYOND_HEAD"
+    BIZ_RLS_NOT_ACTIVE = "BIZ_RLS_NOT_ACTIVE"
+    BIZ_ALL_NAMESPACES_REQUIRES_BYPASS = "BIZ_ALL_NAMESPACES_REQUIRES_BYPASS"
 
 
 class PresenceErrorCode:
@@ -267,6 +277,8 @@ class PresenceErrorCode:
     # Business logic errors
     ENTITY_UNKNOWN = "ENTITY_UNKNOWN"
     HOOK_QUEUE_MISSING = "HOOK_QUEUE_MISSING"
+    BIZ_RLS_NOT_ACTIVE = "BIZ_RLS_NOT_ACTIVE"
+    BIZ_ALL_NAMESPACES_REQUIRES_BYPASS = "BIZ_ALL_NAMESPACES_REQUIRES_BYPASS"
 
 
 class QueueErrorCode:
@@ -299,10 +311,13 @@ class QueueErrorCode:
 
     # Business logic errors (BIZ_)
     BIZ_JOB_NOT_RUNNING = "BIZ_JOB_NOT_RUNNING"
+    BIZ_JOB_NOT_YOURS = "BIZ_JOB_NOT_YOURS"
     BIZ_SCHEDULE_DUPLICATE = "BIZ_SCHEDULE_DUPLICATE"
     BIZ_SCHEDULE_REQUIRES_SCHEDULE = "BIZ_SCHEDULE_REQUIRES_SCHEDULE"
     BIZ_SCHEDULE_CRON_AND_INTERVAL = "BIZ_SCHEDULE_CRON_AND_INTERVAL"
     BIZ_DEAD_LETTER_ALREADY_RETRIED = "BIZ_DEAD_LETTER_ALREADY_RETRIED"
+    BIZ_RLS_NOT_ACTIVE = "BIZ_RLS_NOT_ACTIVE"
+    BIZ_ALL_NAMESPACES_REQUIRES_BYPASS = "BIZ_ALL_NAMESPACES_REQUIRES_BYPASS"
 
     # Data state errors (DATA_)
     DATA_JOB_NOT_FOUND = "DATA_JOB_NOT_FOUND"

{postkit-0.4.0 → postkit-0.5.0}/src/postkit/outbox/client.py

@@ -341,3 +341,16 @@ class OutboxClient(BaseClient):
         return self._fetch_all(
             "SELECT * FROM outbox.list_consumers(%s, %s)", (self.namespace, topic)
         )
+
+    def horizon_blockers(self) -> list[dict[str, Any]]:
+        """Backends whose open write transactions pin the visibility horizon.
+
+        Database-global, like the horizon itself. Seeing other sessions
+        requires pg_read_all_stats (or superuser).
+
+        Returns:
+            One dict per in-progress write transaction, oldest first:
+            pid, datname, xact_age, state, application_name, query,
+            is_horizon
+        """
+        return self._fetch_all("SELECT * FROM outbox.horizon_blockers()", ())

{postkit-0.4.0 → postkit-0.5.0}/src/postkit/queue/client.py

@@ -359,19 +359,25 @@ class QueueClient(BaseClient):
         *,
         error: str | None = None,
         backoff: timedelta | None = None,
+        worker_id: str | None = None,
     ) -> bool:
         """Return job to queue for retry (temporary failure).
 
+        Valid on running jobs and on pending jobs whose claim was rolled
+        back with the consumer's transaction.
+
         Args:
             job_id: Job ID
             error: Error message (stored for debugging)
             backoff: Custom backoff delay (default: exponential)
+            worker_id: If set, refuse jobs running under a different worker
 
         Returns:
             True if returned to queue, False if max attempts exceeded (moved to DLQ)
 
         Raises:
-            QueueValidationError: If job exists but is not in running status
+            QueueValidationError: If job is settled (completed or dead), or
+                running under a different worker than worker_id
             QueueError: If job does not exist
         """
         result = self._fetch_val(
@@ -379,13 +385,15 @@ class QueueClient(BaseClient):
                 p_namespace := %s,
                 p_job_id := %s,
                 p_error := %s,
-                p_backoff := %s
+                p_backoff := %s,
+                p_worker_id := %s
             )""",
             (
                 self.namespace,
                 job_id,
                 error,
                 backoff,
+                worker_id,
             ),
             write=True,
         )
@@ -396,26 +404,34 @@ class QueueClient(BaseClient):
         job_id: int,
         *,
         error: str | None = None,
+        worker_id: str | None = None,
     ) -> bool:
         """Move job to dead letter queue (permanent failure).
 
+        Valid on running jobs and on pending jobs whose claim was rolled
+        back with the consumer's transaction.
+
         Args:
             job_id: Job ID
             error: Error message
+            worker_id: If set, refuse jobs running under a different worker
 
         Returns:
-            True if moved to DLQ, False if job not found or not running
+            True if moved to DLQ, False if job settled, missing, or owned
+            by another worker
         """
         result = self._fetch_val(
             """SELECT queue.fail(
                 p_namespace := %s,
                 p_job_id := %s,
-                p_error := %s
+                p_error := %s,
+                p_worker_id := %s
             )""",
             (
                 self.namespace,
                 job_id,
                 error,
+                worker_id,
             ),
             write=True,
         )

postkit-0.5.0/tests/authn/test_rls_active.py

@@ -0,0 +1,26 @@
+"""assert_rls_active: catch test setups whose role bypasses RLS."""
+
+import pytest
+from postkit.authn import AuthnClient, AuthnError, AuthnErrorCode
+
+from tests.helpers import connect_as_rls_user, ensure_rls_role
+
+
+class TestAssertRlsActive:
+    """Raises for bypass roles, passes when RLS applies."""
+
+    def test_raises_for_bypass_role(self, db_connection):
+        client = AuthnClient(db_connection.cursor(), "rls_assert")
+
+        with pytest.raises(AuthnError) as exc_info:
+            client.assert_rls_active()
+        assert exc_info.value.error_code == AuthnErrorCode.BIZ_RLS_NOT_ACTIVE
+
+    def test_passes_for_rls_role(self, db_connection):
+        ensure_rls_role(db_connection, "authn")
+        conn = connect_as_rls_user(db_connection, "authn")
+        try:
+            AuthnClient(conn.cursor(), "rls_assert").assert_rls_active()
+            conn.rollback()
+        finally:
+            conn.close()

postkit-0.5.0/tests/authz/test_rls_active.py

@@ -0,0 +1,26 @@
+"""assert_rls_active: catch test setups whose role bypasses RLS."""
+
+import pytest
+from postkit.authz import AuthzClient, AuthzError, AuthzErrorCode
+
+from tests.helpers import connect_as_rls_user, ensure_rls_role
+
+
+class TestAssertRlsActive:
+    """Raises for bypass roles, passes when RLS applies."""
+
+    def test_raises_for_bypass_role(self, db_connection):
+        client = AuthzClient(db_connection.cursor(), "rls_assert")
+
+        with pytest.raises(AuthzError) as exc_info:
+            client.assert_rls_active()
+        assert exc_info.value.error_code == AuthzErrorCode.BIZ_RLS_NOT_ACTIVE
+
+    def test_passes_for_rls_role(self, db_connection):
+        ensure_rls_role(db_connection, "authz")
+        conn = connect_as_rls_user(db_connection, "authz")
+        try:
+            AuthzClient(conn.cursor(), "rls_assert").assert_rls_active()
+            conn.rollback()
+        finally:
+            conn.close()

postkit-0.5.0/tests/config/test_rls_active.py

@@ -0,0 +1,26 @@
+"""assert_rls_active: catch test setups whose role bypasses RLS."""
+
+import pytest
+from postkit.config import ConfigClient, ConfigError, ConfigErrorCode
+
+from tests.helpers import connect_as_rls_user, ensure_rls_role
+
+
+class TestAssertRlsActive:
+    """Raises for bypass roles, passes when RLS applies."""
+
+    def test_raises_for_bypass_role(self, db_connection):
+        client = ConfigClient(db_connection.cursor(), "rls_assert")
+
+        with pytest.raises(ConfigError) as exc_info:
+            client.assert_rls_active()
+        assert exc_info.value.error_code == ConfigErrorCode.BIZ_RLS_NOT_ACTIVE
+
+    def test_passes_for_rls_role(self, db_connection):
+        ensure_rls_role(db_connection, "config")
+        conn = connect_as_rls_user(db_connection, "config")
+        try:
+            ConfigClient(conn.cursor(), "rls_assert").assert_rls_active()
+            conn.rollback()
+        finally:
+            conn.close()

postkit-0.5.0/tests/lease/test_rls_active.py

@@ -0,0 +1,26 @@
+"""assert_rls_active: catch test setups whose role bypasses RLS."""
+
+import pytest
+from postkit.lease import LeaseClient, LeaseError, LeaseErrorCode
+
+from tests.helpers import connect_as_rls_user, ensure_rls_role
+
+
+class TestAssertRlsActive:
+    """Raises for bypass roles, passes when RLS applies."""
+
+    def test_raises_for_bypass_role(self, db_connection):
+        client = LeaseClient(db_connection.cursor(), "rls_assert")
+
+        with pytest.raises(LeaseError) as exc_info:
+            client.assert_rls_active()
+        assert exc_info.value.error_code == LeaseErrorCode.BIZ_RLS_NOT_ACTIVE
+
+    def test_passes_for_rls_role(self, db_connection):
+        ensure_rls_role(db_connection, "lease")
+        conn = connect_as_rls_user(db_connection, "lease")
+        try:
+            LeaseClient(conn.cursor(), "rls_assert").assert_rls_active()
+            conn.rollback()
+        finally:
+            conn.close()

postkit-0.5.0/tests/meter/test_rls_active.py

@@ -0,0 +1,55 @@
+"""assert_rls_active and the all-namespaces sweep guard for meter."""
+
+import psycopg
+import pytest
+from postkit.meter import MeterClient, MeterError, MeterErrorCode
+from tests.helpers import connect_as_rls_user, ensure_rls_role
+
+GUARDED_CALLS = [
+    "SELECT meter.release_expired_reservations(p_namespace := {ns})",
+]
+
+
+class TestAssertRlsActive:
+    """Raises for bypass roles, passes when RLS applies."""
+
+    def test_raises_for_bypass_role(self, db_connection):
+        client = MeterClient(db_connection.cursor(), "rls_assert")
+
+        with pytest.raises(MeterError) as exc_info:
+            client.assert_rls_active()
+        assert exc_info.value.error_code == MeterErrorCode.BIZ_RLS_NOT_ACTIVE
+
+    def test_passes_for_rls_role(self, db_connection):
+        ensure_rls_role(db_connection, "meter")
+        conn = connect_as_rls_user(db_connection, "meter")
+        try:
+            MeterClient(conn.cursor(), "rls_assert").assert_rls_active()
+            conn.rollback()
+        finally:
+            conn.close()
+
+
+class TestAllNamespacesGuard:
+    """NULL-namespace sweeps refuse roles subject to RLS."""
+
+    @pytest.fixture
+    def rls_conn(self, db_connection):
+        ensure_rls_role(db_connection, "meter")
+        conn = connect_as_rls_user(db_connection, "meter")
+        yield conn
+        conn.close()
+
+    @pytest.mark.parametrize("call", GUARDED_CALLS)
+    def test_null_namespace_raises_without_bypass(self, rls_conn, call):
+        with pytest.raises(psycopg.errors.InsufficientPrivilege) as exc_info:
+            rls_conn.execute(call.format(ns="NULL"))
+        assert "BIZ_ALL_NAMESPACES_REQUIRES_BYPASS" in exc_info.value.diag.message_hint
+        rls_conn.rollback()
+
+    @pytest.mark.parametrize("call", GUARDED_CALLS)
+    def test_explicit_namespace_works_without_bypass(self, rls_conn, call):
+        MeterClient(rls_conn.cursor(), "rls_guard")
+
+        rls_conn.execute(call.format(ns="'rls_guard'"))
+        rls_conn.rollback()

{postkit-0.4.0 → postkit-0.5.0}/tests/outbox/test_horizon.py

@@ -206,3 +206,41 @@ class TestHorizonGate:
 
         test_helpers.wait_readable("orders", ids[-1])
         assert poll_ids(cur, ns, "orders", "billing") == ids
+
+
+class TestHorizonBlockers:
+    """horizon_blockers surfaces the backends pinning the horizon."""
+
+    def test_open_write_transaction_appears_and_clears(self, outbox, connect):
+        """An uncommitted emit's backend is listed; after commit it is gone.
+
+        The horizon is database-global and other test workers may hold
+        older write transactions, so the is_horizon marker is asserted
+        only when this backend's xid actually is the horizon.
+        """
+        conn = connect()
+        cur = conn.cursor()
+        cur.execute("SELECT pg_backend_pid()")
+        blocker_pid = cur.fetchone()[0]
+        cur.execute(
+            "SELECT outbox.emit(%s, 'orders', 'test.event', '{}')",
+            (outbox.namespace,),
+        )
+        cur.execute("SELECT pg_current_xact_id()::text")
+        blocker_xid = int(cur.fetchone()[0])
+
+        rows = {r["pid"]: r for r in outbox.horizon_blockers()}
+        assert blocker_pid in rows
+        row = rows[blocker_pid]
+        assert row["xact_age"] is not None
+
+        cur.execute("SELECT mod(outbox._horizon()::text::numeric, 4294967296)")
+        horizon_low = int(cur.fetchone()[0])
+        if blocker_xid % 4294967296 == horizon_low:
+            assert row["is_horizon"] is True
+
+        conn.commit()
+        conn.close()
+
+        pids = [r["pid"] for r in outbox.horizon_blockers()]
+        assert blocker_pid not in pids

postkit-0.5.0/tests/outbox/test_rls_active.py

@@ -0,0 +1,63 @@
+"""assert_rls_active and the all-namespaces sweep guard for outbox."""
+
+import psycopg
+import pytest
+from postkit.outbox import OutboxClient, OutboxError, OutboxErrorCode
+
+from tests.helpers import connect_as_rls_user, ensure_rls_role
+
+GUARDED_CALLS = [
+    "SELECT * FROM outbox.trim(p_older_than := interval '30 days', p_namespace := {ns})",
+]
+
+
+class TestAssertRlsActive:
+    """Raises for bypass roles, passes when RLS applies."""
+
+    def test_raises_for_bypass_role(self, db_connection):
+        client = OutboxClient(db_connection.cursor(), "rls_assert")
+
+        with pytest.raises(OutboxError) as exc_info:
+            client.assert_rls_active()
+        assert exc_info.value.error_code == OutboxErrorCode.BIZ_RLS_NOT_ACTIVE
+
+    def test_passes_for_rls_role(self, db_connection):
+        ensure_rls_role(db_connection, "outbox")
+        conn = connect_as_rls_user(db_connection, "outbox")
+        try:
+            OutboxClient(conn.cursor(), "rls_assert").assert_rls_active()
+            conn.rollback()
+        finally:
+            conn.close()
+
+
+class TestAllNamespacesGuard:
+    """NULL-namespace sweeps refuse roles subject to RLS."""
+
+    @pytest.fixture
+    def rls_conn(self, db_connection):
+        ensure_rls_role(db_connection, "outbox")
+        conn = connect_as_rls_user(db_connection, "outbox")
+        yield conn
+        conn.close()
+
+    @pytest.mark.parametrize("call", GUARDED_CALLS)
+    def test_null_namespace_raises_without_bypass(self, rls_conn, call):
+        with pytest.raises(psycopg.errors.InsufficientPrivilege) as exc_info:
+            rls_conn.execute(call.format(ns="NULL"))
+        assert "BIZ_ALL_NAMESPACES_REQUIRES_BYPASS" in exc_info.value.diag.message_hint
+        rls_conn.rollback()
+
+    @pytest.mark.parametrize("call", GUARDED_CALLS)
+    def test_explicit_namespace_works_without_bypass(self, rls_conn, call):
+        OutboxClient(rls_conn.cursor(), "rls_guard")
+
+        rls_conn.execute(call.format(ns="'rls_guard'"))
+        rls_conn.rollback()
+
+    def test_null_namespace_sweeps_for_bypass_role(self, db_connection):
+        """Superuser NULL trim runs unguarded (30-day cutoff deletes nothing)."""
+        db_connection.execute(
+            "SELECT * FROM outbox.trim(p_older_than := interval '30 days',"
+            " p_namespace := NULL)"
+        )

postkit-0.5.0/tests/presence/test_rls_active.py

@@ -0,0 +1,57 @@
+"""assert_rls_active and the all-namespaces sweep guard for presence."""
+
+import psycopg
+import pytest
+from postkit.presence import PresenceClient, PresenceError, PresenceErrorCode
+
+from tests.helpers import connect_as_rls_user, ensure_rls_role
+
+GUARDED_CALLS = [
+    "SELECT * FROM presence.sweep(p_namespace := {ns})",
+    "SELECT * FROM presence.trim(p_older_than := interval '90 days', p_namespace := {ns})",
+]
+
+
+class TestAssertRlsActive:
+    """Raises for bypass roles, passes when RLS applies."""
+
+    def test_raises_for_bypass_role(self, db_connection):
+        client = PresenceClient(db_connection.cursor(), "rls_assert")
+
+        with pytest.raises(PresenceError) as exc_info:
+            client.assert_rls_active()
+        assert exc_info.value.error_code == PresenceErrorCode.BIZ_RLS_NOT_ACTIVE
+
+    def test_passes_for_rls_role(self, db_connection):
+        ensure_rls_role(db_connection, "presence")
+        conn = connect_as_rls_user(db_connection, "presence")
+        try:
+            PresenceClient(conn.cursor(), "rls_assert").assert_rls_active()
+            conn.rollback()
+        finally:
+            conn.close()
+
+
+class TestAllNamespacesGuard:
+    """NULL-namespace sweeps refuse roles subject to RLS."""
+
+    @pytest.fixture
+    def rls_conn(self, db_connection):
+        ensure_rls_role(db_connection, "presence")
+        conn = connect_as_rls_user(db_connection, "presence")
+        yield conn
+        conn.close()
+
+    @pytest.mark.parametrize("call", GUARDED_CALLS)
+    def test_null_namespace_raises_without_bypass(self, rls_conn, call):
+        with pytest.raises(psycopg.errors.InsufficientPrivilege) as exc_info:
+            rls_conn.execute(call.format(ns="NULL"))
+        assert "BIZ_ALL_NAMESPACES_REQUIRES_BYPASS" in exc_info.value.diag.message_hint
+        rls_conn.rollback()
+
+    @pytest.mark.parametrize("call", GUARDED_CALLS)
+    def test_explicit_namespace_works_without_bypass(self, rls_conn, call):
+        PresenceClient(rls_conn.cursor(), "rls_guard")
+
+        rls_conn.execute(call.format(ns="'rls_guard'"))
+        rls_conn.rollback()

{postkit-0.4.0 → postkit-0.5.0}/tests/queue/test_ack.py

@@ -224,15 +224,22 @@ class TestNack:
         stats = queue.get_stats()
         assert stats["dead"] == 1
 
-    def test_nack_not_running_raises_error(self, queue):
-        """nack raises error for non-running job."""
-
-        job_id = queue.push("tasks", {"task": 1})
+    def test_nack_settled_job_raises_error(self, queue):
+        """nack raises for a job that is already settled (dead)."""
+        queue.push("tasks", {"task": 1}, max_attempts=1)
+        job = queue.pull("tasks")
+        queue.fail(job["id"], error="poison")
 
         with pytest.raises(QueueValidationError) as exc_info:
-            queue.nack(job_id)
+            queue.nack(job["id"])
         assert exc_info.value.error_code == QueueErrorCode.BIZ_JOB_NOT_RUNNING
 
+    def test_nack_pending_job_reschedules(self, queue):
+        """nack on a pending job records the error and schedules a retry."""
+        job_id = queue.push("tasks", {"task": 1})
+
+        assert queue.nack(job_id, error="rolled back") is True
+
     def test_nack_not_found_raises_error(self, queue):
         """nack raises error for nonexistent job."""
 
@@ -262,12 +269,22 @@ class TestFail:
         stats = queue.get_stats()
         assert stats["dead"] == 1
 
-    def test_fail_not_running_returns_false(self, queue):
-        """fail returns False for non-running job."""
+    def test_fail_pending_job_dead_letters(self, queue):
+        """fail on a pending job moves it to the dead letter queue."""
         job_id = queue.push("tasks", {"task": 1})
 
-        result = queue.fail(job_id)
-        assert result is False
+        assert queue.fail(job_id) is True
+
+        stats = queue.get_stats()
+        assert stats["dead"] == 1
+
+    def test_fail_settled_job_returns_false(self, queue):
+        """fail returns False for a job that is already settled (dead)."""
+        queue.push("tasks", {"task": 1})
+        job = queue.pull("tasks")
+        queue.fail(job["id"])
+
+        assert queue.fail(job["id"]) is False
 
     def test_fail_stores_error_message(self, raw_cursor):
         """fail stores error message in dead_letters."""