Bug-1075: repair updated_at trigger-coverage drift + drift guard

Story 1075Epic None2 files · +345/−0

PR #268 · pramaan-io/pramaan-functions · merged 2026-06-08

Why this matters

When the timestamp lies, the audit trail goes blind.

Three tables silently lost their updated_at trigger.

Application-level fixes leave holes. The trigger is the only thing that fires on EVERY write.

The fix — One trigger per updated_at column, one guard to prove it.

How it flows

sequenceDiagram
  autonumber
  participant app as Application
  participant pg as PostgreSQL
  participant row as Row
  participant guard as Drift Guard
  app->>pg: UPDATE firms SET name = …
  pg->>pg: checks for BEFORE UPDATE trigger
  pg->>pg: fires the shared set-updated_at function
  row->>row: NEW.updated_at = now()
  row-->>guard: guard queries pg_trigger for every updated_at table
  guard->>guard: fails if any table lacks the trigger

91f0c2d3e4a5_0078_repair_updated_at_trigger_coverage.py · +44 — new methods

Methodin → outwhat it does
upgrade() → None
downgrade() → None

What changed, file by file

alembic/versions/91f0c2d3e4a5_0078_repair_updated_at_trigger_coverage.py+44

Alembic migration that attaches the shared set-updated_at trigger to the three tables that were silently missing it, closing the audit-timestamp gap.

new methodsignature
upgrade() → None
downgrade() → None
New fields: revision : strdown_revision : str | Sequence[str] | Nonebranch_labels : str | Sequence[str] | Nonedepends_on : str | Sequence[str] | None

Files changed (2)

File±
alembic/versions/91f0c2d3e4a5_0078_repair_updated_at_trigger_coverage.py ★+44
tests/integration/test_updated_at_triggers.py+301