GeneralManager 0.89.2__tar.gz → 0.90.0__tar.gz

{generalmanager-0.89.2/src/GeneralManager.egg-info → generalmanager-0.90.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.89.2
+Version: 0.90.0
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.89.2 → generalmanager-0.90.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "GeneralManager"
-version = "0.89.2"
+version = "0.90.0"
 description = "Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching."
 readme = "README.md"
 authors = [{ name = "Tim Kleindick", email = "tkleindick@yahoo.de" }]

{generalmanager-0.89.2 → generalmanager-0.90.0/src/GeneralManager.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.89.2
+Version: 0.90.0
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.89.2 → generalmanager-0.90.0}/src/GeneralManager.egg-info/SOURCES.txt

@@ -232,6 +232,7 @@ src/general_manager/interface/capabilities/read_only/_types.py
 src/general_manager/interface/capabilities/read_only/lifecycle.py
 src/general_manager/interface/capabilities/read_only/management.py
 src/general_manager/interface/capabilities/request/__init__.py
+src/general_manager/interface/capabilities/request/relation_inputs.py
 src/general_manager/interface/infrastructure/__init__.py
 src/general_manager/interface/infrastructure/startup_hooks.py
 src/general_manager/interface/infrastructure/system_checks.py
@@ -296,6 +297,7 @@ src/general_manager/permission/manager_based_permission.py
 src/general_manager/permission/mutation_permission.py
 src/general_manager/permission/permission_checks.py
 src/general_manager/permission/permission_data_manager.py
+src/general_manager/permission/relation_aliases.py
 src/general_manager/permission/utils.py
 src/general_manager/rule/__init__.py
 src/general_manager/rule/handler.py

{generalmanager-0.89.2 → generalmanager-0.90.0}/src/general_manager/api/graphql.py

@@ -246,6 +246,23 @@ def _contains_measurement(annotation: object) -> bool:
     return any(_contains_measurement(argument) for argument in get_args(annotation))
 
 
+class InvalidGraphQLMutationDefaultError(TypeError):
+    """Raised when the global generated CRUD default is not boolean."""
+
+    def __init__(self) -> None:
+        super().__init__("GRAPHQL_MUTATIONS_ENABLED must be a bool.")
+
+
+class InvalidGraphQLMutationConfigurationError(TypeError):
+    """Raised when a manager's generated CRUD allowlist is invalid."""
+
+    def __init__(self, manager_name: str) -> None:
+        super().__init__(
+            f"{manager_name}.__graphql_mutations__ must be a set or frozenset "
+            "containing only 'create', 'update', and 'delete'."
+        )
+
+
 class GraphQLOutputTypeError(ValueError):
     """Raised when an output declaration cannot be registered safely."""
 
@@ -724,7 +741,14 @@ class GraphQL:
         registering anything. Otherwise, it generates create/update/delete
         mutation classes when the manager's Interface advertises support for the
         corresponding operation: either by overriding the `InterfaceBase` method
-        or by listing the operation in `Interface.get_capabilities()`. Each
+        or by listing the operation in `Interface.get_capabilities()`. The
+        manager's `__graphql_mutations__` set or frozenset must also include that
+        operation. When omitted, the global GRAPHQL_MUTATIONS_ENABLED setting
+        defaults to True (all three operations); False hides all. Explicit
+        inherited allowlists override that default. An empty set
+        disables generated CRUD without changing Python writes, permissions,
+        queries, or separately registered custom mutations. Invalid allowlists
+        raise `TypeError` before mutation registration changes. Each
         successfully generated mutation is stored on the class-level registry
         (`_mutations`) under the names `create<ManagerName>`,
         `update<ManagerName>`, and `delete<ManagerName>`. If a mutation factory
@@ -741,6 +765,20 @@ class GraphQL:
         if not interface_cls:
             return None
 
+        supported_mutations = {"create", "update", "delete"}
+        global_default = get_setting("GRAPHQL_MUTATIONS_ENABLED", True)
+        if not isinstance(global_default, bool):
+            raise InvalidGraphQLMutationDefaultError()
+        graphql_mutations = getattr(
+            generalManagerClass,
+            "__graphql_mutations__",
+            supported_mutations if global_default else frozenset(),
+        )
+        if not isinstance(graphql_mutations, (set, frozenset)) or not (
+            graphql_mutations <= supported_mutations
+        ):
+            raise InvalidGraphQLMutationConfigurationError(generalManagerClass.__name__)
+
         default_return_values = {
             "success": graphene.Boolean(),
             generalManagerClass.__name__: graphene.Field(
@@ -765,7 +803,7 @@ class GraphQL:
             method_overridden = base_method.__code__ != method.__code__
             return method_overridden or op_name in capabilities
 
-        if _supports("create", "create"):
+        if "create" in graphql_mutations and _supports("create", "create"):
             create_name = f"create{generalManagerClass.__name__}"
             create_mutation = cls.generate_create_mutation_class(
                 generalManagerClass, default_return_values
@@ -780,7 +818,7 @@ class GraphQL:
                     },
                 )
 
-        if _supports("update", "update"):
+        if "update" in graphql_mutations and _supports("update", "update"):
             update_name = f"update{generalManagerClass.__name__}"
             update_mutation = cls.generate_update_mutation_class(
                 generalManagerClass, default_return_values
@@ -795,7 +833,7 @@ class GraphQL:
                     },
                 )
 
-        if _supports("delete", "delete"):
+        if "delete" in graphql_mutations and _supports("delete", "delete"):
             delete_name = f"delete{generalManagerClass.__name__}"
             delete_mutation = cls.generate_delete_mutation_class(
                 generalManagerClass, default_return_values

{generalmanager-0.89.2 → generalmanager-0.90.0}/src/general_manager/api/graphql_query_permissions.py

@@ -219,7 +219,7 @@ class _NativeQueryStructure:
         for name in names:
             if name not in self.additional:
                 self.additional[name] = additional_local_read_permission(
-                    self.permission, name
+                    self.permission, name, manager=self.manager
                 )
             if self.additional[name] is None:
                 return None
@@ -459,7 +459,8 @@ def authorize_query_fields(
         if getattr_static(permission, "__based_on__", None) is not None:
             return True
         return any(
-            additional_local_read_permission(permission, name) is not False
+            additional_local_read_permission(permission, name, manager=type(instance))
+            is not False
             for name in names
         )
 
@@ -490,8 +491,37 @@ def authorize_query_fields(
         aliases, names, native_relations = _operand_field_names(
             type(instance), field, attributes, native_paths=native_paths
         )
-        if budget_additional_permissions_only and needs_additional_budget(
-            instance, names
+        # A standard delegated policy already resolves its concrete target
+        # during the normal field check. Inspect that same permission object,
+        # not a second relation read or a static declared target type.
+        from general_manager.permission.manager_based_permission import (
+            _can_prepare_local_read_definitions,
+            additional_resolved_read_permission,
+        )
+        from general_manager.permission.base_permission import BasePermission
+
+        permission = getattr_static(instance, "Permission", None)
+        resolved_budget = (
+            budget_additional_permissions_only
+            and getattr_static(permission, "__based_on__", None) is not None
+            and _can_prepare_local_read_definitions(permission)
+        )
+        charged = False
+
+        def charge_resolved(resolved: BasePermission, name: str) -> None:
+            """Charge this operand once when its resolved policy adds or may add restrictions."""
+            nonlocal charged
+            if (
+                not charged
+                and additional_resolved_read_permission(resolved, name) is not False
+            ):
+                budget.charge()
+                charged = True
+
+        if (
+            budget_additional_permissions_only
+            and not resolved_budget
+            and needs_additional_budget(instance, names)
         ):
             budget.charge()
         known_fields = set(attributes) | set(instance.identification)
@@ -500,8 +530,25 @@ def authorize_query_fields(
         known_fields.update(instance.Interface.input_fields)
         if not names.intersection(known_fields):
             raise QueryFieldPermissionError(field)
-        if any(not check_read_permission(instance, info, name) for name in names):
-            raise QueryFieldPermissionError(field)
+        for name in names:
+            if resolved_budget:
+
+                def before_check(
+                    resolved: BasePermission, field_name: str = name
+                ) -> None:
+                    """Account for the exact resolved permission before its normal field check."""
+                    charge_resolved(resolved, field_name)
+
+                allowed = check_read_permission(
+                    instance,
+                    info,
+                    name,
+                    before_check=before_check,
+                )
+            else:
+                allowed = check_read_permission(instance, info, name)
+            if not allowed:
+                raise QueryFieldPermissionError(field)
         for relation in sorted(native_relations):
             # An ORM attname is a scalar spelling of a related field. Give it
             # the same target row/leaf gates as an explicit relation path.

{generalmanager-0.89.2 → generalmanager-0.90.0}/src/general_manager/api/graphql_resolvers.py

@@ -1140,6 +1140,8 @@ def check_read_permission_for_user(
     instance: GeneralManager,
     user: object,
     field_name: str,
+    *,
+    before_check: Callable[[BasePermission], None] | None = None,
 ) -> bool:
     """
     Return ``True`` if *user* may read *field_name* on *instance*.
@@ -1147,10 +1149,15 @@ def check_read_permission_for_user(
     When the manager defines a Permission class, this calls
     ``Permission(instance, user).check_permission("read", field_name)``.
     Managers without a Permission class default to allowing the field read.
+    The internal ``before_check`` hook may account for the resolved policy,
+    without constructing it twice or replacing its authorization decision.
     """
     PermissionClass: type[BasePermission] | None = getattr(instance, "Permission", None)
     if PermissionClass:
-        return PermissionClass(instance, user).check_permission("read", field_name)
+        permission = PermissionClass(instance, user)
+        if before_check is not None:
+            before_check(permission)
+        return permission.check_permission("read", field_name)
     return True
 
 
@@ -1158,6 +1165,8 @@ def check_read_permission(
     instance: GeneralManager,
     info: GraphQLResolveInfo,
     field_name: str,
+    *,
+    before_check: Callable[[BasePermission], None] | None = None,
 ) -> bool:
     """
     Return ``True`` if the request user may read *field_name* on *instance*.
@@ -1165,7 +1174,13 @@ def check_read_permission(
     When the manager defines a Permission class, this calls
     ``Permission(instance, user).check_permission("read", field_name)``.
     Managers without a Permission class default to allowing the field read.
+    The internal ``before_check`` hook may account for the resolved policy,
+    without constructing it twice or replacing its authorization decision.
     """
+    if before_check is not None:
+        return check_read_permission_for_user(
+            instance, info.context.user, field_name, before_check=before_check
+        )
     return check_read_permission_for_user(instance, info.context.user, field_name)
 
 

{generalmanager-0.89.2 → generalmanager-0.90.0}/src/general_manager/interface/base_interface.py

@@ -1183,7 +1183,6 @@ class InterfaceBase(ABC):
             The capability-level create result mapping.
         """
         reject_historical_mutation()
-        observer = cls.get_capability_handler("observability")
 
         def _invoke() -> dict[str, object]:
             """
@@ -1201,12 +1200,22 @@ class InterfaceBase(ABC):
                 return create_handler(cls, *args, **kwargs)
             raise NotImplementedError(f"{cls.__name__} does not support create.")
 
+        return cls._observe_create(args, kwargs, _invoke)
+
+    @classmethod
+    def _observe_create(
+        cls,
+        args: tuple[object, ...],
+        kwargs: dict[str, object],
+        invoke: Callable[[], dict[str, object]],
+    ) -> dict[str, object]:
+        """Share the public create observation envelope with ORM manager writes."""
         return cls._execute_with_observability(
             target=cls,
             operation="create",
             payload={"args": args, "kwargs": kwargs},
-            func=_invoke,
-            observer=observer,
+            func=invoke,
+            observer=cls.get_capability_handler("observability"),
         )
 
     @classmethod

{generalmanager-0.89.2 → generalmanager-0.90.0}/src/general_manager/interface/capabilities/orm/mutations.py

@@ -5,11 +5,14 @@ from __future__ import annotations
 from collections.abc import Iterator
 from contextlib import AbstractContextManager, contextmanager
 from contextvars import ContextVar
-from typing import TYPE_CHECKING, Any, ClassVar, cast
+from copy import copy, deepcopy
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any, ClassVar, Protocol, cast
 
 from django.contrib.auth import get_user_model
 from django.db import DEFAULT_DB_ALIAS, models, router, transaction
 from django.db.models import NOT_PROVIDED
+from django.db.models.fields.related_descriptors import ForwardManyToOneDescriptor
 
 from general_manager.cache.data_change_context import (
     mark_data_change_unchanged,
@@ -53,7 +56,9 @@ from .support import (
 )
 
 if TYPE_CHECKING:  # pragma: no cover
+    from django.db.models.fields.reverse_related import ForeignObjectRel
     from general_manager.interface.orm_interface import OrmInterfaceBase
+    from general_manager.manager.general_manager import GeneralManager
 
 type OrmInterfaceClass = type["OrmInterfaceBase[models.Model]"]
 type OrmInterfaceInstance = "OrmInterfaceBase[models.Model]"
@@ -61,6 +66,110 @@ type MutationPayload = dict[str, object]
 type ManyToManyPayload = dict[str, list[object]]
 type MutationResult = dict[str, object]
 
+
+class _CreatePermissionTargetChangedError(PermissionError):
+    """The prepared create no longer targets the database or key authorized."""
+
+    def __init__(self) -> None:
+        super().__init__("The authorized ORM create relation target changed.")
+
+
+class _UnboundRoutedCreatePermissionError(PermissionError):
+    """A custom writer cannot bind its dynamic route to the permission check."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            "Resolving a related object during a custom ORM create "
+            "requires a fixed database alias."
+        )
+
+
+@dataclass(slots=True)
+class _RoutedCreatePermission:
+    """Share one prepared model between its permission check and write."""
+
+    manager: type[GeneralManager]
+    payload: MutationPayload
+    interface: OrmInterfaceClass
+    shares_source: bool
+    source: models.Model | None = None
+    routing_hint: models.Model | None = None
+    checked_relations: dict[str, tuple[models.ForeignKey[models.Model], object]] = (
+        field(default_factory=dict)
+    )
+
+    def get_source(self) -> models.Model:
+        """Initialize Django defaults only when a permission needs the source."""
+        if not self.shares_source:
+            raise _UnboundRoutedCreatePermissionError
+        if self.source is None:
+            self.source = self.interface._model()
+        return self.source
+
+    @property
+    def database_alias(self) -> str | None:
+        """Return the chosen database once the check resolves a related row."""
+        return self.routing_hint._state.db if self.routing_hint is not None else None
+
+    def verify_target(
+        self, instance: models.Model, configured_database: str | None
+    ) -> None:
+        """Reject routing or relation-key changes introduced by model validation."""
+        if self.database_alias is not None and self.database_alias != (
+            configured_database
+            or router.db_for_write(type(instance), instance=instance)
+        ):
+            raise _CreatePermissionTargetChangedError
+        if any(
+            relation.target_field.to_python(getattr(instance, attname)) != value
+            for attname, (relation, value) in self.checked_relations.items()
+        ):
+            raise _CreatePermissionTargetChangedError
+
+
+_routed_create_check = ContextVar[_RoutedCreatePermission | None](
+    "routed_create_check", default=None
+)
+_routed_create_write = ContextVar[tuple[models.Model, _RoutedCreatePermission] | None](
+    "routed_create_write", default=None
+)
+
+
+def _copy_create_source(
+    source: models.Model, *, isolate_defaults: bool = False
+) -> models.Model:
+    """Copy ORM state, with isolated field defaults for retryable writes."""
+    instance = object.__new__(type(source))
+    instance.__dict__.update(source.__dict__)
+    if isolate_defaults:
+        for concrete in source._meta.concrete_fields:
+            if concrete.attname in source.__dict__:
+                instance.__dict__[concrete.attname] = deepcopy(
+                    source.__dict__[concrete.attname]
+                )
+    instance._state = copy(source._state)
+    vars(instance._state)["fields_cache"] = dict(
+        cast(dict[str, object], source._state.fields_cache)
+    )
+    return instance
+
+
+@contextmanager
+def _bind_routed_create_write(
+    instance: models.Model,
+    permission: _RoutedCreatePermission | None,
+) -> Iterator[None]:
+    """Give the existing save hook the authorization for this exact model."""
+    if permission is None:
+        yield
+        return
+    token = _routed_create_write.set((instance, permission))
+    try:
+        yield
+    finally:
+        _routed_create_write.reset(token)
+
+
 _save_with_history_savepoint = ContextVar(
     "save_with_history_savepoint",
     default=True,
@@ -94,6 +203,37 @@ def _mutation_atomic(
     return transaction.atomic(savepoint=False)
 
 
+class _ModelPkState(Protocol):
+    """Django's PK completeness check, absent from older stubs."""
+
+    def _is_pk_set(self) -> bool: ...
+
+
+def _discard_alternate_key_cache(
+    instance: models.Model, name: str, related: models.Model
+) -> None:
+    """Keep Django assignment checks and reload the current alternate-key owner."""
+    descriptor = getattr(type(instance), name, None)
+    if not isinstance(descriptor, ForwardManyToOneDescriptor):
+        return
+    relation = descriptor.field
+    if (
+        not isinstance(relation, models.ForeignKey)
+        or relation.target_field.primary_key
+        or not cast(_ModelPkState, related)._is_pk_set()
+        or not relation.is_cached(instance)
+    ):
+        # Leave unsaved objects cached so Django still rejects them at save.
+        return
+    relation.delete_cached_value(instance)
+    reverse = cast("ForeignObjectRel", relation.remote_field)
+    if (
+        not reverse.multiple
+        and reverse.get_cached_value(related, default=None) is instance
+    ):
+        reverse.delete_cached_value(related)
+
+
 class OrmMutationCapability(BaseCapability):
     """Common utilities to modify ORM instances."""
 
@@ -144,6 +284,8 @@ class OrmMutationCapability(BaseCapability):
                     raise InvalidFieldValueError(key, value) from error
                 except TypeError as error:
                     raise InvalidFieldTypeError(key, error) from error
+                if isinstance(value, models.Model):
+                    _discard_alternate_key_cache(instance, key, value)
             return instance
 
         return call_with_observability(
@@ -202,6 +344,15 @@ class OrmMutationCapability(BaseCapability):
             """
             support = get_support_capability(interface_cls)
             database_alias = support.get_database_alias(interface_cls)
+            create_write = _routed_create_write.get()
+            create_permission = (
+                create_write[1]
+                if create_write is not None and create_write[0] is instance
+                else None
+            )
+            write_database = (
+                create_permission.database_alias if create_permission else None
+            ) or database_alias
             from general_manager.manager.bulk_create import (
                 CreateManyUnsupportedError,
                 enclosing_create_many_batch,
@@ -216,7 +367,7 @@ class OrmMutationCapability(BaseCapability):
             if database_alias:
                 instance._state.db = database_alias
             atomic_context = _mutation_atomic(
-                database_alias,
+                write_database,
                 savepoint=_save_with_history_savepoint.get(),
             )
             with atomic_context:
@@ -237,8 +388,10 @@ class OrmMutationCapability(BaseCapability):
                         != batch.database_alias
                     ):
                         raise CreateManyUnsupportedError.routing()
-                if database_alias:
-                    instance.save(using=database_alias)
+                if create_permission is not None:
+                    create_permission.verify_target(instance, database_alias)
+                if write_database:
+                    instance.save(using=write_database)
                 else:
                     instance.save()
             return instance.pk
@@ -371,6 +524,16 @@ class OrmCreateCapability(BaseCapability):
                 wrapped.
         """
         _ = args
+        return self._create(interface_cls, kwargs)
+
+    def _create(
+        self,
+        interface_cls: OrmInterfaceClass,
+        kwargs: MutationPayload,
+        *,
+        permission: _RoutedCreatePermission | None = None,
+    ) -> MutationResult:
+        """Persist a create using the initialized source shared with its check."""
         payload_snapshot = {"kwargs": dict(kwargs)}
 
         def _perform() -> MutationResult:
@@ -399,6 +562,10 @@ class OrmCreateCapability(BaseCapability):
             if enclosing_create_many_batch() is not None:
                 validate_create_many_record(normalized_simple)
             mutation = _mutation_capability_for(interface_cls)
+            source = permission.source if permission is not None else None
+            authorized_database = (
+                permission.database_alias if permission is not None else None
+            )
             if has_upload_candidates(normalized_simple):
                 prepared = prepare_upload_claims(
                     interface_cls,
@@ -407,10 +574,18 @@ class OrmCreateCapability(BaseCapability):
                     actor_id=creator_id,
                     target_pk=None,
                 )
+                if authorized_database not in (None, prepared.database_alias):
+                    raise _CreatePermissionTargetChangedError
 
                 def _create_claimed() -> MutationResult:
                     locked = lock_upload_claims(prepared)
-                    instance = interface_cls._model()
+                    # An upload may retry the transaction. Each attempt starts
+                    # with the same authorized defaults and a fresh model state.
+                    instance = (
+                        _copy_create_source(source, isolate_defaults=True)
+                        if source is not None
+                        else interface_cls._model()
+                    )
                     ordinary_values = {
                         key: value
                         for key, value in normalized_simple.items()
@@ -431,12 +606,13 @@ class OrmCreateCapability(BaseCapability):
                         instance,
                         reserved_values,
                     )
-                    claimed_pk = mutation.save_with_history(
-                        interface_cls,
-                        claimed_instance,
-                        creator_id=creator_id,
-                        history_comment=history_comment,
-                    )
+                    with _bind_routed_create_write(claimed_instance, permission):
+                        claimed_pk = mutation.save_with_history(
+                            interface_cls,
+                            claimed_instance,
+                            creator_id=creator_id,
+                            history_comment=history_comment,
+                        )
                     mutation.apply_many_to_many(
                         interface_cls,
                         claimed_instance,
@@ -448,12 +624,16 @@ class OrmCreateCapability(BaseCapability):
 
                 return run_upload_transaction(prepared, _create_claimed)
             instance = mutation.assign_simple_attributes(
-                interface_cls, interface_cls._model(), normalized_simple
+                interface_cls,
+                source if source is not None else interface_cls._model(),
+                normalized_simple,
             )
             support = get_support_capability(interface_cls)
             database_alias = support.get_database_alias(interface_cls)
-            atomic_context = _mutation_atomic(database_alias)
-            with atomic_context:
+            with (
+                _mutation_atomic(authorized_database or database_alias),
+                _bind_routed_create_write(instance, permission),
+            ):
                 with _without_save_with_history_savepoint():
                     pk = mutation.save_with_history(
                         interface_cls,
@@ -477,6 +657,54 @@ class OrmCreateCapability(BaseCapability):
         )
 
 
+def _create_for_manager(
+    interface: OrmInterfaceClass,
+    manager: type[GeneralManager],
+    payload: MutationPayload,
+    creator_id: int | None,
+    history_comment: str | None,
+) -> MutationResult:
+    """Use the prepared model for permission checks in canonical routed creates."""
+    from general_manager.interface.base_interface import InterfaceBase
+
+    create = interface.create
+    if not router.routers:
+        manager.Permission.check_create_permission(payload, manager, creator_id)
+        return create(creator_id=creator_id, history_comment=history_comment, **payload)
+
+    handler = interface.get_capability_handler("create")
+    builtin_create = (
+        isinstance(handler, OrmCreateCapability)
+        and getattr(handler.create, "__func__", None) is OrmCreateCapability.create
+        and getattr(create, "__func__", None)
+        is getattr(InterfaceBase.create, "__func__", None)
+    )
+    mutation = interface.get_capability_handler("orm_mutation")
+    builtin_save = (
+        isinstance(mutation, OrmMutationCapability)
+        and getattr(mutation.save_with_history, "__func__", None)
+        is OrmMutationCapability.save_with_history
+    )
+    permission = _RoutedCreatePermission(
+        manager, payload, interface, shares_source=builtin_create and builtin_save
+    )
+    token = _routed_create_check.set(permission)
+    try:
+        manager.Permission.check_create_permission(payload, manager, creator_id)
+    finally:
+        _routed_create_check.reset(token)
+
+    if not builtin_create:
+        return create(creator_id=creator_id, history_comment=history_comment, **payload)
+    assert isinstance(handler, OrmCreateCapability)
+    kwargs = {"creator_id": creator_id, "history_comment": history_comment, **payload}
+    return interface._observe_create(
+        (),
+        kwargs,
+        lambda: handler._create(interface, kwargs, permission=permission),
+    )
+
+
 class OrmUpdateCapability(BaseCapability):
     """Update existing ORM instances."""