Skip to content

Tech-debt batch 13: apply role grants, module settings and flag overrides after commit, across workers (#621) - #646

Merged
antosubash merged 5 commits into
mainfrom
fix/debt-batch-13
Oct 24, 2026
Merged

antosubash merged 5 commits into
mainfrom
fix/debt-batch-13

Conversation

@antosubash

Copy link
Copy Markdown
Owner

Tech-debt batch 13 — admin changes now reach every worker, and only after commit (#621).

Role→permission edits (permissions), module settings saves (settings/reload.py) and feature-flag overrides used to mutate the handling worker's in-memory state inside the request, before commit, and never told other workers: with N workers, revoking a permission, enabling site_lock or flipping a kill switch affected one worker until restart, and a rolled-back request left that worker enforcing state the DB didn't have.

  • Each change is applied from db.on_commit and published on the InvalidationBus; every worker re-hydrates from the DB (modules/{settings,permissions,feature_flags}/…/invalidation.py).
  • New simple_module_core.invalidation_refresh.InvalidationRefresh: serialized reloads + a 30 s periodic reload as the staleness floor when messages are missed (in-process bus or Redis outage). Per-package isolation, no-op on identical snapshots, quiet on an unmigrated DB.
  • SettingsReloaded now fires on re-hydration (after commit), only when values changed.
  • Branding builds responses from the validated settings and reads replaced asset ids from the DB.
  • Test plugin fix (latent on main): the app fixture's alembic-heads lookup was lru_cached; an autouse SM_PROJECT_ROOT=tmp_path fixture could cache () for the whole xdist worker, after which every app in that worker refused to boot ("36 revision(s) behind"). Order-dependent on main too (reproduced with test_cli_import.py + test_env_pinned.py).

Verification

  • Red/green: 26 new regression tests failed on main, pass here.
  • make lint ✓ · make test-py (8 workers) ✓ 6038 passed · make test-js ✓ 770 · Postgres (settings, feature_flags, permissions, branding, core, testing) ✓ 1343 passed.
  • /ship: code review (pass 1: 5 fixed; pass 2 clean) → QA against 2 uvicorn workers: with the Redis invalidation transport every change was visible on both workers in ~0.4 s (24/24 requests); with the in-process bus, workers converged within the 30 s periodic reload; invalid saves (422) changed nothing on either worker; settings / feature-flag / role-edit UI flows correct; no tracebacks or reload-failure spam.

Closes #621

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

…ommit, across workers (#621)

Changes now apply from db.on_commit and propagate through the InvalidationBus;
every worker re-hydrates from the DB, with a 30 s periodic reload as the
staleness floor. Branding builds responses from the validated settings and
reads the previous asset ids from the DB.

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4
…worker

An autouse SM_PROJECT_ROOT=tmp_path fixture made the lru_cached lookup return ()
once, so every later app fixture in that xdist worker skipped stamping and the
lifespan refused to boot ('36 revision(s) behind'). Order-dependent on main too.

Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review 🔄 Running since 2026-10-24T12:06:51.395275Z 226be5d PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

Deploying simple-module-python with  Cloudflare Pages  Cloudflare Pages

Latest commit: befc1ee
Status: ✅  Deploy successful!
Preview URL: https://e5d4a148.simple-module-python.pages.dev
Branch Preview URL: https://fix-debt-batch-13.simple-module-python.pages.dev

View logs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Admin changes to role permissions, module settings and feature flags apply in one worker only, before commit

1 participant