Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- Highway shall pin auth==3.4.0 in pyproject.toml and uv.lock.
- Every engine container that imports auth.database shall set AUTH_DATABASE_POOL_SIZE, AUTH_DATABASE_MAX_OVERFLOW, AUTH_DATABASE_POOL_TIMEOUT (and leave POOL_RECYCLE unset or valid); values in SPECS/925-cutover.patch shall keep total highway_app connections <= 60 (infra ruling).
- Every Authorization instance Highway creates (enterprise/security/auth_wrapper.py get_auth_for_tenant / auth_for_tenant, enterprise/security/rbac_manager.py) shall have its session closed or rolled back before the request or task ends; no auth connection shall stay idle in transaction after a permission check (auth 3.4.0: reads leave the transaction open until the session closes).
- The pool size per process shall equal the measured maximum number of concurrent permission checks in that process (hypercorn threads / to_thread), stated with the measurement.
- If auth 3.3.0+ requires the auth_tenant_settings.rotate_key_hash migration, then the migrations container shall apply it before the api starts.
- When the stack runs on pg-nano-03, the measured auth connections per api process (pg_stat_activity application_name auth_server, forensic read-only) shall be <= pool_size + max_overflow.
CONTEXT: auth team answer 2026-10-22 (thread 01M5JVCJ9MS5E18JQZTC1VT4EP, msg 01M5JWAVWRHS1KMG36JAJYXWD2): settings AUTH_DATABASE_POOL_SIZE (>=1), MAX_OVERFLOW (>=0), POOL_TIMEOUT (s, >0), POOL_RECYCLE (-1 or >=1); empty string fails validation; defaults 2/2/10/3600. Two-connection path exists only under auth's own Flask app. Authorization reads hold a checked-out connection idle in transaction until close(); 3.4.0 adds close() and context-manager use; a caller-supplied db_session is left alone by close(). TLS URL params pass through to libpq unchanged (verified by auth with verify-full + client cert). Parent #925, #929.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1045