python-authz 0.8.0__tar.gz → 0.8.1__tar.gz

{python_authz-0.8.0 → python_authz-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-authz
-Version: 0.8.0
+Version: 0.8.1
 Summary: A framework-agnostic ReBAC/RBAC/ABAC authorization engine built on one Zanzibar-style relationship graph
 Author: Anupam Gupta
 Author-email: Anupam Gupta <anupam@trois.in>
@@ -54,7 +54,7 @@ kept in agreement with each other.
 
 ## Status
 
-Release, version 0.8.0, a security release. [`docs/security.md`](docs/security.md) analyses the library end to end and records what changed; [`CHANGELOG.md`](CHANGELOG.md) lists the upgrade notes. The library provides:
+Release, version 0.8.1. Version 0.8.0 was a security release: [`docs/security.md`](docs/security.md) analyses the library end to end and records what changed, and [`CHANGELOG.md`](CHANGELOG.md) lists the upgrade notes. The library provides:
 
 - **Unified ReBAC + RBAC + ABAC**: Zanzibar-style relationship graphs with conditions evaluated against stored policy and request context. Stored context takes precedence.
 - **Three-Valued Conditions**: a condition may return `None` when its context is missing or invalid; rewrite rules combine `True`, `False`, and `None` with Kleene logic, and a check allows only on `True`, so missing context never grants access, even under `Exclusion`.

{python_authz-0.8.0 → python_authz-0.8.1}/README.md

@@ -26,7 +26,7 @@ kept in agreement with each other.
 
 ## Status
 
-Release, version 0.8.0, a security release. [`docs/security.md`](docs/security.md) analyses the library end to end and records what changed; [`CHANGELOG.md`](CHANGELOG.md) lists the upgrade notes. The library provides:
+Release, version 0.8.1. Version 0.8.0 was a security release: [`docs/security.md`](docs/security.md) analyses the library end to end and records what changed, and [`CHANGELOG.md`](CHANGELOG.md) lists the upgrade notes. The library provides:
 
 - **Unified ReBAC + RBAC + ABAC**: Zanzibar-style relationship graphs with conditions evaluated against stored policy and request context. Stored context takes precedence.
 - **Three-Valued Conditions**: a condition may return `None` when its context is missing or invalid; rewrite rules combine `True`, `False`, and `None` with Kleene logic, and a check allows only on `True`, so missing context never grants access, even under `Exclusion`.

{python_authz-0.8.0 → python_authz-0.8.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "python-authz"
-version = "0.8.0"
+version = "0.8.1"
 description = "A framework-agnostic ReBAC/RBAC/ABAC authorization engine built on one Zanzibar-style relationship graph"
 readme = "README.md"
 license = "MIT"

{python_authz-0.8.0 → python_authz-0.8.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "python-authz"
-version = "0.8.0"
+version = "0.8.1"
 description = "A framework-agnostic ReBAC/RBAC/ABAC authorization engine built on one Zanzibar-style relationship graph"
 readme = "README.md"
 license = "MIT"

{python_authz-0.8.0 → python_authz-0.8.1}/src/authz/storage/postgres.py

@@ -205,13 +205,11 @@ class PostgresStorage:
     async def current_token(self) -> Token:
         conn, must_release = await self._connection()
         try:
-            # last_value alone is misleading: Postgres pre-seeds a freshly
-            # created (or RESTART IDENTITY-reset) sequence's last_value to
-            # its start value even before anything has actually consumed
-            # it. is_called distinguishes "really advanced" from "just
-            # initialized" -- only count it once nextval() has actually run.
+            # pg_sequence_last_value is NULL until nextval() has run (a fresh
+            # or RESTART IDENTITY-reset sequence), and it needs only USAGE on
+            # the sequence, where SELECT FROM the sequence needs SELECT.
             value = await conn.fetchval(
-                f"SELECT CASE WHEN is_called THEN last_value ELSE 0 END FROM {self._sequence}"
+                "SELECT COALESCE(pg_sequence_last_value($1::regclass), 0)", self._sequence
             )
             return str(value)
         finally: