Enum OrmError 

pub enum OrmError {
    InvalidIdentifier(String),
    Empty(&'static str),
    BadExpr(&'static str),
    TenancyUndeclared(String),
    UnscopedWrite(String),
    TenancyNoPrincipal,
    PublicSubsetUndeclared(String),
    TargetWriteNotGranted(String),
    TargetWriteColumnDenied(String),
    TargetDeleteRefused(String),
    PublicSubsetNotForceable(String),
    TargetWriteUnsupported(&'static str),
    TargetUpsertKeyMissingTenant(String),
    TargetWriteToSessionTable(String),
}

Why compilation failed.

Variants

InvalidIdentifier(String)

An identifier was not a plain [A-Za-z_][A-Za-z0-9_]* (optionally table.column) name.

Empty(&'static str)

The query was structurally empty (no rows to insert, no columns to set, …).

BadExpr(&'static str)

A function was called with the wrong number of arguments, or * was used outside count(*).

TenancyUndeclared(String)

A scoped query touched a table with no entry in the project’s [TenancySchema] (deny-by-default, PLAN-tenancy-principal D3): “no key” and “forgot the key” are indistinguishable, so the safe collapse is to refuse rather than run it unscoped or wrongly scoped. Unscoped is the explicit, reviewed “this table is global”; an absent table is a misconfiguration the host surfaces (the binding names the component + marker site).

UnscopedWrite(String)

A guest WRITE (INSERT/UPDATE/DELETE) targeted a table declared Unscoped (global reference data). Reads of an Unscoped table are global by design, but writes are deny-by-default (a shared-data write is a cross-tenant blast — the TableScope::Unscoped contract), so the host refuses them rather than running the write unbounded-by-tenant.

TenancyNoPrincipal

A scoped read/write needed a resolved principal (an own-tenant value, or — for a TenantOrSession table — at least one of the tenant/session facts) but the request carried none. Fail closed: the query is refused rather than run unscoped. (The single-column raw-SQL path reports the equivalent TenantDenied::NoSource at the binding.)

PublicSubsetUndeclared(String)

A target read (R4/D8) touched a table with no declared public subset in the project schema. A target scope may only read rows that satisfy each accessed table’s host-held public predicate, so a table (root or any joined/subquery ref) that declares none is refused — deny-by-default, the strict analog of [TenancyUndeclared]. This is what keeps a target read from ever reaching another tenant’s PRIVATE rows through an un-confined table.

TargetWriteNotGranted(String)

A WRITE (INSERT/UPDATE) was force-scoped under a target scope whose SET-allowlist is empty — i.e. a target route with no write grant is read-only (5b, deny-by-default). Refused before any SQL.

TargetWriteColumnDenied(String)

A target write tried to set a column that is not in the route’s SET-allowlist — the tenant column, a public-visibility column, or any other un-granted column. Refused fail-closed so a target write can never change ownership, flip visibility, or touch a non-granted column.

TargetDeleteRefused(String)

A DELETE was attempted under a target scope. Target writes are INSERT/UPDATE only; a target DELETE is always refused (a cross-tenant delete is never granted).

PublicSubsetNotForceable(String)

A target INSERT could not force a table’s public subset to a concrete row: a public term that is not column = <literal> or column IS NULL (e.g. a range or IS NOT NULL) has no single value to stamp, so the host cannot guarantee the inserted row lands in the public subset — refused (deny-by-default). Such a subset is read-/update-only, never target-insertable.

TargetWriteUnsupported(&'static str)

A target write used a shape the confinement does not support: an INSERT … SELECT, an ON CONFLICT upsert on an anonymous (domain/handle/target_or_null) target, or a promote. These could reach rows outside the public subset (a selected source; or a conflict-row DO UPDATE whose tenant = B guard carries no visibility subset, so an anonymous upsert could touch B’s non-public row). A capability-axis ON CONFLICT … DO UPDATE upsert IS supported (own↔target parity — see Insert::confine_target_insert); the rest are refused.

TargetUpsertKeyMissingTenant(String)

A capability-axis target upsert (ON CONFLICT … DO UPDATE) whose conflict target does NOT include the table’s tenant column. Required so a conflict is always a same-tenant (B) row: otherwise B’s INSERT could conflict with another tenant A’s row on a tenant-agnostic natural key, and the tenant = B-guarded DO UPDATE would silently no-op — dropping B’s write AND leaking that A holds that key (a cross-tenant existence oracle). Refused fail-closed; add the tenant column to the conflict target (e.g. (tenant_id, …)).

TargetWriteToSessionTable(String)

A target write (INSERT/UPDATE) touched a TenantOrSession (anonymous-session-keyed) table. A target principal carries only the target tenant B (no session fact), so the host cannot write such a row session-scoped — it could only stamp tenant = B, which would silently claim an anon/session-owned row for B and break the anon→promotion model. Refused deny-by-default: write a TenantOrSession table on the caller’s own/session-scoped path, never under a target scope. (PLAN-delegable-capabilities, Stage A.)

Trait Implementations

impl Clone for OrmError

fn clone(&self) -> OrmError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OrmError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for OrmError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for OrmError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for OrmError

fn eq(&self, other: &OrmError) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for OrmError