peter
8206384c91
The owner-filter check missed an aliased() model, an import alias, .in_() and filter_by; four live inline filters on aliased VideoState go through owned_by now. Cross-unit writes are seen under any import name, through sa.update and via __table__. Core modules may commit only where CORE_COMMITS names the reason; trim_read and audit.gc flush now and their callers commit. The pin target, the debug-session header and a link's target fetch through owned_row. The docs claim what the fence holds, and say what is beyond it.
68 lines
2.7 KiB
Python
68 lines
2.7 KiB
Python
"""Helpers for the durable, server-backed per-user notification inbox (phase 1).
|
|
|
|
The inbox COEXISTS with the client-side transient "bell" (localStorage toasts): these rows
|
|
survive reloads/devices and are produced server-side. First producer is the maintenance
|
|
job. Unread rows never auto-expire; read rows are trimmed past a soft per-user cap so the
|
|
table can't grow without bound for a heavy user.
|
|
"""
|
|
|
|
from sqlalchemy import delete, select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.userscope import owned_by
|
|
from app.models import Notification
|
|
|
|
# Keep at most this many READ notifications per user; older read ones are pruned. Unread
|
|
# rows are never pruned (the user hasn't seen them yet).
|
|
READ_SOFT_CAP = 200
|
|
|
|
# Hard limit of the Notification.title column, read straight from the model so the clamp
|
|
# can never drift from the actual column width (a later migration is the single source of
|
|
# truth). Titles are only an English fallback — the client renders the translated message
|
|
# from `data` — so clamping an over-long one (e.g. a FB/IG reel whose "title" is the whole
|
|
# caption, hundreds of chars) is harmless to the UI and prevents a StringDataRightTruncation
|
|
# that would abort the caller's whole transaction (the batched download_gc run in particular).
|
|
TITLE_MAX_LEN = Notification.__table__.c.title.type.length
|
|
|
|
|
|
def create_notification(
|
|
db: Session,
|
|
user_id: int,
|
|
type: str,
|
|
title: str,
|
|
body: str | None = None,
|
|
data: dict | None = None,
|
|
*,
|
|
commit: bool = True,
|
|
) -> Notification:
|
|
"""Insert one notification for a user. Callers that batch many inserts in a single
|
|
transaction can pass commit=False and commit once themselves."""
|
|
if title is not None and len(title) > TITLE_MAX_LEN:
|
|
title = title[: TITLE_MAX_LEN - 1] + "…" # clamp to the column limit, add an ellipsis
|
|
notif = Notification(user_id=user_id, type=type, title=title, body=body, data=data)
|
|
db.add(notif)
|
|
if commit:
|
|
db.commit()
|
|
db.refresh(notif)
|
|
return notif
|
|
|
|
|
|
def trim_read(db: Session, user_id: int, cap: int = READ_SOFT_CAP) -> int:
|
|
"""Delete a user's oldest READ notifications beyond `cap`. Returns the number removed.
|
|
Idempotent and cheap; safe to call after marking things read. Flushes; the caller commits."""
|
|
ids = (
|
|
db.execute(
|
|
select(Notification.id)
|
|
.where(owned_by(Notification.user_id, user_id), Notification.read.is_(True))
|
|
.order_by(Notification.created_at.desc())
|
|
.offset(cap)
|
|
)
|
|
.scalars()
|
|
.all()
|
|
)
|
|
if not ids:
|
|
return 0
|
|
# One bulk DELETE rather than a get+delete per row (the ids are already in hand).
|
|
db.execute(delete(Notification).where(Notification.id.in_(ids)))
|
|
return len(ids)
|