Skip to content

symfonic.memory.backends.postgres_role_barrier

postgres_role_barrier

Read-only, point-in-time catalog barrier for enumerated PostgreSQL logins.

This checks only named principals in the connected database. The operator must separately inventory DSNs, poolers, copied credentials and DBA/superuser access, revoke old grants, drain sessions/prepared transactions, and maintain a DDL change freeze. No local catalog query can prove those external conditions.

RoleBarrierNotReady

Bases: RuntimeError

A named login could still bypass or alter a certified writer fence.

require_named_role_barrier async 

require_named_role_barrier(conn: Any, *, schema: str, retired: tuple[str, ...], active: tuple[str, ...], tables: tuple[str, ...]) -> None

Read one stable, read-only catalog snapshot for the named principals.

Source code in src/symfonic/memory/backends/postgres_role_barrier.py 
31
32
33
34
35
36
37
38
39
40
41
42
43
async def require_named_role_barrier(
    conn: Any,
    *,
    schema: str,
    retired: tuple[str, ...],
    active: tuple[str, ...],
    tables: tuple[str, ...],
) -> None:
    """Read one stable, read-only catalog snapshot for the named principals."""
    async with conn.transaction(isolation="repeatable_read", readonly=True):
        await _check_named_role_barrier(
            conn, schema=schema, retired=retired, active=active, tables=tables
        )