sediment-api 0.3.0__tar.gz → 0.4.0__tar.gz

{sediment_api-0.3.0 → sediment_api-0.4.0}/.gitignore

@@ -13,8 +13,7 @@ exports/
 !docs/exports/
 .env
 .DS_Store
-.claude/settings.local.*
-.claude/worktrees/
+.claude/
 
 # Deployment-local compose overrides (mirror credentials etc.) — never in PRs
 compose.override.yml
@@ -29,4 +28,3 @@ litellm/config.local.yaml
 !.env.example
 .agents/
 skills-lock.json
-.claude/skills/asd-ste100

{sediment_api-0.3.0 → sediment_api-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sediment-api
-Version: 0.3.0
+Version: 0.4.0
 Summary: Sediment ingest API: facts in through three doors
 Project-URL: Source, https://github.com/sediment-ai/sediment
 Project-URL: Documentation, https://github.com/sediment-ai/sediment/tree/main/docs
@@ -13,8 +13,8 @@ Requires-Dist: anyio>=4.15.1
 Requires-Dist: fastapi>=0.141.1
 Requires-Dist: httpx>=0.27
 Requires-Dist: pydantic-settings>=2.15.0
-Requires-Dist: sediment-capture==0.3.0
-Requires-Dist: sediment-core==0.3.0
-Requires-Dist: sediment-derive==0.3.0
-Requires-Dist: sediment-export==0.3.0
-Requires-Dist: uvicorn>=0.53.0
+Requires-Dist: sediment-capture==0.4.0
+Requires-Dist: sediment-core==0.4.0
+Requires-Dist: sediment-derive==0.4.0
+Requires-Dist: sediment-export==0.4.0
+Requires-Dist: uvicorn>=0.54.0

{sediment_api-0.3.0 → sediment_api-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sediment-api"
-version = "0.3.0"
+version = "0.4.0"
 description = "Sediment ingest API: facts in through three doors"
 requires-python = ">=3.12"
 license = "AGPL-3.0-or-later"
@@ -10,12 +10,12 @@ dependencies = [
     "anyio>=4.15.1",
     "fastapi>=0.141.1",
     "httpx>=0.27",
-    "uvicorn>=0.53.0",
+    "uvicorn>=0.54.0",
     "pydantic-settings>=2.15.0",
-    "sediment-core==0.3.0",
-    "sediment-capture==0.3.0",
-    "sediment-derive==0.3.0",
-    "sediment-export==0.3.0",
+    "sediment-core==0.4.0",
+    "sediment-capture==0.4.0",
+    "sediment-derive==0.4.0",
+    "sediment-export==0.4.0",
 ]
 
 [project.urls]

{sediment_api-0.3.0 → sediment_api-0.4.0}/sediment_api/__init__.py

@@ -3,4 +3,4 @@
 
 # Single source for the API version string — FastAPI's ``app.version``
 # (reported by /health) and GET /v1/me both read it, so the two cannot drift.
-__version__ = "0.3.0"
+__version__ = "0.4.0"

{sediment_api-0.3.0 → sediment_api-0.4.0}/sediment_api/config.py

@@ -51,6 +51,11 @@ class Settings(BaseSettings):
     # PostgreSQL is the sole active fact store. SecretStr prevents settings
     # representations and validation diagnostics from echoing credentials.
     database_url: SecretStr
+    # Operator-named database roles (ADR 0027); empty means the default name.
+    # The lifespan validates them, keeping postgres_roles out of workers.
+    migrator_role: str = ""
+    runtime_role: str = ""
+    operator_role: str = ""
 
     # Raw git substrate: base dir for the per-(org, repo) bare mirrors.
     # None (unset) disables mirror refresh entirely — facts still flow;

{sediment_api-0.3.0 → sediment_api-0.4.0}/sediment_api/main.py

@@ -22,7 +22,7 @@ from sediment_core.postgres_migrations import (
     RevisionState,
     inspect_engine_revision,
 )
-from sediment_core.postgres_roles import validate_runtime_privileges
+from sediment_core.postgres_roles import RoleNames, validate_runtime_privileges
 from sqlalchemy.exc import (
     DisconnectionError,
     InterfaceError,
@@ -67,6 +67,10 @@ for _warning in settings.config_warnings():
 async def lifespan(application: FastAPI):
     """Own one PostgreSQL engine and verify the exact schema before traffic."""
     database_url = settings.database_url.get_secret_value()
+    # Invalid role names fail here, with their own message, before any I/O.
+    roles = RoleNames.configured(
+        settings.migrator_role, settings.runtime_role, settings.operator_role
+    )
     engine = None
     workers = None
     try:
@@ -82,7 +86,7 @@ async def lifespan(application: FastAPI):
                 f"{HEAD_REVISION}, found {inspection.state.value}"
             )
         if not settings.dev_mode:
-            validate_runtime_privileges(engine)
+            validate_runtime_privileges(engine, roles)
         application.state.database_engine = engine
         application.state.fact_store = FactStore(engine)
         application.state.database_target = sanitized_database_target(database_url)

{sediment_api-0.3.0 → sediment_api-0.4.0}/sediment_api/routers/ci_vendor.py

@@ -68,8 +68,8 @@ class VendorCIRequest(BaseModel):
     )
     run_id: NonEmptyId = Field(
         description=(
-            "The provider-issued pipeline-run id, unique within the deployment "
-            "organization and provider namespace"
+            "The CI provider's pipeline-run ID. Identified runs also carry a "
+            "forge provider and host; run_attempt distinguishes attempts."
         )
     )
     run_attempt: int | None = Field(default=None, ge=1, le=2**63 - 1, strict=True)

sediment_api-0.4.0/tests/test_database_role_startup.py

@@ -0,0 +1,136 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Production startup against operator-named roles provisioned without Sediment."""
+
+from __future__ import annotations
+
+from uuid import uuid4
+
+import pytest
+from psycopg import sql
+from pydantic import SecretStr
+from sqlalchemy import create_engine
+from sqlalchemy.engine import make_url
+from sqlalchemy.pool import NullPool
+
+from sediment_core.postgres_engine import DatabaseOperationError
+from sediment_core.postgres_roles import (
+    DatabasePrivilegeError,
+    RoleNames,
+    administrator_sql,
+    migrate_database,
+)
+
+# Creates cluster-wide roles under names no other module uses; see
+# packages/core/tests/test_postgres_roles.py for the default-name contract.
+pytestmark = pytest.mark.cluster_roles
+ROLES = RoleNames("sediment_test_api_m", "sediment_test_api_r", "sediment_test_api_o")
+ADMIN, ADMIN_PASSWORD = "sediment_test_api_admin", "api-admin-test-secret"
+PASSWORDS = {role: f"{role}-secret" for role in ROLES}
+
+
+@pytest.fixture
+def provisioned(postgres_admin_url):
+    """The administrator's printed SQL applied by a non-superuser owner."""
+    superuser = create_engine(
+        postgres_admin_url, isolation_level="AUTOCOMMIT", poolclass=NullPool
+    )
+    database = f"sediment_api_role_test_{uuid4().hex}"
+    engines = []
+
+    def url(role, password=None):
+        return (
+            make_url(postgres_admin_url)
+            .set(
+                database=database,
+                username=role,
+                password=password or PASSWORDS.get(role, ADMIN_PASSWORD),
+            )
+            .render_as_string(hide_password=False)
+        )
+
+    def connect(role, password=None):
+        engine = create_engine(url(role, password), poolclass=NullPool)
+        engines.append(engine)
+        return engine
+
+    with superuser.connect() as connection:
+        connection.exec_driver_sql(
+            f"CREATE ROLE {ADMIN} LOGIN CREATEROLE CREATEDB PASSWORD '{ADMIN_PASSWORD}'"
+        )
+        connection.exec_driver_sql(f'CREATE DATABASE "{database}" OWNER {ADMIN}')
+    try:
+        with connect(ADMIN).connect() as connection:
+            driver = connection.connection.driver_connection
+            driver.execute(administrator_sql(database, ROLES))
+            for role, secret in PASSWORDS.items():
+                driver.execute(
+                    sql.SQL("ALTER ROLE {} PASSWORD {}").format(
+                        sql.Identifier(role), sql.Literal(secret)
+                    )
+                )
+            driver.commit()
+        yield url, connect
+    finally:
+        for engine in engines:
+            engine.dispose()
+        with superuser.connect() as connection:
+            connection.exec_driver_sql(f'DROP DATABASE "{database}" WITH (FORCE)')
+            for role in (*ROLES, ADMIN):
+                connection.exec_driver_sql(f'DROP ROLE IF EXISTS "{role}"')
+        superuser.dispose()
+
+
+def start(monkeypatch, database_url):
+    from fastapi.testclient import TestClient
+
+    from sediment_api.config import settings
+    from sediment_api.main import app
+
+    monkeypatch.setattr(settings, "database_url", SecretStr(database_url))
+    monkeypatch.setattr(settings, "dev_mode", False)
+    monkeypatch.setattr(settings, "migrator_role", ROLES.migrator)
+    monkeypatch.setattr(settings, "runtime_role", ROLES.runtime)
+    monkeypatch.setattr(settings, "operator_role", ROLES.operator)
+    with TestClient(app) as client:
+        assert client.get("/health").status_code == 200
+
+
+def test_startup_refuses_until_the_migrate_step_grants_then_serves(
+    provisioned, monkeypatch
+):
+    url, connect = provisioned
+    with pytest.raises(DatabaseOperationError, match="found absent"):
+        start(monkeypatch, url(ROLES.runtime))
+    assert migrate_database(url(ROLES.migrator), ROLES)
+    start(monkeypatch, url(ROLES.runtime))
+    # A table that Alembic created without grants blocks startup again.
+    with connect(ROLES.migrator).begin() as connection:
+        connection.exec_driver_sql(
+            f"REVOKE ALL ON inference_call_aliases FROM {ROLES.runtime}"
+        )
+    with pytest.raises(DatabasePrivilegeError, match="inference_call_aliases"):
+        start(monkeypatch, url(ROLES.runtime))
+    assert migrate_database(url(ROLES.migrator), ROLES)
+    start(monkeypatch, url(ROLES.runtime))
+
+
+def test_startup_uses_a_runtime_password_the_role_rotated_itself(
+    provisioned, monkeypatch
+):
+    url, connect = provisioned
+    assert migrate_database(url(ROLES.migrator), ROLES)
+    with connect(ROLES.runtime).connect() as connection:
+        driver = connection.connection.driver_connection
+        driver.execute("ALTER ROLE CURRENT_USER PASSWORD 'rotated-runtime-secret'")
+        driver.commit()
+    start(monkeypatch, url(ROLES.runtime, "rotated-runtime-secret"))
+
+
+def test_startup_refuses_the_migrator_and_the_administrator(provisioned, monkeypatch):
+    url, _ = provisioned
+    assert migrate_database(url(ROLES.migrator), ROLES)
+    with pytest.raises(DatabasePrivilegeError, match=ROLES.runtime):
+        start(monkeypatch, url(ROLES.migrator))
+    # The administrator can't even read the schema revision.
+    with pytest.raises(DatabaseOperationError, match="verify database startup"):
+        start(monkeypatch, url(ADMIN))

{sediment_api-0.3.0 → sediment_api-0.4.0}/tests/test_v1.py

@@ -101,7 +101,7 @@ def test_me_happy_path(client: TestClient) -> None:
     assert resp.status_code == 200
     assert resp.json() == {
         "org_id": ORG,
-        "version": "0.3.0",
+        "version": "0.4.0",
         "authority": "operator",
         "client_id": "operator",
     }

{sediment_api-0.3.0 → sediment_api-0.4.0}/tests/test_worker_processes.py

@@ -42,10 +42,13 @@ def test_deadline_kills_process_group_before_slot_reuse(monkeypatch, tmp_path):
         "signal.signal(signal.SIGTERM, signal.SIG_IGN)\n"
         "child = subprocess.Popen([sys.executable, '-c', "
         "'import signal,time; signal.signal(signal.SIGTERM, signal.SIG_IGN); time.sleep(60)'])\n"
-        f"open({str(marker)!r}, 'w').write(f'{{os.getpid()}} {{child.pid}}')\n"
+        f"from pathlib import Path; t = Path({str(marker)!r} + '.tmp')\n"
+        "t.write_text(f'{os.getpid()} {child.pid}')\n"
+        f"t.replace({str(marker)!r})\n"
         "time.sleep(60)\n",
     )
-    monkeypatch.setattr(workers, "QUERY_BUDGET_SECONDS", 0.3)
+    # The budget outlasts startup, so the marker exists before the kill.
+    monkeypatch.setattr(workers, "QUERY_BUDGET_SECONDS", 1.0)
     monkeypatch.setattr(workers, "TERMINATION_GRACE_SECONDS", 0.1)
 
     async def check():
@@ -98,7 +101,7 @@ def test_cancellation_and_shutdown_reap_child(monkeypatch, tmp_path, operation):
     marker = tmp_path / "pid"
     _command(
         monkeypatch,
-        f"import os,time; open({str(marker)!r},'w').write(str(os.getpid())); time.sleep(60)",
+        f"import os,time; from pathlib import Path; t=Path({str(marker)!r}+'.tmp'); t.write_text(str(os.getpid())); t.replace({str(marker)!r}); time.sleep(60)",
     )
 
     async def check():
@@ -234,7 +237,7 @@ def test_cancellation_during_spawn_does_not_orphan_the_started_process(
     marker = tmp_path / "pid"
     _command(
         monkeypatch,
-        f"import os,time; open({str(marker)!r},'w').write(str(os.getpid())); time.sleep(60)",
+        f"import os,time; from pathlib import Path; t=Path({str(marker)!r}+'.tmp'); t.write_text(str(os.getpid())); t.replace({str(marker)!r}); time.sleep(60)",
     )
     spawn = asyncio.create_subprocess_exec
 
@@ -335,9 +338,10 @@ def test_dying_process_group_permission_race_is_rechecked(monkeypatch, tmp_path)
     marker = tmp_path / "pid"
     _command(
         monkeypatch,
-        f"import os,time; open({str(marker)!r},'w').write(str(os.getpid())); time.sleep(60)",
+        f"import os,time; from pathlib import Path; t=Path({str(marker)!r}+'.tmp'); t.write_text(str(os.getpid())); t.replace({str(marker)!r}); time.sleep(60)",
     )
-    monkeypatch.setattr(workers, "QUERY_BUDGET_SECONDS", 0.1)
+    # The budget outlasts startup, so the marker exists before the kill.
+    monkeypatch.setattr(workers, "QUERY_BUDGET_SECONDS", 1.0)
     signal_group = os.killpg
     raced = False