Enum TargetRewriteError 

pub enum TargetRewriteError {
    Parse(String),
    NotReadOnly,
    WriteInReadPosition,
    UnsupportedTableSource(String),
    QualifiedTableName(String),
    PublicSubsetUndeclared(String),
    TenancyUndeclared(String),
    UnsupportedLiteral,
    BadColumn(String),
    EmptyConfinement(String),
    MissingTarget,
    UnsupportedJoin(String),
    CteNotAllowed,
}

Why a raw-SQL target read is refused before it reaches the backend (always fail-closed — a target read that cannot be provably confined does not run).

Variants

Parse(String)

The statement did not parse under the backend’s dialect.

NotReadOnly

Not a single read-only query: multiple statements, or a top-level statement that is not a SELECT / VALUES / set-operation (a write or DDL). Target reads are read-only.

WriteInReadPosition

A write was smuggled into a read position (a SELECT … INTO, a TABLE t shorthand, or an INSERT/UPDATE inside a CTE / set-op arm).

UnsupportedTableSource(String)

A table source the confinement cannot reason about (a table-valued function, UNNEST, PIVOT/UNPIVOT, JSON_TABLE, MATCH_RECOGNIZE, …) — refused rather than left unconfined.

QualifiedTableName(String)

A schema-/database-qualified table name (schema.table). A target read must use bare table identifiers so the per-table key/public lookup is unambiguous (a qualified name could point at a different physical table than the schema entry it would be confined by).

PublicSubsetUndeclared(String)

A table accessed under a target read declares no PUBLIC subset (deny-by-default — the strict analog of the ORM’s PublicSubsetUndeclared).

TenancyUndeclared(String)

A table accessed under a target read has no declared tenant key in the schema (deny-by-default — the analog of TenancyUndeclared).

UnsupportedLiteral

The tenant B value, or a public-subset literal, cannot be rendered as a safe SQL literal (a blob / JSON / null / non-finite float where a scalar was required).

BadColumn(String)

A tenant/public column in the schema is not a valid SQL identifier (operator misconfig).

EmptyConfinement(String)

A declared subset lowered to no confinement at all (empty predicate on an unscoped table) — would match every row; refused. (The schema validator rejects empty predicates up front; this is the injector-level backstop.)

MissingTarget

A target read was attempted with no resolved target tenant B (the principal carried no TargetTenant fact). Unreachable by construction — a target principal always resolves B — but refused fail-closed rather than run unconfined.

UnsupportedJoin(String)

A join the target-read confinement cannot soundly place: a RIGHT/FULL OUTER join (the driving side is nullable), a semi/anti/apply/asof join, or a LEFT OUTER join with a USING/NATURAL/ no constraint (no ON to inject the confinement into). Refused fail-closed — the ORM target path is INNER + LEFT-ON only, and the same read is expressible as a LEFT … ON join.

CteNotAllowed

The statement used a WITH (CTE). CTEs are refused in a raw-SQL target read (deny-by-default, matching the ORM target path, which does not support CTEs): a non-recursive CTE’s body may reference the base table under the CTE’s own name, and a recursive CTE references itself, so a name-based “is this a CTE reference?” test cannot soundly distinguish a base-table read from a CTE reference — the safe collapse is to refuse. The same read is expressible with a derived table / subquery, which IS confined.

Implementations

impl TargetRewriteError

pub fn reason(&self) -> String

A short, guest-safe reason (no tenant values leaked).

Trait Implementations

impl Clone for TargetRewriteError

fn clone(&self) -> TargetRewriteError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TargetRewriteError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for TargetRewriteError

impl PartialEq for TargetRewriteError

fn eq(&self, other: &TargetRewriteError) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TargetRewriteError