Enum SqlGuardDenyReason 

pub enum SqlGuardDenyReason {
    OperationNotAllowed {
        operation: String,
    },
    TableNotAllowed {
        table: String,
    },
    ColumnNotAllowed {
        table: String,
        column: String,
    },
    PredicateDenylisted {
        pattern: String,
    },
    MissingWhereClause {
        operation: String,
    },
    ParseError {
        error: String,
    },
    NoConfig,
    SelectStarDenied {
        table: String,
    },
}

Structured reason for a SqlQueryGuard denial.

Every denial path in the SQL guard produces one of these variants. The guard logs the reason via tracing::warn! and returns Ok(Verdict::Deny); callers that need the reason programmatically can use SqlQueryGuard::analyze which returns the reason alongside the verdict.

Variants

OperationNotAllowed

The parsed operation class is not present in the guard’s operation_allowlist (fail-closed default).

Fields

operation: String

The parsed operation class (for example SELECT, DROP).

TableNotAllowed

A referenced table is not present in the guard’s table_allowlist.

Fields

table: String

The offending table name, as parsed (case preserved for logs).

ColumnNotAllowed

A projected column is not present in the guard’s column_allowlist for the given table.

Fields

table: String

The table owning the column.

column: String

The offending column name.

PredicateDenylisted

The canonicalized WHERE/predicate text matched a denylist regex.

Fields

pattern: String

The regex pattern source that matched.

MissingWhereClause

A mutation (UPDATE, DELETE) lacked a WHERE clause.

Fields

operation: String

The mutation operation kind.

ParseError

sqlparser could not parse the query. Fail-closed.

Fields

error: String

Human readable parser error message.

NoConfig

The guard config has no allowlists at all and allow_all is false. Fail-closed default: an unconfigured guard denies every query.

SelectStarDenied

SELECT * attempted while a column allowlist is active.

Fields

table: String

The offending table name.

Implementations

impl SqlGuardDenyReason

pub fn code(&self) -> &'static str

Short stable tag suitable for metrics labels.

Trait Implementations

impl Clone for SqlGuardDenyReason

fn clone(&self) -> SqlGuardDenyReason

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SqlGuardDenyReason

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SqlGuardDenyReason

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for SqlGuardDenyReason

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for SqlGuardDenyReason

fn eq(&self, other: &SqlGuardDenyReason) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for SqlGuardDenyReason

impl StructuralPartialEq for SqlGuardDenyReason