supabase-orm 0.1.2__tar.gz → 0.1.3__tar.gz

{supabase_orm-0.1.2 → supabase_orm-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: supabase-orm
-Version: 0.1.2
+Version: 0.1.3
 Summary: Lightweight async ORM on top of supabase-py with Pydantic validation.
 Project-URL: Homepage, https://github.com/viperadnan-git/supabase-orm
 Project-URL: Repository, https://github.com/viperadnan-git/supabase-orm
@@ -502,7 +502,7 @@ app = FastAPI(lifespan=lifespan)
 
 ### Per-request RLS via JWT
 
-The client is stored in a `ContextVar`, so each FastAPI request runs in its own copied context. Pair `use_client()` with a per-request authenticated client to isolate the JWT — and therefore the RLS identity — to that request only:
+The default client is a module-level reference set by `lifespan()` (visible to every task — required because ASGI servers spawn each request handler as a sibling task of the lifespan task, not a child). Per-request overrides go through `use_client()`, which uses a `ContextVar` so concurrent requests don't see each other's clients. Pair the two for safe per-request RLS:
 
 ```python
 from supabase import acreate_client

{supabase_orm-0.1.2 → supabase_orm-0.1.3}/README.md

@@ -468,7 +468,7 @@ app = FastAPI(lifespan=lifespan)
 
 ### Per-request RLS via JWT
 
-The client is stored in a `ContextVar`, so each FastAPI request runs in its own copied context. Pair `use_client()` with a per-request authenticated client to isolate the JWT — and therefore the RLS identity — to that request only:
+The default client is a module-level reference set by `lifespan()` (visible to every task — required because ASGI servers spawn each request handler as a sibling task of the lifespan task, not a child). Per-request overrides go through `use_client()`, which uses a `ContextVar` so concurrent requests don't see each other's clients. Pair the two for safe per-request RLS:
 
 ```python
 from supabase import acreate_client

{supabase_orm-0.1.2 → supabase_orm-0.1.3}/src/supabase_orm/_client.py

@@ -66,13 +66,29 @@ from ._exceptions import SupabaseORMUsageError
 
 _log = logging.getLogger("supabase_orm")
 
-_client: ContextVar[AsyncClient | None] = ContextVar(
-    "supabase_orm_client", default=None
+# Two-level lookup:
+#
+#   * ``_default_client`` is a module global, set by ``set_client()`` /
+#     ``lifespan()``. Visible to every task on the loop — the right
+#     semantics for "app-wide default set at startup," which under ASGI
+#     servers (uvicorn/hypercorn) means a *different* task than the one
+#     handling each request. ContextVar inheritance only works for child
+#     tasks of the setter; ASGI request handlers are siblings, not
+#     children, so a ContextVar-only design silently sees ``None``.
+#
+#   * ``_client_override`` is a ``ContextVar``, set by ``use_client()``.
+#     Per-task isolated for safe per-request RLS overrides without leaking
+#     across concurrent requests.
+#
+# ``get_client()`` checks the override first, falls back to the default.
+_default_client: AsyncClient | None = None
+_client_override: ContextVar[AsyncClient | None] = ContextVar(
+    "supabase_orm_client_override", default=None
 )
 
 
 def get_client() -> AsyncClient:
-    c = _client.get()
+    c = _client_override.get() or _default_client
     if c is None:
         raise SupabaseORMUsageError(
             "Supabase AsyncClient not initialized. "
@@ -83,13 +99,14 @@ def get_client() -> AsyncClient:
 
 
 def set_client(client: AsyncClient | None) -> None:
-    """Bind ``client`` in the current async context.
+    """Bind ``client`` as the app-wide default.
 
-    Call from app startup (or use :func:`lifespan`) to set the
-    app-wide default; per-request overrides should prefer
-    :func:`use_client` so the previous binding is restored on exit.
+    Visible to every task. Call from app startup (or use :func:`lifespan`).
+    For per-request overrides that must not leak across concurrent requests,
+    use :func:`use_client` instead.
     """
-    _client.set(client)
+    global _default_client
+    _default_client = client
 
 
 @asynccontextmanager
@@ -97,32 +114,34 @@ async def use_client(client: AsyncClient) -> AsyncIterator[AsyncClient]:
     """Bind ``client`` for the duration of the ``async with`` block only.
 
     Restores the previous binding on exit. Safe under concurrent FastAPI
-    requests: each request runs in its own copied context, so the
-    override never leaks across requests::
+    requests: each request runs in its own task with its own ContextVar
+    snapshot, so the override never leaks across requests::
 
         async with use_client(per_request_client):
             row = await Pet.get(some_id)
     """
-    token = _client.set(client)
+    token = _client_override.set(client)
     try:
         yield client
     finally:
-        _client.reset(token)
+        _client_override.reset(token)
 
 
 @asynccontextmanager
 async def lifespan(url: str, key: str) -> AsyncIterator[AsyncClient]:
     """Async context manager that owns one AsyncClient for its lifetime.
 
-    Yields the client so callers can stash it on app state if they want;
-    most code should just import ``get_client`` from inside request handlers.
+    Sets the client as the app-wide default via :func:`set_client`, so
+    request handlers spawned in sibling tasks (the standard ASGI shape)
+    can find it. Yields the client so callers can stash it on app state
+    if they want.
     """
     client = await acreate_client(url, key)
-    token = _client.set(client)
+    set_client(client)
     try:
         yield client
     finally:
-        _client.reset(token)
+        set_client(None)
         # Best-effort teardown of the underlying httpx pools. supabase-py's
         # AsyncClient doesn't expose a top-level close as of 2.x; we close
         # each subclient that does so connection pools drain cleanly on

{supabase_orm-0.1.2 → supabase_orm-0.1.3}/src/supabase_orm/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.2'
-__version_tuple__ = version_tuple = (0, 1, 2)
+__version__ = version = '0.1.3'
+__version_tuple__ = version_tuple = (0, 1, 3)
 
 __commit_id__ = commit_id = None

{supabase_orm-0.1.2 → supabase_orm-0.1.3}/tests/test_client.py

@@ -12,7 +12,7 @@ from supabase_orm import (
     set_client,
     use_client,
 )
-from supabase_orm._client import _client
+from supabase_orm._client import _client_override
 
 
 def test_get_client_without_init_raises():
@@ -87,13 +87,67 @@ async def test_use_client_restores_even_on_exception():
 # ─── ContextVar semantics ────────────────────────────────────────────────
 
 
-def test_client_is_a_contextvar():
-    """Sanity check: the storage backend is a ContextVar (not a module
-    global). Documents the design assumption that per-request isolation
-    relies on."""
+def test_override_is_a_contextvar():
+    """Sanity check: the per-request override backend is a ContextVar so
+    use_client() doesn't leak across concurrent requests."""
     from contextvars import ContextVar
 
-    assert isinstance(_client, ContextVar)
+    assert isinstance(_client_override, ContextVar)
+
+
+# ─── Regression: lifespan task vs request task (the FastAPI bug) ─────────
+
+
+async def test_set_client_visible_across_independent_tasks():
+    """Reproduces the bug a ContextVar-only design has under ASGI servers.
+
+    Uvicorn runs ``lifespan`` in one task and each request handler in a
+    separate, sibling task. ``ContextVar.set()`` only mutates the
+    setter's own context; sibling tasks (request handlers) inherit
+    uvicorn's root context, where the var is still its default.
+
+    set_client() must therefore propagate to ALL tasks — not just
+    descendants of the setter — by storing in a module global. This test
+    spawns the setter as a finished sibling task, then a separate reader
+    task; the reader must see what the setter wrote."""
+    sentinel = object()
+
+    async def setter() -> None:
+        set_client(sentinel)  # type: ignore[arg-type]
+
+    async def reader():
+        return get_client()
+
+    try:
+        await asyncio.create_task(setter())  # completes before we read
+        result = await asyncio.create_task(reader())
+        assert result is sentinel
+    finally:
+        set_client(None)
+
+
+async def test_use_client_override_still_isolated_per_task():
+    """The default is a global, but per-request use_client() overrides
+    must STILL be ContextVar-isolated — otherwise concurrent requests
+    overwrite each other's RLS-scoped client."""
+    default = object()
+    set_client(default)  # type: ignore[arg-type]
+
+    async def request(label: str) -> tuple[object, object]:
+        per_request = f"client-{label}"
+        async with use_client(per_request):  # type: ignore[arg-type]
+            await asyncio.sleep(0)  # let other tasks run between set & read
+            return get_client(), per_request  # type: ignore[return-value]
+
+    try:
+        results = await asyncio.gather(request("a"), request("b"), request("c"))
+        # Each task saw its own override, not anyone else's.
+        for got, expected in results:
+            assert got == expected
+        # After all overrides exit, default is back.
+        assert get_client() is default
+    finally:
+        set_client(None)
 
 
 # ─── QueryBuilder resolves client at terminal time, not chain start ──────