simple-module-core 0.0.34__tar.gz → 0.0.35__tar.gz

{simple_module_core-0.0.34 → simple_module_core-0.0.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_core
-Version: 0.0.34
+Version: 0.0.35
 Summary: Module-system primitives for the simple_module framework — ModuleBase, discovery, diagnostics, events
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python

{simple_module_core-0.0.34 → simple_module_core-0.0.35}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_core"
-version = "0.0.34"
+version = "0.0.35"
 description = "Module-system primitives for the simple_module framework — ModuleBase, discovery, diagnostics, events"
 readme = "README.md"
 license = "MIT"

{simple_module_core-0.0.34 → simple_module_core-0.0.35}/simple_module_core/__init__.py

@@ -36,6 +36,11 @@ from simple_module_core.feature_flags import (
 )
 from simple_module_core.health import HealthCheck, HealthCheckResult, HealthRegistry, HealthStatus
 from simple_module_core.i18n import I18nRegistry, Translator
+from simple_module_core.invalidation import (
+    Invalidation,
+    InvalidationBus,
+    InvalidationTransport,
+)
 from simple_module_core.menu import MenuItem, MenuRegistry, MenuSection
 from simple_module_core.module import ModuleBase, ModuleMeta
 from simple_module_core.permissions import PermissionRegistry
@@ -66,6 +71,9 @@ __all__ = [
     "HealthStatus",
     "I18nRegistry",
     "InvalidModuleError",
+    "Invalidation",
+    "InvalidationBus",
+    "InvalidationTransport",
     "LabelResolver",
     "MenuItem",
     "MenuRegistry",

{simple_module_core-0.0.34 → simple_module_core-0.0.35}/simple_module_core/diagnostics/_module.py

@@ -11,6 +11,7 @@ from simple_module_core.diagnostics._css import check_module_css
 from simple_module_core.diagnostics._inertia_api import check_inertia_api_calls
 from simple_module_core.diagnostics._js_workspace import check_js_workspace_files
 from simple_module_core.diagnostics._pages import check_pages, find_render_calls
+from simple_module_core.diagnostics._tenancy import check_tenant_unique_keys, module_tables
 from simple_module_core.diagnostics._types import Diagnostic, DiagnosticLevel
 
 if TYPE_CHECKING:
@@ -29,6 +30,8 @@ class ModuleDiagnostics:
         diagnostics.extend(self._check_views_without_menu(modules))
         diagnostics.extend(self._check_auth_provider_conflict(modules))
         diagnostics.extend(check_framework_module_coupling(modules))
+        for mod in modules:
+            diagnostics.extend(check_tenant_unique_keys(module_tables(mod), mod.meta.name))
 
         # File-based checks (need to find module source directories)
         for mod in modules:
@@ -95,6 +98,7 @@ class ModuleDiagnostics:
                     "register_permissions",
                     "register_feature_flags",
                     "register_event_handlers",
+                    "register_invalidations",
                     "register_middleware",
                     "register_health_checks",
                     "register_public_routes",

{simple_module_core-0.0.34 → simple_module_core-0.0.35}/simple_module_core/diagnostics/_pages.py

@@ -89,6 +89,15 @@ def _iter_render_components(tree: ast.Module, consts: dict[str, str]) -> list[st
     return found
 
 
+#: A ``*.test.tsx``/``*.spec.tsx`` beside a page is a test, not a page —
+#: mirrors ``simple_module_hosting.page_globs.TEST_FILE_SUFFIXES``, which
+#: excludes the same files from the Vite glob. Duplicated rather than
+#: imported: ``simple_module_hosting`` depends on ``simple_module_core``,
+#: not the other way around, so importing it here would invert the package
+#: layering.
+_TEST_FILE_SUFFIXES = (".test.tsx", ".spec.tsx")
+
+
 def collect_tsx_pages(pages_dir: Path) -> set[str]:
     """Collect .tsx page identifiers relative to pages_dir, without extension.
 
@@ -96,10 +105,15 @@ def collect_tsx_pages(pages_dir: Path) -> set[str]:
     directly against inertia.render("Module/Sub/Page") keys. Subdirectories
     whose names start with a lowercase letter (``components/``, ``hooks/``,
     ...) are treated as helper folders, not Inertia page roots, matching the
-    PascalCase convention Inertia uses.
+    PascalCase convention Inertia uses. Files ending in ``.test.tsx`` or
+    ``.spec.tsx`` are colocated tests, not pages, and are excluded the same
+    way the Vite glob excludes them — otherwise a colocated test with no
+    matching ``inertia.render()`` call is flagged as an SM003 orphan page.
     """
     pages: set[str] = set()
     for f in pages_dir.rglob("*.tsx"):
+        if f.name.endswith(_TEST_FILE_SUFFIXES):
+            continue
         rel = f.relative_to(pages_dir)
         if any(part[:1].islower() for part in rel.parts[:-1]):
             continue

simple_module_core-0.0.35/simple_module_core/diagnostics/_tenancy.py

@@ -0,0 +1,108 @@
+"""SM024: a unique key on a tenant-scoped table that ignores the tenant.
+
+On a ``MultiTenantMixin`` table every business key is per tenant. A unique
+constraint without ``tenant_id`` in it means the first tenant to claim a value
+(a slug, a filename, a name) locks every other tenant out of it — and the
+resulting IntegrityError tells the second tenant the value exists elsewhere.
+
+Duck-typed on SQLAlchemy ``Table`` objects (core does not depend on
+SQLAlchemy). Only tables of models that inherit ``MultiTenantMixin`` count: a
+plain ``tenant_id`` column (``users_user``'s legacy one, the ``tenants``
+registry's own tables) carries no isolation and no per-tenant key rule.
+"""
+
+from __future__ import annotations
+
+import importlib
+import logging
+from collections.abc import Iterable, Iterator
+from typing import TYPE_CHECKING, Any
+
+from simple_module_core.diagnostics._types import Diagnostic, DiagnosticLevel
+
+if TYPE_CHECKING:
+    from simple_module_core.module import ModuleBase
+
+logger = logging.getLogger(__name__)
+
+TENANT_COLUMN = "tenant_id"
+
+
+def _unique_keys(table: Any) -> Iterator[tuple[str, set[str]]]:
+    """Yield ``(label, column names)`` for every unique key except the PK."""
+    for col in table.columns:
+        if col.unique and not col.primary_key:
+            yield f"column '{col.name}'", {col.name}
+    for constraint in table.constraints:
+        if type(constraint).__name__ == "UniqueConstraint":
+            cols = {c.name for c in constraint.columns}
+            yield f"unique constraint {sorted(cols)}", cols
+    for index in table.indexes:
+        if index.unique:
+            cols = {c.name for c in index.columns}
+            label = f"unique index '{index.name}'"
+            # Expression indexes (lower(email)) expose no plain columns; treat
+            # them as not containing the tenant — they are just as global.
+            yield label, cols
+
+
+def check_tenant_unique_keys(tables: Iterable[Any], module_name: str) -> list[Diagnostic]:
+    diags: list[Diagnostic] = []
+    for table in tables:
+        if TENANT_COLUMN not in table.columns:
+            continue
+        reported: set[frozenset[str]] = set()
+        for label, cols in _unique_keys(table):
+            # ``unique=True`` surfaces both as a column flag and as a
+            # UniqueConstraint; report each key once. Expression indexes have
+            # no plain columns and are always reported.
+            key = frozenset(cols)
+            if TENANT_COLUMN in cols or (cols and key in reported):
+                continue
+            reported.add(key)
+            diags.append(
+                Diagnostic(
+                    level=DiagnosticLevel.WARNING,
+                    code="SM024",
+                    message=(
+                        f"Tenant-scoped table '{table.name}' has a {label} that does "
+                        f"not include '{TENANT_COLUMN}' — two tenants cannot both own a value"
+                    ),
+                    module_name=module_name,
+                    suggestion=(
+                        "Make the key per tenant: add tenant_id to the constraint, "
+                        "e.g. Index(..., 'tenant_id', 'slug', unique=True)"
+                    ),
+                )
+            )
+    return diags
+
+
+def _is_tenant_scoped(cls: type) -> bool:
+    return any(base.__name__ == "MultiTenantMixin" for base in cls.__mro__[1:])
+
+
+def module_tables(mod: ModuleBase) -> list[Any]:
+    """Tables of the ``MultiTenantMixin`` models in the module's ``models``."""
+    pkg = type(mod).__module__.rsplit(".", 1)[0]
+    try:
+        models = importlib.import_module(f"{pkg}.models")
+    except ModuleNotFoundError:
+        return []
+    except Exception:  # pragma: no cover - a broken models module fails elsewhere, loudly
+        logger.debug("Could not import %s.models for SM024", pkg, exc_info=True)
+        return []
+    seen: dict[str, Any] = {}
+    for value in vars(models).values():
+        table = getattr(value, "__table__", None)
+        if (
+            isinstance(value, type)
+            and table is not None
+            and hasattr(table, "columns")
+            and _is_tenant_scoped(value)
+        ):
+            seen.setdefault(table.name, table)
+    return list(seen.values())
+
+
+__all__ = ["check_tenant_unique_keys", "module_tables"]

simple_module_core-0.0.35/simple_module_core/invalidation.py

@@ -0,0 +1,280 @@
+"""Cache-invalidation fan-out: in-process by default, cross-process when a
+transport is installed.
+
+Several modules keep a per-process cache of a row that is cheap to read and
+expensive to read *often* — ``users`` caches ``User.session_version`` (the
+revocation counter checked on nearly every authenticated request) and
+``file_storage`` caches its aggregate size, both behind a 30-second TTL. They
+share one failure shape: the worker that performed the write drops its own entry
+immediately, and **every other worker keeps serving the stale value until its own
+entry expires**.
+
+``settings`` has the same shape without the TTL — ``apply_changes_and_reload``
+hot-swaps the settings object in the worker that handled the save and announces it
+on the in-process :class:`~simple_module_core.events.EventBus`, so the others serve
+the old configuration until restart. It needs a re-read rather than an eviction, so
+it is a consumer this bus makes *possible* rather than one it already serves.
+
+The obvious fix — publish the write on Redis pub/sub so every worker drops its
+entry at once — was not reachable from any of those modules. Redis belongs to
+the ``background_tasks`` plugin, so ``users`` would have to open a second
+connection with its own settings that can disagree with it; :class:`EventBus`
+is deliberately in-process; and ``SM009`` makes a ``framework`` → plugin import
+an error, so the framework cannot borrow the plugin's client either (GH #318).
+
+This module is the missing middle. The framework owns the *bus* — the channel
+registry, the wire format and the origin filtering — and knows nothing about
+how a message reaches another process. Whoever owns a shared backend installs
+an :class:`InvalidationTransport` on it; ``background_tasks`` does exactly that
+with the Redis connection it already configures. With no transport installed
+the bus is honest in-process pub/sub, which is precisely today's behaviour: the
+publishing worker sees the invalidation, the others wait out their TTL.
+
+What this is *not*: a message queue. There is no persistence, no retry, no
+delivery guarantee. A dropped message costs staleness for the rest of a cache's
+TTL, never correctness of the cache's contents — so every consumer must keep a
+TTL as its floor and treat the bus as an accelerator. Anything that needs
+delivery guarantees wants a Celery task, not this.
+"""
+
+from __future__ import annotations
+
+import inspect
+import json
+import logging
+import uuid
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from typing import Protocol, runtime_checkable
+
+logger = logging.getLogger(__name__)
+
+__all__ = [
+    "WIRE_VERSION",
+    "Invalidation",
+    "InvalidationBus",
+    "InvalidationHandler",
+    "InvalidationTransport",
+]
+
+WIRE_VERSION = 1
+"""Bumped when :meth:`Invalidation.to_wire` changes shape.
+
+A message carrying any other version is dropped rather than guessed at, so a
+rolling deploy in which half the workers run new code degrades to "no
+cross-process invalidation between the two halves" instead of to a decode
+exception in the listener loop.
+"""
+
+type InvalidationHandler = Callable[["Invalidation"], Awaitable[None] | None]
+"""Sync or async. The caches this exists for are plain dicts, so demanding
+``async def`` for a one-line ``pop`` would be ceremony."""
+
+
+@dataclass(frozen=True, slots=True)
+class Invalidation:
+    """One "this cached thing changed" notice.
+
+    Deliberately not a :class:`~simple_module_core.events.Event`: a domain event
+    describes something that happened in the business ("an order was placed")
+    and its handlers may do anything, while this describes something that
+    stopped being true in a *cache* and its handlers may only forget. Sharing
+    the type would invite a handler that writes to the database on a message
+    that carries no delivery guarantee.
+    """
+
+    #: Who cares. Convention is ``<module>.<cache>`` — ``users.session_version``.
+    channel: str
+    #: Which entry, or ``None`` for "the whole channel". A string because it has
+    #: to survive JSON; a consumer keyed by something else converts on the way
+    #: back in (see ``users.session_revocation``).
+    key: str | None = None
+    #: The publishing process's :attr:`InvalidationBus.origin`. Lets a bus
+    #: ignore its own broadcast coming back off the transport, which it has
+    #: already applied locally.
+    origin: str = ""
+
+    def to_wire(self) -> str:
+        """JSON, because a transport is free to be anything that moves text."""
+        return json.dumps(
+            {"v": WIRE_VERSION, "channel": self.channel, "key": self.key, "origin": self.origin}
+        )
+
+    @classmethod
+    def from_wire(cls, message: str | bytes) -> Invalidation | None:
+        """Parse a wire message, or ``None`` when it isn't one of ours.
+
+        Returns rather than raises on anything unexpected. A Redis database is
+        routinely shared — with another app, with a stray ``redis-cli publish``,
+        with the previous version of this code — and a listener loop that dies
+        on one malformed payload takes cross-process invalidation down for the
+        life of the process. Logged at debug: on a shared database this is
+        normal traffic, not a fault.
+        """
+        try:
+            data = json.loads(message)
+            if not isinstance(data, dict) or data.get("v") != WIRE_VERSION:
+                logger.debug("Ignoring invalidation message with unknown shape: %r", message)
+                return None
+            channel = data["channel"]
+            key = data.get("key")
+            if not isinstance(channel, str) or not isinstance(key, str | None):
+                logger.debug("Ignoring invalidation message with bad field types: %r", message)
+                return None
+            return cls(channel=channel, key=key, origin=str(data.get("origin") or ""))
+        except Exception:
+            logger.debug("Ignoring undecodable invalidation message: %r", message)
+            return None
+
+
+@runtime_checkable
+class InvalidationTransport(Protocol):
+    """Moves an encoded :class:`Invalidation` to the other processes.
+
+    One method, because the inbound direction is the transport's own business:
+    it decides how it listens (a pub/sub subscription, a poll, a test double
+    calling straight through) and hands whatever it receives to
+    :meth:`InvalidationBus.deliver`, which owns decoding and the origin filter.
+    """
+
+    async def publish(self, message: str) -> None:
+        """Broadcast *message* to every other process. May raise."""
+        ...
+
+
+class InvalidationBus:
+    """Channel registry plus fan-out. One per process, on ``app.state.sm``.
+
+    Subscribers register in ``ModuleBase.register_invalidations``; a transport is
+    installed later, in whichever module owns the shared backend, during its
+    ``on_startup``. The two are independent on purpose — subscriptions are what
+    make the bus useful in a single process, and the transport only widens their
+    reach.
+    """
+
+    def __init__(self, origin: str | None = None) -> None:
+        #: Identifies this process for the lifetime of the process. Random
+        #: rather than the pid: pids repeat across containers, and two workers
+        #: that believe they share an origin would each ignore the other's
+        #: broadcasts — the exact bug this class exists to fix, but silent.
+        self.origin = origin or uuid.uuid4().hex
+        self._handlers: dict[str, list[InvalidationHandler]] = {}
+        self._transport: InvalidationTransport | None = None
+
+    # ── subscription ───────────────────────────────────────
+
+    def subscribe(self, channel: str, handler: InvalidationHandler) -> None:
+        """Run *handler* for every invalidation on *channel*, local or remote."""
+        self._handlers.setdefault(channel, []).append(handler)
+        logger.debug(
+            "Subscribed %s to invalidation channel %r",
+            getattr(handler, "__qualname__", repr(handler)),
+            channel,
+        )
+
+    @property
+    def channels(self) -> tuple[str, ...]:
+        """Channels with at least one subscriber, for diagnostics and tests."""
+        return tuple(sorted(self._handlers))
+
+    # ── transport ──────────────────────────────────────────
+
+    def set_transport(self, transport: InvalidationTransport) -> None:
+        """Install the shared backend.
+
+        Replacing one is almost certainly a mistake, so it says so. The bus can
+        only forget the old transport's reference — it cannot stop the listener
+        that transport is running, and two live listeners on one channel deliver
+        every remote message to this bus twice. Whoever owns the transport has to
+        ``stop()`` the old one; ``background_tasks`` does that in ``on_shutdown``.
+        """
+        if self._transport is not None:
+            logger.warning(
+                "Replacing invalidation transport %s with %s — the old one's listener "
+                "is not stopped by this call and will keep delivering, so every remote "
+                "message will be applied twice",
+                type(self._transport).__name__,
+                type(transport).__name__,
+            )
+        self._transport = transport
+        logger.info("Invalidation transport installed: %s", type(transport).__name__)
+
+    def clear_transport(self) -> None:
+        """Drop back to in-process only — the owning module's ``on_shutdown``."""
+        self._transport = None
+
+    @property
+    def has_transport(self) -> bool:
+        """Whether invalidations currently reach other processes."""
+        return self._transport is not None
+
+    # ── publishing ─────────────────────────────────────────
+
+    async def publish(self, channel: str, key: str | None = None) -> None:
+        """Apply locally, then broadcast.
+
+        Local first, and a transport failure never propagates: the caller is
+        typically finishing a write it has already committed — a password change
+        that bumped ``session_version`` — and turning "Redis is unreachable"
+        into a 500 on that request would trade a bounded staleness window for an
+        outright failure. Logged at error, because the operator needs to know
+        the fan-out is silently degraded to per-process.
+        """
+        invalidation = Invalidation(channel=channel, key=key, origin=self.origin)
+        await self._dispatch(invalidation)
+        transport = self._transport
+        if transport is None:
+            return
+        try:
+            await transport.publish(invalidation.to_wire())
+        except Exception:
+            logger.exception(
+                "Invalidation broadcast failed for channel %r; other workers keep "
+                "their cached value until it expires",
+                channel,
+            )
+
+    async def deliver(self, message: str | bytes) -> None:
+        """Apply a message that arrived from another process.
+
+        Called by the transport. Messages this process published are dropped —
+        :meth:`publish` already ran the handlers, and running them twice would
+        be harmless for a ``pop`` but is not a property a handler should have to
+        have.
+        """
+        invalidation = Invalidation.from_wire(message)
+        if invalidation is None:
+            return
+        if invalidation.origin and invalidation.origin == self.origin:
+            return
+        await self._dispatch(invalidation)
+
+    async def _dispatch(self, invalidation: Invalidation) -> None:
+        """Run every handler on the channel, isolating failures.
+
+        Sequential rather than ``gather``: handlers are microsecond-scale cache
+        evictions, and a channel with enough of them for concurrency to matter
+        would be a design smell. A failing handler must not stop the others —
+        one module's broken eviction is not a reason for another's cache to stay
+        stale.
+        """
+        # A snapshot, not the live list. A handler is free to call
+        # :meth:`subscribe` — nothing forbids it, and a module that lazily
+        # registers a cache would — and appending to the list being iterated
+        # would feed the new handler straight back into this loop. Because these
+        # handlers are typically *sync*, that loop contains no await point, so it
+        # does not merely recurse: it wedges the whole event loop, with
+        # ``asyncio.timeout`` unable to fire and the ``except`` below logging
+        # nothing. Measured at 3.1 million invocations from a single ``publish``
+        # before the copy was added.
+        for handler in tuple(self._handlers.get(invalidation.channel, ())):
+            try:
+                result = handler(invalidation)
+                if inspect.isawaitable(result):
+                    await result
+            except Exception:
+                logger.exception(
+                    "Invalidation handler %s failed for channel %r",
+                    getattr(handler, "__qualname__", repr(handler)),
+                    invalidation.channel,
+                )

{simple_module_core-0.0.34 → simple_module_core-0.0.35}/simple_module_core/module.py

@@ -17,6 +17,7 @@ if TYPE_CHECKING:
     from simple_module_core.events import EventBus
     from simple_module_core.feature_flags import FeatureFlagRegistry
     from simple_module_core.health import HealthRegistry
+    from simple_module_core.invalidation import InvalidationBus
     from simple_module_core.menu import MenuRegistry
     from simple_module_core.permissions import PermissionRegistry
     from simple_module_core.public_routes import PublicRouteRegistry
@@ -48,6 +49,7 @@ class ModuleBase(ABC):
           - register_permissions(registry)
           - register_feature_flags(registry)
           - register_event_handlers(bus)
+          - register_invalidations(bus, app)
           - register_health_checks(registry)
 
         Phase 5: Database
@@ -116,6 +118,22 @@ class ModuleBase(ABC):
         framework's engine instead of building their own.
         """
 
+    def register_invalidations(self, bus: InvalidationBus, app: FastAPI) -> None:
+        """Subscribe this module's per-process caches to their channels.
+
+        Handlers may only *forget* — drop a cache entry, clear a dict. The bus
+        carries no delivery guarantee, so a handler that wrote to the database
+        would do it an unknowable number of times::
+
+            def register_invalidations(self, bus, app):
+                bus.subscribe("orders.totals", lambda inv: _TOTALS.pop(inv.key, None))
+
+        Publishing needs no hook — reach the same bus at
+        ``request.app.state.sm.invalidation`` from a ``db.on_commit`` callback.
+        Cross-process delivery depends on a transport being installed, so every
+        cache keeps its TTL as a floor. See ``docs/framework/invalidation.md``.
+        """
+
     def register_health_checks(self, registry: HealthRegistry) -> None:
         """Contribute health checks for the ``/health/ready`` endpoint."""
 

{simple_module_core-0.0.34 → simple_module_core-0.0.35}/simple_module_core/services.py

@@ -16,12 +16,14 @@ from dataclasses import dataclass, field
 from datetime import UTC, datetime
 from typing import TYPE_CHECKING
 
+from simple_module_core.invalidation import InvalidationBus
+
 if TYPE_CHECKING:
     from collections.abc import Callable
 
-    from inertia import InertiaConfig
     from simple_module_db.session import DatabaseState
     from simple_module_hosting.settings import Settings
+    from simple_module_inertia import InertiaConfig
 
     from simple_module_core.audit_links import AuditLinkRegistry
     from simple_module_core.design_packs import DesignPackRegistry
@@ -90,6 +92,11 @@ class Services:
     i18n_registry: I18nRegistry
     inertia_config: InertiaConfig
     modules: tuple[ModuleBase, ...]
+    #: Cross-process cache invalidation. Defaulted for the same reason as
+    #: ``diagnostics``: an app assembled outside ``create_app`` (tests, a
+    #: single-module harness) gets a working in-process bus with no
+    #: subscribers rather than a ``TypeError`` at construction.
+    invalidation: InvalidationBus = field(default_factory=InvalidationBus)
     #: Defaulted so an app built outside ``create_app`` still has a holder to
     #: read; that one simply reports the checks as unsupported.
     diagnostics: DiagnosticsState = field(default_factory=DiagnosticsState)

simple_module_core-0.0.35/tests/test_diagnostics_tenancy.py

@@ -0,0 +1,115 @@
+"""SM024 — unique keys on tenant-scoped tables must include tenant_id."""
+
+from __future__ import annotations
+
+from simple_module_core.diagnostics._tenancy import check_tenant_unique_keys
+from sqlalchemy import Column, Index, Integer, MetaData, String, Table, UniqueConstraint, func
+
+
+def _codes(table: Table) -> list[str]:
+    return [d.code for d in check_tenant_unique_keys([table], "demo")]
+
+
+def test_global_unique_column_on_tenant_table_warns():
+    t = Table(
+        "demo_a",
+        MetaData(),
+        Column("id", Integer, primary_key=True),
+        Column("tenant_id", String(50)),
+        Column("slug", String(50), unique=True),
+    )
+    assert _codes(t) == ["SM024"]
+
+
+def test_per_tenant_unique_index_is_fine():
+    t = Table(
+        "demo_b",
+        MetaData(),
+        Column("id", Integer, primary_key=True),
+        Column("tenant_id", String(50)),
+        Column("slug", String(50)),
+        Index("ix_demo_b_tenant_slug", "tenant_id", "slug", unique=True),
+        UniqueConstraint("tenant_id", "id"),
+    )
+    assert _codes(t) == []
+
+
+def test_unique_index_without_tenant_warns():
+    t = Table(
+        "demo_c",
+        MetaData(),
+        Column("id", Integer, primary_key=True),
+        Column("tenant_id", String(50)),
+        Column("locale", String(8)),
+        Column("slug", String(50)),
+        Index("ix_demo_c_locale_slug", "locale", "slug", unique=True),
+    )
+    diags = check_tenant_unique_keys([t], "demo")
+    assert [d.code for d in diags] == ["SM024"]
+    assert "ix_demo_c_locale_slug" in diags[0].message
+
+
+def test_expression_index_counts_as_global():
+    t = Table(
+        "demo_d",
+        MetaData(),
+        Column("id", Integer, primary_key=True),
+        Column("tenant_id", String(50)),
+        Column("email", String(50)),
+    )
+    Index("ix_demo_d_email_lower", func.lower(t.c.email), unique=True)
+    assert _codes(t) == ["SM024"]
+
+
+def test_non_tenant_table_is_ignored():
+    t = Table(
+        "demo_e",
+        MetaData(),
+        Column("id", Integer, primary_key=True),
+        Column("slug", String(50), unique=True),
+    )
+    assert _codes(t) == []
+
+
+def test_module_tables_only_counts_mixin_models(monkeypatch):
+    import sys
+    import types
+
+    from simple_module_core.diagnostics._tenancy import module_tables
+
+    class MultiTenantMixin:  # stands in for simple_module_db's, matched by name
+        pass
+
+    md = MetaData()
+    scoped = type(
+        "Scoped",
+        (MultiTenantMixin,),
+        {
+            "__table__": Table(
+                "demo_scoped",
+                md,
+                Column("id", Integer, primary_key=True),
+                Column("tenant_id", String(5)),
+            )
+        },
+    )
+    plain = type(
+        "Plain",
+        (),
+        {
+            "__table__": Table(
+                "demo_plain",
+                md,
+                Column("id", Integer, primary_key=True),
+                Column("tenant_id", String(5)),
+            )
+        },
+    )
+    pkg = types.ModuleType("sm024pkg")
+    models = types.ModuleType("sm024pkg.models")
+    models.Scoped, models.Plain = scoped, plain
+    monkeypatch.setitem(sys.modules, "sm024pkg", pkg)
+    monkeypatch.setitem(sys.modules, "sm024pkg.models", models)
+
+    mod_cls = type("DemoModule", (), {"__module__": "sm024pkg.module"})
+    assert [t.name for t in module_tables(mod_cls())] == ["demo_scoped"]

simple_module_core-0.0.35/tests/test_invalidation.py

@@ -0,0 +1,261 @@
+"""The invalidation bus: local fan-out, the wire, and the origin filter.
+
+The properties worth pinning down are the ones a consumer's correctness rests
+on. A revocation that reaches the publishing worker but silently skips the
+others is the bug GH #318 is about, and a listener that dies on one malformed
+payload reintroduces it for the life of the process.
+"""
+
+from __future__ import annotations
+
+import pytest
+from simple_module_core.invalidation import WIRE_VERSION, Invalidation, InvalidationBus
+
+
+class _RecordingTransport:
+    """Captures what would have gone on the wire."""
+
+    def __init__(self) -> None:
+        self.sent: list[str] = []
+
+    async def publish(self, message: str) -> None:
+        self.sent.append(message)
+
+
+class _BrokenTransport:
+    async def publish(self, message: str) -> None:
+        raise ConnectionError("redis is down")
+
+
+class TestLocalFanOut:
+    async def test_publish_runs_subscribers_on_the_channel(self):
+        bus = InvalidationBus()
+        seen: list[Invalidation] = []
+        bus.subscribe("users.session_version", seen.append)
+
+        await bus.publish("users.session_version", key="abc")
+
+        assert [(i.channel, i.key) for i in seen] == [("users.session_version", "abc")]
+
+    async def test_other_channels_are_untouched(self):
+        bus = InvalidationBus()
+        calls: list[str] = []
+        bus.subscribe("a", lambda inv: calls.append("a"))
+        bus.subscribe("b", lambda inv: calls.append("b"))
+
+        await bus.publish("a")
+
+        assert calls == ["a"]
+
+    async def test_async_and_sync_handlers_both_run(self):
+        bus = InvalidationBus()
+        calls: list[str] = []
+
+        async def async_handler(inv):
+            calls.append("async")
+
+        bus.subscribe("c", async_handler)
+        bus.subscribe("c", lambda inv: calls.append("sync"))
+
+        await bus.publish("c")
+
+        assert sorted(calls) == ["async", "sync"]
+
+    async def test_one_failing_handler_does_not_starve_the_others(self):
+        """One module's broken eviction must not leave another's cache stale."""
+        bus = InvalidationBus()
+        calls: list[str] = []
+
+        def boom(inv):
+            raise RuntimeError("bad handler")
+
+        bus.subscribe("c", boom)
+        bus.subscribe("c", lambda inv: calls.append("ran"))
+
+        await bus.publish("c")
+
+        assert calls == ["ran"]
+
+    async def test_publish_with_no_subscribers_is_a_no_op(self):
+        await InvalidationBus().publish("nobody.listening")
+
+    def test_channels_reports_what_has_subscribers(self):
+        bus = InvalidationBus()
+        bus.subscribe("z", lambda inv: None)
+        bus.subscribe("a", lambda inv: None)
+        assert bus.channels == ("a", "z")
+
+
+class TestTransport:
+    async def test_publish_forwards_the_encoded_invalidation(self):
+        bus = InvalidationBus()
+        transport = _RecordingTransport()
+        bus.set_transport(transport)
+
+        await bus.publish("users.session_version", key="u1")
+
+        assert len(transport.sent) == 1
+        decoded = Invalidation.from_wire(transport.sent[0])
+        assert decoded is not None
+        assert (decoded.channel, decoded.key, decoded.origin) == (
+            "users.session_version",
+            "u1",
+            bus.origin,
+        )
+
+    async def test_no_transport_means_local_only(self):
+        bus = InvalidationBus()
+        assert bus.has_transport is False
+        seen: list[Invalidation] = []
+        bus.subscribe("c", seen.append)
+        await bus.publish("c")
+        assert len(seen) == 1
+
+    async def test_a_broken_transport_still_applies_locally(self):
+        """The caller has already committed the write; a dead Redis is not a 500."""
+        bus = InvalidationBus()
+        bus.set_transport(_BrokenTransport())
+        seen: list[Invalidation] = []
+        bus.subscribe("c", seen.append)
+
+        await bus.publish("c", key="k")
+
+        assert len(seen) == 1
+
+    async def test_clear_transport_drops_back_to_in_process(self):
+        bus = InvalidationBus()
+        transport = _RecordingTransport()
+        bus.set_transport(transport)
+        bus.clear_transport()
+
+        await bus.publish("c")
+
+        assert transport.sent == []
+        assert bus.has_transport is False
+
+
+class TestDeliver:
+    async def test_a_remote_message_runs_the_handlers(self):
+        publisher = InvalidationBus()
+        subscriber = InvalidationBus()
+        seen: list[Invalidation] = []
+        subscriber.subscribe("users.session_version", seen.append)
+
+        transport = _RecordingTransport()
+        publisher.set_transport(transport)
+        await publisher.publish("users.session_version", key="u9")
+        await subscriber.deliver(transport.sent[0])
+
+        assert [i.key for i in seen] == ["u9"]
+
+    async def test_a_bus_ignores_its_own_broadcast_coming_back(self):
+        """Publish already ran the handlers; the echo must not run them twice."""
+        bus = InvalidationBus()
+        transport = _RecordingTransport()
+        bus.set_transport(transport)
+        seen: list[Invalidation] = []
+        bus.subscribe("c", seen.append)
+
+        await bus.publish("c", key="k")
+        await bus.deliver(transport.sent[0])
+
+        assert len(seen) == 1
+
+    async def test_bytes_are_accepted(self):
+        """redis-py yields bytes unless the client decodes responses."""
+        bus = InvalidationBus()
+        seen: list[Invalidation] = []
+        bus.subscribe("c", seen.append)
+
+        await bus.deliver(Invalidation(channel="c", key="k", origin="elsewhere").to_wire().encode())
+
+        assert [i.key for i in seen] == ["k"]
+
+    @pytest.mark.parametrize(
+        "message",
+        [
+            b"not json at all",
+            b"[]",
+            b'{"v": 999, "channel": "c", "key": "k"}',
+            b'{"channel": "c"}',
+            b'{"v": 1, "channel": 7, "key": "k"}',
+            b'{"v": 1, "channel": "c", "key": 7}',
+        ],
+    )
+    async def test_junk_is_dropped_rather_than_raised(self, message):
+        """A shared Redis server carries other people's traffic."""
+        bus = InvalidationBus()
+        seen: list[Invalidation] = []
+        bus.subscribe("c", seen.append)
+
+        await bus.deliver(message)
+
+        assert seen == []
+
+    async def test_a_key_less_message_survives_the_round_trip(self):
+        """``key=None`` means "forget the whole channel" and must stay None."""
+        bus = InvalidationBus()
+        seen: list[Invalidation] = []
+        bus.subscribe("c", seen.append)
+
+        await bus.deliver(Invalidation(channel="c", origin="elsewhere").to_wire())
+
+        assert [i.key for i in seen] == [None]
+
+
+class TestRelaying:
+    """A worker relays what it publishes even when it caches nothing itself."""
+
+    async def test_a_channel_with_no_local_subscribers_still_broadcasts(self):
+        """Otherwise a heterogeneous fleet loses messages by luck of routing.
+
+        The worker that serves a revocation need not be one that caches the
+        counter — a module can publish for caches that only *other* modules keep.
+        If the transport were skipped when nothing local listens, whether the
+        other workers heard would depend on which worker got the request.
+        """
+        bus = InvalidationBus()
+        transport = _RecordingTransport()
+        bus.set_transport(transport)
+
+        await bus.publish("nobody.local", key="k")
+
+        assert len(transport.sent) == 1
+
+
+class TestUnknownChannels:
+    async def test_a_remote_message_for_an_unsubscribed_channel_is_a_no_op(self):
+        """A shared transport carries every channel; most are not ours."""
+        bus = InvalidationBus()
+        seen: list[Invalidation] = []
+        bus.subscribe("mine", seen.append)
+
+        await bus.deliver(Invalidation(channel="theirs", key="k", origin="other").to_wire())
+
+        assert seen == []
+
+    async def test_non_utf8_bytes_are_dropped_rather_than_raised(self):
+        """``json.loads`` raises ``UnicodeDecodeError`` on these, not ValueError.
+
+        A listener that died on one such frame would take cross-process
+        invalidation down for the life of the process, and a shared Redis
+        database is exactly where arbitrary bytes come from.
+        """
+        bus = InvalidationBus()
+        seen: list[Invalidation] = []
+        bus.subscribe("c", seen.append)
+
+        await bus.deliver(b"\xff\xfe\x00not json")
+
+        assert seen == []
+
+
+class TestOrigin:
+    def test_two_buses_do_not_share_an_origin(self):
+        """A shared origin would make each ignore the other — silently."""
+        assert InvalidationBus().origin != InvalidationBus().origin
+
+    def test_wire_carries_the_current_version(self):
+        import json
+
+        assert json.loads(Invalidation(channel="c").to_wire())["v"] == WIRE_VERSION

simple_module_core-0.0.35/tests/test_invalidation_handlers.py

@@ -0,0 +1,62 @@
+"""Handler-registration hazards, split from ``test_invalidation.py``.
+
+That file asks whether the bus delivers the right message to the right handler;
+this one asks what happens when the set of handlers changes while the bus is
+walking it. Different question, and together they crossed the 300-line cap.
+"""
+
+from __future__ import annotations
+
+import asyncio
+
+from simple_module_core.invalidation import InvalidationBus
+
+
+class TestReentrantSubscribe:
+    """A handler that subscribes during dispatch must not wedge the event loop.
+
+    ``_dispatch`` used to iterate the live handler list, so a handler that
+    re-armed itself appended to the list being walked. With sync handlers that
+    loop has no await point, so it did not merely recurse — it took the event
+    loop with it, and neither ``asyncio.timeout`` nor the per-handler ``except``
+    could intervene. Found by exploratory QA at 3.1 million invocations from one
+    ``publish``; the fix is to iterate a snapshot.
+    """
+
+    async def test_a_self_rearming_handler_terminates(self):
+        bus = InvalidationBus()
+        calls: list[int] = []
+
+        def rearm(inv):
+            calls.append(1)
+            bus.subscribe("orders.totals", rearm)
+
+        bus.subscribe("orders.totals", rearm)
+
+        # A real timeout, because the failure mode is a hang rather than a wrong
+        # answer. It can only fire if the loop yields, which is exactly what the
+        # bug prevented — so on a regression this test times out and fails.
+        async with asyncio.timeout(10):
+            await bus.publish("orders.totals", key="k")
+
+        assert calls == [1], "the handler ran more than once within a single publish"
+
+    async def test_a_handler_added_during_dispatch_waits_for_the_next_publish(self):
+        """The snapshot's other consequence, stated so it is not a surprise."""
+        bus = InvalidationBus()
+        calls: list[str] = []
+
+        def adder(inv):
+            calls.append("adder")
+            bus.subscribe("c", lambda i: calls.append("added"))
+
+        bus.subscribe("c", adder)
+
+        async with asyncio.timeout(10):
+            await bus.publish("c")
+        assert calls == ["adder"]
+
+        calls.clear()
+        async with asyncio.timeout(10):
+            await bus.publish("c")
+        assert "added" in calls

{simple_module_core-0.0.34 → simple_module_core-0.0.35}/tests/test_sm003_page_render.py

@@ -108,6 +108,24 @@ class TestSm003PageRenderResolution:
         mod = _FakeModule(meta=_FakeMeta(name="M"))
         assert "admin/Browse" in find_render_calls(mod, src_dir)  # pyright: ignore[reportArgumentType]
 
+    async def test_colocated_test_file_is_not_flagged_as_orphan_page(self, tmp_path: Path):
+        """A ``*.test.tsx``/``*.spec.tsx`` beside a page is a test, not a page.
+
+        Regression test: ``collect_tsx_pages`` globbed ``pages/**/*.tsx``
+        with no exclusion, so a colocated ``Browse.test.tsx`` (the same
+        pattern Vite's import.meta.glob now excludes) was reported as an
+        SM003 orphan page since nothing renders "M/Browse.test".
+        """
+        src_dir = tmp_path / "m" / "m"
+        (src_dir / "pages").mkdir(parents=True)
+        (src_dir / "pages" / "Browse.tsx").write_text("export default function B() {}")
+        (src_dir / "pages" / "Browse.test.tsx").write_text("test('renders', () => {})")
+        (src_dir / "pages" / "Browse.spec.tsx").write_text("test('renders', () => {})")
+        (src_dir / "endpoints.py").write_text(
+            'async def view(inertia):\n    return await inertia.render("M/Browse", {})\n'
+        )
+        assert self._diags(src_dir, "M") == []
+
     async def test_fstring_with_unknown_name_stays_flagged(self, tmp_path: Path):
         """An f-string over a runtime value is not static — don't guess."""
         src_dir = tmp_path / "m" / "m"