Trait ScopableEntity

Source

pub trait ScopableEntity: EntityTrait {
    const IS_UNRESTRICTED: bool = false;

    // Required methods
    fn tenant_col() -> Option<Self::Column>;
    fn resource_col() -> Option<Self::Column>;
    fn owner_col() -> Option<Self::Column>;
    fn type_col() -> Option<Self::Column>;
}

Expand description

Defines the contract for entities that can be scoped by tenant, resource, owner, and type.

Each entity implementing this trait must explicitly declare all four scope dimensions:

tenant_col(): Column for tenant-based isolation (multi-tenancy)
resource_col(): Column for resource-level access (typically the primary key)
owner_col(): Column for owner-based filtering
type_col(): Column for type-based filtering

Important: No implicit defaults are allowed. Every scope dimension must be explicitly specified as Some(Column::...) or None to enforce compile-time safety in secure systems.

§Example (Manual Implementation)

impl ScopableEntity for user::Entity {
    fn tenant_col() -> Option<Self::Column> {
        Some(user::Column::TenantId)
    }
    fn resource_col() -> Option<Self::Column> {
        Some(user::Column::Id)
    }
    fn owner_col() -> Option<Self::Column> {
        None
    }
    fn type_col() -> Option<Self::Column> {
        None
    }
}

§Example (Using Derive Macro)

use modkit_db::secure::Scopable;

#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Scopable)]
#[sea_orm(table_name = "users")]
#[secure(
    tenant_col = "tenant_id",
    resource_col = "id",
    no_owner,
    no_type
)]
pub struct Model {
    #[sea_orm(primary_key)]
    pub id: Uuid,
    pub tenant_id: Uuid,
    pub email: String,
}

§Unrestricted Entities

#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Scopable)]
#[sea_orm(table_name = "system_config")]
#[secure(unrestricted)]
pub struct Model {
    #[sea_orm(primary_key)]
    pub id: Uuid,
    pub config_key: String,
}