fix(vector): close local pgvector final review

2026-07-12 02:48:10 +02:00
parent 407c4a6faf
commit 6c67235caf
16 changed files with 265 additions and 28 deletions
@@ -97,6 +97,13 @@ class PgVectorStore:
            try:
                with raw.cursor() as cursor:
                    cursor.execute("SELECT 1")
+                    cursor.execute(
+                        "SELECT has_schema_privilege(current_user, %s, 'USAGE')",
+                        (self._schema,),
+                    )
+                    schema_usage = bool(cursor.fetchone()[0])
+                    if not schema_usage:
+                        return False, "vector schema incomplete: missing schema usage", set()
                    cursor.execute(
                        """SELECT c.relname, format_type(a.atttypid, a.atttypmod),
                                  has_table_privilege(current_user, c.oid, 'SELECT'),
@@ -244,8 +251,9 @@ class PgVectorStore:
        if kinds:
            _validate_known_kinds(kinds)
        hits: list[VectorHit] = []
-        raw = self._reader.raw_connection()
+        raw = None
        try:
+            raw = self._reader.raw_connection()
            with raw.cursor() as cursor:
                for collection in collections:
                    table = _collection(self._schema, collection)
@@ -272,8 +280,13 @@ class PgVectorStore:
                    params.extend((_vector_literal(embedding), limit))
                    cursor.execute(query, params)
                    hits.extend(hit_from_metadata(row[1], row[0]) for row in cursor.fetchall())
+        except VectorStoreError:
+            raise
+        except Exception as exc:
+            raise VectorReadUnavailable("Vector read operation unavailable") from exc
        finally:
-            raw.close()
+            if raw is not None:
+                raw.close()
        return sorted(hits, key=lambda hit: (-hit.similarity, hit.id))[:limit]

    def _require_writer(self) -> Engine:
@@ -285,8 +298,9 @@ class PgVectorStore:
        engine = self._require_writer()
        table = _collection(self._schema, collection)
        _validate_collection_kinds(collection, kinds)
-        raw = engine.raw_connection()
+        raw = None
        try:
+            raw = engine.raw_connection()
            with raw.cursor() as cursor:
                cursor.execute(
                    sql.SQL("SELECT record_key, content_hash FROM {} WHERE kind = ANY(%s)").format(
@@ -295,8 +309,13 @@ class PgVectorStore:
                    (kinds,),
                )
                return dict(cursor.fetchall())
+        except VectorStoreError:
+            raise
+        except Exception as exc:
+            raise VectorWriteUnavailable("Vector write operation unavailable") from exc
        finally:
-            raw.close()
+            if raw is not None:
+                raw.close()

    def upsert(self, collection: str, records: list[VectorWriteRecord]) -> int:
        engine = self._require_writer()
@@ -317,8 +336,9 @@ class PgVectorStore:
            "UPDATE {} SET kind = %s, content_hash = %s, metadata = %s::jsonb, "
            "embedding = %s::{}, indexed_at = pg_catalog.now() WHERE record_key = %s"
        ).format(table, _vector_type(self._schema))
-        raw = engine.raw_connection()
+        raw = None
        try:
+            raw = engine.raw_connection()
            with raw.cursor() as cursor:
                for write_record in records:
                    record = write_record.record
@@ -348,11 +368,17 @@ class PgVectorStore:
                            ),
                        )
            raw.commit()
-        except Exception:
-            raw.rollback()
+        except VectorStoreError:
+            if raw is not None:
+                raw.rollback()
            raise
+        except Exception as exc:
+            if raw is not None:
+                raw.rollback()
+            raise VectorWriteUnavailable("Vector write operation unavailable") from exc
        finally:
-            raw.close()
+            if raw is not None:
+                raw.close()
        return len(records)


@@ -36,6 +36,26 @@ def _expand_env(value: Any) -> Any:
    return value


+def _resolve_secret_files(value: Any) -> Any:
+    if isinstance(value, dict):
+        resolved = {key: _resolve_secret_files(item) for key, item in value.items()}
+        if "password_file" in resolved:
+            if "password" in resolved:
+                raise ConfigError("password and password_file are mutually exclusive")
+            path = Path(resolved.pop("password_file"))
+            try:
+                secret = path.read_text()
+            except (OSError, UnicodeError) as exc:
+                raise ConfigError(f"Cannot read secret file: {path}") from exc
+            if not secret or any(char.isspace() for char in secret) or "\x00" in secret:
+                raise ConfigError(f"Invalid secret file: {path}")
+            resolved["password"] = secret
+        return resolved
+    if isinstance(value, list):
+        return [_resolve_secret_files(item) for item in value]
+    return value
+
+
 class DatabaseConfig(BaseModel):
    host: str = "localhost"
    port: int = 5432
@@ -254,7 +274,7 @@ def load_config(path: Path) -> Config:
    raw = yaml.safe_load(path.read_text())
    if not isinstance(raw, dict):
        raise ConfigError(f"Configurazione non valida (atteso un mapping YAML): {path}")
-    expanded = _expand_env(raw)
+    expanded = _resolve_secret_files(_expand_env(raw))
    translated, used_legacy = translate_legacy_config(expanded)
    _populate_legacy_views(translated)
    try: