fix(storage): address PR #798 round-3 review (SonarQube + pool sizing + RETURNING test)
Round-3 fixes. Two threads: - 9 OPEN SonarQube issues caused the "E Security Rating on New Code" gate failure. The bot's diagnosis (sa.text(text_sql) → SQL injection) was a wrong guess; the actual SQ rules firing were different. - Bot's substantive concerns: pool defaults too aggressive, delete_browser_session RETURNING path untested on Postgres, schema_version legacy table created on Postgres, stale module docstring. - User's underlying question on the pool: "isn't 1 connection enough?" Right-sized to 2+5 and documented the concurrency model in ADR-026 so the rationale is durable. SonarQube quality-gate fixes (clears all 9 OPEN issues) ------------------------------------------------------- - BLOCKER S6418: rename `SECRET` constant in test_storage_logging.py to `SENTINEL_PASSWORD_FRAGMENT` + NOSONAR with rationale. - CRITICAL S3776: extract `_build_postgres_engine()` from `initialize()` (was complexity 26 > 15); incidentally creates a clean unit-test seam for engine args. - CRITICAL S4423: `ssl.create_default_context(cafile=...)` is flagged as "weak protocol" — Python 3.10+ already negotiates the strongest available protocol. Explicitly pass `purpose=ssl.Purpose.SERVER_AUTH` and NOSONAR with the Python-version rationale. - MAJOR S3358: split the TLS-mode nested ternary in the engine factory into a `_describe_ssl_arg()` helper. - MAJOR S2068 ×3: bind test app-password literals to local vars and put `# NOSONAR S2068` on the same line as the literal (anchoring requirement) instead of on the closing paren. - MINOR S7503 ×2: `# NOSONAR S7503` on `_Cursor.__aenter__/__aexit__` — they MUST be `async` per the context-manager protocol. Pool sizing right-sized (answers "why so many connections?") ------------------------------------------------------------ - `DATABASE_POOL_SIZE` default 10 → **2**. - `DATABASE_MAX_OVERFLOW` default 20 → **5**. - Per-pod max drops from 30 to 7. With 3 replicas, total = 21 connections (was 90) — well under managed-Postgres `max_connections=100`. - New INFO log at startup: `Postgres engine ready: pool_size=N max_overflow=M (per-pod max K connections)`. Surfaces the active sizing without grepping config. - New ADR-026 § "Concurrency model and pool sizing" explains asyncpg's single-flight connection semantics, the MCP workload shape (read-mostly point lookups), why-not-1 (multi-user serialization), and the tune-up/tune-down recipe. - `docs/configuration.md` table updated with new defaults + homelab-vs-prod tuning guidance, linking the ADR. RETURNING path covered on Postgres ---------------------------------- - New `test_browser_session_delete_returning` exercises the `DELETE … RETURNING user_id` path — the only RETURNING clause in the storage layer and the most dialect-sensitive SQL in this PR. Asserts both present-row (returns True, row gone) and absent-row (returns False) branches. Schema portability polish ------------------------- - `alembic 001`: gate `schema_version` table creation on `op.get_bind().dialect.name == "sqlite"`. The table exists purely to match the fingerprint of pre-Alembic SQLite databases; fresh Postgres installs no longer carry the dead legacy table. Misc polish ----------- - Module docstring: "SQLite-based" → "SQL-backed", with a sentence on the DATABASE_URL opt-in and an ADR-026 link. - Comment on `_wrap_row` noting `row._mapping` is the documented RowMapping accessor in SQLAlchemy 2.x despite the underscore. Skipped (rationale in PR reply) ------------------------------- - `_qmark_to_named` SQL-comment handling: docstring already notes the limitation; no `?` in storage SQL comments today. - Module-level `anyio.Lock()`: established precedent confirmed by the bot itself. - `get_audit_logs` `SELECT *`: pre-existing pattern, out of scope. Verification ------------ - `uv run pytest tests/unit/` — 1025 passed. - `TEST_DATABASE_URL=… uv run pytest tests/integration/test_storage_postgres.py -m postgres` — 7 passed. - `ruff check && ruff format --check && ty check` — clean. - Confirmed `schema_version` absent on fresh Postgres, still present on fresh SQLite. Tracked on Astrolabe Cloud POC board, card #99. --- _This PR was generated with the help of AI, and reviewed by a Human_ Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
f2b7bf132f
commit
51419329b0
@@ -67,12 +67,14 @@ _DEFAULTS: dict[str, Any] = {
|
||||
# homelab servers. DATABASE_CA_BUNDLE points at a private-CA PEM.
|
||||
"database_verify_ssl": None,
|
||||
"database_ca_bundle": None,
|
||||
# Postgres connection pool sizing (ADR-026, reviewer feedback on #798).
|
||||
# Per-pod pool defaults to 10 + 20 overflow = 30 max connections.
|
||||
# With many replicas this can blow past managed-Postgres
|
||||
# `max_connections=100`; tune down via env when needed.
|
||||
"database_pool_size": 10,
|
||||
"database_max_overflow": 20,
|
||||
# Postgres connection pool sizing (ADR-026 → "Concurrency model and
|
||||
# pool sizing"). Per-pod defaults to 2 + 5 overflow = 7 max
|
||||
# connections. asyncpg connections are single-flight, so the pool
|
||||
# only needs to cover typical multi-user MCP burst — not every
|
||||
# potential in-flight tool call. Tune up with DATABASE_POOL_SIZE /
|
||||
# DATABASE_MAX_OVERFLOW for high-traffic prod fleets.
|
||||
"database_pool_size": 2,
|
||||
"database_max_overflow": 5,
|
||||
# Webhook delivery authentication (ADR-010): when set, registrations
|
||||
# tell NC to add `Authorization: Bearer <secret>` to webhook deliveries
|
||||
# and the receiver rejects unauthenticated requests.
|
||||
@@ -515,9 +517,12 @@ class Settings:
|
||||
database_ca_bundle: str | None = None
|
||||
# Postgres connection pool sizing (ADR-026). The asyncpg engine maps
|
||||
# these to its underlying QueuePool. Per-pod max = pool_size +
|
||||
# max_overflow. Validate >= 1 in __post_init__.
|
||||
database_pool_size: int = 10
|
||||
database_max_overflow: int = 20
|
||||
# max_overflow. Defaults are intentionally small (2 + 5 = 7) because
|
||||
# asyncpg connections are single-flight and the typical MCP workload
|
||||
# is light read-mostly point lookups. Validate >= 1 / >= 0 in
|
||||
# __post_init__.
|
||||
database_pool_size: int = 2
|
||||
database_max_overflow: int = 5
|
||||
|
||||
# ADR-005: Token Audience Validation (required for OAuth mode)
|
||||
nextcloud_mcp_server_url: str | None = None # MCP server URL (used as audience)
|
||||
@@ -1166,7 +1171,15 @@ def get_database_ssl() -> bool | ssl.SSLContext | None:
|
||||
if settings.database_verify_ssl is False:
|
||||
return False
|
||||
if settings.database_ca_bundle:
|
||||
return ssl.create_default_context(cafile=settings.database_ca_bundle)
|
||||
# ``ssl.create_default_context()`` on Python 3.10+ already negotiates
|
||||
# the strongest available protocol (TLS 1.2+ with secure ciphers);
|
||||
# we pin Python 3.11+ in pyproject.toml. ``purpose=SERVER_AUTH`` is
|
||||
# the default but spelt out here so static analysers (SonarQube
|
||||
# ``S4423``) can see it explicitly. NOSONAR S4423
|
||||
return ssl.create_default_context( # NOSONAR S4423
|
||||
purpose=ssl.Purpose.SERVER_AUTH,
|
||||
cafile=settings.database_ca_bundle,
|
||||
)
|
||||
if settings.database_verify_ssl is True:
|
||||
return True
|
||||
return None
|
||||
|
||||
Reference in New Issue
Block a user