Struct SecureSelect 

pub struct SecureSelect<E: EntityTrait, S> { /* private fields */ }

A type-safe wrapper around SeaORM’s Select that enforces scoping.

This wrapper uses the typestate pattern to ensure that queries cannot be executed without first applying access control via .scope_with().

Type Parameters

• E: The SeaORM entity type
• S: The typestate (Unscoped or Scoped)

Example

use modkit_db::secure::{AccessScope, SecureEntityExt};

let scope = AccessScope::tenants_only(vec![tenant_id]);
let users = user::Entity::find()
    .secure()           // Returns SecureSelect<E, Unscoped>
    .scope_with(&scope)? // Returns SecureSelect<E, Scoped>
    .all(conn)          // Now can execute
    .await?;

Implementations

impl<E> SecureSelect<E, Unscoped>

where E: ScopableEntity + EntityTrait, E::Column: ColumnTrait + Copy,

pub fn scope_with(self, scope: &AccessScope) -> SecureSelect<E, Scoped>

Apply access control scope to this query, transitioning to the Scoped state.

This applies the implicit policy:

• Empty scope → deny all
• Tenants only → filter by tenant
• Resources only → filter by resource IDs
• Both → AND them together

impl<E> SecureSelect<E, Scoped>

where E: EntityTrait,

pub async fn all<C>(self, conn: &C) -> Result<Vec<E::Model>, ScopeError>

where C: ConnectionTrait + Send + Sync,

Execute the query and return all matching results.

Errors

Returns ScopeError::Db if the database query fails.

pub async fn one<C>(self, conn: &C) -> Result<Option<E::Model>, ScopeError>

where C: ConnectionTrait + Send + Sync,

Execute the query and return at most one result.

Errors

Returns ScopeError::Db if the database query fails.

pub async fn count<C>(self, conn: &C) -> Result<u64, ScopeError>

where C: ConnectionTrait + Send + Sync, E::Model: FromQueryResult + Send + Sync,

Execute the query and return the number of matching results.

Errors

Returns ScopeError::Db if the database query fails.

pub fn and_id(self, id: Uuid) -> Result<Self, ScopeError>

where E: ScopableEntity, E::Column: ColumnTrait + Copy,

Add an additional filter for a specific resource ID.

This is useful when you want to further narrow a scoped query to a single resource.

Example

let user = User::find()
    .secure()
    .scope_with(&scope)?
    .and_id(user_id)
    .one(conn)
    .await?;

Errors

Returns ScopeError::Invalid if the entity doesn’t have a resource column.

pub fn into_inner(self) -> Select<E>

Unwrap the inner SeaORM Select for advanced use cases.

This is an escape hatch if you need to add additional filters, joins, or ordering after scoping has been applied.

Safety

The caller must ensure they don’t remove or bypass the security conditions that were applied during .scope_with().

impl<E> SecureSelect<E, Scoped>

where E: EntityTrait,

pub fn filter(self, filter: Condition) -> Self

Add additional filters to the scoped query. The scope conditions remain in place.

pub fn order_by<C>(self, col: C, order: Order) -> Self

where C: IntoSimpleExpr,

Add ordering to the scoped query.

pub fn limit(self, limit: u64) -> Self

Add a limit to the scoped query.

pub fn offset(self, offset: u64) -> Self

Add an offset to the scoped query.

pub fn and_scope_for<J>(self, scope: &AccessScope) -> Self

where J: ScopableEntity + EntityTrait, J::Column: ColumnTrait + Copy,

Apply scoping for a joined entity.

This is useful when you need to filter by tenant on a joined table.

Example

// Select orders, ensuring both Order and Customer match tenant scope
Order::find()
    .secure()
    .scope_with(&scope)?
    .and_scope_for::<customer::Entity>(&scope)
    .all(conn)
    .await?

pub fn scope_via_exists<J>(self, scope: &AccessScope) -> Self

where J: ScopableEntity + EntityTrait, J::Column: ColumnTrait + Copy,

Apply scoping via EXISTS subquery on a related entity.

This is particularly useful when the base entity doesn’t have a tenant column but is related to one that does.

Note

This is a simplified version that filters by tenant on the joined entity. For complex join predicates, use into_inner() and build custom EXISTS clauses.

Example

// Find settings that exist in a tenant-scoped relationship
GlobalSetting::find()
    .secure()
    .scope_with(&AccessScope::resources_only(vec![]))?
    .scope_via_exists::<TenantSetting>(&scope)
    .all(conn)
    .await?

Trait Implementations

impl<E: Clone + EntityTrait, S: Clone> Clone for SecureSelect<E, S>

fn clone(&self) -> SecureSelect<E, S>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<E: Debug + EntityTrait, S: Debug> Debug for SecureSelect<E, S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.