Fix #413–#424: tenancy API and Vary, outer-join tenant filter, i18n overrides, admin a11y by antosubash · Pull Request #425 · antosubash/simple_module_python

antosubash · 2026-10-09T10:18:45Z

Summary

Fixes twelve issues filed on 2026-10-08 in one batch. Design: docs/superpowers/specs/2026-10-09-issue-batch-413-424-design.md. Plan: docs/superpowers/plans/2026-10-09-issue-batch-413-424.md. #317 is not included: it needs access to the external design file.

Tenancy

hosting: TenantMiddleware drops existing Vary header lines, including Vary: *, when it adds its own #423: TenantMiddleware merges every Vary line and never drops Vary: *. Existing tokens are de-duplicated case-insensitively.
hosting: a resolver returning TenantResolution(None, source) leaves tenant_source set with no tenant bound #424: tenant_source is None whenever no tenant is bound.
hosting: publish tenancy mode, single-tenant id and a tenant-binding dependency so modules stop re-implementing them #418: new public API in simple_module_hosting.tenancy: TenancyMode, tenancy_mode, single_tenant_id, require_tenant() and tenant_vary. require_tenant() is an async yield dependency that binds the tenant through the commit. A test fails if that binding breaks.
hosting: publish tenancy mode, single-tenant id and a tenant-binding dependency so modules stop re-implementing them #418, Vary completeness:
- The tenants resolver adds Cookie whenever a signed-in user shaped the answer: session, header and subdomain sources.
- Claim-sourced tenants vary on Cookie, Authorization.
- Anonymous public pages stay cacheable.
- The session middleware no longer emits a duplicate Cookie token.
db: tenant filter adds the nullable side of a LEFT OUTER JOIN to WHERE when its column is only inside an aggregate (func.count(Child.id)) #417: the tenant/soft-delete filter keeps ORM LEFT outer joins outer, including relationship paths (.outerjoin(Parent.children), with or without of_type). Unused parents are no longer dropped from count() queries. Leak guards check that another tenant's rows are never counted.
Session listener registration (found during review): attach_session_listeners now marks each session class instead of using event.contains, which keys on id().
- The bug: a new session class that reused a garbage-collected class's id was skipped, so it ran with no tenant filter.
- Single-app worker processes were not affected.
- Multi-app processes were (the test suite, scripts, embedders), so an order-dependent subset of tests was running unfiltered.

Background tasks

background_tasks: admin page 500s on Postgres (naive vs aware datetime in success_count_since) #413: already fixed on main by fix(migrations): make SQLite-autogenerated revisions portable to Postgres (#342) #406, which is not in a release yet. This PR only adds regression tests: the columns are timezone-aware, and success_count_since binds an aware cutoff on Postgres.

Auth

auth: subresource requests overwrite the post-login next target (sign-in lands on /favicon.ico) #416: only navigations and Inertia visits record the post-login target. A favicon, script or fetch() no longer overwrites it.

i18n

i18n: host apps cannot override module copy (e.g. sign-in aside text) #415: host override layer, host/locales/overrides/<lang>.json, keyed by full dotted path.
- Overrides replace existing keys only; admin-only keys stay admin-only.
- Unknown keys are reported as SM027 by make doctor and at dev boot.
- Malformed override JSON is reported as SM016 instead of crashing doctor.

Build

hosting: gen-pages @source never reaches subdirectories of wheel modules in a uv venv — .venv/.gitignore '*' hides them from Tailwind (follow-up to #258) #419: gen-pages emits one @source per wheel-module subdirectory that holds .ts/.tsx files, so uv's .venv/.gitignore no longer hides those subdirectories from Tailwind.

UI and admin

ui: sign-in aside footer text fails WCAG AA contrast (2.7:1) #414: the sign-in aside footer is now 5.5:1 against its background.
ui: --primary-foreground stays white under a light brand colour, and the sidebar active row hard-codes text-white — admin buttons fail WCAG AA (2.2:1 on #62B8E2) #420: --primary-foreground and --sidebar-primary-foreground are chosen by WCAG contrast against the brand colour. The active sidebar row uses them. The branding live preview now does too.
Branding colour field (found in QA, beyond ui: --primary-foreground stays white under a light brand colour, and the sidebar active row hard-codes text-white — admin buttons fail WCAG AA (2.2:1 on #62B8E2) #420): it validates hex input and normalises #abc and F5F5F5 to #rrggbb. Publish stays disabled while the value is invalid.
ui: NativeSelect applies className to the inner select, so w-full cannot widen its w-fit wrapper #421: NativeSelect gets a wrapperClassName prop.
admin: empty <title> on /admin/users/, no h1 on /admin/settings/, and admin 404/422 render outside the admin shell #422:
- Every admin page has a <Head title>, enforced by a guard test.
- /admin/settings/ has a visible h1.
- Admin 404 and 422 pages render inside AdminLayout for signed-in admins; anonymous viewers and pre-shared-props errors still get the bare page.

Deviations from the approved design (all reviewed):

background_tasks: admin page 500s on Postgres (naive vs aware datetime in success_count_since) #413: tests only; the model was already fixed by fix(migrations): make SQLite-autogenerated revisions portable to Postgres (#342) #406.
auth: subresource requests overwrite the post-login next target (sign-in lands on /favicon.ico) #416: a request with no fetch metadata still records the target, which is the old behaviour. Every current browser sends Sec-Fetch-Dest on subresources.
db: tenant filter adds the nullable side of a LEFT OUTER JOIN to WHERE when its column is only inside an aggregate (func.count(Child.id)) #417: FULL outer joins are never exempted. An ON predicate never filters a FULL join's preserved side, so exempting them leaked rows. Raw-table outer-join targets keep their WHERE predicate.
ui: --primary-foreground stays white under a light brand colour, and the sidebar active row hard-codes text-white — admin buttons fail WCAG AA (2.2:1 on #62B8E2) #420: the BrandingMark logo badge stays white. It sits on a gradient of fixed-lightness ramp steps, so the brand-colour ink made it worse.
Vary: Cookie: extended from the session source to every signed-in branch (above).

Verification

Browser-verified on Postgres at /admin/users/ and the other touched pages, on port 8201 single-tenant and 8202 multi-tenant.
Console: no errors, apart from the intentional 404 resource errors.
Local CI:
- lint, ty, Biome, tsc, the 300-line cap and the untranslated-string check
- Python 3894 passed; JS 523 passed
- build
- full e2e suite: 46 passed
Postgres suites (db, tenancy, tenants, background_tasks, users) and the migrations round-trip are green.
Verification report: https://claude.ai/artifact/RjngNVs4jxB1fYjPiE79dW

QA Report

Full QA cycle completed in 2 iterations.
2 bugs found, 2 fixed: the branding preview's foreground ink, and colour-field validation.
Categories tested: happy path, form validation, error states and edge cases, plus multi-tenant tenancy (the NativeSelect invite/members pages and Vary headers verbatim).
Follow-ups (P3, not addressed here):
- ?q=%00 in users or background-tasks search returns 500 on Postgres. This predates the branch.
- /admin/settings/ nests two <main> landmarks.
- The admin 404's "Go home" goes to /dashboard/.
- A whitespace-only users search shows "No users match".
Full QA report: https://claude.ai/artifact/CSxvHoFHENcyENuDs2zCg8

Report links are Claude Artifacts and start private — the author can share them
from claude.ai/code/artifacts if reviewers need access.

Test plan

Sign out, open /admin/settings/, sign in, and confirm you land back on /admin/settings/.
Open /admin/users/00000000-0000-0000-0000-000000000000 as an admin and confirm the 404 renders inside the admin sidebar layout.
In /admin/branding/, set a light colour (#62B8E2) and confirm the primary buttons and the active sidebar row use dark text.
On Postgres, /admin/background-tasks/ loads.
CI is green.

Closes #413, closes #414, closes #415, closes #416, closes #417, closes #418, closes #419, closes #420, closes #421, closes #422, closes #423, closes #424

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…enant (#423, #424) Also records the resolution's vary on request.state.tenant_vary and makes the claim path vary on Cookie, Authorization. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…ant (#418) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…418) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

A child column used only inside a function (func.count(Child.id)) loses its ORM annotation, so _plain_tables took the outer-joined child for a Core table and added WHERE child.tenant_id = :t, turning the LEFT JOIN into an inner join. Exclude a columns-clause table from the WHERE candidates only when it is the target of an outer/full join in _setup_joins whose target is a plain ORM entity carrying loader criteria (they already sit in ON). Raw Model.__table__ targets keep the WHERE predicate; strict mode without a tenant still refuses. Pins the pre-existing Core outer join leak as a strict xfail. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

A FULL join preserves its right side, and an ON predicate never removes a preserved row: with the child's WHERE gone, other tenants' (and trashed) child rows came back as unmatched rows. Exempt LEFT outer joins only, and pin it with FULL-join tests over a non-tenant left model. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…nt_since (#413) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…415) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

host/locales/overrides/<locale>.json replaces existing keys by full dotted path after all catalogs; unknown keys are skipped and reported as SM027. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…ntrast (#414, #420) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…ol (#421) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…hell (#422) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…lter (#417) .outerjoin(Parent.kids) and .outerjoin(Parent.kids.of_type(Kid)) record the relationship attribute as the join target, so the ON-covered exclusion never matched and func.count(Kid.id) still added WHERE kid.tenant_id = :t, dropping parents without children. Resolve the relationship's target mapper and apply the existing entity rules (LEFT only, covered class, single table, tenant bound). secondary relationships and aliased of_type keep their WHERE. Also: TenancyMode in simple_module_core.tenancy.__all__; mode_for dropped from simple_module_hosting.tenancy.__all__ (internal to create_app). Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…#415) make doctor rebuilt the catalog from modules + host + ui but not the framework's own hosting namespace (setup wizard), so every valid hosting.* host override was reported as SM027. Locate simple_module_hosting/locales via importlib.util.find_spec (core must not import hosting) and add it like the running app's build_i18n_registry does. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

attach_session_listeners guarded with event.contains, which SQLAlchemy keys on id(target): a new session class reusing a garbage-collected class's id read as already wired and got no tenant stamping, no tenant/soft-delete filter and no write marker. Guard with a marker in the class's own __dict__ instead. Found as an order-dependent test failure (a request's write never committed) that the new relationship outer-join tests shifted into view. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…d read_catalog Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…d local import Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

@source

- tenants resolver varies on Cookie whenever a signed-in user shaped the answer - session middleware no longer emits a duplicate Cookie in Vary - session listeners: a subclass of a wired class inherits its listeners once - doctor reports malformed override JSON as SM016 instead of crashing - gen-pages prunes node_modules/__pycache__ during the @source walk - settings: group headings are h3 under the module h2 Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

chatgpt-codex-connector · 2026-10-09T10:19:06Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-09T10:24:13.440121Z	`6961aee`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

cloudflare-workers-and-pages · 2026-10-09T10:20:30Z

Deploying simple-module-python with Cloudflare Pages

Latest commit:	`6961aee`
Status:	✅ Deploy successful!
Preview URL:	https://28671ac3.simple-module-python.pages.dev
Branch Preview URL:	https://feat-issue-batch-413-424.simple-module-python.pages.dev

View logs

antosubash added 30 commits October 9, 2026 07:33

docs: issue-batch-413-424 design

96a2c87

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

docs: issue-batch-413-424 implementation plan

6dba0f7

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(hosting): merge every Vary line and blank tenant_source with no t…

cb6d1ce

…enant (#423, #424) Also records the resolution's vary on request.state.tenant_vary and makes the claim path vary on Cookie, Authorization. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

feat(hosting): publish tenancy mode, single-tenant id and require_ten…

0213b1e

…ant (#418) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

test(hosting): pin require_tenant commit-time binding (#418)

044a35e

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(tenants): vary on Cookie when the tenant comes from the session (#…

6b11a99

…418) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

test(background_tasks): pin timezone-aware timestamps for success_cou…

64de87c

…nt_since (#413) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(auth): record the post-login target only for navigations (#416)

da58ea3

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

refactor(i18n): split flatten and registry build out of capped files (#…

ff52b39

…415) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

feat(i18n): host override layer for module copy (#415)

8875dd9

host/locales/overrides/<locale>.json replaces existing keys by full dotted path after all catalogs; unknown keys are skipped and reported as SM027. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(i18n): doctor reports SM027; overrides reach default-only keys (#415

0f56061

) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(hosting): emit @source per wheel-module subdirectory (#419)

87f8a4c

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(ui): brand foreground ink by WCAG contrast; raise aside footer co…

1813c0c

…ntrast (#414, #420) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(ui): keep the logo badge initial white on the ramp gradient (#420)

64b1f22

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

feat(ui): NativeSelect wrapperClassName so callers can size the contr…

49199d7

…ol (#421) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(admin): page titles, settings h1, admin errors inside the admin s…

cd0e6be

…hell (#422) Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(admin): visible settings heading; ErrorShell out of pages/ (#422)

9f145d6

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

docs: ruff-format plan snippets

b5a5106

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

docs: changelog for #413–#424

06dbbcc

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

docs: add running-the-stack skill

86ac7ea

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

docs: changelog for the session-listener registration fix

b8be1f0

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

refactor(optimize): duplication — fold duplicated test helpers, share…

8d95a70

…d read_catalog Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

refactor(optimize): over-engineering — drop redundant guards, args an…

e291718

…d local import Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

fix(qa): BUG-001, BUG-002 — branding preview ink and colour validation

6961aee

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

antosubash merged commit 3b4415d into main Oct 11, 2026
14 checks passed

Navigation Menu

Repository navigation

Fix #413–#424: tenancy API and Vary, outer-join tenant filter, i18n overrides, admin a11y - #425

Fix #413–#424: tenancy API and Vary, outer-join tenant filter, i18n overrides, admin a11y#425
antosubash merged 30 commits into
mainfrom
feat/issue-batch-413-424

antosubash commented Oct 9, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

antosubash commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

QA Report

Test plan

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 9, 2026

Deploying simple-module-python with Cloudflare Pages

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

antosubash commented Oct 9, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading