storepy 2.7.0__tar.gz → 3.0.0__tar.gz

{storepy-2.7.0/src/storepy.egg-info → storepy-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: storepy
-Version: 2.7.0
+Version: 3.0.0
 Summary: Multi-backend data layer for Python asyncio (MongoDB, MySQL, SQLite, PostgreSQL): pure JSON schemas, GQL tree queries compiled to a single native query, GROUP BY/HAVING aggregation, computed columns, soft-delete and role-based access control
 Author-email: leo <coen_ddt@qq.com>
 License-Expression: MIT
@@ -24,7 +24,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: pymongo>=4.9
-Requires-Dist: rust-store-py<3.0.0,>=2.0.0
+Requires-Dist: rust-store-py<4.0.0,>=3.0.0
 Provides-Extra: mysql
 Requires-Dist: asyncmy>=0.2.9; extra == "mysql"
 Provides-Extra: postgres

{storepy-2.7.0 → storepy-3.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "storepy"
-version = "2.7.0"
+version = "3.0.0"
 description = "Multi-backend data layer for Python asyncio (MongoDB, MySQL, SQLite, PostgreSQL): pure JSON schemas, GQL tree queries compiled to a single native query, GROUP BY/HAVING aggregation, computed columns, soft-delete and role-based access control"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -25,7 +25,7 @@ authors = [
 ]
 dependencies = [
   "pymongo>=4.9",
-  "rust-store-py>=2.0.0,<3.0.0",
+  "rust-store-py>=3.0.0,<4.0.0",
 ]
 classifiers = [
   "Development Status :: 4 - Beta",

{storepy-2.7.0 → storepy-3.0.0}/src/py_store/__init__.py

@@ -281,6 +281,13 @@ class Store:
     rbac_writable_fields = staticmethod(permission.rbac_writable_fields)
     rbacRowCondition = staticmethod(permission.rbac_row_condition)
     rbac_row_condition = staticmethod(permission.rbac_row_condition)
+    # 角色清单与未配置姿态（清单化语义，判决唯一在 core；本层仅透传配置）
+    setExemptRoles = staticmethod(permission.set_exempt_roles)
+    set_exempt_roles = staticmethod(permission.set_exempt_roles)
+    setDenyWriteRoles = staticmethod(permission.set_deny_write_roles)
+    set_deny_write_roles = staticmethod(permission.set_deny_write_roles)
+    setUnconfiguredPolicy = staticmethod(permission.set_unconfigured_policy)
+    set_unconfigured_policy = staticmethod(permission.set_unconfigured_policy)
     # 查询档位（判决唯一在 core）：standard 默认放开 / text2query 功能收缩
     # 进入档即等效强制 ctx；未知档由 core 抛 ValueError 上抛（禁静默回落默认档）
     setProfile = staticmethod(schema.set_profile)

{storepy-2.7.0 → storepy-3.0.0}/src/py_store/permission.py

@@ -153,6 +153,25 @@ def rbac_row_condition(model, action, ctx=None):
     return core.rbac_row_condition(_model(model), action, ctx)
 
 
+def set_exempt_roles(roles):
+    """豁免角色清单（命中者在一切判决环节直接放行）。
+
+    判决唯一在 core：本层仅透传配置。默认空——无豁免（清单化语义，
+    super_admin/admin 不再默认放行，迁移见迁移指南）。
+    """
+    return core.set_exempt_roles(roles)
+
+
+def set_deny_write_roles(roles):
+    """拒写角色清单（命中者一切写路径拒绝，读不受影响）。默认空——无拒写。"""
+    return core.set_deny_write_roles(roles)
+
+
+def set_unconfigured_policy(policy):
+    """schema 白名单缺失/为空时的默认姿态："open"（默认，放行）| "closed"（全拒）。"""
+    return core.set_unconfigured_policy(policy)
+
+
 # ─── 自定义错误 ──────────────────────────────────────────────
 
 

{storepy-2.7.0 → storepy-3.0.0}/src/py_store/schema.py

@@ -213,6 +213,21 @@ def set_require_context(require=True):
     core.set_require_context(bool(require))
 
 
+def set_exempt_roles(roles):
+    """豁免角色清单（命中者在一切判决环节直接放行）。默认空——无豁免（清单化语义）"""
+    core.set_exempt_roles(roles)
+
+
+def set_deny_write_roles(roles):
+    """拒写角色清单（命中者一切写路径拒绝，读不受影响）。默认空——无拒写"""
+    core.set_deny_write_roles(roles)
+
+
+def set_unconfigured_policy(policy):
+    """schema 白名单缺失/为空时的默认姿态："open"（默认，放行）| "closed"（全拒）"""
+    core.set_unconfigured_policy(policy)
+
+
 def require_context():
     """「上下文强制」开关当前值"""
     return core.require_context()

{storepy-2.7.0 → storepy-3.0.0/src/storepy.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: storepy
-Version: 2.7.0
+Version: 3.0.0
 Summary: Multi-backend data layer for Python asyncio (MongoDB, MySQL, SQLite, PostgreSQL): pure JSON schemas, GQL tree queries compiled to a single native query, GROUP BY/HAVING aggregation, computed columns, soft-delete and role-based access control
 Author-email: leo <coen_ddt@qq.com>
 License-Expression: MIT
@@ -24,7 +24,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: pymongo>=4.9
-Requires-Dist: rust-store-py<3.0.0,>=2.0.0
+Requires-Dist: rust-store-py<4.0.0,>=3.0.0
 Provides-Extra: mysql
 Requires-Dist: asyncmy>=0.2.9; extra == "mysql"
 Provides-Extra: postgres

{storepy-2.7.0 → storepy-3.0.0}/src/storepy.egg-info/requires.txt

@@ -1,5 +1,5 @@
 pymongo>=4.9
-rust-store-py<3.0.0,>=2.0.0
+rust-store-py<4.0.0,>=3.0.0
 
 [dev]
 pytest>=8

{storepy-2.7.0 → storepy-3.0.0}/tests/test_ask.py

@@ -354,20 +354,26 @@ def test_t8_summary_without_ctx_names_only():
 def test_t8_admin_summary_and_compute_skip_warning():
     """admin 视角：role 进摘要；read 白名单计算列无论角色一律收窄并告警（同签名去重）"""
     _ask_mod._COMPUTE_SKIP_SIGS.clear()  # 告警去重为进程级，单测内复位以保证可断言
-    events = []
-    feedback.set_sink(events.append)
-    s = store.describe_for_ai(CTX_ADMIN)
-    aku = next(m for m in s if m['name'] == 'AkUser')
-    assert aku['fields']['role'] == 'string'
-    assert 'displayName' not in aku['computes']
-    assert 'upperName' in aku['computes']
-    assert 'itemCount' in next(m for m in s if m['name'] == 'AkOrder')['computes']
-    warns = [e for e in events if e['type'] == 'ask_summary_compute_skipped']
-    assert len(warns) == 1
-    assert warns[0]['model'] == 'AkUser' and warns[0]['compute'] == 'displayName'
-    # 同签名只告警一次（再次 describe 不重复）
-    store.describe_for_ai(CTX_ADMIN)
-    assert len([e for e in events if e['type'] == 'ask_summary_compute_skipped']) == 1
+    # 清单化语义（设计 §11.5）：AkUser.read 白名单不含 admin，admin 视角需显式豁免
+    from py_store import permission as _perm
+    _perm.set_exempt_roles(['admin'])
+    try:
+        events = []
+        feedback.set_sink(events.append)
+        s = store.describe_for_ai(CTX_ADMIN)
+        aku = next(m for m in s if m['name'] == 'AkUser')
+        assert aku['fields']['role'] == 'string'
+        assert 'displayName' not in aku['computes']
+        assert 'upperName' in aku['computes']
+        assert 'itemCount' in next(m for m in s if m['name'] == 'AkOrder')['computes']
+        warns = [e for e in events if e['type'] == 'ask_summary_compute_skipped']
+        assert len(warns) == 1
+        assert warns[0]['model'] == 'AkUser' and warns[0]['compute'] == 'displayName'
+        # 同签名只告警一次（再次 describe 不重复）
+        store.describe_for_ai(CTX_ADMIN)
+        assert len([e for e in events if e['type'] == 'ask_summary_compute_skipped']) == 1
+    finally:
+        _perm.set_exempt_roles([])
 
 
 # ── T9 无 ctx 直接拒绝（fail-secure，A4） ──────────────────────

{storepy-2.7.0 → storepy-3.0.0}/tests/test_coverage_margin.py

@@ -320,8 +320,14 @@ def test_permission_wrappers_and_internal_sync_return():
     })
     assert permission.should_inject_owner_condition(
         'CovOwner', {'userId': 'u1', 'roles': ['user']}) is True
+    # 清单化语义（设计 §11.5）：admin 不再默认豁免——creator-only 下同样注入 owner 条件；
+    # 显式豁免后恢复「不注入」
+    assert permission.should_inject_owner_condition(
+        'CovOwner', {'userId': 'u1', 'roles': ['admin']}) is True
+    permission.set_exempt_roles(['admin'])
     assert permission.should_inject_owner_condition(
         'CovOwner', {'userId': 'u1', 'roles': ['admin']}) is False
+    permission.set_exempt_roles([])
     assert permission.get_readable_relations('CovOwner', None) is None, '无上下文不裁剪'
     assert _run(permission.run_as_internal(lambda: 42)) == 42, '同步返回值须原样返回'
 

{storepy-2.7.0 → storepy-3.0.0}/tests/test_py_store.py

@@ -98,10 +98,14 @@ def test_perm_scoped_roles_and_run_as_internal():
 def test_perm_schema_read_write():
     s = _sc.get('PermModel')
     assert perm.can_read_schema(s, {'roles': ['seller']}) is True
-    assert perm.can_read_schema(s, {'roles': ['admin']}) is True
+    # 清单化语义（设计 §11.5）：admin 不再默认放行——不在白名单即拒，显式豁免后直通
+    assert perm.can_read_schema(s, {'roles': ['admin']}) is False
     assert perm.can_read_schema(s, {'roles': ['guest']}) is False
     assert perm.can_write_schema(s, {'roles': ['seller']}) is True
     assert perm.can_write_schema(s, {'roles': ['guest']}) is False
+    perm.set_exempt_roles(['admin'])
+    assert perm.can_read_schema(s, {'roles': ['admin']}) is True
+    perm.set_exempt_roles([])
 
 
 def test_perm_owner_condition():