simple-module-sharing 0.0.39__tar.gz → 0.0.40__tar.gz

{simple_module_sharing-0.0.39 → simple_module_sharing-0.0.40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_sharing
-Version: 0.0.39
+Version: 0.0.40
 Summary: Generic resource shares (owner / shared-with-user) for simple_module resource-scoped access
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -11,10 +11,10 @@ License-Expression: MIT
 License-File: LICENSE
 Keywords: access-control,permissions,sharing,simple-module
 Requires-Python: >=3.12
-Requires-Dist: simple-module-core==0.0.39
-Requires-Dist: simple-module-db==0.0.39
-Requires-Dist: simple-module-hosting==0.0.39
-Requires-Dist: simple-module-inertia==0.0.39
+Requires-Dist: simple-module-core==0.0.40
+Requires-Dist: simple-module-db==0.0.40
+Requires-Dist: simple-module-hosting==0.0.40
+Requires-Dist: simple-module-inertia==0.0.40
 Description-Content-Type: text/markdown
 
 # simple_module_sharing

{simple_module_sharing-0.0.39 → simple_module_sharing-0.0.40}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/sharing",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "private": true,
   "description": "Frontend assets for the Sharing module",
   "peerDependencies": {

{simple_module_sharing-0.0.39 → simple_module_sharing-0.0.40}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_sharing"
-version = "0.0.39"
+version = "0.0.40"
 description = "Generic resource shares (owner / shared-with-user) for simple_module resource-scoped access"
 readme = "README.md"
 license = "MIT"
@@ -9,10 +9,10 @@ requires-python = ">=3.12"
 authors = [{ name = "Anto Subash", email = "antosubash@live.com" }]
 keywords = ["simple-module", "sharing", "permissions", "access-control"]
 dependencies = [
-    "simple_module_core==0.0.39",
-    "simple_module_db==0.0.39",
-    "simple_module_hosting==0.0.39",
-    "simple_module_inertia==0.0.39",
+    "simple_module_core==0.0.40",
+    "simple_module_db==0.0.40",
+    "simple_module_hosting==0.0.40",
+    "simple_module_inertia==0.0.40",
 ]
 
 [project.entry-points.simple_module]

{simple_module_sharing-0.0.39 → simple_module_sharing-0.0.40}/sharing/module.py

@@ -35,6 +35,12 @@ class SharingModule(ModuleBase):
 
         bus.subscribe_durable(TenantDeleted, purge_tenant_data)
 
+        from simple_module_core.user_events import UserDeleted
+
+        from sharing.user_cleanup import purge_user_shares
+
+        bus.subscribe_durable(UserDeleted, purge_user_shares)
+
     def register_settings(self, app: FastAPI) -> None:
         from sharing.services import SharingServices
         from sharing.settings import SharingSettings

{simple_module_sharing-0.0.39 → simple_module_sharing-0.0.40}/sharing/service.py

@@ -9,9 +9,10 @@ grantee is someone the user directory knows. Rows are tenant-scoped by
 from __future__ import annotations
 
 import uuid
-from datetime import UTC, datetime
 from typing import Any
 
+from simple_module_core.datetimes import aware as _aware
+from simple_module_core.datetimes import utcnow
 from simple_module_core.resources import (
     ACTION_SHARE,
     ResourcePrincipal,
@@ -20,6 +21,7 @@ from simple_module_core.resources import (
 )
 from simple_module_core.user_directory import UserDirectory
 from simple_module_db.resource_policy import load_authorized
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlmodel import select
 
@@ -49,10 +51,6 @@ class SharingError(Exception):
         self.detail = detail
 
 
-def _aware(value: datetime) -> datetime:
-    return value if value.tzinfo is not None else value.replace(tzinfo=UTC)
-
-
 class SharingService:
     def __init__(
         self,
@@ -93,7 +91,7 @@ class SharingService:
         resource_type = self._type(data.resource_type)
         if data.role not in resource_type.shareable_actions:
             raise SharingError(422, ERR_BAD_ROLE)
-        if data.expires_at is not None and _aware(data.expires_at) <= datetime.now(UTC):
+        if data.expires_at is not None and _aware(data.expires_at) <= utcnow():
             raise SharingError(422, ERR_EXPIRED)
         row = await self._authorize(principal, resource_type, data.resource_id)
         grantee = (await self.directory.get_many(self.db, [data.subject_id])).get(data.subject_id)
@@ -112,8 +110,17 @@ class SharingService:
                 subject_id=grantee.id,
                 role=data.role,
                 granted_by=principal.user_id or "",
+                expires_at=data.expires_at,
             )
-            self.db.add(share)
+            try:
+                async with self.db.begin_nested():
+                    self.db.add(share)
+                    await self.db.flush()
+            except IntegrityError:
+                # Another grant may have won the unique-key race.
+                share = await self._existing(data.resource_type, resource_id, grantee.id)
+                if share is None:
+                    raise
         share.role = data.role
         share.expires_at = data.expires_at
         share.granted_by = principal.user_id or ""

simple_module_sharing-0.0.40/sharing/user_cleanup.py

@@ -0,0 +1,25 @@
+"""Revoke shares addressed to a deleted principal across tenants."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from simple_module_core.durable_events import DurableContext
+from simple_module_db import all_tenants
+from sqlmodel import col, delete
+
+from sharing.constants import SUBJECT_USER
+from sharing.models import ResourceShare
+
+if TYPE_CHECKING:
+    from simple_module_core.user_events import UserDeleted
+
+
+async def purge_user_shares(event: UserDeleted, ctx: DurableContext) -> None:
+    with all_tenants():
+        await ctx.db.execute(
+            delete(ResourceShare).where(
+                col(ResourceShare.subject_type) == SUBJECT_USER,
+                col(ResourceShare.subject_id) == str(event.user_id),
+            )
+        )

{simple_module_sharing-0.0.39 → simple_module_sharing-0.0.40}/tests/test_sharing_service.py

@@ -204,3 +204,24 @@ async def test_expired_share_can_be_renewed_without_duplicate_grants(env):
         assert renewed.id == share.id
         assert await _visible(service.db, FRIEND, ACTION_EDIT) == ["n"]
         assert len(await service.for_resource(_who(OWNER), NOTE_TYPE, note_id)) == 1
+
+
+async def test_duplicate_insert_race_reuses_winner_and_preserves_transaction(env, monkeypatch):
+    service, note_id = env
+    with tenant_context("t1"):
+        winner = await service.grant(_who(OWNER), _grant(note_id))
+        original = service._existing
+        calls = 0
+
+        async def miss_once(*args):
+            nonlocal calls
+            calls += 1
+            return None if calls == 1 else await original(*args)
+
+        # Simulate a concurrent winner becoming visible after our initial lookup.
+        monkeypatch.setattr(service, "_existing", miss_once)
+        result = await service.grant(_who(OWNER), _grant(note_id, role=ACTION_EDIT))
+        assert result.id == winner.id
+        assert result.role == ACTION_EDIT
+        assert len(await service.for_resource(_who(OWNER), NOTE_TYPE, note_id)) == 1
+        assert await _visible(service.db, FRIEND, ACTION_EDIT) == ["n"]