Refuse the pre-0.15 scoping hook, and support Python 3.14 (v0.19.5).

A class still carrying get_queryset, the name row scoping used before 0.15,
was neither read nor reported. It looks scoped to its author and is not, so
every row it was written to hide comes back. Nothing in the schema changes
shape on upgrade, which is what made it quiet. It is now refused when the type
is defined, whatever warn_missing_scope is set to: that flag is about an
absent hook, not a misnamed one.

Python 3.14 made annotations lazy (PEP 649), which broke two things. Reading a
class's own annotations through __dict__ reported none mid-creation, and the
empty dict written back dropped every annotation the class declared. And
functools.wraps now carries the lazy annotation function rather than the
computed annotations, so wrapping a resolver whose annotations had been set
explicitly left the wrapper with none at all.

Both are fixed, along with a third case the reporter had not reached: a
resolver's return type has to be set along the whole __wrapped__ chain,
because inspect.signature follows it. The suite passes on 3.12, 3.13 and 3.14.

Reported by @jayashankarvr in #2, with the diagnosis for both clusters.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jamietdavidson

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "strawberry-orm"
-version = "0.19.4"
+version = "0.19.5"
 description = "Unified, backend-agnostic ORM abstraction for Strawberry GraphQL"
 readme = "README.md"
 license = "MIT"

src/strawberry_orm/_async.py

@@ -14,6 +14,19 @@
 AwaitableOrValue = T | Awaitable[T]
 
 
+def keep_annotations(wrapper: Any, wrapped: Any) -> Any:
+    """Give *wrapper* the annotations *wrapped* declares.
+
+    From 3.14 ``functools.wraps`` carries over the lazy annotation function
+    rather than the computed annotations, and assigning ``__annotations__``
+    clears that function - so wrapping a resolver whose annotations were set
+    explicitly leaves the wrapper with none at all. Strawberry reads a field's
+    arguments and return type from there.
+    """
+    wrapper.__annotations__ = dict(getattr(wrapped, "__annotations__", {}))
+    return wrapper
+
+
 def in_async_context() -> bool:
     """Return ``True`` when called from a running event loop."""
     try:

src/strawberry_orm/backends/_base.py

@@ -55,6 +55,9 @@ def _annotate_filter_relation_presence(FilterCls: type) -> None:
 
 
 _ROW_SCOPE_HOOK = "scope_rows"
+#: What the hook was called before 0.15. Left in place it is simply not read,
+#: so the rows it was written to hide come back instead.
+_LEGACY_ROW_SCOPE_HOOK = "get_queryset"
 
 
 _KNOWN_FILTER_KEYS = frozenset({"field", "object", "all", "any", "not_", "one_of"})
@@ -1883,6 +1886,18 @@ def _process_type_annotations(
 
         if isinstance(vars(cls).get(_ROW_SCOPE_HOOK), classmethod):
             self._register_type_scope(cls, model, type_name)
+        elif isinstance(vars(cls).get(_LEGACY_ROW_SCOPE_HOOK), classmethod):
+            # Refused rather than warned about: the class reads as scoped and
+            # is not, so every row it meant to hide is being returned. That is
+            # a widening of what a caller can read, and it happens on upgrade
+            # without anything in the schema changing shape.
+            raise ValueError(
+                f"{type_name} defines {_LEGACY_ROW_SCOPE_HOOK}, which was "
+                f"renamed to {_ROW_SCOPE_HOOK} in 0.15 and is no longer read. "
+                f"Left as it is, {model.__name__} rows load unscoped and the "
+                f"rows it was written to hide are returned. Rename it to "
+                f"{_ROW_SCOPE_HOOK}."
+            )
 
         self._check_missing_scope(cls, model, type_name)
 

src/strawberry_orm/core.py

@@ -27,6 +27,7 @@
     await_maybe,
     await_maybe_blocking,
     in_async_context,
+    keep_annotations,
     materialize_result,
     run_orm_work,
     run_orm_work_blocking,
@@ -956,8 +957,21 @@ def resolver(*args: Any, **kw: Any) -> Any:  # noqa: F811
                     )
                     return call_scope(scope, generated(*args, **kw), info)
 
+                keep_annotations(resolver, generated)
+
             if node_type is not None:
-                resolver.__annotations__["return"] = list[node_type]
+                # inspect.signature follows __wrapped__, so every function in
+                # the chain has to carry the return type, not just the outermost.
+                # Assign rather than mutate: from 3.14 a wrapper and the
+                # function it wraps no longer share one annotations dict.
+                return_ann = list[node_type]
+                target: Any = resolver
+                while target is not None:
+                    target.__annotations__ = {
+                        **target.__annotations__,
+                        "return": return_ann,
+                    }
+                    target = getattr(target, "__wrapped__", None)
 
         # On a backend that materializes asynchronously the field has to be
         # async, or the connection machinery takes its sync path and ends up
@@ -972,6 +986,8 @@ def resolver(*args: Any, **kw: Any) -> Any:  # noqa: F811
             async def resolver(*args: Any, **kwargs: Any) -> Any:  # noqa: F811
                 return sync_resolver(*args, **kwargs)
 
+            keep_annotations(resolver, sync_resolver)
+
         extensions = list(self._kwargs.get("extensions") or [])
         extensions.append(
             _AutoFilterOrderExtension(

src/strawberry_orm/payload.py

@@ -26,7 +26,7 @@
 
 import strawberry
 
-from strawberry_orm._async import in_async_context, run_sync
+from strawberry_orm._async import in_async_context, keep_annotations, run_sync
 
 
 @dataclass(frozen=True)
@@ -196,7 +196,7 @@ async def _offloaded() -> Any:
 
         return _offloaded()
 
-    return resolver
+    return keep_annotations(resolver, fn)
 
 
 class PayloadFactory:

src/strawberry_orm/types.py

@@ -47,6 +47,34 @@ class OperationInfo:
 auto = strawberry.auto
 
 
+def _own_annotations(owner: type) -> dict[str, Any] | None:
+    """The annotations declared on *owner* itself, or ``None`` if it has none.
+
+    From 3.14 annotations are lazy (PEP 649), so a class that has them may
+    carry ``__annotate__`` and no ``__annotations__`` entry yet. Reading
+    ``__dict__`` alone reports nothing in that case, and writing a fresh dict
+    back would drop every annotation the class declared.
+    """
+    existing = owner.__dict__.get("__annotations__")
+    if existing is not None:
+        return existing
+    try:
+        import annotationlib
+    except ImportError:  # pragma: no cover - Python < 3.14
+        return None
+
+    # Mid-class-creation the annotations are reachable through neither
+    # ``__annotations__`` nor ``__annotate__``, so ask for them directly.
+    # FORWARDREF so a reference to a type defined later resolves to a
+    # ForwardRef rather than raising, which is normal in these schemas.
+    # Exercised on 3.14 runs; the coverage gate runs on 3.12, where the import
+    # above has already returned.
+    return (  # pragma: no cover
+        annotationlib.get_annotations(owner, format=annotationlib.Format.FORWARDREF)
+        or None
+    )
+
+
 @dataclass
 class FieldDefinition:
     """Metadata attached to fields created via orm.field()."""
@@ -68,12 +96,15 @@ def __set_name__(self, owner: type, name: str) -> None:
         a class annotation. This runs while the class is being created, which
         is before ``@orm.type`` reads annotations.
         """
-        annotations = owner.__dict__.get("__annotations__")
+        annotations = _own_annotations(owner)
         if self.declared_type is not None:
             if annotations is None:
                 annotations = {}
-                owner.__annotations__ = annotations
             annotations.setdefault(name, self.declared_type)
+            # Assign rather than mutate: the dict may have been materialised
+            # from a lazy annotation function, in which case nothing is
+            # watching it.
+            owner.__annotations__ = annotations
         elif self.scope is not None and name not in (annotations or {}):
             raise TypeError(
                 f"{owner.__name__}.{name} has no type. Annotate the attribute "

tests/backends/django/test_renamed_scope_hook.py

@@ -0,0 +1,77 @@
+"""The 0.14 name for the row-scoping hook must not be ignored in silence.
+
+``get_queryset`` became ``scope_rows`` in 0.15. A class still carrying the old
+name looks scoped to its author and is not, so every row it was meant to hide
+is returned. The upgrade path has to fail loudly rather than quietly widen
+what a caller can read.
+"""
+
+import pytest
+import strawberry
+
+from strawberry_orm import StrawberryORM
+from strawberry_orm.types import auto
+from tests.backends.django.models import Post as SAPost
+
+
+def _orm(**kwargs):
+    return StrawberryORM.for_django(lazy_resolution="off", **kwargs)
+
+
+@pytest.mark.django_db
+class TestRenamedScopeHook:
+    @pytest.fixture(autouse=True)
+    def _seed(self, seed):
+        pass
+
+    def _build(self, orm):
+        @orm.type(SAPost)
+        class PostType:
+            id: auto
+            title: auto
+
+            @classmethod
+            def get_queryset(cls, query, info):
+                return query.filter(is_published=True)
+
+        @strawberry.type
+        class Query:
+            posts: list[PostType] = orm.field.eager()
+
+        return orm.schema(query=Query)
+
+    def test_the_old_name_is_refused(self):
+        with pytest.raises(ValueError, match="get_queryset"):
+            self._build(_orm(warn_missing_scope=False))
+
+    def test_the_message_names_the_replacement(self):
+        with pytest.raises(ValueError, match="scope_rows"):
+            self._build(_orm(warn_missing_scope=False))
+
+    def test_it_is_refused_even_with_the_warning_turned_off(self):
+        """warn_missing_scope covers an absent hook, not a misnamed one."""
+        with pytest.raises(ValueError):
+            self._build(_orm(warn_missing_scope=False))
+
+    def test_the_new_name_still_works(self):
+        orm = _orm(warn_missing_scope=False)
+
+        @orm.type(SAPost)
+        class PostType:
+            id: auto
+            title: auto
+
+            @classmethod
+            def scope_rows(cls, query, info):
+                return query.filter(is_published=True)
+
+        @strawberry.type
+        class Query:
+            posts: list[PostType] = orm.field.eager()
+
+        result = orm.schema(query=Query).execute_sync(
+            "{ posts { title } }", context_value={}
+        )
+        assert result.errors is None, result.errors
+        titles = [p["title"] for p in result.data["posts"]]
+        assert "Draft Post" not in titles, titles

tests/backends/sqlalchemy/test_renamed_scope_hook.py

@@ -0,0 +1,78 @@
+"""The 0.14 name for the row-scoping hook must not be ignored in silence.
+
+``get_queryset`` became ``scope_rows`` in 0.15. A class still carrying the old
+name looks scoped to its author and is not, so every row it was meant to hide
+is returned. The upgrade path has to fail loudly rather than quietly widen
+what a caller can read.
+"""
+
+import pytest
+import strawberry
+
+from strawberry_orm import StrawberryORM
+from strawberry_orm.types import auto
+from tests.backends.sqlalchemy.models import Post as SAPost
+
+
+def _orm(**kwargs):
+    return StrawberryORM.for_sqlalchemy(
+        dialect="sqlite", lazy_resolution="off", **kwargs
+    )
+
+
+class TestRenamedScopeHook:
+    @pytest.fixture(autouse=True)
+    def _session(self, sa_session, seed):
+        self._s = sa_session
+
+    def _build(self, orm):
+        @orm.type(SAPost)
+        class PostType:
+            id: auto
+            title: auto
+
+            @classmethod
+            def get_queryset(cls, query, info):
+                return query.where(SAPost.is_published.is_(True))
+
+        @strawberry.type
+        class Query:
+            posts: list[PostType] = orm.field.eager()
+
+        return orm.schema(query=Query)
+
+    def test_the_old_name_is_refused(self):
+        with pytest.raises(ValueError, match="get_queryset"):
+            self._build(_orm(warn_missing_scope=False))
+
+    def test_the_message_names_the_replacement(self):
+        with pytest.raises(ValueError, match="scope_rows"):
+            self._build(_orm(warn_missing_scope=False))
+
+    def test_it_is_refused_even_with_the_warning_turned_off(self):
+        """warn_missing_scope covers an absent hook, not a misnamed one."""
+        with pytest.raises(ValueError):
+            self._build(_orm(warn_missing_scope=False))
+
+    def test_the_new_name_still_works(self):
+        orm = _orm(warn_missing_scope=False)
+
+        @orm.type(SAPost)
+        class PostType:
+            id: auto
+            title: auto
+
+            @classmethod
+            def scope_rows(cls, query, info):
+                return query.where(SAPost.is_published.is_(True))
+
+        @strawberry.type
+        class Query:
+            posts: list[PostType] = orm.field.eager()
+
+        result = orm.schema(query=Query).execute_sync(
+            "{ posts { title } }", context_value={"session": self._s}
+        )
+        assert result.errors is None, result.errors
+        titles = [p["title"] for p in result.data["posts"]]
+        assert "Draft Post" not in titles, titles