Protect migration connection from direct commits

openslides_backend/migrations/migration_handler.py

@@ -21,6 +21,7 @@
     MigrationHelper,
     MigrationState,
 )
+from ..migrations.migrations.base import MigrationCursor
 from ..shared.handlers.base_handler import BaseHandler
 from ..shared.interfaces.env import Env
 from ..shared.interfaces.logging import LoggingModule
@@ -295,9 +296,9 @@ def execute_migrations(self) -> None:
             )
             self.logger.info("Executing migration: " + module_name)
 
-            # checks wether the methods are available and executes them.
-            mig_class.data_definition(self.cursor)
-            mig_class.data_manipulation(self.cursor)
+            with MigrationCursor(self.cursor.connection) as migration_cursor:
+                mig_class.data_definition(migration_cursor)
+                mig_class.data_manipulation(migration_cursor)
 
             MigrationHelper.set_database_migration_info(
                 self.cursor, index, MigrationState.FINALIZATION_REQUIRED
@@ -329,7 +330,9 @@ def migrate(self) -> None:
                         import_module(f"{MODULE_PATH}{module_name}"), "Migration"
                     )
                     self.logger.info("Pre check: " + module_name + " ...")
-                    if errors := mig_class.check_prerequisites(self.cursor):
+                    with MigrationCursor(self.cursor.connection) as migration_cursor:
+                        errors = mig_class.check_prerequisites(migration_cursor)
+                    if errors:
                         if minimum_required_index:
                             MigrationHelper.set_database_migration_info(
                                 self.cursor,
@@ -448,7 +451,8 @@ def finalize(self) -> None:
             mig_class = getattr(
                 import_module(f"{MODULE_PATH}{module_name}"), "Migration"
             )
-            mig_class.cleanup(self.cursor)
+            with MigrationCursor(self.cursor.connection) as migration_cursor:
+                mig_class.cleanup(migration_cursor)
 
         unified_replace_tables, relevant_mis = (
             MigrationHelper.get_unified_replace_tables_from_database(self.cursor)

openslides_backend/migrations/migrations/base.py

@@ -1,7 +1,15 @@
+from typing import NoReturn
+
 from psycopg import Cursor
 from psycopg.rows import DictRow
 
 
+class MigrationCursor(Cursor[DictRow]):
+    @property
+    def connection(self) -> NoReturn:
+        raise RuntimeError("Migration cursors do not expose their connection")
+
+
 class BaseMigration:
     """Interface class for all migrations"""
 

tests/unit/test_migration_cursor.py

@@ -0,0 +1,10 @@
+import pytest
+
+from openslides_backend.migrations.migrations.base import MigrationCursor
+
+
+def test_migration_cursor_does_not_expose_connection() -> None:
+    cursor = object.__new__(MigrationCursor)
+
+    with pytest.raises(RuntimeError, match="do not expose their connection"):
+        cursor.connection