simple-module-background-tasks 0.0.34__tar.gz → 0.0.35__tar.gz

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_background_tasks
-Version: 0.0.34
+Version: 0.0.35
 Summary: Celery + Redis task queue with admin UI for monitoring and retrying failed/stuck tasks
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -23,10 +23,10 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: celery[redis]>=5.4
 Requires-Dist: redis>=5
-Requires-Dist: simple-module-core==0.0.34
-Requires-Dist: simple-module-db==0.0.34
-Requires-Dist: simple-module-hosting==0.0.34
-Requires-Dist: simple-module-settings==0.0.34
+Requires-Dist: simple-module-core==0.0.35
+Requires-Dist: simple-module-db==0.0.35
+Requires-Dist: simple-module-hosting==0.0.35
+Requires-Dist: simple-module-settings==0.0.35
 Description-Content-Type: text/markdown
 
 # simple_module_background_tasks

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/constants.py

@@ -87,6 +87,14 @@ DEFAULT_STUCK_SWEEP_INTERVAL_SECONDS = 60
 DEFAULT_PURGE_INTERVAL_SECONDS = 60 * 60 * 24
 DEFAULT_RETENTION_DAYS = 14
 DEFAULT_MAX_RETRIES = 3
+# Redis pub/sub channel carrying the framework's cache invalidations. Namespaced
+# so that two apps on one Redis *server* do not each act on the other's messages.
+# The server, not the database: pub/sub ignores the logical DB index, so DBs 4 and
+# 5 of one instance share this channel. Mostly that costs pointless reads, but it
+# is not unconditionally harmless — an emptied cache is also what exposes
+# ``UsersAuthProvider._version_still_current``'s fail-open branch, so rename it
+# per app rather than relying on the DB number.
+DEFAULT_INVALIDATION_CHANNEL = "simple_module.invalidation"
 
 # ── Internal task names ─────────────────────────────────────────
 INTERNAL_TASK_SWEEP_STUCK = "background_tasks.sweep_stuck_tasks"

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/endpoints/views.py

@@ -6,9 +6,9 @@ import asyncio
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
-from inertia import InertiaResponse
 from simple_module_hosting.inertia_deps import InertiaDep
 from simple_module_hosting.permissions import RequiresPermission
+from simple_module_inertia import InertiaResponse
 
 from background_tasks.constants import (
     PERM_VIEW,

simple_module_background_tasks-0.0.35/background_tasks/invalidation.py

@@ -0,0 +1,211 @@
+"""Redis pub/sub transport for the framework's :class:`InvalidationBus`.
+
+This module owns the app's Redis connection already — one URL, one set of
+settings, one health check. Cross-process cache invalidation needs exactly that
+connection and nothing else, so it is installed from here rather than opened a
+second time inside whichever module happens to keep a cache (GH #318). A module
+→ framework import is fine; the reverse is what ``SM009`` forbids, which is why
+the bus itself knows nothing about Redis.
+
+Every framework channel shares one Redis channel. The volume is a handful of
+messages per revocation — ``users`` is the only publisher today — and
+``Invalidation.channel`` routes
+inside the receiving process, so one subscription is less machinery for the same
+result — and it means a module that adds a channel after boot needs no
+resubscribe.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import logging
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from simple_module_core.invalidation import InvalidationBus
+
+logger = logging.getLogger(__name__)
+
+__all__ = ["RedisInvalidationTransport"]
+
+INITIAL_BACKOFF_SECONDS = 1.0
+MAX_BACKOFF_SECONDS = 30.0
+
+SUBSCRIBE_TIMEOUT_SECONDS = 5.0
+"""Ceiling on the one-shot SUBSCRIBE at the top of each listener attempt.
+
+A separate bound from :data:`PUBLISH_TIMEOUT_SECONDS` because it is not in a
+request's way — only a wedged listener's. Needed because ``socket_connect_timeout``
+bounds the *connect* and nothing else: against a broker that completes the TCP
+handshake and then never answers, ``subscribe`` waits on a read that has no
+deadline, so the listener hangs before it has ever raised, ``_log_failure`` never
+runs, and the reconnect loop below never gets a turn. Cross-process invalidation
+is then silently and permanently off on this worker, while the boot log says it is
+on — the exact "does nothing and nobody learns" failure this whole file is
+supposed to avoid. Found by QA, not by the original tests.
+"""
+
+READ_TIMEOUT_SECONDS = 10.0
+"""``socket_timeout`` for the client: a bound on any read that has started.
+
+Cannot simply be small: the same option applies to the subscription, and a quiet
+channel must not be torn down for being quiet. That is why the listener polls
+:meth:`redis.asyncio.client.PubSub.get_message` with its own short timeout instead
+of blocking in ``listen()`` — polling returns ``None`` on an idle channel without
+ever starting a read, so this deadline only bites when bytes stop arriving
+mid-message.
+"""
+
+HEALTH_CHECK_INTERVAL_SECONDS = 15.0
+"""How often redis-py PINGs an otherwise idle subscription.
+
+The half-open socket — ESTABLISHED at both ends, carrying nothing, as a NAT or
+load balancer idle-drop leaves it — is invisible to every timeout above, because
+no read is ever attempted. redis-py's health check is what turns it into an error:
+the PING's reply read is bounded by ``socket_timeout``, so a mute peer raises into
+the reconnect loop within roughly this interval.
+"""
+
+LISTEN_POLL_SECONDS = 1.0
+"""How long each ``get_message`` waits before returning ``None`` and looping.
+
+Also the granularity at which the health check and cancellation get a turn.
+"""
+
+PUBLISH_TIMEOUT_SECONDS = 1.0
+"""Ceiling on how long a publish may hold up the request that triggered it.
+
+``publish`` is awaited inside the response cycle — a password change's
+``db.on_commit`` callback runs before the response is sent — and redis-py
+defaults to *no* socket timeout, so a Redis that accepts connections but stops
+answering would hang that request indefinitely rather than degrade the fan-out.
+One second is far more than a local round trip needs and far less than a user
+waits. Exceeding it raises, which the bus logs and swallows: the local eviction
+has already happened, so the cost of the timeout is the same staleness window
+that existed before this transport.
+"""
+
+
+class RedisInvalidationTransport:
+    """Publishes to, and listens on, one Redis pub/sub channel.
+
+    Satisfies ``simple_module_core.invalidation.InvalidationTransport``
+    structurally — no import of the Protocol at runtime, so this file costs
+    nothing when the bus is unused.
+    """
+
+    def __init__(self, bus: InvalidationBus, url: str, channel: str) -> None:
+        self._bus = bus
+        self._url = url
+        self._channel = channel
+        self._client = None
+        self._listener: asyncio.Task | None = None
+        self._warned = False
+
+    async def start(self) -> None:
+        """Open the client and start the listener task.
+
+        Does **not** wait for a successful connection, and does not raise if
+        Redis is down. Invalidation is an accelerator over a TTL that already
+        bounds staleness, so an unreachable broker must degrade the app to
+        per-process caching — its behaviour before this existed — rather than
+        fail the boot of a web worker that can otherwise serve every request.
+        ``/health`` already reports Redis; this logs a warning naming the
+        consequence so the two agree.
+        """
+        import redis.asyncio as aioredis
+
+        # Four deadlines, each covering a failure the others do not. Connect
+        # covers a host that swallows SYN packets; socket_timeout covers a read
+        # that starts and stalls; keepalive and the health check cover a socket
+        # that is open at both ends and carrying nothing. Without the last two a
+        # half-open connection leaves this worker permanently and silently
+        # without cross-process invalidation.
+        self._client = aioredis.from_url(
+            self._url,
+            socket_connect_timeout=PUBLISH_TIMEOUT_SECONDS,
+            socket_timeout=READ_TIMEOUT_SECONDS,
+            socket_keepalive=True,
+            health_check_interval=HEALTH_CHECK_INTERVAL_SECONDS,
+        )
+        self._listener = asyncio.create_task(self._listen(), name="sm-invalidation-listener")
+
+    async def publish(self, message: str) -> None:
+        """Broadcast one encoded invalidation. Raises — the bus logs it.
+
+        Bounded by :data:`PUBLISH_TIMEOUT_SECONDS`, because this runs inside the
+        response cycle of the request that made the write.
+        """
+        if self._client is None:
+            raise RuntimeError("RedisInvalidationTransport.start() was not called")
+        async with asyncio.timeout(PUBLISH_TIMEOUT_SECONDS):
+            await self._client.publish(self._channel, message)
+
+    async def stop(self) -> None:
+        """Cancel the listener and close the client."""
+        if self._listener is not None:
+            self._listener.cancel()
+            with contextlib.suppress(asyncio.CancelledError):
+                await self._listener
+            self._listener = None
+        if self._client is not None:
+            with contextlib.suppress(Exception):
+                await self._client.aclose()
+            self._client = None
+
+    async def _listen(self) -> None:
+        """Subscribe and hand every message to the bus, reconnecting forever.
+
+        Reconnects rather than giving up after the first failure: a Redis that
+        is briefly unreachable during a deploy would otherwise leave this worker
+        with cross-process invalidation permanently off, which is the original
+        bug wearing a warning message. Backoff is capped so a long outage does
+        not turn into a reconnect storm when it ends.
+
+        Only the *first* failure of a run logs at warning. A worker that
+        outlives an hour of downtime should not have written an hour of
+        identical lines, but the state still has to be visible once.
+        """
+        backoff = INITIAL_BACKOFF_SECONDS
+        while True:
+            pubsub = None
+            try:
+                pubsub = self._client.pubsub()
+                async with asyncio.timeout(SUBSCRIBE_TIMEOUT_SECONDS):
+                    await pubsub.subscribe(self._channel)
+                if self._warned:
+                    logger.info("Invalidation listener reconnected to %r", self._channel)
+                self._warned = False
+                backoff = INITIAL_BACKOFF_SECONDS
+                while True:
+                    # Polling rather than ``listen()``: an idle channel returns
+                    # None instead of blocking in an unbounded read, which is what
+                    # lets redis-py run its health check and lets cancellation
+                    # land promptly at shutdown.
+                    raw = await pubsub.get_message(timeout=LISTEN_POLL_SECONDS)
+                    if raw is None or raw.get("type") != "message":
+                        continue
+                    await self._bus.deliver(raw["data"])
+            except asyncio.CancelledError:
+                raise
+            except Exception as exc:
+                self._log_failure(exc)
+                await asyncio.sleep(backoff)
+                backoff = min(backoff * 2, MAX_BACKOFF_SECONDS)
+            finally:
+                if pubsub is not None:
+                    with contextlib.suppress(Exception):
+                        await pubsub.aclose()
+
+    def _log_failure(self, exc: Exception) -> None:
+        """Warn once per outage, then stay quiet about the same outage."""
+        if self._warned:
+            logger.debug("Invalidation listener still down: %s", exc)
+            return
+        self._warned = True
+        logger.warning(
+            "Invalidation listener lost Redis (%s); other workers keep cached "
+            "values until they expire. Retrying.",
+            exc,
+        )

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/module.py

@@ -152,13 +152,17 @@ class BackgroundTasksModule(ModuleBase):
         from background_tasks.celery_app import build_celery
         from background_tasks.signals import bind_event_bus
         from background_tasks.sync_db import set_database_url
+        from background_tasks.tenant_context import set_default_tenant
 
         services = app.state.background_tasks
         # Pin the sync engine to the same URL the host's async settings
         # resolved — pydantic-settings reads ``.env`` but never propagates
         # to ``os.environ``, so signals would otherwise fall back to the
         # SQLite default and silently drop ``TaskExecution`` rows.
-        set_database_url(app.state.sm.settings.database_url)
+        host = app.state.sm.settings
+        multi = bool(getattr(host, "multi_tenant", False))
+        set_database_url(host.database_url, tenant_strict=multi)
+        set_default_tenant(None if multi else getattr(host, "default_tenant", "") or None)
         # build_celery imports `signals` for side effects and runs
         # `autodiscover_tasks` across every installed module.
         services.celery = build_celery(services.settings)
@@ -172,6 +176,8 @@ class BackgroundTasksModule(ModuleBase):
             services.settings.task_default_queue,
         )
 
+        await self._start_invalidation_transport(app)
+
         # Registered here, not in register_health_checks: the Celery app does
         # not exist until this hook builds it, and the check must follow later
         # settings changes rather than pinning the boot-time instance.
@@ -199,11 +205,52 @@ class BackgroundTasksModule(ModuleBase):
             )
         )
 
+    @staticmethod
+    async def _start_invalidation_transport(app: FastAPI) -> None:
+        """Hand the framework bus the Redis connection this module configures.
+
+        The transport is installed here rather than in a registration hook
+        because it needs a running event loop for its listener task, and it is
+        installed by *this* module because it owns the Redis URL — a cache-owning
+        module opening its own connection is the duplication GH #318 exists to
+        avoid.
+
+        A worker process that runs Celery without the FastAPI app never reaches
+        this, so it publishes nothing and hears nothing. That is the same
+        documented cross-process limit as ``bind_event_bus`` above: a task that
+        invalidates a cache should do it through an API call or accept the TTL.
+        """
+        from background_tasks.invalidation import RedisInvalidationTransport
+
+        services = app.state.background_tasks
+        s = services.settings
+        if not s.broadcast_invalidations:
+            logger.info(
+                "BackgroundTasks: cross-worker cache invalidation disabled "
+                "(broadcast_invalidations=false) — per-process caches expire on their own TTL"
+            )
+            return
+
+        bus = app.state.sm.invalidation
+        transport = RedisInvalidationTransport(bus, s.broker_url, s.invalidation_channel)
+        await transport.start()
+        bus.set_transport(transport)
+        services.invalidation_transport = transport
+        logger.info(
+            "BackgroundTasks: invalidation transport on %r for channel(s) %s",
+            s.invalidation_channel,
+            ", ".join(bus.channels) or "(none subscribed)",
+        )
+
     async def on_shutdown(self, app: FastAPI) -> None:
         from background_tasks.signals import unbind_event_bus
         from background_tasks.sync_db import dispose_sync_engine
 
         services = app.state.background_tasks
+        if services.invalidation_transport is not None:
+            app.state.sm.invalidation.clear_transport()
+            await services.invalidation_transport.stop()
+            services.invalidation_transport = None
         if services.celery is not None:
             services.celery.close()
         unbind_event_bus()

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/pages/Detail.tsx

@@ -125,5 +125,5 @@ function Detail() {
   );
 }
 
-Detail.layout = (page: React.ReactNode) => <AdminLayout>{page}</AdminLayout>;
+Detail.layout = [AdminLayout];
 export default Detail;

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/pages/Index.tsx

@@ -228,5 +228,5 @@ function Index() {
   );
 }
 
-Index.layout = (page: React.ReactNode) => <AdminLayout>{page}</AdminLayout>;
+Index.layout = [AdminLayout];
 export default Index;

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/pages/Workers.tsx

@@ -111,5 +111,5 @@ function Workers() {
   );
 }
 
-Workers.layout = (page: React.ReactNode) => <AdminLayout>{page}</AdminLayout>;
+Workers.layout = [AdminLayout];
 export default Workers;

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/services.py

@@ -20,6 +20,7 @@ if TYPE_CHECKING:
     from celery import Celery
 
     from background_tasks.contracts.schemas import WorkerSnapshot
+    from background_tasks.invalidation import RedisInvalidationTransport
     from background_tasks.settings import BackgroundTasksSettings
 
 
@@ -35,3 +36,7 @@ class BackgroundTasksServices:
     # until something has. Read it for reporting, never as a live reading —
     # ``polled_at`` says how old it is.
     last_worker_snapshot: WorkerSnapshot | None = None
+    # The cross-worker cache-invalidation transport this module installs on the
+    # framework bus, kept only so ``on_shutdown`` can stop its listener task.
+    # ``None`` when ``broadcast_invalidations`` is off.
+    invalidation_transport: RedisInvalidationTransport | None = None

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/settings.py

@@ -41,6 +41,7 @@ from simple_module_core.environments import NON_PROD_ENVIRONMENTS
 
 from background_tasks.constants import (
     DEFAULT_BROKER_URL,
+    DEFAULT_INVALIDATION_CHANNEL,
     DEFAULT_MAX_RETRIES,
     DEFAULT_PURGE_INTERVAL_SECONDS,
     DEFAULT_QUEUE,
@@ -87,6 +88,23 @@ class BackgroundTasksSettings(BaseSettings):
     )
     task_default_queue: str = Field(default=DEFAULT_QUEUE, json_schema_extra=_CELERY_RESTART)
 
+    # ── Cross-process cache invalidation (GH #318) ──────────
+    # This module owns the Redis connection, so it installs the transport that
+    # carries the framework InvalidationBus between workers. Off means every
+    # per-process cache — ``users``' revocation counter above all — stays stale
+    # in the *other* workers until its own TTL expires, which is the behaviour
+    # that predates the transport. Left on by default because a deployment with
+    # Redis configured is the one that has several workers to keep in step; the
+    # test suite turns it off, having no Redis to reach.
+    broadcast_invalidations: bool = Field(
+        default=True, json_schema_extra={"requires_restart": True, "group": "Celery"}
+    )
+    invalidation_channel: str = Field(
+        default=DEFAULT_INVALIDATION_CHANNEL,
+        min_length=1,
+        json_schema_extra={"requires_restart": True, "group": "Celery"},
+    )
+
     # Run tasks synchronously inside the calling process. Tests flip it on via
     # ``SM_BG_TASKS_TASK_ALWAYS_EAGER`` or by passing it explicitly, either of
     # which works without DB-backed hydration (which never fires for suites

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/signals.py

@@ -41,6 +41,7 @@ from background_tasks.contracts.events import TaskFailed
 from background_tasks.log_context import signal_task_finished, signal_task_started
 from background_tasks.models import TaskExecution
 from background_tasks.sync_db import sync_session
+from background_tasks.tenant_context import release_tenant, restore_tenant, stamp_tenant
 
 logger = logging.getLogger(__name__)
 
@@ -126,6 +127,7 @@ def on_task_publish(
     **_kwargs: Any,
 ) -> None:
     """Record a row the moment a task is pushed onto the broker."""
+    stamp_tenant(headers)
     task_id = (headers or {}).get("id")
     task_name = sender or (headers or {}).get("task") or "unknown"
 
@@ -179,6 +181,7 @@ def on_task_prerun(
         },
     )
     signal_task_started(task_id=task_id, task_name=name)
+    restore_tenant(task_id=task_id, task=task)
 
 
 @signals.task_postrun.connect
@@ -199,6 +202,7 @@ def on_task_postrun(
         celery_task_id=task_id,
         defaults={"task_name": task_name_of(sender, task), "heartbeat_at": now_utc()},
     )
+    release_tenant(task_id=task_id)
     signal_task_finished(task_id=task_id)
 
 

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/background_tasks/sync_db.py

@@ -18,6 +18,8 @@ import os
 from collections.abc import Iterator
 from contextlib import contextmanager
 
+from simple_module_db.listeners import attach_session_listeners
+from simple_module_db.query_filter import EngineTenancy, bind_engine_policy
 from sqlalchemy import create_engine
 from sqlalchemy.engine import Engine
 from sqlalchemy.orm import Session, sessionmaker
@@ -27,6 +29,13 @@ logger = logging.getLogger(__name__)
 _engine: Engine | None = None
 _session_factory: sessionmaker[Session] | None = None
 _url_override: str | None = None
+_tenant_strict: bool = False
+
+
+class WorkerSession(Session):
+    """This engine's own session class, so the entity listeners attached to it
+    never double up with a ``DatabaseState``'s (each state has its own
+    ``Session`` subclass; listeners on the base class would fire for both)."""
 
 
 def _sync_url(async_url: str) -> str:
@@ -38,7 +47,7 @@ def _sync_url(async_url: str) -> str:
     return async_url.replace("+aiosqlite", "").replace("+asyncpg", "+psycopg2")
 
 
-def set_database_url(url: str | None) -> None:
+def set_database_url(url: str | None, *, tenant_strict: bool = False) -> None:
     """Pin the URL used to build the sync engine.
 
     The web process loads ``.env`` via pydantic-settings, but those values
@@ -48,11 +57,15 @@ def set_database_url(url: str | None) -> None:
     calls this with the resolved ``settings.database_url`` so signals use
     the same DB the app is on. Pass ``None`` to clear the override (used in
     tests + on shutdown).
+
+    ``tenant_strict`` mirrors the host's ``multi_tenant``: task bodies get the
+    same fail-closed tenant rules as request code.
     """
-    global _url_override, _engine, _session_factory
-    if _url_override == url:
+    global _url_override, _engine, _session_factory, _tenant_strict
+    if _url_override == url and _tenant_strict == tenant_strict:
         return
     _url_override = url
+    _tenant_strict = tenant_strict
     if _engine is not None:
         _engine.dispose()
     _engine = None
@@ -68,7 +81,13 @@ def _resolve_url() -> str:
 def _build_engine() -> Engine:
     sync_url = _sync_url(_resolve_url())
     # Small pool — signals fire sequentially per worker process.
-    return create_engine(sync_url, pool_pre_ping=True, pool_size=2, max_overflow=3)
+    engine = create_engine(sync_url, pool_pre_ping=True, pool_size=2, max_overflow=3)
+    # A worker never runs create_app, so without this its sessions would have
+    # no tenant filter at all: the tenant restored around a task body would
+    # scope nothing (#371).
+    attach_session_listeners(WorkerSession)
+    bind_engine_policy(engine, EngineTenancy(tenant_strict=_tenant_strict))
+    return engine
 
 
 def get_sync_session_factory() -> sessionmaker[Session]:
@@ -76,7 +95,7 @@ def get_sync_session_factory() -> sessionmaker[Session]:
     global _engine, _session_factory
     if _session_factory is None:
         _engine = _build_engine()
-        _session_factory = sessionmaker(bind=_engine, expire_on_commit=False)
+        _session_factory = sessionmaker(bind=_engine, class_=WorkerSession, expire_on_commit=False)
     return _session_factory
 
 
@@ -87,12 +106,13 @@ def dispose_sync_engine() -> None:
     restarts within one process (test runners, uvicorn dev reload) don't
     accumulate engines against the old DB URL.
     """
-    global _engine, _session_factory, _url_override
+    global _engine, _session_factory, _url_override, _tenant_strict
     if _engine is not None:
         _engine.dispose()
     _engine = None
     _session_factory = None
     _url_override = None
+    _tenant_strict = False
 
 
 @contextmanager

simple_module_background_tasks-0.0.35/background_tasks/tenant_context.py

@@ -0,0 +1,104 @@
+"""Carry the enqueuing request's tenant into the Celery task that runs later.
+
+A task body runs in a worker with no request, so ``current_tenant_id`` is
+unset there — under strict isolation any tenant-scoped query would raise, and
+without it the query would read every tenant. The tenant is stamped onto the
+message headers at publish time and restored around the task body.
+
+Platform tasks that legitimately span tenants (sweeps, purges) wrap their
+work in ``simple_module_db.all_tenants()`` instead.
+"""
+
+from __future__ import annotations
+
+import logging
+from contextvars import Token
+from typing import Any
+
+from simple_module_db import TenantIsolationError, current_tenant_id, is_valid_tenant_id
+
+TENANT_HEADER = "sm_tenant_id"
+
+_log = logging.getLogger(__name__)
+_tokens: dict[str, Token[str | None]] = {}
+# Single-tenant hosts (``default_tenant``): tasks with no tenant on the message
+# — beat jobs, tasks enqueued outside a request — run as that tenant.
+_default_tenant: str | None = None
+
+
+def set_default_tenant(tenant_id: str | None) -> None:
+    global _default_tenant
+    _default_tenant = tenant_id or None
+
+
+def stamp_tenant(headers: dict[str, Any] | None) -> None:
+    """Record the current tenant on an outgoing message (publish side).
+
+    An explicit ``headers={"sm_tenant_id": ...}`` passed to ``send_task`` is
+    kept only when no tenant is bound (platform code enqueueing work for a
+    tenant) or it names the bound tenant: request code must not be able to
+    schedule work as another tenant.
+    """
+    if headers is None:
+        return
+    tenant_id = current_tenant_id.get()
+    explicit = headers.get(TENANT_HEADER)
+    if explicit:
+        if not is_valid_tenant_id(explicit):
+            raise TenantIsolationError(f"Invalid tenant id on task headers: {explicit!r}")
+        if tenant_id is not None and explicit != tenant_id:
+            raise TenantIsolationError(
+                f"Cannot enqueue a task for tenant '{explicit}' in context of tenant '{tenant_id}'"
+            )
+        return
+    if tenant_id is not None:
+        headers[TENANT_HEADER] = tenant_id
+
+
+def _tenant_of(task: Any) -> str | None:
+    request = getattr(task, "request", None)
+    if request is None:
+        return None
+    value = getattr(request, TENANT_HEADER, None)
+    if value is None and isinstance(getattr(request, "headers", None), dict):
+        value = request.headers.get(TENANT_HEADER)
+    if not value:
+        return None
+    if not is_valid_tenant_id(value):
+        # Never run a task body as a malformed tenant; it runs unscoped and,
+        # under strict mode, fails closed on its first tenant-scoped query.
+        _log.warning("Ignoring invalid tenant id on task message: %r", str(value)[:80])
+        return None
+    return str(value)
+
+
+def restore_tenant(*, task_id: str | None, task: Any) -> None:
+    """Enter the message's tenant for the task body (prerun)."""
+    if not task_id:
+        return
+    tenant_id = _tenant_of(task) or _default_tenant
+    if tenant_id is not None:
+        _tokens[task_id] = current_tenant_id.set(tenant_id)
+
+
+def release_tenant(*, task_id: str | None) -> None:
+    """Leave the tenant entered by :func:`restore_tenant` (postrun)."""
+    token = _tokens.pop(task_id, None) if task_id else None
+    if token is None:
+        return
+    try:
+        current_tenant_id.reset(token)
+    except ValueError:
+        # Token from another context (exotic pool patching): fall back to
+        # clearing, so the next task on this worker never inherits a tenant.
+        _log.debug("Tenant reset skipped for task_id=%s; clearing", task_id)
+        current_tenant_id.set(None)
+
+
+__all__ = [
+    "TENANT_HEADER",
+    "release_tenant",
+    "restore_tenant",
+    "set_default_tenant",
+    "stamp_tenant",
+]

{simple_module_background_tasks-0.0.34 → simple_module_background_tasks-0.0.35}/package.json

@@ -6,14 +6,14 @@
   "peerDependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "@inertiajs/react": "^2.0.0",
+    "@inertiajs/react": "^3.7.0",
     "@simple-module-py/ui": "*"
   },
   "devDependencies": {
     "@simple-module-py/tsconfig": "*"
   },
   "dependencies": {
-    "lucide-react": "^1.28.0",
-    "sonner": "^2.0.7"
+    "lucide-react": "^1.43.0",
+    "sonner": "^2.0.8"
   }
 }