timber-common 1.2.0__tar.gz → 1.2.2__tar.gz

{timber_common-1.2.0 → timber_common-1.2.2}/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to Timber will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.2] - 2026-10-24
+
+### Fixed
+
+- Reject malformed and unknown database filters instead of dropping their predicates.
+- Require non-empty filter dictionaries for updates and deletes, and preserve null
+  filters as SQL `IS NULL` predicates so a scoped mutation cannot become table-wide.
+
+## [1.2.1] - 2026-10-06
+
+### Fixed
+
+- **`import common` failed on a fresh install with `No module named 'psycopg'`.**
+  SQLAlchemy 2.1 changed the driver a bare `postgresql://` URL selects from
+  psycopg2 to psycopg (v3). timber allows `sqlalchemy = "^2.0.36"`, which admits
+  2.1, and depends on `psycopg2-binary` only, and `db_utils` builds an engine at
+  import time. So any install without a lock file (a fresh venv, a domain
+  package's CI, a host-side script) broke on import. Services were unaffected only
+  because grove's lock holds SQLAlchemy 2.0.51; the first `poetry update` that
+  moved it would have broken grove at boot.
+
+  Every `create_engine` call now goes through `common.utils.db_url.with_pinned_driver`,
+  which turns `postgresql://` and `postgres://` into `postgresql+psycopg2://`.
+  `config.DATABASE_URL` is NOT rewritten, because `Config.validate` and callers in
+  other repos compare it against `postgresql://`. An AST test fails if a new
+  `create_engine` call skips the pin. Verified in a clean SQLAlchemy 2.1.3 venv
+  with no psycopg v3 installed: `import common` succeeds and the engine's driver is
+  psycopg2.
+
 ## [1.2.0] - 2026-10-06
 
 ### Added

{timber_common-1.2.0 → timber_common-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: timber-common
-Version: 1.2.0
+Version: 1.2.2
 Summary: Configuration-driven persistence library with ml tools (finance related) config driven db model registration, llm model choice, automatic encryption, caching, vector search, and GDPR compliance for Python applications
 License: Apache-2.0
 Keywords: orm,sqlalchemy,persistence,vector-search,semantic-search,encryption,gdpr,yaml-config,postgres,redis,configuration-driven,data-modeling,machine-learning,embeddings

{timber_common-1.2.0 → timber_common-1.2.2}/common/models/base.py

@@ -13,6 +13,7 @@ from sqlalchemy import create_engine, event, text
 from sqlalchemy.orm import declarative_base
 from sqlalchemy.orm import sessionmaker, Session, scoped_session
 from sqlalchemy.pool import QueuePool
+from common.utils.db_url import with_pinned_driver
 from sqlalchemy.exc import OperationalError, DBAPIError
 from contextlib import contextmanager
 from typing import Optional, Generator
@@ -98,7 +99,7 @@ class DatabaseManager:
                 
                 # Create engine with connection pooling
                 self._engine = create_engine(
-                    database_url,
+                    with_pinned_driver(database_url),
                     echo=echo,
                     poolclass=QueuePool,
                     pool_size=pool_size,

{timber_common-1.2.0 → timber_common-1.2.2}/common/services/db_service.py

@@ -22,6 +22,7 @@ from sqlalchemy.exc import OperationalError, DBAPIError, IntegrityError
 from sqlalchemy.pool import QueuePool
 
 from common.utils.config import config
+from common.utils.db_url import with_pinned_driver
 
 logger = logging.getLogger(__name__)
 
@@ -81,7 +82,7 @@ class DBService:
             try:
                 # Create engine with connection pooling
                 self._engine = create_engine(
-                    db_url,
+                    with_pinned_driver(db_url),
                     echo=config.DATABASE_ECHO,
                     poolclass=QueuePool,
                     pool_size=pool_config['pool_size'],
@@ -322,29 +323,18 @@ class DBService:
     
     def _apply_filters(self, query, model_class: Type, filters: Dict[str, Any]):
         """Apply filters to query."""
-        # Handle None or empty filters
-        if not filters:
-            return query
-        
-        # Handle string filters (invalid input - return unfiltered)
-        if isinstance(filters, str):
-            logger.warning(f"Received string filters instead of dict: {filters}")
-            return query
-        
-        # Handle non-dict filters
+        if filters is None:
+            filters = {}
         if not isinstance(filters, dict):
-            logger.warning(f"Received non-dict filters: {type(filters)}")
-            return query
-        
-        # Apply filters
+            raise ValueError("Filters must be a dict")
+        unknown = [field for field in filters if not hasattr(model_class, field)]
+        if unknown:
+            raise ValueError(f"Unknown filter fields: {', '.join(map(str, unknown))}")
         for field, value in filters.items():
-            if value is not None:  # Skip None values
-                if hasattr(model_class, field):
-                    query = query.filter(getattr(model_class, field) == value)
-                else:
-                    logger.warning(f"Model {model_class.__name__} has no field '{field}'")
+            # SQLAlchemy translates None to IS NULL; dropping it broadens scope.
+            query = query.filter(getattr(model_class, field) == value)
         return query
-    
+
     def _apply_ordering(self, query, model_class: Type, order_by):
         """Apply ordering to a query.
 
@@ -461,8 +451,7 @@ class DBService:
             logger.warning(f"Filters passed as string, using empty filters. Got: {filters}")
             filters = {}
         elif not isinstance(filters, dict):
-            logger.warning(f"Filters not a dict (type: {type(filters)}), using empty filters")
-            filters = {}
+            raise ValueError("Filters must be a dict")
         
         if include_relationships is None:
             include_relationships = []
@@ -593,6 +582,9 @@ class DBService:
                 data={'status': 'completed'}
             )
         """
+        if not isinstance(filters, dict) or not filters:
+            raise ValueError("Mutations require a non-empty filter dict")
+
         model_class = self._get_model_class(model)
         
         with self.session_scope() as session:
@@ -626,6 +618,9 @@ class DBService:
                 filters={'id': 'goal-123'}
             )
         """
+        if not isinstance(filters, dict) or not filters:
+            raise ValueError("Mutations require a non-empty filter dict")
+
         model_class = self._get_model_class(model)
         
         with self.session_scope() as session:

timber_common-1.2.2/common/utils/db_url.py

@@ -0,0 +1,41 @@
+# timber/common/utils/db_url.py
+"""Name the Postgres driver in every URL handed to ``create_engine``.
+
+⚠️⚠️ SQLALCHEMY 2.1 CHANGED WHAT ``postgresql://`` MEANS. Under 2.0 a bare
+``postgresql://`` URL selects psycopg2; under 2.1 it selects psycopg (v3).
+timber declares ``sqlalchemy = "^2.0.36"``, which admits 2.1, and depends on
+``psycopg2-binary`` only. So any install without a lock file (a fresh venv, a
+domain package's CI, a host-side script) got SQLAlchemy 2.1.3 and failed on
+``import common`` with ``No module named 'psycopg'``, because ``db_utils``
+builds an engine at import time. Measured 2026-10-06 in a clean venv. The
+services were unaffected only because grove's lock holds 2.0.51, so the first
+``poetry update`` that moved SQLAlchemy would have broken grove at boot.
+
+The fix is to say which driver we mean, at the boundary where the URL becomes
+an engine, so the URL and the declared dependency can never disagree again.
+``config.DATABASE_URL`` itself is NOT rewritten: ``Config.validate`` and callers
+in other repos compare it against ``postgresql://``.
+"""
+
+from __future__ import annotations
+
+__all__ = ["PG_DRIVER", "with_pinned_driver"]
+
+#: The driver timber declares in pyproject. Change both together or neither.
+PG_DRIVER = "psycopg2"
+
+_BARE_SCHEMES = ("postgresql://", "postgres://")
+
+
+def with_pinned_driver(url: str) -> str:
+    """``postgresql://…`` to ``postgresql+psycopg2://…``; anything else unchanged.
+
+    A URL that already names a driver (``postgresql+psycopg://``) is the
+    caller's explicit choice and is left alone. So is SQLite.
+    """
+    if not url:
+        return url
+    for scheme in _BARE_SCHEMES:
+        if url.startswith(scheme):
+            return f"postgresql+{PG_DRIVER}://" + url[len(scheme):]
+    return url

{timber_common-1.2.0 → timber_common-1.2.2}/common/utils/db_utils.py

@@ -8,6 +8,7 @@ from sqlalchemy.orm import sessionmaker, Session, DeclarativeBase
 from sqlalchemy.pool import StaticPool
 
 from common.utils.config import config
+from common.utils.db_url import with_pinned_driver
 
 
 class Base(DeclarativeBase):
@@ -41,7 +42,7 @@ class DatabaseManager:
             if ":memory:" in self.database_url:
                 engine_kwargs["poolclass"] = StaticPool
         
-        self.engine = create_engine(self.database_url, **engine_kwargs)
+        self.engine = create_engine(with_pinned_driver(self.database_url), **engine_kwargs)
         self.SessionLocal = sessionmaker(
             autocommit=False,
             autoflush=False,

{timber_common-1.2.0 → timber_common-1.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "timber-common"
-version = "1.2.0"
+version = "1.2.2"
 description = "Configuration-driven persistence library with ml tools (finance related) config driven db model registration, llm model choice, automatic encryption, caching, vector search, and GDPR compliance for Python applications"
 authors = ["Pumulo Sikaneta <pumulo@gmail.com>"]
 maintainers = ["Pumulo Sikaneta <pumulo@gmail.com>"]