simple-module-settings 0.0.41__tar.gz → 0.0.42__tar.gz

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_settings
-Version: 0.0.41
+Version: 0.0.42
 Summary: Runtime settings UI — modules plug their own settings panels into a shared admin view
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,9 +21,9 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: simple-module-core==0.0.41
-Requires-Dist: simple-module-db==0.0.41
-Requires-Dist: simple-module-hosting==0.0.41
+Requires-Dist: simple-module-core==0.0.42
+Requires-Dist: simple-module-db==0.0.42
+Requires-Dist: simple-module-hosting==0.0.42
 Requires-Dist: typer<0.28,>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@simple-module-py/settings",
-  "version": "0.0.41",
+  "version": "0.0.42",
   "private": true,
   "description": "Frontend assets for the Settings module",
   "peerDependencies": {
+    "@inertiajs/react": "^3.9.1",
+    "@simple-module-py/ui": "*",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "@inertiajs/react": "^3.7.0",
-    "@simple-module-py/ui": "*"
+    "react-dom": "^19.3.1"
   },
   "devDependencies": {
     "@simple-module-py/tsconfig": "*"

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_settings"
-version = "0.0.41"
+version = "0.0.42"
 description = "Runtime settings UI — modules plug their own settings panels into a shared admin view"
 readme = "README.md"
 license = "MIT"
@@ -21,9 +21,9 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.41",
-    "simple_module_db==0.0.41",
-    "simple_module_hosting==0.0.41",
+    "simple_module_core==0.0.42",
+    "simple_module_db==0.0.42",
+    "simple_module_hosting==0.0.42",
     "typer>=0.12,<0.28",
 ]
 

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/_managed_keys.py

@@ -22,7 +22,7 @@ from __future__ import annotations
 
 from collections.abc import Awaitable, Callable
 
-from settings.constants import ERR_MANAGED_KEY_DELETE
+from settings.constants import ERR_MANAGED_KEY_DELETE, ERR_MODULE_KEY_EDIT
 from settings.contracts.registry import SettingsRegistry, clear_route
 from settings.contracts.schemas import SettingScope
 from settings.exceptions import SettingsError
@@ -58,3 +58,11 @@ async def ensure_deletable(
     if orphaned:
         return
     raise ManagedKeyError(key, clear_route(definition, scope))
+
+
+class ModuleKeyError(SettingsError):
+    """A generic mutation would bypass the module editor's validation."""
+
+    def __init__(self, package: str, edit_via: str) -> None:
+        self.edit_via = edit_via
+        super().__init__(ERR_MODULE_KEY_EDIT.format(package=package, edit_via=edit_via))

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/constants.py

@@ -145,6 +145,7 @@ ERR_VALUE_MISMATCH: Final = "value does not parse as declared value_type"
 ERR_UNKNOWN_TENANT: Final = "Unknown tenant"
 ERR_NO_ACTIVE_TENANT: Final = "No active organisation for this request"
 ERR_MANAGED_KEY_DELETE: Final = "This setting is managed elsewhere; clear it at {clear_via}"
+ERR_MODULE_KEY_EDIT: Final = "Module settings must be edited at {edit_via} (package: {package})"
 ERR_NOT_TENANT_OVERRIDABLE: Final = "This setting cannot be changed per organisation"
 
 # ── HTTP ─────────────────────────────────────────────────────────────

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/deps.py

@@ -12,6 +12,7 @@ from typing import Annotated
 
 from fastapi import Depends, Request
 from simple_module_core.app_state import get_services
+from simple_module_core.module_settings import get_module_settings_registry
 from simple_module_db.deps import get_db
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -36,6 +37,15 @@ async def get_setting_service(
     )
 
 
+async def get_generic_setting_service(
+    request: Request,
+    service: SettingService = Depends(get_setting_service),
+) -> SettingService:
+    """Raw store routes must send module configuration through its own editor."""
+    service.module_registry = get_module_settings_registry(request.app)
+    return service
+
+
 def get_settings_registry(request: Request) -> SettingsRegistry:
     """Return the app-wide settings registry populated during boot."""
     services = getattr(request.app.state, MODULE_PACKAGE)

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/endpoints/_create_form.py

@@ -7,6 +7,7 @@ from pydantic import ValidationError
 from simple_module_hosting.inertia_utils import redirect_back_with_errors, validation_errors_to_dict
 from starlette.responses import RedirectResponse
 
+from settings._managed_keys import ModuleKeyError
 from settings._unique_write import DuplicateSettingError
 from settings.constants import ERR_SETTING_EXISTS
 from settings.contracts.schemas import SettingCreate, SettingScope
@@ -31,4 +32,6 @@ async def create_from_form(
         await service.create(data)
     except DuplicateSettingError:
         return redirect_back_with_errors(request, {"key": ERR_SETTING_EXISTS})
+    except ModuleKeyError as exc:
+        return redirect_back_with_errors(request, {"key": str(exc)})
     return RedirectResponse(redirect_to, status_code=303)

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/endpoints/api.py

@@ -37,7 +37,7 @@ from settings.contracts.schemas import (
     SettingUpdate,
     SettingUpsert,
 )
-from settings.deps import get_setting_service
+from settings.deps import get_generic_setting_service
 from settings.service import SettingService
 from settings.tenant_scope import (
     is_known_tenant,
@@ -69,7 +69,7 @@ def _not_found() -> HTTPException:
 async def list_settings(
     scope: SettingScope | None = Query(default=None, alias=QP_SCOPE),
     scope_id: str = Query(default=SYSTEM_SCOPE_ID, alias=QP_SCOPE_ID),
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> list[SettingOut]:
     if scope is None:
         return await service.list_all()
@@ -84,7 +84,7 @@ async def resolve_setting(
     key: str,
     user_id: str | None = Query(default=None, alias=QP_USER_ID),
     tenant_id: str | None = Query(default=None, alias=QP_TENANT_ID),
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> SettingOut:
     result = await service.resolve(key, user_id=user_id, tenant_id=tenant_id)
     if result is None:
@@ -97,7 +97,7 @@ async def resolve_setting(
 
 @router.get(API_SYSTEM_PATH, response_model=SettingOut, dependencies=_VIEW)
 async def get_system_setting(
-    key: str, service: SettingService = Depends(get_setting_service)
+    key: str, service: SettingService = Depends(get_generic_setting_service)
 ) -> SettingOut:
     result = await service.get_scoped(SettingScope.SYSTEM, SYSTEM_SCOPE_ID, key)
     if result is None:
@@ -109,14 +109,14 @@ async def get_system_setting(
 async def upsert_system_setting(
     key: str,
     data: SettingUpsert,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> SettingOut:
     return await service.upsert_scoped(SettingScope.SYSTEM, SYSTEM_SCOPE_ID, key, data)
 
 
 @router.delete(API_SYSTEM_PATH, status_code=STATUS_NO_CONTENT, dependencies=_DELETE)
 async def delete_system_setting(
-    key: str, service: SettingService = Depends(get_setting_service)
+    key: str, service: SettingService = Depends(get_generic_setting_service)
 ) -> None:
     if not await service.delete_scoped(SettingScope.SYSTEM, SYSTEM_SCOPE_ID, key):
         raise _not_found()
@@ -133,7 +133,7 @@ async def get_tenant_setting(
     scope_id: str,
     key: str,
     request: Request,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> SettingOut:
     await require_known_tenant(request, scope_id)
     result = await service.get_scoped(SettingScope.TENANT, scope_id, key)
@@ -148,7 +148,7 @@ async def upsert_tenant_setting(
     key: str,
     data: SettingUpsert,
     request: Request,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> SettingOut:
     await require_known_tenant(request, scope_id)
     await run_check(request, scope_id, key, data.value)
@@ -159,7 +159,7 @@ async def upsert_tenant_setting(
 async def delete_tenant_setting(
     scope_id: str,
     key: str,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> None:
     if not await service.delete_scoped(SettingScope.TENANT, scope_id, key):
         raise _not_found()
@@ -169,7 +169,7 @@ async def delete_tenant_setting(
 async def get_user_setting(
     scope_id: str,
     key: str,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> SettingOut:
     result = await service.get_scoped(SettingScope.USER, scope_id, key)
     if result is None:
@@ -182,7 +182,7 @@ async def upsert_user_setting(
     scope_id: str,
     key: str,
     data: SettingUpsert,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> SettingOut:
     return await service.upsert_scoped(SettingScope.USER, scope_id, key, data)
 
@@ -191,7 +191,7 @@ async def upsert_user_setting(
 async def delete_user_setting(
     scope_id: str,
     key: str,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> None:
     if not await service.delete_scoped(SettingScope.USER, scope_id, key):
         raise _not_found()
@@ -204,7 +204,7 @@ async def delete_user_setting(
 async def create_setting(
     data: SettingCreate,
     request: Request,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> SettingOut:
     if data.scope is SettingScope.TENANT:
         # A body field, not a path segment: an unknown tenant is invalid input.
@@ -219,7 +219,7 @@ async def create_setting(
 
 @router.get(API_BY_ID_PATH, response_model=SettingOut, dependencies=_VIEW)
 async def get_setting(
-    setting_id: int, service: SettingService = Depends(get_setting_service)
+    setting_id: int, service: SettingService = Depends(get_generic_setting_service)
 ) -> SettingOut:
     result = await service.get_by_id(setting_id)
     if result is None:
@@ -232,7 +232,7 @@ async def update_setting(
     setting_id: int,
     data: SettingUpdate,
     request: Request,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> SettingOut:
     current = await service.get_by_id(setting_id)
     if current is not None and current.scope is SettingScope.TENANT and data.value is not None:
@@ -245,7 +245,7 @@ async def update_setting(
 
 @router.delete(API_BY_ID_PATH, status_code=STATUS_NO_CONTENT, dependencies=_DELETE)
 async def delete_setting(
-    setting_id: int, service: SettingService = Depends(get_setting_service)
+    setting_id: int, service: SettingService = Depends(get_generic_setting_service)
 ) -> None:
     if not await service.delete(setting_id):
         raise _not_found()

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/endpoints/views.py

@@ -22,7 +22,7 @@ from simple_module_inertia import InertiaResponse
 from starlette.responses import RedirectResponse
 
 from settings import browse_query, known_keys
-from settings._managed_keys import ManagedKeyError
+from settings._managed_keys import ManagedKeyError, ModuleKeyError
 from settings._module_settings import (
     _package_of,
     collect_module_settings,
@@ -53,7 +53,7 @@ from settings.constants import (
     VIEW_STORE_PATH,
 )
 from settings.contracts.schemas import SettingUpdate
-from settings.deps import get_setting_service
+from settings.deps import get_generic_setting_service
 from settings.endpoints._create_form import create_from_form
 from settings.service import SettingService
 from settings.tenant_scope import tenant_update_error
@@ -81,7 +81,7 @@ router = APIRouter(dependencies=[Depends(RequiresPermission(PERM_VIEW))])
 @router.get(VIEW_STORE_PATH, response_model=None)
 async def browse(
     inertia: InertiaDep,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
     scope: str = SCOPE_ALL,
     q: str = "",
     page: browse_query.PageParam = 1,
@@ -139,7 +139,7 @@ async def create_view(request: Request, inertia: InertiaDep) -> InertiaResponse:
 async def edit_view(
     setting_id: int,
     inertia: InertiaDep,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> InertiaResponse:
     item = await service.get_by_id(setting_id)
     if item is None:
@@ -159,7 +159,7 @@ async def edit_view(
 )
 async def create_action(
     request: Request,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> RedirectResponse:
     return await create_from_form(request, service, _REDIRECT_SETTINGS)
 
@@ -172,7 +172,7 @@ async def create_action(
 async def update_action(
     setting_id: int,
     request: Request,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> RedirectResponse:
     body = await request.json()
     try:
@@ -181,7 +181,10 @@ async def update_action(
         return redirect_back_with_errors(request, validation_errors_to_dict(exc))
     if error := await tenant_update_error(request, await service.get_by_id(setting_id), data.value):
         return redirect_back_with_errors(request, {"value": error})
-    await service.update(setting_id, data)
+    try:
+        await service.update(setting_id, data)
+    except ModuleKeyError as exc:
+        return redirect_back_with_errors(request, {"value": str(exc)})
     return RedirectResponse(_REDIRECT_SETTINGS, status_code=303)
 
 
@@ -194,7 +197,7 @@ async def delete_action(
     setting_id: int,
     request: Request,
     t: TranslatorDep,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> RedirectResponse:
     try:
         await service.delete(setting_id)
@@ -204,6 +207,8 @@ async def delete_action(
             "settings.browse.delete_managed_error", setting=exc.key, clear_via=exc.clear_via
         )
         return redirect_back_with_errors(request, {"delete": message})
+    except ModuleKeyError as exc:
+        return redirect_back_with_errors(request, {"delete": str(exc)})
     return RedirectResponse(_REDIRECT_SETTINGS, status_code=303)
 
 
@@ -211,7 +216,7 @@ async def delete_action(
 async def modules_view(
     request: Request,
     inertia: InertiaDep,
-    service: SettingService = Depends(get_setting_service),
+    service: SettingService = Depends(get_generic_setting_service),
 ) -> InertiaResponse:
     """Read-only view of every module's pydantic ``BaseSettings`` instance.
 

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/errors.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from fastapi import FastAPI, Request
 from fastapi.responses import JSONResponse, Response
 
-from settings._managed_keys import ManagedKeyError
+from settings._managed_keys import ManagedKeyError, ModuleKeyError
 from settings.constants import STATUS_UNPROCESSABLE
 
 
@@ -16,5 +16,13 @@ async def _managed_key(request: Request, exc: Exception) -> Response:
     )
 
 
+async def _module_key(request: Request, exc: Exception) -> Response:
+    assert isinstance(exc, ModuleKeyError)
+    return JSONResponse(
+        {"detail": str(exc), "edit_via": exc.edit_via}, status_code=STATUS_UNPROCESSABLE
+    )
+
+
 def install_exception_handlers(app: FastAPI) -> None:
     app.add_exception_handler(ManagedKeyError, _managed_key)
+    app.add_exception_handler(ModuleKeyError, _module_key)

simple_module_settings-0.0.42/settings/known_keys.py

@@ -0,0 +1,47 @@
+"""Autocomplete for declared generic keys; module settings use their own editor.
+
+Defaults are masked here because Browse renders them in its resolved-value panel.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import FastAPI
+from fastapi.encoders import jsonable_encoder
+from simple_module_core.module_settings import get_module_settings_registry
+from simple_module_core.secret_fields import conceals_secret, mask
+
+
+def _from_definition(definition) -> dict[str, Any]:
+    """Mask declarations directly, as module fields are no longer suggested."""
+    value_type = str(definition.value_type)
+    default = jsonable_encoder(definition.default)
+    secret = conceals_secret(definition.key, default, value_type)
+    return {
+        "key": definition.key,
+        "type": value_type,
+        "env_var": "",
+        "env_readable": False,
+        "env_set": False,
+        "env_value": None,
+        "default": mask(default) if secret else default,
+        "requires_restart": False,
+        "is_secret": secret,
+        "choices": None,
+    }
+
+
+def build(app: FastAPI) -> list[dict[str, Any]]:
+    """Declared generic keys only; registered module packages use their editor."""
+    suggestions: dict[str, dict[str, Any]] = {}
+    modules = get_module_settings_registry(app)
+    registry = getattr(getattr(app.state, "settings", None), "registry", None)
+    if registry is not None:
+        for definition in registry.all_definitions:
+            package, sep, _ = definition.key.partition(".")
+            if sep and modules is not None and modules.get(package) is not None:
+                continue
+            suggestions[definition.key] = _from_definition(definition)
+
+    return [suggestions[key] for key in sorted(suggestions)]

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/pages/components/ModuleForm.tsx

@@ -46,6 +46,7 @@ export function ModuleForm({ module: m, checks = [] }: Props) {
   const [errors, setErrors] = useState<Record<string, string>>({});
   const [busy, setBusy] = useState(false);
   const [saved, setSaved] = useState(false);
+  const [savedOverrides, setSavedOverrides] = useState<Record<string, boolean>>({});
   const [formErrors, setFormErrors] = useState<string[]>([]);
 
   // Refresh saved values without discarding drafts in other fields (#637).
@@ -61,6 +62,7 @@ export function ModuleForm({ module: m, checks = [] }: Props) {
     }));
     setErrors({});
     setSaved(false);
+    setSavedOverrides({});
   }, [initial]);
 
   const modifiedFields = useMemo(() => {
@@ -113,6 +115,14 @@ export function ModuleForm({ module: m, checks = [] }: Props) {
       // Keeping the form mounted lets the confirmation remain visible instead
       // of being discarded by an immediate Inertia reload.
       setBuffer((prev) => ({ ...prev, baseline: { ...values } }));
+      setSavedOverrides((prev) => ({
+        ...prev,
+        ...Object.fromEntries(
+          m.fields
+            .filter((f) => f.name in changed)
+            .map((f) => [f.name, notEqual(changed[f.name], f.default)]),
+        ),
+      }));
       setSaved(true);
     }
     setBusy(false);
@@ -126,11 +136,28 @@ export function ModuleForm({ module: m, checks = [] }: Props) {
         params: { path: { package: m.package, field: name } },
       }),
     );
+    setSavedOverrides((prev) => ({ ...prev, [name]: false }));
     setBuffer((prev) => ({
       ...prev,
       values: { ...prev.values, [name]: prev.baseline[name] },
     }));
-    router.reload({ only: ['modules'] });
+    // Take the field's live value from the reload itself: when the page never
+    // reloaded after a save, the fresh props equal the old ones and the
+    // [initial] effect does not fire, leaving the reverted value on screen.
+    router.reload({
+      only: ['modules'],
+      onSuccess: (page) => {
+        const modules = (page.props as { modules?: ModuleView[] }).modules ?? [];
+        const fresh = modules
+          .find((other) => other.package === m.package)
+          ?.fields.find((f) => f.name === name);
+        if (!fresh) return;
+        setBuffer((prev) => ({
+          values: { ...prev.values, [name]: fresh.value },
+          baseline: { ...prev.baseline, [name]: fresh.value },
+        }));
+      },
+    });
   }
 
   return (
@@ -188,7 +215,7 @@ export function ModuleForm({ module: m, checks = [] }: Props) {
               {fields.map((f) => (
                 <ModuleFieldRow
                   key={f.name}
-                  field={f}
+                  field={{ ...f, db_override: savedOverrides[f.name] ?? f.db_override }}
                   package={m.package}
                   value={values[f.name]}
                   modified={modifiedFields.has(f.name)}

{simple_module_settings-0.0.41 → simple_module_settings-0.0.42}/settings/service.py

@@ -11,9 +11,10 @@ from sqlmodel import col
 
 from settings._announce import announce
 from settings._listing import SettingListing
-from settings._managed_keys import TenantIsLive, ensure_deletable
+from settings._managed_keys import ModuleKeyError, TenantIsLive, ensure_deletable
 from settings._row_masking import drop_placeholder_write, is_placeholder_write, out
 from settings._unique_write import DuplicateSettingError, insert_if_free
+from settings.constants import VIEW_PREFIX
 from settings.contracts.schemas import (
     SettingCreate,
     SettingOut,
@@ -24,6 +25,7 @@ from settings.contracts.schemas import (
 
 if TYPE_CHECKING:
     from simple_module_core.invalidation import InvalidationBus
+    from simple_module_core.module_settings import ModuleSettingsRegistry
 
     from settings.contracts.registry import SettingsRegistry
 
@@ -43,6 +45,7 @@ class SettingService(SettingListing):
         tenant_is_live: TenantIsLive | None = None,
     ) -> None:
         self.db = db
+        self.module_registry: ModuleSettingsRegistry | None = None
         # With a registry, ``delete``/``delete_scoped`` refuse a ``clear_via``
         # key (see ``_managed_keys``); ``tenant_is_live`` lets a deleted
         # tenant's leftover row through.
@@ -55,6 +58,22 @@ class SettingService(SettingListing):
     def _changed(self, entity: Setting) -> None:
         announce(self.db, self.invalidation, entity.scope, entity.scope_id, entity.key)
 
+    def _ensure_generic_key(self, scope: SettingScope | str, key: str) -> None:
+        """Refuse a system row for a module field: only its editor validates and reloads.
+
+        Tenant (and user) rows stay writable here: a ``tenant_overridable``
+        module key's per-tenant override has no other platform route (#690).
+        """
+        if SettingScope(scope) is not SettingScope.SYSTEM:
+            return
+        package, sep, field = key.partition(".")
+        registry = self.module_registry
+        settings_cls = registry.get(package) if sep and registry is not None else None
+        # An orphaned row (no such field any more) has no editor to clear it, so
+        # it stays deletable here.
+        if settings_cls is not None and field in settings_cls.model_fields:
+            raise ModuleKeyError(package, registry.manage_url(package) or f"{VIEW_PREFIX}/")
+
     # ── Lookup ──────────────────────────────────────────────────────
 
     async def get_by_id(self, setting_id: int) -> SettingOut | None:
@@ -115,6 +134,7 @@ class SettingService(SettingListing):
     # ── Mutations ───────────────────────────────────────────────────
 
     async def create(self, data: SettingCreate) -> SettingOut:
+        self._ensure_generic_key(data.scope, data.key)
         entity = Setting(**data.model_dump())
         if not await insert_if_free(self.db, entity):
             raise DuplicateSettingError(f"{data.scope.value}/{data.scope_id}/{data.key}")
@@ -126,6 +146,7 @@ class SettingService(SettingListing):
         entity = await self.db.get(Setting, setting_id)
         if entity is None:
             return None
+        self._ensure_generic_key(entity.scope, entity.key)
         changes = data.model_dump(exclude_unset=True)
         drop_placeholder_write(entity, changes)
         for field, value in changes.items():
@@ -142,6 +163,7 @@ class SettingService(SettingListing):
         key: str,
         data: SettingUpsert,
     ) -> SettingOut:
+        self._ensure_generic_key(scope, key)
         entity = await self._find(scope, scope_id, key)
         if entity is None:
             entity = Setting(
@@ -194,9 +216,11 @@ class SettingService(SettingListing):
 
     async def _remove(self, entity: Setting, as_owner: bool) -> None:
         if not as_owner:
+            # A managed key's own clear route is the more specific refusal.
             await ensure_deletable(
                 self.registry, self.tenant_is_live, entity.scope, entity.scope_id, entity.key
             )
+        self._ensure_generic_key(entity.scope, entity.key)
         self._changed(entity)
         await self.db.delete(entity)
         await self.db.flush()