velocity-python 0.2.4__tar.gz → 0.2.5__tar.gz

{velocity_python-0.2.4/src/velocity_python.egg-info → velocity_python-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.2.4
+Version: 0.2.5
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.2.4 → velocity_python-0.2.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.2.4"
+version = "0.2.5"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.2.4 → velocity_python-0.2.5}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.2.4"
+__version__ = version = "0.2.5"
 
 import importlib as _importlib
 

{velocity_python-0.2.4 → velocity_python-0.2.5}/src/velocity/aws/authz.py

@@ -80,6 +80,7 @@ from __future__ import annotations
 
 import logging
 import re
+import sys
 from dataclasses import dataclass, field, replace
 from fnmatch import fnmatchcase
 from typing import Any, Callable, Optional
@@ -379,22 +380,42 @@ BUILTIN_RULES = (permit("data.ordinary_tables", DATA_ACCESS, when=_ordinary_tabl
 
 _REGISTERED = {}
 _REGISTERED_TUPLE = None
+# name -> the globals of the module that registered it. A module imported a
+# second time (importlib.reload, a test that patches sys.modules) runs with
+# new globals under the same __name__ and builds new condition closures, so
+# its rules never compare equal to the first import's.
+_OWNERS = {}
 
 
 def register(*rules):
     """Add rules to the ones every handler evaluates. Registering the same
-    rule again is a no-op; a different rule under a taken name is an error."""
+    rule again is a no-op, and so is a module re-registering its own rules
+    when it is imported again (the new rules replace the old). A different
+    rule under a taken name is otherwise an error."""
     global _REGISTERED_TUPLE
+    caller = sys._getframe(1).f_globals
     for rule in rules:
         if not isinstance(rule, Rule):
             raise ValueError("register() takes rules made by permit() or forbid().")
         known = _REGISTERED.get(rule.name)
-        if known is not None and known != rule:
+        if known is not None and known != rule and not _reimported(rule.name, caller):
             raise ValueError(f"An authorization rule named '{rule.name}' exists.")
         _REGISTERED[rule.name] = rule
+        _OWNERS[rule.name] = caller
     _REGISTERED_TUPLE = None
 
 
+def _reimported(name, caller):
+    """True when ``caller`` is a fresh import of the module that registered
+    ``name``: same module name, different globals."""
+    owner = _OWNERS.get(name)
+    return (
+        owner is not None
+        and owner is not caller
+        and owner.get("__name__") == caller.get("__name__")
+    )
+
+
 def registered():
     """Every rule a handler evaluates before its own. The same tuple object
     until a rule is registered, so its action index is built once."""

{velocity_python-0.2.4 → velocity_python-0.2.5/src/velocity_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.2.4
+Version: 0.2.5
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.2.4 → velocity_python-0.2.5}/tests/test_authz.py

@@ -7,6 +7,7 @@ each ``_any`` permission, masquerade, and the audit row.
 """
 
 import logging
+import sys
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -137,6 +138,55 @@ def test_rules_are_validated_and_registered_once():
             authz.register(authz.permit("test.once", "t.write"))
     finally:
         authz._REGISTERED.pop("test.once", None)
+        authz._OWNERS.pop("test.once", None)
+
+
+_MODULE_SOURCE = """
+from velocity.aws import authz
+authz.register(
+    authz.permit(
+        "test.reimport",
+        "t.read",
+        when=authz.any_of(authz.signed_in, authz.holds("t.read")),
+    )
+)
+"""
+
+
+def _import_as(module_name):
+    """Run a module that registers a rule, as a fresh import would: new
+    globals (so new condition closures) under ``module_name``."""
+    exec(_MODULE_SOURCE, {"__name__": module_name})
+
+
+def test_a_module_imported_again_replaces_its_own_rules(_fresh_registry):
+    _import_as("tests.fake_rules")
+    first = authz._REGISTERED["test.reimport"]
+    _import_as("tests.fake_rules")  # a second import of the same module
+    second = authz._REGISTERED["test.reimport"]
+    assert first != second  # new closures: never equal
+    assert authz.registered().count(second) == 1
+    assert first not in authz.registered()
+
+
+def test_another_module_cannot_take_a_registered_name(_fresh_registry):
+    _import_as("tests.fake_rules")
+    with pytest.raises(ValueError, match="exists"):
+        _import_as("tests.other_rules")
+
+
+def test_velocity_handler_mixins_survive_a_second_import(_fresh_registry):
+    """A consumer test that patches sys.modules imports velocity's handler
+    mixins twice; the permissions rules must not refuse the second import."""
+    import importlib
+
+    name = "velocity.aws.handlers.mixins.permissions_actions"
+    original = sys.modules[name]
+    try:
+        sys.modules.pop(name)
+        importlib.import_module(name)
+    finally:
+        sys.modules[name] = original
 
 
 # ── on a handler ─────────────────────────────────────────────────────────────
@@ -484,10 +534,13 @@ def _fresh_registry():
         dict(authz._REGISTERED),
         authz._REGISTERED_TUPLE,
         dict(authz._PERMISSIONS),
+        dict(authz._OWNERS),
     )
     authz._INDEX.clear()
     authz._HANDLER_RULES.clear()
     yield
+    authz._OWNERS.clear()
+    authz._OWNERS.update(saved[3])
     authz._REGISTERED.clear()
     authz._REGISTERED.update(saved[0])
     authz._REGISTERED_TUPLE = saved[1]