fix(perf): migra actions/xray al pool + test de aislamiento de claims + log en lifespan

- ActionRepository._connect y XrayConfig._connect migrados a get_pool().connection()
  (eliminado psycopg.connect directo por petición; row_factory/vector los gestiona el pool)
- test_pooled_connection_does_not_leak_claims: test de integración con pool max_size=1
  que verifica que set_config transaction-local no se filtra entre checkouts
- asgi.py lifespan: except Exception:pass → logging.warning con el exc (no swallow silencioso)

Claude-Session: https://claude.ai/code/session_0198KfgRWvAM8BhiVz24uTok

Author: gonzaloMorenoc

asgi.py

@@ -20,8 +20,9 @@
 async def lifespan(app: FastAPI):
     try:
         get_pool()          # pre-calienta el pool; si la BD no está, no tumbar el arranque
-    except Exception:
-        pass
+    except Exception as exc:
+        import logging
+        logging.getLogger(__name__).warning("pool pre-warm failed; lazy init on first request: %s", exc)
     yield
     close_pool()
 

src/actions/repository.py

@@ -1,10 +1,10 @@
 from typing import Any, Dict, List, Optional
 
 import psycopg
-from psycopg.rows import dict_row
 from psycopg.types.json import Json
 
 from src.config import DATABASE_URL
+from src.db.pool import get_pool
 
 
 class ActionRepository:
@@ -16,8 +16,8 @@ def __init__(self, db_url: str = DATABASE_URL):
             raise RuntimeError("DATABASE_URL must be configured for Mnemo persistence")
         self.db_url = db_url
 
-    def _connect(self) -> psycopg.Connection:
-        return psycopg.connect(self.db_url, row_factory=dict_row)
+    def _connect(self):
+        return get_pool().connection()
 
     def _set_claims(self, conn: psycopg.Connection, user_id: str) -> None:
         with conn.cursor() as cur:

src/xray/config.py

@@ -21,10 +21,10 @@
 from typing import Any, Dict, Optional
 
 import psycopg
-from psycopg.rows import dict_row
 from cryptography.fernet import InvalidToken
 
 from src.config import DATABASE_URL
+from src.db.pool import get_pool
 from src.jira.crypto import decrypt_token, encrypt_token
 
 _CLOUD_BASE = "https://xray.cloud.getxray.app"
@@ -43,8 +43,8 @@ def __init__(self, db_url: str = DATABASE_URL) -> None:
     # Private helpers
     # ------------------------------------------------------------------
 
-    def _connect(self) -> psycopg.Connection:
-        return psycopg.connect(self.db_url, row_factory=dict_row)
+    def _connect(self):
+        return get_pool().connection()
 
     def _decrypt(self, enc: str) -> str:
         try:

tests/test_db_pool.py

@@ -1,3 +1,10 @@
+import os
+
+import pytest
+from dotenv import load_dotenv
+
+load_dotenv()
+
 import src.db.pool as poolmod
 
 
@@ -24,3 +31,22 @@ class Conn: row_factory = None
     from psycopg.rows import dict_row
     assert c.row_factory is dict_row
     assert calls["vector"] == 1
+
+
+@pytest.mark.integration
+def test_pooled_connection_does_not_leak_claims():
+    url = os.getenv("DATABASE_URL")
+    if not url:
+        pytest.skip("DATABASE_URL not configured")
+    from psycopg_pool import ConnectionPool
+    from psycopg.rows import dict_row
+    pool = ConnectionPool(conninfo=url, min_size=1, max_size=1, open=True, kwargs={"row_factory": dict_row})
+    try:
+        with pool.connection() as c1:
+            c1.execute("select set_config('request.jwt.claim.sub', 'user-A', true)")
+            # is_local=true → scoped to this transaction; commit on block exit clears it
+        with pool.connection() as c2:   # same physical connection (max_size=1)
+            row = c2.execute("select current_setting('request.jwt.claim.sub', true) as v").fetchone()
+            assert row["v"] in (None, ""), f"claim leaked across checkouts: {row['v']!r}"
+    finally:
+        pool.close()