simple-module-db 0.0.34__tar.gz → 0.0.36__tar.gz

{simple_module_db-0.0.34 → simple_module_db-0.0.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_db
-Version: 0.0.34
+Version: 0.0.36
 Summary: Per-module SQLModel Base, async session, standard mixins (Audit, SoftDelete, MultiTenant, Versioned) for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -25,7 +25,7 @@ Requires-Dist: aiosqlite>=0.20
 Requires-Dist: alembic>=1.14
 Requires-Dist: asyncpg>=0.30
 Requires-Dist: psycopg2-binary>=2.9
-Requires-Dist: simple-module-core==0.0.34
+Requires-Dist: simple-module-core==0.0.36
 Requires-Dist: sqlalchemy[asyncio]>=2.0
 Requires-Dist: sqlmodel>=0.0.22
 Description-Content-Type: text/markdown

{simple_module_db-0.0.34 → simple_module_db-0.0.36}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_db"
-version = "0.0.34"
+version = "0.0.36"
 description = "Per-module SQLModel Base, async session, standard mixins (Audit, SoftDelete, MultiTenant, Versioned) for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -28,7 +28,7 @@ dependencies = [
     # The async app code goes through asyncpg; migration env.py rewrites the
     # URL to +psycopg2 because Alembic's online migrations are sync-only.
     "psycopg2-binary>=2.9",
-    "simple_module_core==0.0.34",
+    "simple_module_core==0.0.36",
     "sqlalchemy[asyncio]>=2.0",
     "sqlmodel>=0.0.22",
 ]

{simple_module_db-0.0.34 → simple_module_db-0.0.36}/simple_module_db/__init__.py

@@ -4,7 +4,7 @@ from simple_module_db.audit import AuditRecord
 from simple_module_db.base import create_module_base
 from simple_module_db.callbacks import OnCommitCallback
 from simple_module_db.deps import get_db
-from simple_module_db.listeners import TenantIsolationError, current_tenant_id
+from simple_module_db.migration_portability import drop_enums_if_postgres
 from simple_module_db.migrations import (
     build_module_metadata,
     make_include_object,
@@ -15,31 +15,57 @@ from simple_module_db.mixins import AuditMixin, MultiTenantMixin, SoftDeleteMixi
 from simple_module_db.provider import DatabaseProvider, detect_provider
 from simple_module_db.search import LIKE_ESCAPE_CHAR, like_contains_pattern, like_prefix_pattern
 from simple_module_db.session import DatabaseState, RequestSession, init_db
+from simple_module_db.tenancy import (
+    ALL_TENANTS_OPTION,
+    DEFAULT_TENANT_ID,
+    PLATFORM_TENANT_ID,
+    TENANT_ID_PATTERN,
+    MissingTenantError,
+    TenantIsolationError,
+    all_tenants,
+    bind_current_tenant,
+    current_tenant_id,
+    is_valid_tenant_id,
+    tenant_context,
+)
 from simple_module_db.transaction import CommitBeforeResponseMiddleware, finalize_session
+from simple_module_db.writes import hard_delete, mark_written
 
 __all__ = [
+    "ALL_TENANTS_OPTION",
+    "DEFAULT_TENANT_ID",
     "LIKE_ESCAPE_CHAR",
+    "PLATFORM_TENANT_ID",
+    "TENANT_ID_PATTERN",
     "AuditMixin",
     "AuditRecord",
     "CommitBeforeResponseMiddleware",
     "DatabaseProvider",
     "DatabaseState",
+    "MissingTenantError",
     "MultiTenantMixin",
     "OnCommitCallback",
     "RequestSession",
     "SoftDeleteMixin",
     "TenantIsolationError",
     "VersionedMixin",
+    "all_tenants",
+    "bind_current_tenant",
     "build_module_metadata",
     "create_module_base",
     "current_tenant_id",
     "detect_provider",
+    "drop_enums_if_postgres",
     "finalize_session",
     "get_db",
+    "hard_delete",
     "init_db",
+    "is_valid_tenant_id",
     "like_contains_pattern",
     "like_prefix_pattern",
     "make_include_object",
     "make_process_revision_directives",
+    "mark_written",
     "render_item",
+    "tenant_context",
 ]

simple_module_db-0.0.36/simple_module_db/_outer_joins.py

@@ -0,0 +1,97 @@
+"""Tables an ORM entity LEFT-joins in, whose criteria already sit in ``ON`` (#417).
+
+``select(Parent, func.count(Child.id)).outerjoin(Child, ...)``: the column
+wrapped in ``func.count`` strips the ORM annotation, so ``columns_clause_froms``
+lists a bare ``Table child``. ``_plain_tables`` took that for a Core
+``Model.__table__`` reference and added ``WHERE child.tenant_id = :t``, which
+is false for every row the outer join padded with NULLs — the LEFT JOIN became
+an inner one and parents without children vanished.
+
+Excluding such a table from the ``WHERE`` is only safe when something else
+filters it. That holds for exactly one shape: the target of a LEFT outer join
+is a plain ORM entity (``.outerjoin(Child, ...)``) whose class carries the
+loader criteria, because ``with_loader_criteria`` renders them into the join's
+``ON``, and an ``ON`` predicate fully filters a LEFT join's nullable side.
+A relationship path (``.outerjoin(Parent.kids)``, ``.outerjoin(Parent.kids.
+of_type(Kid))``) lands on the same ``ON`` and counts as that entity. So:
+
+* a FULL outer join (``full=True``) is deliberately NOT exempted: it preserves
+  its right side too, and an ``ON`` predicate never removes a preserved row —
+  another tenant's (or a trashed) child that fails ``ON`` still comes back as
+  an unmatched row. Only the ``WHERE`` predicate keeps it out (over-filters,
+  never leaks);
+
+* a relationship with ``secondary`` keeps the child's ``WHERE``: the child
+  sits behind an association table, outside the outer join's own ``ON``;
+* a raw ``Model.__table__`` target gets no loader criteria and keeps its
+  ``WHERE`` predicate (over-filters, never leaks);
+* an ``aliased(Model)`` target is left alone: its name never matches a table
+  name, so it was never a ``WHERE`` candidate in the first place;
+* a target whose mapper does not map exactly one table (joined inheritance)
+  is left alone, conservatively;
+* a target whose class is not in ``covered`` (the classes the caller attaches
+  loader criteria for) is left alone — no criteria, no ``ON`` predicate.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from sqlalchemy.orm import Mapper, RelationshipProperty
+
+
+def _plain(element: Any) -> Any:
+    deannotate = getattr(element, "_deannotate", None)
+    return deannotate() if deannotate is not None else element
+
+
+def orm_outer_join_tables(stmt: Any, covered: set[type] | frozenset[type]) -> list[Any]:
+    """Un-annotated tables of ORM entities ``stmt`` LEFT-outer-joins in (never FULL).
+
+    Only entities whose class is in ``covered`` count: those are the ones the
+    filter gives ``with_loader_criteria``, which is what puts their predicate
+    in ``ON``. Compare the result by identity against FROM candidates.
+    """
+    tables: list[Any] = []
+    for entry in getattr(stmt, "_setup_joins", ()):
+        # SQLAlchemy 2.0: (target, onclause, from_, {"isouter": .., "full": ..})
+        target, flags = entry[0], entry[-1]
+        # LEFT only: ON cannot filter a FULL join's preserved right side.
+        if not isinstance(flags, dict) or not flags.get("isouter") or flags.get("full"):
+            continue
+        prop = getattr(target, "property", None)
+        if isinstance(prop, RelationshipProperty):
+            mapper, table = _relationship_target(target, prop)
+        else:
+            mapper = getattr(target, "_annotations", {}).get("parententity")
+            table = _plain(target)
+        if not isinstance(mapper, Mapper) or mapper.class_ not in covered:
+            continue
+        if table is mapper.local_table and mapper.persist_selectable is mapper.local_table:
+            tables.append(table)
+    return tables
+
+
+def _relationship_target(attr: Any, prop: RelationshipProperty) -> tuple[Any, Any]:
+    """Mapper and table a ``.outerjoin(Parent.kids)`` path lands on, or ``(None, None)``.
+
+    The child's loader criteria render into that join's ``ON`` exactly as for
+    an entity target. Two shapes are refused: a ``secondary`` relationship
+    (the child sits behind an association table, with no ``ON`` guarantee for
+    the outer join itself) and an aliased ``of_type`` (aliases never matched a
+    ``WHERE`` candidate anyway).
+    """
+    if prop.secondary is not None:
+        return None, None
+    of_type = getattr(attr, "_of_type", None)
+    mapper = prop.mapper if of_type is None else of_type
+    if not isinstance(mapper, Mapper):  # aliased(Child) is an AliasedInsp
+        return None, None
+    return mapper, mapper.local_table
+
+
+def is_excluded(from_obj: Any, excluded: list[Any]) -> bool:
+    # Table-object identity on purpose: matching by name would also drop the
+    # WHERE on a raw duplicate occurrence (an alias, another FROM) of the table.
+    plain = _plain(from_obj)
+    return any(plain is t for t in excluded)

simple_module_db-0.0.36/simple_module_db/flush_guard.py

@@ -0,0 +1,92 @@
+"""Unit-of-work tenant rules, applied in ``before_flush``.
+
+The query filter scopes what a statement *reads*; this guards what a flush
+*writes*. It covers the paths that never reach ``do_orm_execute``: objects
+added with ``session.add``, and objects that came out of the identity map —
+``session.get`` answers from it without SQL, so a session reused across a
+``tenant_context`` switch can hand back, and then write, another tenant's row.
+"""
+
+from __future__ import annotations
+
+from sqlalchemy import inspect as sa_inspect
+from sqlalchemy.orm import Session
+
+from simple_module_db.mixins import MultiTenantMixin
+from simple_module_db.query_filter import fallback_tenant_id, is_strict, strict_configured
+from simple_module_db.tenancy import (
+    TenantIsolationError,
+    current_tenant_id,
+    is_all_tenants,
+    missing_tenant_error,
+)
+
+
+def _owner(obj: MultiTenantMixin) -> str | None:
+    """The tenant the row belongs to in the database (before this flush)."""
+    hist = sa_inspect(obj).attrs.tenant_id.history
+    if hist.deleted:
+        return hist.deleted[0]
+    return obj.tenant_id
+
+
+def _stamp_unbound(session: Session) -> None:
+    """Non-strict and unscoped (unbound, or an ``all_tenants()`` block).
+
+    New rows go to the bound tenant if there is one — a bypass widens what a
+    block may *read*, it does not move its writes elsewhere — else to the
+    install's fallback (``default_tenant`` or ``DEFAULT_TENANT_ID``).
+    """
+    stamp = current_tenant_id.get() or fallback_tenant_id(session)
+    for obj in session.new:
+        if isinstance(obj, MultiTenantMixin) and obj.tenant_id is None:
+            obj.tenant_id = stamp
+
+
+def guard_flush(session: Session) -> None:
+    if is_all_tenants():
+        # A bypass block is never scoped; on a single-tenant install its new
+        # rows still need a tenant to satisfy NOT NULL (strict: left to the DB).
+        if not strict_configured(session):
+            _stamp_unbound(session)
+        return
+    tenant_id = current_tenant_id.get()
+    strict = is_strict(session)
+    if tenant_id is None and not strict:
+        _stamp_unbound(session)
+
+    for obj in session.new:
+        if not isinstance(obj, MultiTenantMixin):
+            continue
+        if obj.tenant_id is None:
+            if tenant_id is not None:
+                obj.tenant_id = tenant_id
+            elif strict:
+                raise missing_tenant_error(type(obj).__name__, "INSERT")
+        elif tenant_id is not None and obj.tenant_id != tenant_id:
+            raise TenantIsolationError(
+                f"Cannot create object for tenant '{obj.tenant_id}' "
+                f"in context of tenant '{tenant_id}'"
+            )
+
+    for obj in list(session.dirty) + list(session.deleted):
+        if not isinstance(obj, MultiTenantMixin):
+            continue
+        is_deleted = obj in session.deleted
+        if not is_deleted and not session.is_modified(obj):
+            continue
+        # Moving a row between tenants is never a routine edit, bound or not
+        # (#356); only a deliberate all_tenants() block may do it.
+        if not is_deleted and sa_inspect(obj).attrs.tenant_id.history.has_changes():
+            raise TenantIsolationError("Cannot change tenant_id of an existing object")
+        owner = _owner(obj)
+        op = "DELETE" if is_deleted else "UPDATE"
+        if tenant_id is not None and owner != tenant_id:
+            raise TenantIsolationError(
+                f"Cannot {op} an object of tenant '{owner}' in context of tenant '{tenant_id}'"
+            )
+        if tenant_id is None and strict:
+            raise missing_tenant_error(type(obj).__name__, op)
+
+
+__all__ = ["guard_flush"]

simple_module_db-0.0.36/simple_module_db/insert_guard.py

@@ -0,0 +1,136 @@
+"""INSERT guard and statement-value helpers for the tenant query filter.
+
+Explicit ``tenant_id`` values in an insert must match the bound tenant, and
+missing ones are stamped with it (#357) — or, unbound on a non-strict
+install, with the install's fallback tenant (#380); the same value readers let the
+query filter refuse an UPDATE that assigns ``tenant_id`` (#356).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from sqlalchemy.orm import ORMExecuteState
+
+from simple_module_db import model_registry as registry
+from simple_module_db.tenancy import (
+    ALL_TENANTS_OPTION,
+    DEFAULT_TENANT_ID,
+    TenantIsolationError,
+    current_tenant_id,
+    is_all_tenants,
+    missing_tenant_error,
+)
+
+TENANT_COLUMN = "tenant_id"
+
+
+def _bound_value(value: Any) -> Any:
+    return getattr(value, "value", value)
+
+
+def _column_name(key: Any) -> str:
+    return getattr(key, "key", None) or getattr(key, "name", None) or str(key)
+
+
+def _statement_values(execute_state: ORMExecuteState) -> dict[str, Any]:
+    raw = getattr(execute_state.statement, "_values", None) or {}
+    return {_column_name(k): _bound_value(v) for k, v in raw.items()}
+
+
+def _param_rows(execute_state: ORMExecuteState) -> list[dict[str, Any]]:
+    params = execute_state.parameters
+    if isinstance(params, dict):
+        return [params] if params else []
+    return [p for p in (params or []) if isinstance(p, dict)]
+
+
+def assigned_tenant_ids(execute_state: ORMExecuteState) -> list[Any]:
+    found = []
+    stmt_values = _statement_values(execute_state)
+    if TENANT_COLUMN in stmt_values:
+        found.append(stmt_values[TENANT_COLUMN])
+    found.extend(row[TENANT_COLUMN] for row in _param_rows(execute_state) if TENANT_COLUMN in row)
+    return found
+
+
+def _foreign_insert(value: Any, tenant_id: str) -> TenantIsolationError:
+    return TenantIsolationError(
+        f"Cannot insert rows for tenant '{value}' in context of tenant '{tenant_id}'"
+    )
+
+
+def guard_insert(
+    execute_state: ORMExecuteState, *, strict: bool, fallback: str = DEFAULT_TENANT_ID
+) -> Any:
+    mappers = [m.class_.__name__ for m in execute_state.all_mappers if registry.flags(m.class_)[1]]
+    target = getattr(execute_state.statement, "table", None)
+    if not mappers and getattr(target, "name", None) in registry.tenant_table_names:
+        mappers = [target.name]  # Core insert(Model.__table__)
+    if not mappers:
+        return None
+    bypass = execute_state.execution_options.get(ALL_TENANTS_OPTION, False) or is_all_tenants()
+    if bypass and strict:
+        return None
+    # A non-strict bypass checks no explicit values; missing ones still get
+    # the bound tenant, else the install's fallback (#380).
+    bound = current_tenant_id.get()
+    tenant_id = None if bypass else bound
+    stamp = bound or fallback
+    if getattr(execute_state.statement, "_multi_values", None):
+        return _guard_multi_values(execute_state, tenant_id, stamp, mappers[0], strict)
+    for value in assigned_tenant_ids(execute_state):
+        if tenant_id is not None and value != tenant_id:
+            raise _foreign_insert(value, tenant_id)
+
+    rows = _param_rows(execute_state)
+    stmt_has_tenant = TENANT_COLUMN in _statement_values(execute_state)
+    missing = (
+        [r for r in rows if TENANT_COLUMN not in r] if rows else ([] if stmt_has_tenant else [None])
+    )
+    if not missing:
+        return None
+    if tenant_id is None and strict:
+        raise missing_tenant_error(mappers[0], "INSERT")
+    if rows:
+        stamped = [{**r, TENANT_COLUMN: r.get(TENANT_COLUMN, stamp)} for r in rows]
+        payload = stamped if isinstance(execute_state.parameters, list) else stamped[0]
+        return execute_state.invoke_statement(params=payload)
+    execute_state.statement = execute_state.statement.values(**{TENANT_COLUMN: stamp})
+    return None
+
+
+def _guard_multi_values(
+    execute_state: ORMExecuteState, tenant_id: str | None, stamp: str, entity: str, strict: bool
+) -> Any:
+    """``insert(M).values([{...}, {...}])``: check and stamp each row.
+
+    ``.values(tenant_id=...)`` cannot be appended to a multi-VALUES insert
+    (SQLAlchemy refuses to mix the two forms), so the rows are rewritten.
+    """
+    stmt = execute_state.statement
+    columns = list(stmt.table.c)
+    tenant_col = stmt.table.c[TENANT_COLUMN]
+    groups, missing = [], False
+    for group in stmt._multi_values:
+        rows = []
+        for row in group:
+            mapping = dict(row) if isinstance(row, dict) else dict(zip(columns, row, strict=False))
+            keys = {_column_name(k): k for k in mapping}
+            if TENANT_COLUMN in keys:
+                value = _bound_value(mapping[keys[TENANT_COLUMN]])
+                if tenant_id is not None and value != tenant_id:
+                    raise _foreign_insert(value, tenant_id)
+            else:
+                missing = True
+                mapping[tenant_col] = stamp
+            rows.append(mapping)
+        groups.append(rows)
+    if not missing:
+        return None
+    if tenant_id is None and strict:
+        raise missing_tenant_error(entity, "INSERT")
+    stamped = stmt._generate()
+    stamped._multi_values = tuple(groups)
+    execute_state.statement = stamped
+    return None

{simple_module_db-0.0.34 → simple_module_db-0.0.36}/simple_module_db/listeners.py

@@ -8,10 +8,35 @@ from datetime import UTC, datetime
 
 from sqlalchemy import event
 from sqlalchemy import inspect as sa_inspect
-from sqlalchemy.orm import ORMExecuteState, Session, with_loader_criteria
+from sqlalchemy.orm import Session
 
-from simple_module_db.mixins import AuditMixin, MultiTenantMixin, SoftDeleteMixin, VersionedMixin
+from simple_module_db.flush_guard import guard_flush
+from simple_module_db.mixins import AuditMixin, SoftDeleteMixin, VersionedMixin
+from simple_module_db.query_filter import bind_engine_policy, filter_statements
 from simple_module_db.session import DatabaseState
+from simple_module_db.writes import (
+    _HARD_DELETE_KEY,
+    SESSION_HAS_WRITES_KEY,
+    _is_purge,
+    _mark_dml_written,
+    _mark_session_written,
+    hard_delete,
+    mark_written,
+)
+
+# Re-exported: ``transaction`` and published modules import these from here.
+__all__ = [
+    "SESSION_HAS_WRITES_KEY",
+    "TenantIsolationError",
+    "current_tenant_id",
+    "current_user_id",
+    "hard_delete",
+    "mark_written",
+    "register_listeners",
+]
+
+# Re-exported: callers import these from here since before tenancy.py existed.
+from simple_module_db.tenancy import TenantIsolationError, current_tenant_id
 
 logger = logging.getLogger(__name__)
 _db_logger = logging.getLogger("simple_module.db")
@@ -19,19 +44,6 @@ _db_logger = logging.getLogger("simple_module.db")
 # Set by auth middleware on each request
 current_user_id: ContextVar[str | None] = ContextVar("current_user_id", default=None)
 
-# Set by tenant middleware on each request
-current_tenant_id: ContextVar[str | None] = ContextVar("current_tenant_id", default=None)
-
-
-class TenantIsolationError(Exception):
-    """Raised when a multi-tenancy isolation constraint is violated."""
-
-
-# Key on ``Session.info`` stamped by the after_flush listener so
-# ``get_db`` can distinguish read-only requests from write requests after
-# flush has cleared ``session.new/.dirty/.deleted``.
-SESSION_HAS_WRITES_KEY = "has_writes"
-
 # Key on ``Session.info`` for pending audit snapshots produced in before_flush
 # and consumed in after_flush_postexec (when DB-assigned PKs are populated).
 _AUDIT_PENDING_KEY = "_audit_pending"
@@ -50,6 +62,8 @@ _OP_UPDATE = "update"
 _OP_SOFT_DELETE = "soft_delete"
 _OP_DELETE = "delete"
 
+_LISTENERS_ATTACHED = "_sm_entity_listeners_attached"
+
 
 def _entity_label(obj: object) -> str:
     """Return 'ClassName' for a mapped entity instance."""
@@ -70,17 +84,6 @@ def _entity_pk(obj: object) -> object:
         return None
 
 
-def _mark_session_written(session: Session, flush_context: object) -> None:
-    """Flag the session as having performed write work.
-
-    ``get_db`` reads this flag to decide between commit and rollback at
-    request end. Checking ``session.new/.dirty/.deleted`` directly after
-    a flush is useless — flush empties those sets — so we stash a tag on
-    ``session.info`` that survives the rest of the request.
-    """
-    session.info[SESSION_HAS_WRITES_KEY] = True
-
-
 def register_listeners(db_state: DatabaseState) -> None:
     """Register SQLAlchemy event listeners for audit, soft delete, versioning, and tenancy.
 
@@ -93,22 +96,47 @@ def register_listeners(db_state: DatabaseState) -> None:
 
     global _db_state
     _db_state = db_state
-
-    event.listen(db_state.sync_session_class, "before_flush", _before_flush_listener)
-    event.listen(db_state.sync_session_class, "after_flush", _mark_session_written)
-    event.listen(db_state.sync_session_class, "after_flush_postexec", _after_flush_audit)
-    event.listen(db_state.sync_session_class, "do_orm_execute", _filter_select_statements)
+    # Strict mode is read from db_state at query time, per engine.
+    bind_engine_policy(db_state.engine.sync_engine, db_state)
+    attach_session_listeners(db_state.sync_session_class)
     db_state._listeners_registered = True
     logger.info("Registered SQLAlchemy entity listeners")
 
 
+def attach_session_listeners(session_class: type[Session]) -> None:
+    """Attach the entity listeners to a session class; idempotent.
+
+    For a process with no ``DatabaseState`` (the Celery worker's sync engine),
+    call this and ``bind_engine_policy(engine, EngineTenancy(...))``.
+
+    Idempotence is a marker in the ``__dict__`` of the class or a base, not
+    ``event.contains``: SQLAlchemy keys its event registry on ``id(target)``,
+    so a fresh session class that reuses a garbage-collected one's id reads as
+    already wired and would silently get no tenant, soft-delete or write
+    listeners at all. A subclass of a wired class is skipped because SQLAlchemy
+    propagates class-level session listeners to subclasses (even ones defined
+    later); wiring it again would fire every listener twice.
+    """
+    if any(base.__dict__.get(_LISTENERS_ATTACHED) for base in session_class.__mro__):
+        return
+    for name, fn in (
+        ("before_flush", _before_flush_listener),
+        ("after_flush", _mark_session_written),
+        ("after_flush_postexec", _after_flush_audit),
+        ("do_orm_execute", _mark_dml_written),
+        ("do_orm_execute", filter_statements),
+    ):
+        event.listen(session_class, name, fn)
+    setattr(session_class, _LISTENERS_ATTACHED, True)
+
+
 def _before_flush_listener(
     session: Session,
     flush_context: object,
     instances: object,
 ) -> None:
+    guard_flush(session)
     user_id = current_user_id.get()
-    tenant_id = current_tenant_id.get()
     now = datetime.now(UTC)
 
     for obj in session.new:
@@ -118,16 +146,6 @@ def _before_flush_listener(
             if obj.updated_by is None:
                 obj.updated_by = user_id
 
-        # Auto-populate tenant_id; reject cross-tenant creation
-        if isinstance(obj, MultiTenantMixin):
-            if obj.tenant_id is None and tenant_id is not None:
-                obj.tenant_id = tenant_id
-            elif tenant_id is not None and obj.tenant_id != tenant_id:
-                raise TenantIsolationError(
-                    f"Cannot create object for tenant '{obj.tenant_id}' "
-                    f"in context of tenant '{tenant_id}'"
-                )
-
         _db_logger.info(
             _EVENT_ENTITY_CREATED,
             extra={
@@ -148,12 +166,6 @@ def _before_flush_listener(
         if isinstance(obj, VersionedMixin):
             obj.version += 1
 
-        # Prevent tenant_id from being changed on existing objects
-        if isinstance(obj, MultiTenantMixin) and tenant_id is not None:
-            hist = sa_inspect(obj).attrs.tenant_id.history
-            if hist.has_changes():
-                raise TenantIsolationError("Cannot change tenant_id of an existing object")
-
         _db_logger.info(
             _EVENT_ENTITY_UPDATED,
             extra={
@@ -165,8 +177,9 @@ def _before_flush_listener(
         )
 
     # Deleted objects — convert to soft delete if applicable
+    hard_delete_ids = session.info.pop(_HARD_DELETE_KEY, frozenset())
     for obj in list(session.deleted):
-        if isinstance(obj, SoftDeleteMixin):
+        if isinstance(obj, SoftDeleteMixin) and not _is_purge(obj, hard_delete_ids):
             # Cancel the hard delete
             session.expunge(obj)
             # Merge back as modified with soft-delete fields set
@@ -233,47 +246,3 @@ def _after_flush_audit(session: Session, flush_context: object) -> None:
     records = finalize_records(pending)
     if records:
         _db_state.audit_callback(session, records)
-
-
-# Cache ``(is_soft_delete, is_multi_tenant)`` flags per mapper class so the
-# ``do_orm_execute`` hot path skips redundant ``issubclass`` work on every query.
-_mixin_flags_cache: dict[type, tuple[bool, bool]] = {}
-
-
-def _filter_select_statements(execute_state: ORMExecuteState) -> None:
-    """Attach per-mapper ``with_loader_criteria`` for soft-delete and tenant isolation.
-
-    The criteria are attached per concrete mapper because SQLModel mixins
-    expose Pydantic ``FieldInfo`` (not SQLAlchemy ``InstrumentedAttribute``)
-    at the mixin-class level, which breaks the lambda form of
-    ``with_loader_criteria`` that was used before the SQLModel migration.
-
-    Soft-delete bypass: ``stmt.execution_options(include_deleted=True)``.
-    """
-    if not execute_state.is_select:
-        return
-
-    skip_soft_delete = execute_state.execution_options.get("include_deleted", False)
-    tenant_id = current_tenant_id.get()
-    if skip_soft_delete and tenant_id is None:
-        return
-
-    options = []
-    for mapper in execute_state.all_mappers:
-        cls = mapper.class_
-        flags = _mixin_flags_cache.get(cls)
-        if flags is None:
-            flags = (issubclass(cls, SoftDeleteMixin), issubclass(cls, MultiTenantMixin))
-            _mixin_flags_cache[cls] = flags
-        is_soft_delete, is_multi_tenant = flags
-        if is_soft_delete and not skip_soft_delete:
-            options.append(
-                with_loader_criteria(cls, cls.is_deleted.is_(False), include_aliases=True)
-            )
-        if is_multi_tenant and tenant_id is not None:
-            options.append(
-                with_loader_criteria(cls, cls.tenant_id == tenant_id, include_aliases=True)
-            )
-
-    if options:
-        execute_state.statement = execute_state.statement.options(*options)