Orm datascope

[Jengro777]

fix #27154

Summary

Replaces the old global, thread-unsafe tenant_filter system with a per-connection, decorator-based DataScope system. This is the V ORM equivalent of Java's DelegatingConnection, Go's connector wrappers, and Rust's Tower middleware pattern.

Problem (Old System)

// Global mutable state — shared across ALL goroutines/requests
__global tenant_filter_state = TenantFilterState{...}

orm.set_current_tenant_id(orm.Primitive(5))
sql db { select from User }!  // implicitly filtered by global state

Three fatal flaws:

1. Not thread-safe — one request's set_current_tenant_id() leaks to others
2. Single-tenant only — global state means only one tenant filter active process-wide
3. Invasive — every DB driver (sqlite/pg/mysql) had to call apply_tenant_filter() internally

Solution (New System)

// Per-request DB — isolated, immutable configuration
db := orm.new_db(raw_conn, orm.DataScope{
    filters: [orm.QueryFilter{field: 'tenant_id', value: orm.Primitive(5)}]
})

sql db { select from User }!  // filtered by db's own DataScope, no global state

Architecture comparison

        OLD (v1)                              NEW (v2)
   ┌─────────────────┐                 ┌─────────────────┐
   │  __global state │                 │  per-request DB │
   │  tenant_id = 5  │                 │  DataScope{...} │
   └────────┬────────┘                 └────────┬────────┘
            │                                    │
    ┌───────▼────────┐                  ┌───────▼────────┐
    │ sqlite.select() │                  │  orm.DB.select()│
    │  ┌───────────┐  │                  │  ┌───────────┐  │
    │  │apply_     │  │                  │  │apply_data │  │
    │  │tenant_    │  │                  │  │_scope()   │  │
    │  │filter()   │──┤ reads global     │  └─────┬─────┘  │
    │  └───────────┘  │                  │        │        │
    │       │         │                  │  ┌─────▼─────┐  │
    │  actual query   │                  │  │conn.select│  │
    └─────────────────┘                  │  └───────────┘  │
        ⚠ thread-unsafe                  └─────────────────┘
        ⚠ single scope                       ✅ thread-safe
        ⚠ couples backends                   ✅ multi-scope
                                             ✅ backends clean

Public API

// Create scoped DB — accepts any Connection
pub fn new_db(conn Connection, scope DataScope) DB

// Skip scope filters. Returns a new DB (immutable builder).
db.unscoped()              // skip ALL scope filters
db.unscoped('org_id')      // skip only 'org_id' filter

// Mark table permanently exempt from DataScope
@[unscoped]
struct Config { ... }

Key design decisions

Decision	Rationale
new_db(conn Connection, ...) accepts base interface	Decorator pattern. JDBC/Go/Rust all accept the widest interface
Transaction methods use runtime is check	Go's .(ConnBeginTx) equivalent. Returns error when unsupported
unscoped() returns new DB (immutable)	Go's context.WithValue() pattern. No mutation
conn field is module-private	Encapsulation. Callers use the interface

Migration

Basic setup

- orm.set_current_tenant_id(orm.Primitive(5))
+ db := orm.new_db(raw_conn, orm.DataScope{
+     filters: [orm.QueryFilter{field: 'tenant_id', value: orm.Primitive(5)}]
+ })

Skip filters

- orm.without_tenant_filter(fn () ![]User {
-     return sql db { select from User }!
- })!
+ unscoped_db := db.unscoped('tenant_id')
+ users := sql unscoped_db { select from User }!

Middleware pattern

fn request_handler(mut ctx Context) {
    base := orm.new_db(ctx.pool.acquire()!, orm.DataScope{
        filters: [orm.QueryFilter{field: 'tenant_id', value: orm.Primitive(ctx.tenant_id)}]
    })
    ctx.db = match ctx.role {
        .admin   { base.unscoped() }        // no scope
        .manager { base.unscoped('org_id') } // partial scope
        .normal  { base }                    // full scope
    }
    // handlers use ctx.db — scope-unaware
}

Removed API

Removed	Replacement
configure_tenant_filter() / set_current_tenant_id()	orm.new_db(conn, DataScope{...})
with_tenant() / without_tenant_filter()	db.unscoped(...)
@[tenant_filter] / @[ignore_tenant_filter]	@[unscoped]
apply_tenant_filter()	Handled internally by orm.DB

Tests

• 84 assertions in orm_scope_test.v covering SELECT/INSERT/UPDATE/DELETE × scope/unscoped/transaction
• All 38 existing ORM tests continue to pass
• All three DB backends (sqlite/pg/mysql) pass
• Compiled and tested under tcc, gcc, clang × debug + `-prod

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89b7385e65

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Replicate scoped INSERT values for every batch row

When scope filters are applied in insert mode, this appends each filter value only once, but batch inserts (QueryData.batch_rows > 1) require row-major data with one value per field per row. As a result, using a scoped orm.DB with insert users into User can misalign/break parameter binding (wrong values per row or missing bind values), because orm_stmt_gen/prepare_insert_query_data expect fields.len * batch_rows values.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve extern emission for modules linked via #flag -l

This now emits C extern declarations only when the source file links .c/.o artifacts, dropping the previous module-level #flag -l... path. That breaks C interop modules that link prebuilt libraries and declare fn C.* without local #includes: the generated C can call undeclared functions, which fails on toolchains that treat implicit declarations as errors.

Useful? React with 👍 / 👎.