Module secure 

Secure ORM layer for scoped database access.

This module provides a type-safe wrapper around SeaORM that enforces access control scoping at compile time using the typestate pattern.

Basic Example

Creating and using access scopes:

use modkit_db::secure::AccessScope;
use uuid::Uuid;

// Create an empty scope (deny-all)
let deny_scope = AccessScope::default();
assert!(deny_scope.is_empty());

// Create a tenant-scoped access
let tenant_id = Uuid::new_v4();
let scope = AccessScope::tenant(tenant_id);
assert!(scope.has_tenants());
assert!(!scope.is_empty());

// Create a resource-scoped access
let resource_id = Uuid::new_v4();
let resource_scope = AccessScope::resource(resource_id);
assert!(resource_scope.has_resources());

Quick Start with SeaORM

use modkit_db::secure::{AccessScope, SecureEntityExt, Scopable};
use sea_orm::entity::prelude::*;

// 1. Derive Scopable for your entity (or implement manually)
#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Scopable)]
#[sea_orm(table_name = "users")]
#[secure(
    tenant_col = "tenant_id",
    resource_col = "id",
    no_owner,
    no_type
)]
pub struct Model {
    #[sea_orm(primary_key)]
    pub id: Uuid,
    pub tenant_id: Uuid,
    pub email: String,
}

// 2. Create an access scope
let scope = AccessScope::tenants_only(vec![tenant_id]);

// 3. Execute scoped queries
let users = Entity::find()
    .secure()
    .scope_with(&scope)?
    .all(conn)
    .await?;

Manual Implementation

If you prefer not to use the derive macro:

use modkit_db::secure::ScopableEntity;

impl ScopableEntity for Entity {
    fn tenant_col() -> Option<Self::Column> {
        Some(Column::TenantId)
    }
    fn resource_col() -> Option<Self::Column> {
        Some(Column::Id)
    }
    fn owner_col() -> Option<Self::Column> {
        None
    }
    fn type_col() -> Option<Self::Column> {
        None
    }
}

Features

• Typestate enforcement: Prevents unscoped queries at compile time
• Implicit policy: Automatic deny-all for empty scopes
• Multi-tenant support: Enforces tenant isolation when applicable
• Resource-level access: Fine-grained control via explicit IDs
• Zero runtime overhead: All checks at compile/build time

Policy

Scope	Behavior
Empty	Deny all (WHERE 1=0)
Tenants only	Filter by tenant column
Resources only	Filter by ID column
Both	AND them together

See the docs module for comprehensive examples and usage patterns.

Re-exports

pub use provider::SimpleTenantFilter;

pub use provider::TenantFilterProvider;

Modules

docs

Secure ORM Layer Documentation

provider

Structs

AccessScope

Access scope defining which tenants and resources a request can access.

Db

Database handle for secure operations.

DbConn

Non-transactional database runner.

DbTx

Transactional database runner.

InfraError

Infrastructure error representing a database-level failure.

Scoped

Typestate marker: query has been scoped with access control. Can now execute queries safely.

SecureConn

Secure database connection wrapper.

SecureDeleteMany

A type-safe wrapper around SeaORM’s DeleteMany that enforces scoping.

SecureInsertOne

A type-safe wrapper around SeaORM’s Insert that enforces scoping.

SecureOnConflict

A secure builder for ON CONFLICT DO UPDATE clauses that enforces tenant immutability.

SecureSelect

A type-safe wrapper around SeaORM’s Select that enforces scoping.

SecureSelectTwo

A type-safe wrapper around SeaORM’s SelectTwo that enforces scoping.

SecureSelectTwoMany

A type-safe wrapper around SeaORM’s SelectTwoMany that enforces scoping.

SecureTx

Secure transaction wrapper (capability).

SecureUpdateMany

A type-safe wrapper around SeaORM’s UpdateMany that enforces scoping.

TxConfig

Configuration for database transactions.

Unscoped

Typestate marker: query has not yet been scoped. Cannot execute queries in this state.

Enums

ScopeError

Errors that can occur during scoped query execution.

TxAccessMode

Transaction access mode.

TxError

Transaction error that distinguishes domain errors from infrastructure errors.

TxIsolationLevel

Transaction isolation level.

Traits

ScopableEntity

Defines the contract for entities that can be scoped by tenant, resource, owner, and type.

SecureDeleteExt

Extension trait to convert a regular SeaORM DeleteMany into a SecureDeleteMany.

SecureEntityExt

Extension trait to convert a regular SeaORM Select into a SecureSelect.

SecureFindRelatedExt

Extension trait to perform secure find_related queries from a model instance.

SecureInsertExt

Extension trait to convert a regular SeaORM Insert into a SecureInsertOne.

SecureUpdateExt

Extension trait to convert a regular SeaORM UpdateMany into a SecureUpdateMany.

Functions

secure_insert

Secure insert helper for Scopable entities.

secure_update_with_scope

Secure update helper for updating a single entity by ID inside a scope.

validate_tenant_in_scope

Helper to validate a tenant ID is in the scope.

Derive Macros

Scopable

Derive macro for implementing ScopableEntity.