fix(sqlx): 0.9 AssertSqlSafe, Json payloads, and CRUD generator compatibility

Author: Tuntii

CHANGELOG.md

@@ -23,6 +23,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - **`rcgen` 0.14 HTTP/3 dev certs**: `generate_self_signed_cert` uses `CertifiedKey { cert, signing_key }` so `--all-features` / `http3-dev` builds pass CI again.
+- **SQLx 0.9 jobs + CRUD generator**: Postgres job backend uses `AssertSqlSafe` and `Json` payloads; `cargo rustapi generate crud` emits SQLx 0.9-compatible SQLite handlers.
 - **Security Audit** (`cargo audit`) passes on the current lockfile (no high-severity `quick-xml` advisories).
 
 ## [0.1.551] - 2026-07-05

crates/cargo-rustapi/src/commands/generate.rs

@@ -230,7 +230,7 @@ async fn ensure_crud_dependencies() -> Result<()> {
         .any(|line| line.trim_start().starts_with("sqlx "))
     {
         deps_to_add.push(
-            "sqlx = { version = \"0.8\", default-features = false, features = [\"runtime-tokio\", \"sqlite\", \"derive\"] }",
+            "sqlx = { version = \"0.9\", default-features = false, features = [\"runtime-tokio\", \"sqlite\", \"derive\"] }",
         );
     }
 
@@ -269,7 +269,7 @@ const DB_RS_HEADER: &str = r#"//! Database bootstrap for generated CRUD resource
 //! Default columns are the standard scaffold (`id`, `name`, `description`, timestamps).
 
 use sqlx::sqlite::SqlitePoolOptions;
-use sqlx::SqlitePool;
+use sqlx::{AssertSqlSafe, SqlitePool};
 
 /// Default CRUD column layout for generated resources (customize per model as needed).
 macro_rules! crud_columns {
@@ -311,7 +311,7 @@ async fn upsert_db_resource(table: &str, singular: &str) -> Result<()> {
             "{header}{module_block}\
 async fn ensure_table(pool: &SqlitePool, table: &str, columns: &str) -> Result<(), sqlx::Error> {{
     let schema = format!(\"CREATE TABLE IF NOT EXISTS {{}} ({{}})\", table, columns.trim());
-    sqlx::query(&schema).execute(pool).await?;
+    sqlx::query(AssertSqlSafe(schema.as_str())).execute(pool).await?;
     Ok(())
 }}
 
@@ -427,7 +427,7 @@ async fn generate_sqlx_handler(name: &str, type_name: &str, table: &str) -> Resu
 use crate::db::{table_mod}::{{SINGULAR, TABLE}};
 use crate::models::{{Create{type_name}, Update{type_name}, {type_name}}};
 use rustapi_rs::prelude::*;
-use sqlx::SqlitePool;
+use sqlx::{{AssertSqlSafe, SqlitePool}};
 
 fn now_ts() -> String {{
     chrono::Utc::now().to_rfc3339()
@@ -442,10 +442,10 @@ fn db_error(err: sqlx::Error) -> ApiError {{
 #[rustapi_rs::tag("{type_name}")]
 #[rustapi_rs::summary("List all {name}")]
 pub async fn list(State(pool): State<SqlitePool>) -> Result<Json<Vec<{type_name}>>> {{
-    let rows = sqlx::query_as::<_, {type_name}>(&format!(
+    let rows = sqlx::query_as::<_, {type_name}>(AssertSqlSafe(format!(
         "SELECT id, name, description, created_at, updated_at FROM {{}} ORDER BY id",
         TABLE
-    ))
+    )))
     .fetch_all(&pool)
     .await
     .map_err(db_error)?;
@@ -457,10 +457,10 @@ pub async fn list(State(pool): State<SqlitePool>) -> Result<Json<Vec<{type_name}
 #[rustapi_rs::tag("{type_name}")]
 #[rustapi_rs::summary("Get {singular} by ID")]
 pub async fn get(Path(id): Path<i64>, State(pool): State<SqlitePool>) -> Result<Json<{type_name}>> {{
-    let row = sqlx::query_as::<_, {type_name}>(&format!(
+    let row = sqlx::query_as::<_, {type_name}>(AssertSqlSafe(format!(
         "SELECT id, name, description, created_at, updated_at FROM {{}} WHERE id = ?",
         TABLE
-    ))
+    )))
     .bind(id)
     .fetch_optional(&pool)
     .await
@@ -478,10 +478,10 @@ pub async fn create(
     Json(body): Json<Create{type_name}>,
 ) -> Result<WithStatus<Json<{type_name}>, 201>> {{
     let now = now_ts();
-    let result = sqlx::query(&format!(
+    let result = sqlx::query(AssertSqlSafe(format!(
         "INSERT INTO {{}} (name, description, created_at, updated_at) VALUES (?, ?, ?, ?)",
         TABLE
-    ))
+    )))
     .bind(&body.name)
     .bind(&body.description)
     .bind(&now)
@@ -491,10 +491,10 @@ pub async fn create(
     .map_err(db_error)?;
 
     let id = result.last_insert_rowid();
-    let row = sqlx::query_as::<_, {type_name}>(&format!(
+    let row = sqlx::query_as::<_, {type_name}>(AssertSqlSafe(format!(
         "SELECT id, name, description, created_at, updated_at FROM {{}} WHERE id = ?",
         TABLE
-    ))
+    )))
     .bind(id)
     .fetch_one(&pool)
     .await
@@ -511,10 +511,10 @@ pub async fn update(
     State(pool): State<SqlitePool>,
     Json(body): Json<Update{type_name}>,
 ) -> Result<Json<{type_name}>> {{
-    let existing = sqlx::query_as::<_, {type_name}>(&format!(
+    let existing = sqlx::query_as::<_, {type_name}>(AssertSqlSafe(format!(
         "SELECT id, name, description, created_at, updated_at FROM {{}} WHERE id = ?",
         TABLE
-    ))
+    )))
     .bind(id)
     .fetch_optional(&pool)
     .await
@@ -525,10 +525,10 @@ pub async fn update(
     let description = body.description.or(existing.description);
     let updated_at = now_ts();
 
-    sqlx::query(&format!(
+    sqlx::query(AssertSqlSafe(format!(
         "UPDATE {{}} SET name = ?, description = ?, updated_at = ? WHERE id = ?",
         TABLE
-    ))
+    )))
     .bind(&name)
     .bind(&description)
     .bind(&updated_at)
@@ -537,10 +537,10 @@ pub async fn update(
     .await
     .map_err(db_error)?;
 
-    let row = sqlx::query_as::<_, {type_name}>(&format!(
+    let row = sqlx::query_as::<_, {type_name}>(AssertSqlSafe(format!(
         "SELECT id, name, description, created_at, updated_at FROM {{}} WHERE id = ?",
         TABLE
-    ))
+    )))
     .bind(id)
     .fetch_one(&pool)
     .await
@@ -553,7 +553,7 @@ pub async fn update(
 #[rustapi_rs::tag("{type_name}")]
 #[rustapi_rs::summary("Delete {singular}")]
 pub async fn delete(Path(id): Path<i64>, State(pool): State<SqlitePool>) -> Result<NoContent> {{
-    let result = sqlx::query(&format!("DELETE FROM {{}} WHERE id = ?", TABLE))
+    let result = sqlx::query(AssertSqlSafe(format!("DELETE FROM {{}} WHERE id = ?", TABLE)))
         .bind(id)
         .execute(&pool)
         .await

crates/rustapi-extras/Cargo.toml

@@ -134,7 +134,7 @@ session-redis = ["session", "dep:redis"]
 # Background job processing
 jobs = ["dep:chrono", "dep:uuid"]
 jobs-redis = ["jobs", "dep:redis", "redis/script"]
-jobs-postgres = ["jobs", "dep:sqlx", "sqlx/postgres", "sqlx/runtime-tokio", "sqlx/tls-rustls", "sqlx/chrono", "sqlx/uuid"]
+jobs-postgres = ["jobs", "dep:sqlx", "sqlx/postgres", "sqlx/runtime-tokio", "sqlx/tls-rustls", "sqlx/chrono", "sqlx/uuid", "sqlx/json"]
 
 # Replay (time-travel debugging)
 replay = ["dep:reqwest", "dep:dashmap", "dep:uuid", "dep:serde_urlencoded", "rustapi-core/replay"]

crates/rustapi-extras/src/jobs/backend/postgres.rs

@@ -1,6 +1,7 @@
 use super::super::error::{JobError, Result};
 use super::{JobBackend, JobRequest};
-use sqlx::{Pool, Postgres, Row};
+use sqlx::types::Json;
+use sqlx::{AssertSqlSafe, Pool, Postgres, Row};
 use std::future::Future;
 use std::pin::Pin;
 
@@ -39,7 +40,7 @@ impl PostgresBackend {
             self.table_name, self.table_name, self.table_name
         );
 
-        sqlx::query(&query)
+        sqlx::query(AssertSqlSafe(query.as_str()))
             .execute(&self.pool)
             .await
             .map_err(|e| JobError::BackendError(e.to_string()))?;
@@ -62,10 +63,10 @@ impl JobBackend for PostgresBackend {
                 self.table_name
             );
 
-            sqlx::query(&query)
+            sqlx::query(AssertSqlSafe(query.as_str()))
                 .bind(&job.id)
                 .bind(&job.name)
-                .bind(&job.payload)
+                .bind(Json(&job.payload))
                 .bind(job.created_at)
                 .bind(job.run_at)
                 .bind(job.attempts as i32)
@@ -98,7 +99,7 @@ impl JobBackend for PostgresBackend {
                 self.table_name, self.table_name
             );
 
-            let row = sqlx::query(&query)
+            let row = sqlx::query(AssertSqlSafe(query.as_str()))
                 .fetch_optional(&self.pool)
                 .await
                 .map_err(|e| JobError::BackendError(e.to_string()))?;
@@ -107,7 +108,7 @@ impl JobBackend for PostgresBackend {
                 Ok(Some(JobRequest {
                     id: row.get("id"),
                     name: row.get("name"),
-                    payload: row.get("payload"),
+                    payload: row.get::<Json<serde_json::Value>, _>("payload").0,
                     created_at: row.get("created_at"),
                     run_at: row.get("run_at"),
                     attempts: row.get::<i32, _>("attempts") as u32,