Skip to content

feat(orm): add an escape hatch for raw SELECT queries#609

Open
m4tx wants to merge 2 commits into
masterfrom
db-fetch-raw
Open

feat(orm): add an escape hatch for raw SELECT queries#609
m4tx wants to merge 2 commits into
masterfrom
db-fetch-raw

Conversation

@m4tx

@m4tx m4tx commented Jul 11, 2026

Copy link
Copy Markdown
Member

Related issue or discussion

Description

Type of change

  • Bug fix
  • New feature
  • Documentation
  • Refactor / cleanup
  • Performance improvement
  • Other (describe above)

Checklist

  • I've read the contributing guide
  • Tests pass locally (just test-all)
  • Code passes clippy (just clippy)
  • Code is properly formatted (cargo fmt)
  • New tests added (regression test for bugs, coverage for new features)
  • Documentation (both code and site) updated (if applicable)

@github-actions github-actions Bot added the C-lib Crate: cot (main library crate) label Jul 11, 2026
@github-actions

github-actions Bot commented Jul 11, 2026

Copy link
Copy Markdown

🐰 Bencher Report

Projectcot
Branchdb-fetch-raw
Testbedgithub-ubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
microseconds (µs)
(Result Δ%)
Upper Boundary
microseconds (µs)
(Limit %)
empty_router/empty_router📈 view plot
🚷 view threshold
11,577.00 µs
(+59.65%)Baseline: 7,251.66 µs
12,548.18 µs
(92.26%)
json_api/json_api📈 view plot
🚷 view threshold
906.36 µs
(-16.10%)Baseline: 1,080.30 µs
1,366.69 µs
(66.32%)
nested_routers/nested_routers📈 view plot
🚷 view threshold
854.01 µs
(-15.13%)Baseline: 1,006.29 µs
1,243.37 µs
(68.69%)
single_root_route/single_root_route📈 view plot
🚷 view threshold
815.87 µs
(-15.85%)Baseline: 969.60 µs
1,206.40 µs
(67.63%)
single_root_route_burst/single_root_route_burst📈 view plot
🚷 view threshold
16,974.00 µs
(-2.29%)Baseline: 17,371.55 µs
21,686.46 µs
(78.27%)
🐰 View full continuous benchmarking report in Bencher

@codecov

codecov Bot commented Jul 11, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 95.23810% with 1 line in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
cot/src/db.rs 95.23% 0 Missing and 1 partial ⚠️
Flag Coverage Δ
rust 90.29% <95.23%> (+0.03%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
cot/src/db.rs 88.20% <95.23%> (+1.37%) ⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions github-actions Bot added the A-docs Area: Documentation label Jul 17, 2026
@m4tx
m4tx marked this pull request as ready for review July 17, 2026 15:27
@m4tx
m4tx requested review from a team and Copilot and removed request for Copilot July 17, 2026 15:27
Copilot AI review requested due to automatic review settings July 23, 2026 17:56

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a raw-SQL “escape hatch” to Cot’s ORM so callers can execute raw SELECT statements and map result rows directly into Model types, complementing the existing raw statement execution APIs.

Changes:

  • Introduces Database::raw_as / Database::raw_as_with for mapping raw SELECT results into models.
  • Adds documentation for raw SQL query APIs, including parameterized variants and SQL injection warnings.
  • Adds database tests covering raw statement execution and raw row-to-model mapping.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File Description
docs/databases/queries.md Documents raw SQL APIs and shows usage examples for raw statements and raw SELECT mapping.
cot/tests/db.rs Adds tests validating raw, raw_as, and (SQLite-only) parameterized raw methods.
cot/src/db.rs Implements raw_as / raw_as_with by routing raw SQL through the existing fetch_all path via a RawStatement binder.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread cot/src/db.rs
.collect::<Vec<_>>();
let values = SqlxValues(sea_query::Values(values));

let rows = self.fetch_all(&RawStatement { sql: query, values }).await?;
Comment thread docs/databases/queries.md
}
```

If your query takes parameters, use [`raw_with`](struct@cot::db::Database#method.raw_with) instead of interpolating the values into the query string yourself. The parameters are passed separately and bound safely by the underlying database driver, so this is the preferred way of running raw statements that depend on runtime values.
Comment thread cot/src/db.rs
Comment on lines +1978 to +1982
/// This method executes the raw SQL string without any sanitization.
/// Callers are responsible for ensuring the query is safe. The bound
/// `values`, however, are passed to the database driver separately from
/// the query text and are safe from SQL injection.
///
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-docs Area: Documentation C-lib Crate: cot (main library crate)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants