Repair ORM release fixture locks and execute PostgreSQL count authorization

.github/workflows/release.yml

@@ -155,7 +155,7 @@ jobs:
           cargo test -p graphql-orm --no-default-features --features sqlite,field-case-pascal,argument-case-snake --test federation_entity_keys_case_features --locked
           cargo check -p graphql-orm --no-default-features --features postgres --locked
           cargo test -p graphql-orm --no-default-features --features postgres --test federation_entity_keys_postgres --locked
-          cargo test -p graphql-orm --no-default-features --features postgres --test projection_visibility --test cross_crate_relations_fixture --locked
+          cargo test -p graphql-orm --no-default-features --features postgres --test projection_visibility --test cross_crate_relations_fixture --test repository_counts --locked
           cargo test -p graphql-orm --no-default-features --features postgres --test grouped_aggregates_postgres --locked -- --ignored --test-threads=1
           cargo run --manifest-path crates/graphql-orm/tests/fixtures/repository-aggregate-consumer/Cargo.toml --locked --no-default-features --features sqlite --example policy_projections
           cargo run --manifest-path crates/graphql-orm/tests/fixtures/repository-aggregate-consumer/Cargo.toml --locked --no-default-features --features sqlite --example complete_events

CHANGELOG.md

@@ -16,6 +16,10 @@ for historical context.
 
 ## 0.35.2 - 2026-10-01
 
+- Keep standalone fixture lockfiles aligned with this package set and execute
+  transaction count authorization regressions on test-owned PostgreSQL as well
+  as SQLite during release validation.
+
 Companion macros crate: `graphql-orm-macros` **0.35.2** (alignment only).
 
 - Allow transaction-bound repository `count` and `exists` with an installed

crates/graphql-orm/tests/repository_counts.rs

@@ -1,9 +1,24 @@
-#![cfg(feature = "sqlite")]
+#![cfg(any(feature = "sqlite", feature = "postgres"))]
 
 use graphql_orm::prelude::*;
 
+#[cfg(feature = "postgres")]
+#[path = "support/owned_postgres.rs"]
+mod owned_postgres;
+#[cfg(feature = "sqlite")]
+type Backend = SqliteBackend;
+#[cfg(feature = "postgres")]
+type Backend = PostgresBackend;
+
 #[derive(RepositoryEntity, Clone, Debug, serde::Serialize, serde::Deserialize)]
-#[repository_entity(backend = "sqlite", table = "count_rows", plural = "CountRows")]
+#[cfg_attr(
+    feature = "sqlite",
+    repository_entity(backend = "sqlite", table = "count_rows", plural = "CountRows")
+)]
+#[cfg_attr(
+    feature = "postgres",
+    repository_entity(backend = "postgres", table = "count_rows", plural = "CountRows")
+)]
 struct CountRow {
     #[primary_key]
     #[graphql_orm(auto_generated = false)]
@@ -23,19 +38,26 @@ enum Visibility {
 }
 
 #[derive(RepositoryEntity, Clone, Debug, serde::Serialize, serde::Deserialize)]
-#[repository_entity(backend = "sqlite", table = "other_rows", plural = "OtherRows")]
+#[cfg_attr(
+    feature = "sqlite",
+    repository_entity(backend = "sqlite", table = "other_rows", plural = "OtherRows")
+)]
+#[cfg_attr(
+    feature = "postgres",
+    repository_entity(backend = "postgres", table = "other_rows", plural = "OtherRows")
+)]
 struct OtherRow {
     #[primary_key]
     #[graphql_orm(auto_generated = false)]
     #[filterable(type = "string")]
     id: String,
 }
 
-impl RowPolicy<SqliteBackend> for Visibility {
+impl RowPolicy<Backend> for Visibility {
     fn read_visibility<'a>(
         &'a self,
         ctx: Option<&'a async_graphql::Context<'_>>,
-        _db: &'a Database<SqliteBackend>,
+        _db: &'a Database<Backend>,
         _entity: &'static str,
         _key: Option<&'static str>,
         surface: EntityAccessSurface,
@@ -47,7 +69,7 @@ impl RowPolicy<SqliteBackend> for Visibility {
                 Self::Unrestricted => ReadVisibility::Unrestricted,
                 Self::CallbackOnly => ReadVisibility::CallbackOnly,
                 Self::WrongEntity => {
-                    ReadVisibility::Complete(ReadPredicate::from_filter::<SqliteBackend, _>(
+                    ReadVisibility::Complete(ReadPredicate::from_filter::<Backend, _>(
                         &OtherRowWhereInput {
                             id: Some(StringFilter {
                                 eq: Some("1".into()),
@@ -59,7 +81,7 @@ impl RowPolicy<SqliteBackend> for Visibility {
                 }
                 Self::Complete | Self::Prefilter => {
                     let predicate =
-                        ReadPredicate::from_filter::<SqliteBackend, _>(&CountRowWhereInput {
+                        ReadPredicate::from_filter::<Backend, _>(&CountRowWhereInput {
                             tenant: Some(StringFilter {
                                 eq: Some("alpha".into()),
                                 ..Default::default()
@@ -79,7 +101,7 @@ impl RowPolicy<SqliteBackend> for Visibility {
     fn can_read_row<'a>(
         &'a self,
         _ctx: Option<&'a async_graphql::Context<'_>>,
-        _db: &'a Database<SqliteBackend>,
+        _db: &'a Database<Backend>,
         _entity: &'static str,
         _key: Option<&'static str>,
         _surface: EntityAccessSurface,
@@ -91,7 +113,7 @@ impl RowPolicy<SqliteBackend> for Visibility {
     fn can_write_row<'a>(
         &'a self,
         _ctx: Option<&'a async_graphql::Context<'_>>,
-        _db: &'a Database<SqliteBackend>,
+        _db: &'a Database<Backend>,
         _entity: &'static str,
         _key: Option<&'static str>,
         _surface: EntityAccessSurface,
@@ -103,11 +125,11 @@ impl RowPolicy<SqliteBackend> for Visibility {
 
 struct DenyEntity;
 
-impl EntityPolicy<SqliteBackend> for DenyEntity {
+impl EntityPolicy<Backend> for DenyEntity {
     fn can_access_entity<'a>(
         &'a self,
         _ctx: Option<&'a async_graphql::Context<'_>>,
-        _db: &'a Database<SqliteBackend>,
+        _db: &'a Database<Backend>,
         _entity: &'static str,
         _key: Option<&'static str>,
         _kind: EntityAccessKind,
@@ -117,8 +139,42 @@ impl EntityPolicy<SqliteBackend> for DenyEntity {
     }
 }
 
-async fn fixture(visibility: Option<Visibility>) -> Database<SqliteBackend> {
-    let mut db = Database::<SqliteBackend>::connect_sqlite("sqlite::memory:")
+struct Fixture {
+    db: Database<Backend>,
+    #[cfg(feature = "postgres")]
+    owned: owned_postgres::OwnedPostgres,
+}
+impl std::ops::Deref for Fixture {
+    type Target = Database<Backend>;
+    fn deref(&self) -> &Self::Target {
+        &self.db
+    }
+}
+impl std::ops::DerefMut for Fixture {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.db
+    }
+}
+impl Fixture {
+    async fn finish(self) {
+        self.db.pool().close().await;
+        #[cfg(feature = "postgres")]
+        {
+            let mut owned = self.owned;
+            owned.cleanup().unwrap();
+        }
+    }
+}
+
+async fn fixture(visibility: Option<Visibility>) -> Fixture {
+    #[cfg(feature = "sqlite")]
+    let mut db = Database::<Backend>::connect_sqlite("sqlite::memory:")
+        .await
+        .unwrap();
+    #[cfg(feature = "postgres")]
+    let owned = owned_postgres::OwnedPostgres::start("repository-counts").unwrap();
+    #[cfg(feature = "postgres")]
+    let mut db = Database::<Backend>::connect_postgres(&owned.url)
         .await
         .unwrap();
     sqlx::query("CREATE TABLE count_rows(id TEXT PRIMARY KEY, tenant TEXT NOT NULL)")
@@ -132,7 +188,11 @@ async fn fixture(visibility: Option<Visibility>) -> Database<SqliteBackend> {
     if let Some(policy) = visibility {
         db.set_row_policy(policy);
     }
-    db
+    Fixture {
+        db,
+        #[cfg(feature = "postgres")]
+        owned,
+    }
 }
 
 #[tokio::test]
@@ -145,6 +205,7 @@ async fn unrestricted_policy_counts_inside_repository_transaction() {
         .await
         .unwrap();
     assert_eq!(total, 3);
+    db.finish().await;
 }
 
 #[tokio::test]
@@ -171,6 +232,7 @@ async fn complete_visibility_intersects_caller_filter_and_exists() {
         .await
         .unwrap();
     assert_eq!(result, (2, false));
+    db.finish().await;
 }
 
 #[tokio::test]
@@ -184,6 +246,7 @@ async fn callback_and_prefilter_counts_remain_rejected() {
             .await
             .is_err()
         );
+        db.finish().await;
     }
 }
 
@@ -197,6 +260,7 @@ async fn no_policy_count_keeps_existing_behavior() {
         .await
         .unwrap();
     assert_eq!(count, 3);
+    db.finish().await;
 }
 
 #[tokio::test]
@@ -209,6 +273,7 @@ async fn wrong_entity_predicate_is_rejected_before_sql() {
         .await
         .is_err()
     );
+    db.finish().await;
 }
 
 #[tokio::test]
@@ -222,6 +287,7 @@ async fn unrestricted_visibility_does_not_override_entity_denial() {
         .await
         .is_err()
     );
+    db.finish().await;
 }
 
 #[tokio::test]
@@ -241,6 +307,7 @@ async fn counts_use_the_current_policy_instead_of_reusing_visibility() {
         .await
         .unwrap();
     assert_eq!((before, after), (3, 2));
+    db.finish().await;
 }
 
 #[tokio::test]
@@ -270,4 +337,5 @@ async fn count_sees_writes_in_the_same_transaction_and_rollback_keeps_them_priva
         .await
         .unwrap();
     assert_eq!(after, 2);
+    db.finish().await;
 }

docs/reference/graphql-orm/runtime-and-writes.md

@@ -364,3 +364,11 @@ impl Job {
 ```
 
 If a computed field needs database access, use request-scoped `DataLoader` or another batching mechanism. Generated relation fields already use the relation batching runtime; custom computed fields should follow the same rule to avoid N+1 behavior.
+
+Transaction count regressions run on memory SQLite and individually owned
+PostgreSQL containers (never an ambient application database):
+
+```bash
+cargo test -p graphql-orm --locked --no-default-features --features sqlite --test repository_counts
+cargo test -p graphql-orm --locked --no-default-features --features postgres --test repository_counts -- --test-threads=1
+```