n.siegfried
64a5fd5612
Closes known issue 3. server/smoketest.py predated the login portal and had no
login step at all, so auth_gate refused every route after /api/health and the
documented way to verify a deploy reported a wall of failures against a healthy
stack.
- Signs in first, holding the session in an http.cookiejar on a shared opener.
urlopen() has no cookie support, which is why the session was dropped.
- Credentials from WP_SMOKE_USER / WP_SMOKE_PASSWORD, or --user/--password, so
a password need not land in shell history. Refuses to start without them
rather than running headlong into 401s.
- Checks the signed-in role up front and warns when it cannot archive or delete
a project, instead of failing six checks later for an unexplained reason.
- New exit code 2 for "could not run" (unreachable, or credentials missing or
rejected), kept distinct from 1 "ran and found problems".
- Also asserts the session is accepted on an authenticated route and refused
after sign-out; signs out at the end so a run on a shared host leaves none.
The working smoke test immediately caught a real bug: SQLite ships with foreign
keys disabled and the pragma is per-connection, so every ondelete="CASCADE" was
silently a no-op on dev while working on Postgres. Deleting a project orphaned its
SOPs, work packages and membership rows; deleting a user orphaned theirs. db.py
now sets PRAGMA foreign_keys=ON for SQLite, so dev matches production.
Enforcing them exposed two things that had been getting away with it:
- create_user adds an account and its ProjectMember rows in one flush, and the
ORM takes flush order from relationship() declarations. models.py has none by
design, so it emitted the child INSERT first and the database rejected it.
Fixed with a db.flush() after the account, and documented at the top of
models.py so the next same-flush pair does not rediscover it. The other three
call sites already commit the parent first.
- A write aimed at a since-deleted project used to leave an orphan row; with FKs
enforced it would have been an IntegrityError surfacing as a 500, which the
browser outbox retries forever (it only retires 4xx). require_project_writable
now refuses a vanished project with 409, like the archived case beside it.
Verified: smoke test 27/27 exit 0 against a live server (the cascade assertion now
passes on SQLite, which is what used to fail); credentials missing and credentials
rejected both abort cleanly with exit 2 and no stray PASS lines; a project_user run
warns up front and fails as described. Scope tests 93/93, live HTTP checks 29/29,
static JS checks 33/33. No orphan rows left in the database afterwards.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
82 lines
3.1 KiB
Python
82 lines
3.1 KiB
Python
"""Database engine and session setup.
|
|
|
|
Connection precedence:
|
|
1. POSTGRES_USER + POSTGRES_PASSWORD + POSTGRES_DB (preferred) — the URL is
|
|
built with SQLAlchemy's URL.create(), which encodes the password for you,
|
|
so passwords with special characters (@ ! # : / …) need NO manual escaping.
|
|
Host/port default to POSTGRES_HOST=db / POSTGRES_PORT=5432.
|
|
2. DATABASE_URL — a full SQLAlchemy URL, if you'd rather supply one directly
|
|
(you must URL-encode any special characters in the password yourself).
|
|
3. Neither set → a local SQLite file, so the API runs anywhere without Postgres.
|
|
|
|
The schema is identical either way (SQLAlchemy handles dialect differences).
|
|
"""
|
|
import os
|
|
from sqlalchemy import create_engine, event, URL
|
|
from sqlalchemy.orm import sessionmaker, DeclarativeBase
|
|
|
|
# Load a local .env if present (dev convenience).
|
|
try:
|
|
from dotenv import load_dotenv
|
|
load_dotenv()
|
|
except Exception:
|
|
pass
|
|
|
|
|
|
def _resolve_url():
|
|
user = os.getenv("POSTGRES_USER")
|
|
pw = os.getenv("POSTGRES_PASSWORD")
|
|
dbname = os.getenv("POSTGRES_DB")
|
|
if user and pw and dbname:
|
|
# Build from components — password is encoded automatically.
|
|
return URL.create(
|
|
"postgresql+psycopg",
|
|
username=user, password=pw,
|
|
host=os.getenv("POSTGRES_HOST", "db"),
|
|
port=int(os.getenv("POSTGRES_PORT", "5432")),
|
|
database=dbname,
|
|
)
|
|
return os.getenv("DATABASE_URL") or "sqlite:///./wpsuite.db"
|
|
|
|
|
|
DATABASE_URL = _resolve_url()
|
|
|
|
# SQLite needs this flag from FastAPI's threadpool; Postgres ignores it.
|
|
_is_sqlite = isinstance(DATABASE_URL, str) and DATABASE_URL.startswith("sqlite")
|
|
connect_args = {"check_same_thread": False} if _is_sqlite else {}
|
|
|
|
engine = create_engine(DATABASE_URL, connect_args=connect_args, pool_pre_ping=True, future=True)
|
|
|
|
if _is_sqlite:
|
|
# SQLite ships with foreign keys DISABLED and the pragma is per-connection, so
|
|
# without this every `ondelete="CASCADE"` in models.py is silently a no-op on a
|
|
# dev database while working correctly on Postgres. That divergence is worse than
|
|
# it sounds: deleting a project left its SOPs, work packages and membership rows
|
|
# behind as orphans pointing at an id that no longer exists, and deleting a user
|
|
# left their project_members rows — and the smoke test's cascade assertion failed
|
|
# on dev while passing in production, which is the exact failure that makes a
|
|
# smoke test worth ignoring.
|
|
#
|
|
# Registered on the engine, not a session, because the pragma has to be set on
|
|
# each new DBAPI connection as the pool creates it.
|
|
@event.listens_for(engine, "connect")
|
|
def _sqlite_enforce_foreign_keys(dbapi_connection, _record):
|
|
cur = dbapi_connection.cursor()
|
|
cur.execute("PRAGMA foreign_keys=ON")
|
|
cur.close()
|
|
|
|
SessionLocal = sessionmaker(bind=engine, autoflush=False, autocommit=False, future=True)
|
|
|
|
|
|
class Base(DeclarativeBase):
|
|
pass
|
|
|
|
|
|
def get_db():
|
|
"""FastAPI dependency that yields a session and always closes it."""
|
|
db = SessionLocal()
|
|
try:
|
|
yield db
|
|
finally:
|
|
db.close()
|