simple-module-db 0.0.34__tar.gz → 0.0.35__tar.gz

{simple_module_db-0.0.34 → simple_module_db-0.0.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_db
-Version: 0.0.34
+Version: 0.0.35
 Summary: Per-module SQLModel Base, async session, standard mixins (Audit, SoftDelete, MultiTenant, Versioned) for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -25,7 +25,7 @@ Requires-Dist: aiosqlite>=0.20
 Requires-Dist: alembic>=1.14
 Requires-Dist: asyncpg>=0.30
 Requires-Dist: psycopg2-binary>=2.9
-Requires-Dist: simple-module-core==0.0.34
+Requires-Dist: simple-module-core==0.0.35
 Requires-Dist: sqlalchemy[asyncio]>=2.0
 Requires-Dist: sqlmodel>=0.0.22
 Description-Content-Type: text/markdown

{simple_module_db-0.0.34 → simple_module_db-0.0.35}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_db"
-version = "0.0.34"
+version = "0.0.35"
 description = "Per-module SQLModel Base, async session, standard mixins (Audit, SoftDelete, MultiTenant, Versioned) for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -28,7 +28,7 @@ dependencies = [
     # The async app code goes through asyncpg; migration env.py rewrites the
     # URL to +psycopg2 because Alembic's online migrations are sync-only.
     "psycopg2-binary>=2.9",
-    "simple_module_core==0.0.34",
+    "simple_module_core==0.0.35",
     "sqlalchemy[asyncio]>=2.0",
     "sqlmodel>=0.0.22",
 ]

{simple_module_db-0.0.34 → simple_module_db-0.0.35}/simple_module_db/__init__.py

@@ -4,7 +4,6 @@ from simple_module_db.audit import AuditRecord
 from simple_module_db.base import create_module_base
 from simple_module_db.callbacks import OnCommitCallback
 from simple_module_db.deps import get_db
-from simple_module_db.listeners import TenantIsolationError, current_tenant_id
 from simple_module_db.migrations import (
     build_module_metadata,
     make_include_object,
@@ -15,31 +14,52 @@ from simple_module_db.mixins import AuditMixin, MultiTenantMixin, SoftDeleteMixi
 from simple_module_db.provider import DatabaseProvider, detect_provider
 from simple_module_db.search import LIKE_ESCAPE_CHAR, like_contains_pattern, like_prefix_pattern
 from simple_module_db.session import DatabaseState, RequestSession, init_db
+from simple_module_db.tenancy import (
+    ALL_TENANTS_OPTION,
+    TENANT_ID_PATTERN,
+    MissingTenantError,
+    TenantIsolationError,
+    all_tenants,
+    bind_current_tenant,
+    current_tenant_id,
+    is_valid_tenant_id,
+    tenant_context,
+)
 from simple_module_db.transaction import CommitBeforeResponseMiddleware, finalize_session
+from simple_module_db.writes import hard_delete, mark_written
 
 __all__ = [
+    "ALL_TENANTS_OPTION",
     "LIKE_ESCAPE_CHAR",
+    "TENANT_ID_PATTERN",
     "AuditMixin",
     "AuditRecord",
     "CommitBeforeResponseMiddleware",
     "DatabaseProvider",
     "DatabaseState",
+    "MissingTenantError",
     "MultiTenantMixin",
     "OnCommitCallback",
     "RequestSession",
     "SoftDeleteMixin",
     "TenantIsolationError",
     "VersionedMixin",
+    "all_tenants",
+    "bind_current_tenant",
     "build_module_metadata",
     "create_module_base",
     "current_tenant_id",
     "detect_provider",
     "finalize_session",
     "get_db",
+    "hard_delete",
     "init_db",
+    "is_valid_tenant_id",
     "like_contains_pattern",
     "like_prefix_pattern",
     "make_include_object",
     "make_process_revision_directives",
+    "mark_written",
     "render_item",
+    "tenant_context",
 ]

simple_module_db-0.0.35/simple_module_db/flush_guard.py

@@ -0,0 +1,73 @@
+"""Unit-of-work tenant rules, applied in ``before_flush``.
+
+The query filter scopes what a statement *reads*; this guards what a flush
+*writes*. It covers the paths that never reach ``do_orm_execute``: objects
+added with ``session.add``, and objects that came out of the identity map —
+``session.get`` answers from it without SQL, so a session reused across a
+``tenant_context`` switch can hand back, and then write, another tenant's row.
+"""
+
+from __future__ import annotations
+
+from sqlalchemy import inspect as sa_inspect
+from sqlalchemy.orm import Session
+
+from simple_module_db.mixins import MultiTenantMixin
+from simple_module_db.query_filter import is_strict
+from simple_module_db.tenancy import (
+    TenantIsolationError,
+    current_tenant_id,
+    is_all_tenants,
+    missing_tenant_error,
+)
+
+
+def _owner(obj: MultiTenantMixin) -> str | None:
+    """The tenant the row belongs to in the database (before this flush)."""
+    hist = sa_inspect(obj).attrs.tenant_id.history
+    if hist.deleted:
+        return hist.deleted[0]
+    return obj.tenant_id
+
+
+def guard_flush(session: Session) -> None:
+    if is_all_tenants():
+        return
+    tenant_id = current_tenant_id.get()
+    strict = is_strict(session)
+
+    for obj in session.new:
+        if not isinstance(obj, MultiTenantMixin):
+            continue
+        if obj.tenant_id is None:
+            if tenant_id is not None:
+                obj.tenant_id = tenant_id
+            elif strict:
+                raise missing_tenant_error(type(obj).__name__, "INSERT")
+        elif tenant_id is not None and obj.tenant_id != tenant_id:
+            raise TenantIsolationError(
+                f"Cannot create object for tenant '{obj.tenant_id}' "
+                f"in context of tenant '{tenant_id}'"
+            )
+
+    for obj in list(session.dirty) + list(session.deleted):
+        if not isinstance(obj, MultiTenantMixin):
+            continue
+        is_deleted = obj in session.deleted
+        if not is_deleted and not session.is_modified(obj):
+            continue
+        # Moving a row between tenants is never a routine edit, bound or not
+        # (#356); only a deliberate all_tenants() block may do it.
+        if not is_deleted and sa_inspect(obj).attrs.tenant_id.history.has_changes():
+            raise TenantIsolationError("Cannot change tenant_id of an existing object")
+        owner = _owner(obj)
+        op = "DELETE" if is_deleted else "UPDATE"
+        if tenant_id is not None and owner != tenant_id:
+            raise TenantIsolationError(
+                f"Cannot {op} an object of tenant '{owner}' in context of tenant '{tenant_id}'"
+            )
+        if tenant_id is None and strict:
+            raise missing_tenant_error(type(obj).__name__, op)
+
+
+__all__ = ["guard_flush"]

simple_module_db-0.0.35/simple_module_db/insert_guard.py

@@ -0,0 +1,131 @@
+"""INSERT guard and statement-value helpers for the tenant query filter.
+
+Explicit ``tenant_id`` values in an insert must match the bound tenant, and
+missing ones are stamped with it (#357); the same value readers let the
+query filter refuse an UPDATE that assigns ``tenant_id`` (#356).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from sqlalchemy.orm import ORMExecuteState
+
+from simple_module_db import model_registry as registry
+from simple_module_db.tenancy import (
+    ALL_TENANTS_OPTION,
+    TenantIsolationError,
+    current_tenant_id,
+    is_all_tenants,
+    missing_tenant_error,
+)
+
+TENANT_COLUMN = "tenant_id"
+
+
+def _bound_value(value: Any) -> Any:
+    return getattr(value, "value", value)
+
+
+def _column_name(key: Any) -> str:
+    return getattr(key, "key", None) or getattr(key, "name", None) or str(key)
+
+
+def _statement_values(execute_state: ORMExecuteState) -> dict[str, Any]:
+    raw = getattr(execute_state.statement, "_values", None) or {}
+    return {_column_name(k): _bound_value(v) for k, v in raw.items()}
+
+
+def _param_rows(execute_state: ORMExecuteState) -> list[dict[str, Any]]:
+    params = execute_state.parameters
+    if isinstance(params, dict):
+        return [params] if params else []
+    return [p for p in (params or []) if isinstance(p, dict)]
+
+
+def assigned_tenant_ids(execute_state: ORMExecuteState) -> list[Any]:
+    found = []
+    stmt_values = _statement_values(execute_state)
+    if TENANT_COLUMN in stmt_values:
+        found.append(stmt_values[TENANT_COLUMN])
+    found.extend(row[TENANT_COLUMN] for row in _param_rows(execute_state) if TENANT_COLUMN in row)
+    return found
+
+
+def _foreign_insert(value: Any, tenant_id: str) -> TenantIsolationError:
+    return TenantIsolationError(
+        f"Cannot insert rows for tenant '{value}' in context of tenant '{tenant_id}'"
+    )
+
+
+def guard_insert(execute_state: ORMExecuteState, *, strict: bool) -> Any:
+    mappers = [m.class_.__name__ for m in execute_state.all_mappers if registry.flags(m.class_)[1]]
+    target = getattr(execute_state.statement, "table", None)
+    if not mappers and getattr(target, "name", None) in registry.tenant_table_names:
+        mappers = [target.name]  # Core insert(Model.__table__)
+    if not mappers or execute_state.execution_options.get(ALL_TENANTS_OPTION, False):
+        return None
+    if is_all_tenants():
+        return None
+    tenant_id = current_tenant_id.get()
+    if getattr(execute_state.statement, "_multi_values", None):
+        return _guard_multi_values(execute_state, tenant_id, mappers[0], strict)
+    for value in assigned_tenant_ids(execute_state):
+        if tenant_id is not None and value != tenant_id:
+            raise _foreign_insert(value, tenant_id)
+
+    rows = _param_rows(execute_state)
+    stmt_has_tenant = TENANT_COLUMN in _statement_values(execute_state)
+    missing = (
+        [r for r in rows if TENANT_COLUMN not in r] if rows else ([] if stmt_has_tenant else [None])
+    )
+    if not missing:
+        return None
+    if tenant_id is None:
+        if strict:
+            raise missing_tenant_error(mappers[0], "INSERT")
+        return None
+    if rows:
+        stamped = [{**r, TENANT_COLUMN: r.get(TENANT_COLUMN, tenant_id)} for r in rows]
+        payload = stamped if isinstance(execute_state.parameters, list) else stamped[0]
+        return execute_state.invoke_statement(params=payload)
+    execute_state.statement = execute_state.statement.values(**{TENANT_COLUMN: tenant_id})
+    return None
+
+
+def _guard_multi_values(
+    execute_state: ORMExecuteState, tenant_id: str | None, entity: str, strict: bool
+) -> Any:
+    """``insert(M).values([{...}, {...}])``: check and stamp each row.
+
+    ``.values(tenant_id=...)`` cannot be appended to a multi-VALUES insert
+    (SQLAlchemy refuses to mix the two forms), so the rows are rewritten.
+    """
+    stmt = execute_state.statement
+    columns = list(stmt.table.c)
+    tenant_col = stmt.table.c[TENANT_COLUMN]
+    groups, missing = [], False
+    for group in stmt._multi_values:
+        rows = []
+        for row in group:
+            mapping = dict(row) if isinstance(row, dict) else dict(zip(columns, row, strict=False))
+            keys = {_column_name(k): k for k in mapping}
+            if TENANT_COLUMN in keys:
+                value = _bound_value(mapping[keys[TENANT_COLUMN]])
+                if tenant_id is not None and value != tenant_id:
+                    raise _foreign_insert(value, tenant_id)
+            else:
+                missing = True
+                mapping[tenant_col] = tenant_id
+            rows.append(mapping)
+        groups.append(rows)
+    if not missing:
+        return None
+    if tenant_id is None:
+        if strict:
+            raise missing_tenant_error(entity, "INSERT")
+        return None
+    stamped = stmt._generate()
+    stamped._multi_values = tuple(groups)
+    execute_state.statement = stamped
+    return None

{simple_module_db-0.0.34 → simple_module_db-0.0.35}/simple_module_db/listeners.py

@@ -8,10 +8,35 @@ from datetime import UTC, datetime
 
 from sqlalchemy import event
 from sqlalchemy import inspect as sa_inspect
-from sqlalchemy.orm import ORMExecuteState, Session, with_loader_criteria
+from sqlalchemy.orm import Session
 
-from simple_module_db.mixins import AuditMixin, MultiTenantMixin, SoftDeleteMixin, VersionedMixin
+from simple_module_db.flush_guard import guard_flush
+from simple_module_db.mixins import AuditMixin, SoftDeleteMixin, VersionedMixin
+from simple_module_db.query_filter import bind_engine_policy, filter_statements
 from simple_module_db.session import DatabaseState
+from simple_module_db.writes import (
+    _HARD_DELETE_KEY,
+    SESSION_HAS_WRITES_KEY,
+    _is_purge,
+    _mark_dml_written,
+    _mark_session_written,
+    hard_delete,
+    mark_written,
+)
+
+# Re-exported: ``transaction`` and published modules import these from here.
+__all__ = [
+    "SESSION_HAS_WRITES_KEY",
+    "TenantIsolationError",
+    "current_tenant_id",
+    "current_user_id",
+    "hard_delete",
+    "mark_written",
+    "register_listeners",
+]
+
+# Re-exported: callers import these from here since before tenancy.py existed.
+from simple_module_db.tenancy import TenantIsolationError, current_tenant_id
 
 logger = logging.getLogger(__name__)
 _db_logger = logging.getLogger("simple_module.db")
@@ -19,19 +44,6 @@ _db_logger = logging.getLogger("simple_module.db")
 # Set by auth middleware on each request
 current_user_id: ContextVar[str | None] = ContextVar("current_user_id", default=None)
 
-# Set by tenant middleware on each request
-current_tenant_id: ContextVar[str | None] = ContextVar("current_tenant_id", default=None)
-
-
-class TenantIsolationError(Exception):
-    """Raised when a multi-tenancy isolation constraint is violated."""
-
-
-# Key on ``Session.info`` stamped by the after_flush listener so
-# ``get_db`` can distinguish read-only requests from write requests after
-# flush has cleared ``session.new/.dirty/.deleted``.
-SESSION_HAS_WRITES_KEY = "has_writes"
-
 # Key on ``Session.info`` for pending audit snapshots produced in before_flush
 # and consumed in after_flush_postexec (when DB-assigned PKs are populated).
 _AUDIT_PENDING_KEY = "_audit_pending"
@@ -70,17 +82,6 @@ def _entity_pk(obj: object) -> object:
         return None
 
 
-def _mark_session_written(session: Session, flush_context: object) -> None:
-    """Flag the session as having performed write work.
-
-    ``get_db`` reads this flag to decide between commit and rollback at
-    request end. Checking ``session.new/.dirty/.deleted`` directly after
-    a flush is useless — flush empties those sets — so we stash a tag on
-    ``session.info`` that survives the rest of the request.
-    """
-    session.info[SESSION_HAS_WRITES_KEY] = True
-
-
 def register_listeners(db_state: DatabaseState) -> None:
     """Register SQLAlchemy event listeners for audit, soft delete, versioning, and tenancy.
 
@@ -93,22 +94,37 @@ def register_listeners(db_state: DatabaseState) -> None:
 
     global _db_state
     _db_state = db_state
-
-    event.listen(db_state.sync_session_class, "before_flush", _before_flush_listener)
-    event.listen(db_state.sync_session_class, "after_flush", _mark_session_written)
-    event.listen(db_state.sync_session_class, "after_flush_postexec", _after_flush_audit)
-    event.listen(db_state.sync_session_class, "do_orm_execute", _filter_select_statements)
+    # Strict mode is read from db_state at query time, per engine.
+    bind_engine_policy(db_state.engine.sync_engine, db_state)
+    attach_session_listeners(db_state.sync_session_class)
     db_state._listeners_registered = True
     logger.info("Registered SQLAlchemy entity listeners")
 
 
+def attach_session_listeners(session_class: type[Session]) -> None:
+    """Attach the entity listeners to a session class; idempotent.
+
+    For a process with no ``DatabaseState`` (the Celery worker's sync engine),
+    call this and ``bind_engine_policy(engine, EngineTenancy(...))``.
+    """
+    for name, fn in (
+        ("before_flush", _before_flush_listener),
+        ("after_flush", _mark_session_written),
+        ("after_flush_postexec", _after_flush_audit),
+        ("do_orm_execute", _mark_dml_written),
+        ("do_orm_execute", filter_statements),
+    ):
+        if not event.contains(session_class, name, fn):
+            event.listen(session_class, name, fn)
+
+
 def _before_flush_listener(
     session: Session,
     flush_context: object,
     instances: object,
 ) -> None:
+    guard_flush(session)
     user_id = current_user_id.get()
-    tenant_id = current_tenant_id.get()
     now = datetime.now(UTC)
 
     for obj in session.new:
@@ -118,16 +134,6 @@ def _before_flush_listener(
             if obj.updated_by is None:
                 obj.updated_by = user_id
 
-        # Auto-populate tenant_id; reject cross-tenant creation
-        if isinstance(obj, MultiTenantMixin):
-            if obj.tenant_id is None and tenant_id is not None:
-                obj.tenant_id = tenant_id
-            elif tenant_id is not None and obj.tenant_id != tenant_id:
-                raise TenantIsolationError(
-                    f"Cannot create object for tenant '{obj.tenant_id}' "
-                    f"in context of tenant '{tenant_id}'"
-                )
-
         _db_logger.info(
             _EVENT_ENTITY_CREATED,
             extra={
@@ -148,12 +154,6 @@ def _before_flush_listener(
         if isinstance(obj, VersionedMixin):
             obj.version += 1
 
-        # Prevent tenant_id from being changed on existing objects
-        if isinstance(obj, MultiTenantMixin) and tenant_id is not None:
-            hist = sa_inspect(obj).attrs.tenant_id.history
-            if hist.has_changes():
-                raise TenantIsolationError("Cannot change tenant_id of an existing object")
-
         _db_logger.info(
             _EVENT_ENTITY_UPDATED,
             extra={
@@ -165,8 +165,9 @@ def _before_flush_listener(
         )
 
     # Deleted objects — convert to soft delete if applicable
+    hard_delete_ids = session.info.pop(_HARD_DELETE_KEY, frozenset())
     for obj in list(session.deleted):
-        if isinstance(obj, SoftDeleteMixin):
+        if isinstance(obj, SoftDeleteMixin) and not _is_purge(obj, hard_delete_ids):
             # Cancel the hard delete
             session.expunge(obj)
             # Merge back as modified with soft-delete fields set
@@ -233,47 +234,3 @@ def _after_flush_audit(session: Session, flush_context: object) -> None:
     records = finalize_records(pending)
     if records:
         _db_state.audit_callback(session, records)
-
-
-# Cache ``(is_soft_delete, is_multi_tenant)`` flags per mapper class so the
-# ``do_orm_execute`` hot path skips redundant ``issubclass`` work on every query.
-_mixin_flags_cache: dict[type, tuple[bool, bool]] = {}
-
-
-def _filter_select_statements(execute_state: ORMExecuteState) -> None:
-    """Attach per-mapper ``with_loader_criteria`` for soft-delete and tenant isolation.
-
-    The criteria are attached per concrete mapper because SQLModel mixins
-    expose Pydantic ``FieldInfo`` (not SQLAlchemy ``InstrumentedAttribute``)
-    at the mixin-class level, which breaks the lambda form of
-    ``with_loader_criteria`` that was used before the SQLModel migration.
-
-    Soft-delete bypass: ``stmt.execution_options(include_deleted=True)``.
-    """
-    if not execute_state.is_select:
-        return
-
-    skip_soft_delete = execute_state.execution_options.get("include_deleted", False)
-    tenant_id = current_tenant_id.get()
-    if skip_soft_delete and tenant_id is None:
-        return
-
-    options = []
-    for mapper in execute_state.all_mappers:
-        cls = mapper.class_
-        flags = _mixin_flags_cache.get(cls)
-        if flags is None:
-            flags = (issubclass(cls, SoftDeleteMixin), issubclass(cls, MultiTenantMixin))
-            _mixin_flags_cache[cls] = flags
-        is_soft_delete, is_multi_tenant = flags
-        if is_soft_delete and not skip_soft_delete:
-            options.append(
-                with_loader_criteria(cls, cls.is_deleted.is_(False), include_aliases=True)
-            )
-        if is_multi_tenant and tenant_id is not None:
-            options.append(
-                with_loader_criteria(cls, cls.tenant_id == tenant_id, include_aliases=True)
-            )
-
-    if options:
-        execute_state.statement = execute_state.statement.options(*options)

simple_module_db-0.0.35/simple_module_db/model_registry.py

@@ -0,0 +1,56 @@
+"""Every mapped tenant-scoped and soft-deletable model, known to the filters.
+
+Filled as mappers configure (and topped up from any statement that names a
+model), so criteria can be attached for models a statement does *not* name:
+a join target, a subquery, a count (#332).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from sqlalchemy import event
+from sqlalchemy.orm import Mapper
+
+from simple_module_db.mixins import MultiTenantMixin, SoftDeleteMixin
+
+tenant_classes: set[type] = set()
+soft_delete_classes: set[type] = set()
+tenant_table_names: set[str] = set()
+soft_delete_table_names: set[str] = set()
+
+# ``(is_soft_delete, is_multi_tenant)`` per class, for the hot path.
+_flags_cache: dict[type, tuple[bool, bool]] = {}
+
+
+def flags(cls: type) -> tuple[bool, bool]:
+    found = _flags_cache.get(cls)
+    if found is None:
+        found = (issubclass(cls, SoftDeleteMixin), issubclass(cls, MultiTenantMixin))
+        _flags_cache[cls] = found
+        register(cls)
+    return found
+
+
+def register(cls: type) -> None:
+    table = getattr(cls, "__table__", None)
+    if table is None:
+        return
+    if issubclass(cls, MultiTenantMixin) and cls not in tenant_classes:
+        tenant_classes.add(cls)
+        tenant_table_names.add(table.name)
+    if issubclass(cls, SoftDeleteMixin) and cls not in soft_delete_classes:
+        soft_delete_classes.add(cls)
+        soft_delete_table_names.add(table.name)
+
+
+@event.listens_for(Mapper, "mapper_configured")
+def _on_mapper_configured(mapper: Mapper, cls: type) -> None:
+    register(cls)
+
+
+def is_plain_table(from_obj: Any, names: set[str]) -> bool:
+    """A Core table (``Model.__table__``), not an ORM-annotated occurrence."""
+    return getattr(from_obj, "name", None) in names and "parententity" not in getattr(
+        from_obj, "_annotations", {}
+    )