Struct SecureInsertOne 

pub struct SecureInsertOne<A, S>
where
    A: ActiveModelTrait,
{ /* private fields */ }

A type-safe wrapper around SeaORM’s Insert that enforces scoping.

This wrapper uses the typestate pattern to ensure that insert operations cannot be executed without first applying access control via .scope_with().

Unlike the simpler secure_insert() helper, this wrapper preserves SeaORM’s builder methods like on_conflict() for upsert semantics.

Example

use modkit_db::secure::{AccessScope, SecureInsertExt};
use sea_orm::sea_query::OnConflict;

let scope = AccessScope::tenants_only(vec![tenant_id]);
let am = user::ActiveModel {
    tenant_id: Set(tenant_id),
    email: Set("user@example.com".to_string()),
    ..Default::default()
};

user::Entity::insert(am)
    .secure()                    // Returns SecureInsertOne<E, Unscoped>
    .scope_with(&scope)?         // Returns SecureInsertOne<E, Scoped>
    .on_conflict(OnConflict::...) // Builder methods still available
    .exec(conn)                  // Now can execute
    .await?;

Implementations

impl<A> SecureInsertOne<A, Unscoped>

where A: ActiveModelTrait + Send, A::Entity: ScopableEntity + EntityTrait, <A::Entity as EntityTrait>::Column: ColumnTrait + Copy,

pub fn scope_with( self, scope: &AccessScope, ) -> Result<SecureInsertOne<A, Scoped>, ScopeError>

Apply access control scope to this insert, transitioning to the Scoped state.

For tenant-scoped entities, this validates that the tenant_id in the ActiveModel matches one of the tenants in the provided scope.

Errors

• Returns ScopeError::Invalid if tenant_id is not set for tenant-scoped entities.
• Returns ScopeError::TenantNotInScope if tenant_id is not in the provided scope.

pub fn scope_with_model( self, scope: &AccessScope, am: &A, ) -> Result<SecureInsertOne<A, Scoped>, ScopeError>

Apply access control scope with explicit ActiveModel validation.

This method extracts the tenant_id from the provided ActiveModel and validates it against the provided scope before allowing the insert.

Errors

• Returns ScopeError::Invalid if tenant_id is not set for tenant-scoped entities.
• Returns ScopeError::TenantNotInScope if tenant_id is not in the provided scope.

impl<A> SecureInsertOne<A, Scoped>

where A: ActiveModelTrait, A::Entity: ScopableEntity + EntityTrait, <A::Entity as EntityTrait>::Column: ColumnTrait + Copy,

pub fn on_conflict(self, on_conflict: SecureOnConflict<A::Entity>) -> Self

Set the ON CONFLICT clause for upsert semantics using SecureOnConflict.

This is the recommended way to add upsert semantics as it enforces tenant immutability at compile/validation time.

Example

let on_conflict = SecureOnConflict::<Entity>::columns([Column::TenantId, Column::UserId])
    .update_columns([Column::Theme, Column::Language])?;

Entity::insert(am)
    .secure()
    .scope_with(&scope)?
    .on_conflict(on_conflict)
    .exec(conn)
    .await?;

pub fn on_conflict_raw(self, on_conflict: OnConflict) -> Self

Set the ON CONFLICT clause using raw SeaORM OnConflict.

Safety

This method bypasses tenant immutability validation. The caller is responsible for ensuring that tenant_id is not included in update columns. Use on_conflict() with SecureOnConflict for automatic validation.

impl<A> SecureInsertOne<A, Scoped>

where A: ActiveModelTrait,

pub async fn exec<C>(self, runner: &C) -> Result<InsertResult<A>, ScopeError>

where C: DBRunner, A: Send,

Execute the insert operation.

Errors

Returns ScopeError::Db if the database operation fails.

pub async fn exec_with_returning<C>( self, runner: &C, ) -> Result<<A::Entity as EntityTrait>::Model, ScopeError>

where C: DBRunner, A: Send, <A::Entity as EntityTrait>::Model: IntoActiveModel<A>,

Execute the insert and return the inserted model.

This is useful when you need the inserted data with any database-generated values (like auto-increment IDs or default values).

Errors

Returns ScopeError::Db if the database operation fails.

pub fn into_inner(self) -> Insert<A>

Unwrap the inner SeaORM Insert for advanced use cases.

Safety

The caller must ensure they don’t remove or bypass the security validation that was applied during .scope_with().

Trait Implementations

impl<A, S: Debug> Debug for SecureInsertOne<A, S>

where A: ActiveModelTrait + Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.