surreal-orm-lite 0.34.0__tar.gz → 0.34.2__tar.gz

{surreal_orm_lite-0.34.0 → surreal_orm_lite-0.34.2}/CHANGELOG.md

@@ -5,6 +5,56 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.34.1] - 2026-10-22
+
+Follow-ups to the review of v0.34.0's model table DDL (#296): `define_access()` and
+`define_table()` refuse an auth model whose `SCHEMAFULL` table would leave out a field SIGNUP
+writes, and the README describes three behaviours of v0.34.0 more precisely. No new public API.
+
+### Fixed
+
+- **`define_access()` and `define_table()` raise `TypeError` for a signup field the table would
+  leave out** (#296). Since v0.34.0, a model whose schema mode is `SCHEMAFULL`
+  (`table_type=TableType.USER`, or a declared `schema_mode=SchemaMode.SCHEMAFULL`) gets from
+  `define_access()` and `define_table()` a `SCHEMAFULL` table with one `DEFINE FIELD` per column
+  `model_dump()` writes, while SIGNUP writes every field of the model. A field declared with
+  `Field(exclude=True)` (`password: str = Field(exclude=True)`) therefore had no column: SurrealDB
+  3.x refused every signup ("The record access signup query failed"), and 2.x dropped the value, a
+  password hash, so every signin failed. For such an auth model (`AuthenticatedUserMixin`),
+  `access_ddl()` and `define_access()` with `with_table=True`, and `table_ddl()` and
+  `define_table()`, now raise `TypeError` before any request, naming the model and the fields.
+  Remove `exclude=True` and leave the field out where you serialise the model instead
+  (`model_dump(exclude={"password"})`): a table defined by hand does not help, since `update()` and
+  `upsert()` replace the record with what `model_dump()` writes, which a required column refuses
+  and an optional one loses. `define_access(with_table=False)`, a `SCHEMALESS` table and a model
+  that is not an auth model (whose excluded field `save()` never writes) behave as before.
+
+### Notes
+
+- **A regenerated `SCHEMAFULL` edge model is applied with `define_table()`**: since v0.34.0,
+  `generate_models_from_db()` gives a `SCHEMAFULL` relation table with data fields an edge model
+  with `schema_mode=SchemaMode.SCHEMAFULL`, for which `define_relation()` raises `SurrealDbError`
+  before any request (it defines no field). Call `define_table()`, which applies the same relation
+  statement, then the data fields. README sections 31 and 34 say so.
+- **`define_access()` and `define_table()` write different table types for a model that declares
+  no `table_type`** and whose schema mode is not `SCHEMAFULL`: `define_access()` writes no `TYPE`,
+  which SurrealDB stores as `TYPE ANY`, and `define_table()` writes `TYPE NORMAL`, so a start-up
+  that calls both changes the table's type each time. Declare `table_type` to keep one type. The
+  schema mode, fields and permissions are the same in any call order; README "User models" and the
+  docstrings no longer say that the two converge on everything.
+- **Undeclared keys in `FLEXIBLE` list items on SurrealDB 2.x and the embedded engine**: the items
+  of a list `define_table()` writes `FLEXIBLE` (a list of sub-models holding a `dict`, an `Any` or
+  an untyped `list`) keep a key the model does not declare, written raw or by another client (the
+  ORM never sends one), while a list that is not `FLEXIBLE` drops it. This is a 2.x limitation:
+  `FLEXIBLE` there covers the whole item. 3.x keeps such a key in the items of any list of objects,
+  `FLEXIBLE` or not, and refuses it at the top level or in a sub-model. README section 35 and the
+  "ORM behaviour: SurrealDB 2.x vs 3.x" row on undeclared fields say so.
+- **Enum columns**: the 0.34.0 entry's list of column kinds leaves out one case: an `enum.Flag` or
+  `IntFlag` field is written `int`, since Pydantic also accepts any combination of its members, and
+  zero. The README "Field types" table, which says so, is now pinned by a test.
+- Server pins unchanged: tested against SurrealDB 3.3.4 and 2.7.0 and on the embedded engine,
+  plus 3.1.5 for backward compatibility.
+
 ## [0.34.0] - 2026-10-21
 
 Model table DDL: a model declares its table's schema mode, change feed, permissions and comment

{surreal_orm_lite-0.34.0 → surreal_orm_lite-0.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: surreal-orm-lite
-Version: 0.34.0
+Version: 0.34.2
 Summary: Lightweight Django-style ORM for SurrealDB using the official Python SDK. Async support with Pydantic validation.
 Project-URL: Homepage, https://github.com/EulogySnowfall/SurrealDB-ORM-lite
 Project-URL: Documentation, https://github.com/EulogySnowfall/SurrealDB-ORM-lite
@@ -4321,7 +4321,10 @@ class Person(BaseSurrealModel):
   when the schema was read from another connection than `"default"`, then `server_fields` and `extra="allow"`
   (below). A model declares
   `id: str | None = None` first (`id: RecordID | None = None` for a view: a grouped view's ids are arrays), then one
-  line per field, in codepoint order of the columns.
+  line per field, in codepoint order of the columns. A `SCHEMAFULL` relation table with data fields gives an edge model
+  with `schema_mode=SchemaMode.SCHEMAFULL` (since v0.34.0): apply it with `define_table()`, which defines those fields,
+  not `define_relation()`, which raises `SurrealDbError` before any request
+  ([section 34](#34-relation-constraints-relation_in-define_relation)).
 - A class is named after its table in PascalCase, without singularisation (`game_tables` → `GameTables`); a name
   that is taken — a Python keyword, a name the module imports, another table's class — gets `Model` appended (`range`
   → `RangeModel`). The table's indexes and events are comments of its class, and so are its comment, change feed
@@ -5168,6 +5171,11 @@ print(await Follows.define_relation())
   other clauses.
 - `define_relation()` raises `SurrealDbError` before any DDL on a materialized view (the `OVERWRITE` would drop its
   query) and on a definition the ORM cannot read back (it could not keep the other clauses).
+- An edge model that declares `schema_mode=SchemaMode.SCHEMAFULL` and has data fields — the model
+  `generate_models_from_db()` writes for a `SCHEMAFULL` relation table with data fields, since v0.34.0 — is applied
+  with `define_table()`, not `define_relation()`: `define_relation()` defines no field, so it raises `SurrealDbError`
+  before any request, and `define_table()` applies the same relation statement, then the data fields
+  ([section 35](#35-model-table-ddl-define_table-schema_mode-permissions)).
 - SurrealDB rewrites the `in` and `out` field definitions from `IN` and `OUT` (`TYPE record<person>`): an `ASSERT`
   written on them by hand is lost. Declare the tables with `relation_in` and `relation_out` instead.
 - Why not `ALTER TABLE`, which keeps the other clauses too: on SurrealDB 2.x and the embedded engine, a raw
@@ -5667,7 +5675,10 @@ print(edge.stars)
 same schema mode. A model with `table_type=TableType.USER` (the full ORM's key for an auth table) or
 `schema_mode=SchemaMode.SCHEMAFULL` gets from `define_access()` a `SCHEMAFULL` table with one `DEFINE FIELD` per field
 and the access's permissions, then the access: signup and signin work on SurrealDB 2.x and 3.x, `define_table()` is
-optional, and any call order gives the same table. Every other model keeps v0.17.0's `SCHEMALESS` table.
+optional, and any call order gives the same table. Every other model keeps v0.17.0's `SCHEMALESS` table. One that
+declares no `table_type` gets no `TYPE` from `define_access()`, which SurrealDB stores as `TYPE ANY`, and `TYPE NORMAL`
+from `define_table()`: calling both changes the table's type each time, so declare `table_type` to keep one. The schema
+mode, fields and permissions are the same in any call order.
 
 ```python
 from surreal_orm_lite import AuthenticatedUserMixin, TableType
@@ -5692,6 +5703,13 @@ print(*table, sep="\n")
   declares its own.
 - A `TableType.USER` model with `extra="allow"` raises `TypeError` there (with `with_table=True`), since its table is
   `SCHEMAFULL`; a `server_fields` column without a constant default needs a database `DEFAULT` ("Field types" above).
+- A field SIGNUP writes that `Field(exclude=True)` keeps out of `model_dump()` (`password: str = Field(exclude=True)`)
+  raises `TypeError` too, naming the field, before any request (with a `SCHEMAFULL` schema mode): `define_access()`
+  with `with_table=True` and `define_table()` both refuse it, since the table would not define it, so SurrealDB 3.x
+  would refuse every signup and 2.x drop the password hash, failing every signin. Remove `exclude=True` and leave the
+  field out where you serialise the model instead (`model_dump(exclude={"password"})`): `update()` and `upsert()`
+  replace the record with what `model_dump()` writes, so even over a table defined by hand (`with_table=False`) they
+  would be refused (a required column) or drop the hash (an optional one), failing every later signin.
 - Upgrading: a 0.33 `TableType.USER` model's table turns `SCHEMAFULL` at its next `define_access()`; records already
   there are checked at their next write.
 
@@ -5703,7 +5721,8 @@ print(*table, sep="\n")
 - **A write naming a field the table does not define** — `merge()` with a key the model does not declare,
   `bulk_update()`, a raw query — is refused on SurrealDB 3.x
   (`Found field 'nope', but no such field exists for table 'note'`) and the field dropped on 2.x and the embedded
-  engine, silently: declare the field on the model.
+  engine, silently: declare the field on the model. The items of a list of objects are the exception ("SurrealDB 2.x
+  and 3.x" below).
 - **A node model over a table that holds edges**: `define_table()` refuses a relation table (`TYPE RELATION`), but not
   a `TYPE ANY` table holding edges, whose edges its `TYPE NORMAL` keeps while refusing every new one: declare
   `table_type=TableType.ANY` for a table that holds records and edges.
@@ -5720,7 +5739,10 @@ print(*table, sep="\n")
   of objects from every item — the `dict`, `Any` or untyped `list` of a sub-model in a `list[M]`, at any depth
   (`items.*.meta`) — unless the list is `FLEXIBLE` too, then refuse the record's next write (`Found NONE for field`).
   `define_table()` writes such a list `FLEXIBLE` before 3.x; the item's typed fields are still checked. 3.x keeps those
-  values without it.
+  values without it. On 2.x and the embedded engine, the items of such a list then also keep a key the model does not
+  declare, written raw or by another client (the ORM never sends one), which they drop from a list that is not
+  `FLEXIBLE`: a 2.x limitation, since `FLEXIBLE` there covers the whole item. 3.x keeps such a key in the items of any
+  list of objects, `FLEXIBLE` or not, and refuses it at the top level or in a sub-model.
 - On SurrealDB 3.x a required untyped array refuses an object item unless its items are defined
   (`no such field exists`): `define_table()` writes the item definition `TYPE any` (`bag.*`) on every line.
 - A write naming a field a `SCHEMAFULL` table does not define is refused on 3.x and dropped on 2.x and the embedded
@@ -6075,7 +6097,7 @@ The SDK's in-process engine has a table of its own: [ORM behaviour: the embedded
 | Model table DDL (`define_table()`: `DEFINE TABLE` + `DEFINE FIELD`)                                                                    | same on both lines: one `DEFINE TABLE OVERWRITE` and one `DEFINE FIELD OVERWRITE` per column, keeping what the model does not declare                                         | the same                                                                                                                                                                            | v0.34.0                              |
 | An `Any` or untyped `list`/`set` field of a `SCHEMAFULL` model                                                                         | `define_table()` adds `FLEXIBLE` (read from `client.version()`): without it these engines empty such values, optional or not; the item definitions as on 3.x                  | kept without `FLEXIBLE` (refused there); an untyped `list` gets an item definition `TYPE any`, without which 3.x refuses an object item of a required one (`no such field exists`)  | v0.34.0                              |
 | A `list` of sub-models (`list[M]`, at any depth) holding a `dict`, an `Any` or an untyped `list`, in a `SCHEMAFULL` model              | `define_table()` also writes the `list` `FLEXIBLE`: without it these engines drop such a value from every item, then refuse the record's next write (`Found NONE for field`)  | kept without `FLEXIBLE` on the `list`, which `define_table()` does not write there                                                                                                  | v0.34.0                              |
-| A write naming a field a `SCHEMAFULL` table does not define (an undeclared `merge()` key, a raw query, records predating `SCHEMAFULL`) | the field is dropped, silently                                                                                                                                                | the write is refused (`no such field exists`)                                                                                                                                       | v0.34.0                              |
+| A write naming a field a `SCHEMAFULL` table does not define (an undeclared `merge()` key, a raw query, records predating `SCHEMAFULL`) | the field is dropped, silently; kept in the items of a list `define_table()` writes `FLEXIBLE` (a 2.x limitation)                                                             | the write is refused (`no such field exists`), except in the items of a list of objects, which keep it                                                                              | v0.34.0                              |
 | Full suite and every divergence in this table, re-run on SurrealDB 2.7.0 and 3.3.0                                                     | 2.7.0 identical to 2.6.5 (same passes, same 3.x-only skips)                                                                                                                   | 3.3.0 identical to 3.2.4, except the system-user signin row                                                                                                                         | v0.19.1                              |
 
 > **Note on record IDs**: A record loaded from the database has its `id` field set to a native `surrealdb.RecordID` object, not a plain string. Use `model.get_raw_id()` to obtain the bare identifier string (e.g. `"alice"`), or compare directly with `model.id == RecordID("User", "alice")`. In-memory instances you construct yourself retain whatever value you assign.

{surreal_orm_lite-0.34.0 → surreal_orm_lite-0.34.2}/README.md

@@ -4270,7 +4270,10 @@ class Person(BaseSurrealModel):
   when the schema was read from another connection than `"default"`, then `server_fields` and `extra="allow"`
   (below). A model declares
   `id: str | None = None` first (`id: RecordID | None = None` for a view: a grouped view's ids are arrays), then one
-  line per field, in codepoint order of the columns.
+  line per field, in codepoint order of the columns. A `SCHEMAFULL` relation table with data fields gives an edge model
+  with `schema_mode=SchemaMode.SCHEMAFULL` (since v0.34.0): apply it with `define_table()`, which defines those fields,
+  not `define_relation()`, which raises `SurrealDbError` before any request
+  ([section 34](#34-relation-constraints-relation_in-define_relation)).
 - A class is named after its table in PascalCase, without singularisation (`game_tables` → `GameTables`); a name
   that is taken — a Python keyword, a name the module imports, another table's class — gets `Model` appended (`range`
   → `RangeModel`). The table's indexes and events are comments of its class, and so are its comment, change feed
@@ -5117,6 +5120,11 @@ print(await Follows.define_relation())
   other clauses.
 - `define_relation()` raises `SurrealDbError` before any DDL on a materialized view (the `OVERWRITE` would drop its
   query) and on a definition the ORM cannot read back (it could not keep the other clauses).
+- An edge model that declares `schema_mode=SchemaMode.SCHEMAFULL` and has data fields — the model
+  `generate_models_from_db()` writes for a `SCHEMAFULL` relation table with data fields, since v0.34.0 — is applied
+  with `define_table()`, not `define_relation()`: `define_relation()` defines no field, so it raises `SurrealDbError`
+  before any request, and `define_table()` applies the same relation statement, then the data fields
+  ([section 35](#35-model-table-ddl-define_table-schema_mode-permissions)).
 - SurrealDB rewrites the `in` and `out` field definitions from `IN` and `OUT` (`TYPE record<person>`): an `ASSERT`
   written on them by hand is lost. Declare the tables with `relation_in` and `relation_out` instead.
 - Why not `ALTER TABLE`, which keeps the other clauses too: on SurrealDB 2.x and the embedded engine, a raw
@@ -5616,7 +5624,10 @@ print(edge.stars)
 same schema mode. A model with `table_type=TableType.USER` (the full ORM's key for an auth table) or
 `schema_mode=SchemaMode.SCHEMAFULL` gets from `define_access()` a `SCHEMAFULL` table with one `DEFINE FIELD` per field
 and the access's permissions, then the access: signup and signin work on SurrealDB 2.x and 3.x, `define_table()` is
-optional, and any call order gives the same table. Every other model keeps v0.17.0's `SCHEMALESS` table.
+optional, and any call order gives the same table. Every other model keeps v0.17.0's `SCHEMALESS` table. One that
+declares no `table_type` gets no `TYPE` from `define_access()`, which SurrealDB stores as `TYPE ANY`, and `TYPE NORMAL`
+from `define_table()`: calling both changes the table's type each time, so declare `table_type` to keep one. The schema
+mode, fields and permissions are the same in any call order.
 
 ```python
 from surreal_orm_lite import AuthenticatedUserMixin, TableType
@@ -5641,6 +5652,13 @@ print(*table, sep="\n")
   declares its own.
 - A `TableType.USER` model with `extra="allow"` raises `TypeError` there (with `with_table=True`), since its table is
   `SCHEMAFULL`; a `server_fields` column without a constant default needs a database `DEFAULT` ("Field types" above).
+- A field SIGNUP writes that `Field(exclude=True)` keeps out of `model_dump()` (`password: str = Field(exclude=True)`)
+  raises `TypeError` too, naming the field, before any request (with a `SCHEMAFULL` schema mode): `define_access()`
+  with `with_table=True` and `define_table()` both refuse it, since the table would not define it, so SurrealDB 3.x
+  would refuse every signup and 2.x drop the password hash, failing every signin. Remove `exclude=True` and leave the
+  field out where you serialise the model instead (`model_dump(exclude={"password"})`): `update()` and `upsert()`
+  replace the record with what `model_dump()` writes, so even over a table defined by hand (`with_table=False`) they
+  would be refused (a required column) or drop the hash (an optional one), failing every later signin.
 - Upgrading: a 0.33 `TableType.USER` model's table turns `SCHEMAFULL` at its next `define_access()`; records already
   there are checked at their next write.
 
@@ -5652,7 +5670,8 @@ print(*table, sep="\n")
 - **A write naming a field the table does not define** — `merge()` with a key the model does not declare,
   `bulk_update()`, a raw query — is refused on SurrealDB 3.x
   (`Found field 'nope', but no such field exists for table 'note'`) and the field dropped on 2.x and the embedded
-  engine, silently: declare the field on the model.
+  engine, silently: declare the field on the model. The items of a list of objects are the exception ("SurrealDB 2.x
+  and 3.x" below).
 - **A node model over a table that holds edges**: `define_table()` refuses a relation table (`TYPE RELATION`), but not
   a `TYPE ANY` table holding edges, whose edges its `TYPE NORMAL` keeps while refusing every new one: declare
   `table_type=TableType.ANY` for a table that holds records and edges.
@@ -5669,7 +5688,10 @@ print(*table, sep="\n")
   of objects from every item — the `dict`, `Any` or untyped `list` of a sub-model in a `list[M]`, at any depth
   (`items.*.meta`) — unless the list is `FLEXIBLE` too, then refuse the record's next write (`Found NONE for field`).
   `define_table()` writes such a list `FLEXIBLE` before 3.x; the item's typed fields are still checked. 3.x keeps those
-  values without it.
+  values without it. On 2.x and the embedded engine, the items of such a list then also keep a key the model does not
+  declare, written raw or by another client (the ORM never sends one), which they drop from a list that is not
+  `FLEXIBLE`: a 2.x limitation, since `FLEXIBLE` there covers the whole item. 3.x keeps such a key in the items of any
+  list of objects, `FLEXIBLE` or not, and refuses it at the top level or in a sub-model.
 - On SurrealDB 3.x a required untyped array refuses an object item unless its items are defined
   (`no such field exists`): `define_table()` writes the item definition `TYPE any` (`bag.*`) on every line.
 - A write naming a field a `SCHEMAFULL` table does not define is refused on 3.x and dropped on 2.x and the embedded
@@ -6024,7 +6046,7 @@ The SDK's in-process engine has a table of its own: [ORM behaviour: the embedded
 | Model table DDL (`define_table()`: `DEFINE TABLE` + `DEFINE FIELD`)                                                                    | same on both lines: one `DEFINE TABLE OVERWRITE` and one `DEFINE FIELD OVERWRITE` per column, keeping what the model does not declare                                         | the same                                                                                                                                                                            | v0.34.0                              |
 | An `Any` or untyped `list`/`set` field of a `SCHEMAFULL` model                                                                         | `define_table()` adds `FLEXIBLE` (read from `client.version()`): without it these engines empty such values, optional or not; the item definitions as on 3.x                  | kept without `FLEXIBLE` (refused there); an untyped `list` gets an item definition `TYPE any`, without which 3.x refuses an object item of a required one (`no such field exists`)  | v0.34.0                              |
 | A `list` of sub-models (`list[M]`, at any depth) holding a `dict`, an `Any` or an untyped `list`, in a `SCHEMAFULL` model              | `define_table()` also writes the `list` `FLEXIBLE`: without it these engines drop such a value from every item, then refuse the record's next write (`Found NONE for field`)  | kept without `FLEXIBLE` on the `list`, which `define_table()` does not write there                                                                                                  | v0.34.0                              |
-| A write naming a field a `SCHEMAFULL` table does not define (an undeclared `merge()` key, a raw query, records predating `SCHEMAFULL`) | the field is dropped, silently                                                                                                                                                | the write is refused (`no such field exists`)                                                                                                                                       | v0.34.0                              |
+| A write naming a field a `SCHEMAFULL` table does not define (an undeclared `merge()` key, a raw query, records predating `SCHEMAFULL`) | the field is dropped, silently; kept in the items of a list `define_table()` writes `FLEXIBLE` (a 2.x limitation)                                                             | the write is refused (`no such field exists`), except in the items of a list of objects, which keep it                                                                              | v0.34.0                              |
 | Full suite and every divergence in this table, re-run on SurrealDB 2.7.0 and 3.3.0                                                     | 2.7.0 identical to 2.6.5 (same passes, same 3.x-only skips)                                                                                                                   | 3.3.0 identical to 3.2.4, except the system-user signin row                                                                                                                         | v0.19.1                              |
 
 > **Note on record IDs**: A record loaded from the database has its `id` field set to a native `surrealdb.RecordID` object, not a plain string. Use `model.get_raw_id()` to obtain the bare identifier string (e.g. `"alice"`), or compare directly with `model.id == RecordID("User", "alice")`. In-memory instances you construct yourself retain whatever value you assign.

{surreal_orm_lite-0.34.0 → surreal_orm_lite-0.34.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "surreal-orm-lite"
-version = "0.34.0"
+version = "0.34.2"
 description = "Lightweight Django-style ORM for SurrealDB using the official Python SDK. Async support with Pydantic validation."
 readme = "README.md"
 requires-python = ">=3.11"

{surreal_orm_lite-0.34.0 → surreal_orm_lite-0.34.2}/src/surreal_orm_lite/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.34.0"
+__version__ = "0.34.2"
 
 from ._sdk import BoundExcluded, BoundIncluded
 from .aggregations import Aggregation, Avg, Count, Max, Min, Sum

{surreal_orm_lite-0.34.0 → surreal_orm_lite-0.34.2}/src/surreal_orm_lite/model_auth.py

@@ -265,6 +265,20 @@ class AuthenticatedUserMixin:
         server_owned = cls.get_server_fields()  # type: ignore[attr-defined]
         return [name for name in cls._model_field_names() if name != "id" and name not in server_owned]
 
+    @classmethod
+    def _signup_fields_excluded(cls) -> list[str]:
+        """The fields SIGNUP writes that ``Field(exclude=True)`` keeps out of ``model_dump()``, in declaration order
+        (#296).
+
+        The model table DDL defines the columns ``model_dump()`` writes (``model_ddl.model_columns()`` skips the same
+        fields), while SIGNUP writes every field of :meth:`_signup_fields` — so on a ``SCHEMAFULL`` table these have no
+        column: SurrealDB 3.x refuses the signup, 2.x drops their values (a password hash, and every signin fails).
+        ``BaseSurrealModel._table_ddl()`` refuses such a table (SG1), behind ``table_ddl()``, ``define_table()``,
+        :meth:`access_ddl` and :meth:`define_access`.
+        """
+        fields = getattr(cls, "model_fields", {}) or {}
+        return [name for name in cls._signup_fields() if fields[name].exclude is True]
+
     @classmethod
     def _signup_primary_key(cls) -> str | None:
         """The primary key SIGNUP builds the record id from, or ``None`` for a server id.
@@ -344,8 +358,12 @@ class AuthenticatedUserMixin:
         own), since such a table refuses or empties the record SIGNUP creates unless its fields
         are defined; every other model gets v0.17.0's ``SCHEMALESS`` table statement, with the
         comment, change feed, permissions and ``TYPE`` clause it declares — v0.17.0's text when it
-        declares none. Any call order with ``define_table()`` converges: both write the same
-        schema mode and fields.
+        declares none. Any call order with ``define_table()`` converges on the schema mode, the
+        fields and the permissions. Not on the table type of a model that declares no
+        ``table_type`` and whose schema mode is not ``SCHEMAFULL`` (neither key, say): this
+        statement writes no ``TYPE``, which SurrealDB stores as ``TYPE ANY``, while
+        ``define_table()`` writes ``TYPE NORMAL``, so calling both changes the type each time.
+        Declaring ``table_type`` gives both the same type.
 
         Args:
             overwrite: ``True`` (default) emits ``OVERWRITE`` — the model is the source of
@@ -365,7 +383,15 @@ class AuthenticatedUserMixin:
             TypeError: with ``with_table=True``, a ``TableType.USER`` model with
                 ``extra="allow"`` (its ``SCHEMAFULL`` table refuses or drops the fields the
                 model does not declare), or, for a model whose schema mode is ``SCHEMAFULL``,
-                an *overwrite* that is not a ``bool``.
+                an *overwrite* that is not a ``bool``, or a field SIGNUP writes that
+                ``Field(exclude=True)`` keeps out of ``model_dump()`` and so out of the table
+                (SurrealDB 3.x would refuse every signup, 2.x drop the value — a password hash,
+                failing every signin); the message names the model and the fields, in
+                declaration order. ``table_ddl()`` and ``define_table()`` refuse that model too.
+                Remove ``exclude=True`` and pass ``exclude=`` to ``model_dump()`` where you
+                serialise the model: ``update()`` and ``upsert()`` replace the record with what
+                ``model_dump()`` writes, so a table defined by hand would refuse them or drop the
+                value.
             ValueError: an auth key naming no field of the model, an unknown hashing family or
                 duration, a primary key SIGNUP cannot bind; with ``with_table=True`` and a
                 ``SCHEMAFULL`` schema mode, a ``FLEXIBLE`` request on a kind without an object
@@ -390,6 +416,7 @@ class AuthenticatedUserMixin:
 
         statements: list[str] = []
         if with_table and cls._schemafull_access():
+            # The model table DDL's refusals, SG1 (#296) included: a column SIGNUP writes that the table would not define.
             table_ddl: list[str] = cls._table_ddl(overwrite, cls._access_table_clauses())  # type: ignore[attr-defined]
             statements.extend(table_ddl)
         elif with_table:
@@ -468,7 +495,11 @@ class AuthenticatedUserMixin:
         statement. Every other model applies v0.17.0's two statements, whose ``OVERWRITE``
         resets the table clauses it does not write; when it declares ``permissions``, the table
         statement is applied on its own first, and a refusal names the table, never the rules.
-        Any call order with ``define_table()`` converges, so neither needs the other first.
+        Any call order with ``define_table()`` converges on the schema mode, the fields and the
+        permissions, so neither needs the other first. A model that declares no ``table_type``
+        and whose schema mode is not ``SCHEMAFULL`` gets no ``TYPE`` here (SurrealDB stores
+        ``TYPE ANY``) and ``TYPE NORMAL`` from ``define_table()``, so calling both changes the
+        table's type each time; declaring ``table_type`` keeps one type.
 
         Args:
             overwrite: see :meth:`access_ddl`.
@@ -484,7 +515,9 @@ class AuthenticatedUserMixin:
             access statement.
 
         Raises:
-            TypeError: see :meth:`access_ddl` — before any request.
+            TypeError: see :meth:`access_ddl` — before any request, a field SIGNUP writes that
+                ``Field(exclude=True)`` keeps out of a ``SCHEMAFULL`` table included, which
+                ``define_table()`` refuses too.
             ValueError: see :meth:`access_ddl` — before any request.
             SurrealDbError: if the server rejects a statement. The most likely cause on
                 **SurrealDB 2.6.x** is ``with_refresh=True``: that line cannot parse

{surreal_orm_lite-0.34.0 → surreal_orm_lite-0.34.2}/src/surreal_orm_lite/model_base.py

@@ -47,6 +47,7 @@ from .schema import (
     read_table_fields,
     remove_event_statement,
     remove_view_statement,
+    signup_excluded_refused,
     table_holds_records,
     table_kind,
     table_permissions_text,
@@ -1493,7 +1494,9 @@ class BaseSurrealModel(BaseModel):
         ``FLEXIBLE`` following *clauses*' schema mode. Pure.
 
         Raises:
-            TypeError: *overwrite* is not a ``bool``; a ``TableType.USER`` model with ``extra="allow"``.
+            TypeError: *overwrite* is not a ``bool``; a ``TableType.USER`` model with ``extra="allow"`` (UX1); then, when
+                *clauses* are ``SCHEMAFULL``, an auth model (``AuthenticatedUserMixin``) with a field SIGNUP writes that
+                ``Field(exclude=True)`` keeps out of the columns (SG1, #296).
             ValueError: see :meth:`_table_columns`.
         """
         if cls._is_view():
@@ -1504,6 +1507,16 @@ class BaseSurrealModel(BaseModel):
             raise TypeError(user_extra_refused(cls.__name__))
         schemafull = clauses.schema_mode == SchemaMode.SCHEMAFULL.value
         fields = [field_statement(table, column, overwrite=overwrite, schemafull=schemafull) for column in cls._table_columns()]
+        if schemafull:
+            # Imported here, only for a SCHEMAFULL table: model_auth sits above this module.
+            from .model_auth import AuthenticatedUserMixin
+
+            # SG1 (#296), after the other refusals: SIGNUP writes a field the columns leave out, which the SCHEMAFULL
+            # table would refuse (3.x) or drop (2.x) — checked here, as UX1 is, so that table_ddl(), define_table(),
+            # access_ddl() and define_access() refuse the same model.
+            excluded: list[str] = cls._signup_fields_excluded() if issubclass(cls, AuthenticatedUserMixin) else []
+            if excluded:
+                raise TypeError(signup_excluded_refused(cls.__name__, excluded))
         return [statement, *fields]
 
     @classmethod
@@ -1546,7 +1559,12 @@ class BaseSurrealModel(BaseModel):
 
         Raises:
             TypeError: *overwrite* is not a ``bool``; a ``TableType.USER`` model with ``extra="allow"`` (its table is
-                ``SCHEMAFULL``, which refuses or drops the fields the model does not declare).
+                ``SCHEMAFULL``, which refuses or drops the fields the model does not declare); an auth model
+                (``AuthenticatedUserMixin``) whose declared schema mode is ``SCHEMAFULL`` with a field SIGNUP writes
+                that ``Field(exclude=True)`` keeps out of the columns (``password: str = Field(exclude=True)``), which
+                the table would refuse or drop, failing every signup or signin — ``define_access()`` refuses it too;
+                remove ``exclude=True`` (a table defined by hand would not help: ``update()`` and ``upsert()`` replace
+                the record with what ``model_dump()`` writes).
             ValueError: a ``FLEXIBLE`` request on a kind without an object; a computed field's expression that is not
                 SurrealQL the ORM can embed.
 
@@ -1573,7 +1591,7 @@ class BaseSurrealModel(BaseModel):
         ``SCHEMAFULL`` (its own). *method* names the caller in the transaction check, TG1–TG4 and RG1–RG3.
 
         In order, each step before any later request: the transaction check; a view model applies
-        :meth:`define_view` (its own guards) and returns its statement; the pure statements (E1, UX1, FX1, CV1);
+        :meth:`define_view` (its own guards) and returns its statement; the pure statements (E1, UX1, FX1, CV1, SG1);
         ``INFO FOR DB`` and the table guard (:meth:`_guarded_table_statement`) — for a node model TG1 a view, TG2 a
         definition the parser cannot read, TG3 a relation table, and, for a table that exists with ``overwrite=True``,
         TG2 a carried table clause that fails its check; for an edge model ``define_relation()``'s RG1–RG3 —; for a
@@ -1722,8 +1740,9 @@ class BaseSurrealModel(BaseModel):
             The statements applied (or queued), table first, joined with ``"\\n"``.
 
         Raises:
-            TypeError: *overwrite* is not a ``bool``; a ``TableType.USER`` model with ``extra="allow"`` — before any
-                request.
+            TypeError: *overwrite* is not a ``bool``; a ``TableType.USER`` model with ``extra="allow"``; an auth model
+                whose declared schema mode is ``SCHEMAFULL`` with a field SIGNUP writes that ``Field(exclude=True)``
+                keeps out of the columns (see :meth:`table_ddl`) — before any request.
             ValueError: a ``FLEXIBLE`` request on a kind without an object; a computed field's expression that is not
                 SurrealQL the ORM can embed — before any request.
             SurrealDbError: *tx* belongs to another connection — before any request; the table is a materialized view

{surreal_orm_lite-0.34.0 → surreal_orm_lite-0.34.2}/src/surreal_orm_lite/schema.py

@@ -85,6 +85,8 @@ table's field definitions with one ``INFO FOR TABLE``, keyed by path whichever r
 definition the parser cannot read. ``table_refused()`` gives the texts of the node models' table guard (TG1–TG4),
 ``relation_table_refused()`` names ``define_table()`` when it is the caller, and ``relation_schemafull_refused()``
 refuses ``define_relation()`` of an edge model declared ``SCHEMAFULL`` with data fields, which it would not define.
+``user_extra_refused()`` and ``signup_excluded_refused()`` give the texts of UX1 and SG1, the refusals of a
+``SCHEMAFULL`` table the model table DDL checks before any request.
 
 The module sits low in the package: it imports neither ``model_base`` nor ``connection_manager``, so both can import
 it.
@@ -1944,3 +1946,19 @@ def user_extra_refused(model: str) -> str:
         f'{model}: extra="allow" keeps fields the model does not declare, and a TableType.USER table is SCHEMAFULL, which '
         f'refuses them (SurrealDB 3.x) or drops them (2.x); remove extra="allow" from {model}.'
     )
+
+
+def signup_excluded_refused(model: str, fields: Sequence[str]) -> str:
+    """The refusal of an auth model whose ``SCHEMAFULL`` table would leave out *fields* (SG1, #296): SIGNUP writes
+    them, ``Field(exclude=True)`` keeps them out of ``model_dump()`` and so out of the columns the model table DDL
+    defines — in ``table_ddl()``, ``define_table()`` and ``define_access()`` alike. Pure."""
+    names = ", ".join(repr(name) for name in fields)
+    pronoun = "it" if len(fields) == 1 else "them"
+    return (
+        f"{model}: SIGNUP writes {names}, but Field(exclude=True) keeps {pronoun} out of model_dump() and so out of the "
+        f"SCHEMAFULL table that table_ddl(), define_table() and define_access() define for the model; that table would "
+        f"refuse {pronoun} (SurrealDB 3.x) or drop {pronoun} (2.x), so no signup or signin would work. Remove "
+        f"exclude=True and leave {pronoun} out where you serialise the model instead (model_dump(exclude={{{names}}})): "
+        f"update() and upsert() replace the record with what model_dump() writes, so even over a table defined by "
+        f"hand they would be refused or drop {pronoun}."
+    )