Return owned Database handles and propagate errors

Refactor global DB access to return owned Database handles and make internal connection access fallible. Many call sites now propagate Result errors (use ?), and Database internal accessors (__internal_connection, __internal_backend, __get_connection) return Result to avoid silently bypassing transaction scopes or panicking on disconnected handles. TideConfig schema path storage was changed from &'static str to owned String to prevent leaks and allow safe reconfiguration, and TideConfig::schema_file_path() now returns Option<String>. Restored Model::to_hash_map() behavior that omits structured presenter `params` (documented and tested), added profiling short-circuit to skip Instant::now() when global profiling is disabled, and reworked SelfRefMany::load_tree() to fetch trees with a single recursive CTE (honors configured local_key). Updated docs and changelog and added/adjusted tests to cover schema path replacement, profiling, presenter serialization, self-ref SQL, and disconnected-handle behavior.

Author: mohamadzoh

CHANGELOG.md

@@ -9,12 +9,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Restored transaction scoping for TideORM model and query helpers so `save()`, `update()`, `delete()`, eager loading, nested operations, full-text reads, and aggregate helpers now honor the active transaction instead of bypassing it through the global pooled connection.
+- Hardened raw SQL builder escape hatches by rejecting obvious injection markers in `where_raw`, raw column expressions, and nested subqueries before execution.
+- Restored the original `Model::to_hash_map()` behavior that hides structured presenter `params` payloads entirely; `params` remains a reserved presenter key and is now documented as such.
+- Removed disabled-path profiling overhead in `__profile_future()` by skipping `Instant::now()` when global profiling is off.
+- Replaced leaked schema-path storage in `TideConfig` so repeated `apply()` and `connect()` calls no longer leak each configured schema file path.
+- Reworked `SelfRefMany::load_tree()` to use a single recursive CTE query, eliminating per-node descendant lookups and honoring the configured `local_key` when walking self-referential trees.
 - Repaired all-features build breakage after the reconfigurable global-database refactor by updating direct SeaORM call sites to borrow owned internal connections correctly.
 - Restored consistent full-text SQL parameterization coverage across the query and full-text test suites, including PostgreSQL ranked search placeholders and SQLite FTS pagination bindings.
 - Tightened encrypted-field missing-key coverage so integration tests now assert the actionable startup-configuration error message returned by `Encrypted<T>`.
 
 ### Changed
 
+- `require_db()`, `try_db()`, `TideConfig::db()`, `TideConfig::try_db()`, `Model::db()`, and `Model::database()` now return owned `Database` handles for consistency with transaction-aware current-connection access.
+- `TideConfig::schema_file_path()` now returns `Option<String>` instead of `Option<&'static str>` so schema path state can be replaced safely without leaking memory across reconfiguration.
 - Documented resettable global configuration, tokenization override reset behavior, and the batched nested many-model save/update/delete paths in the README and mdBook chapters.
 
 ### Internal

docs/models.md

@@ -25,6 +25,15 @@ The `#[tideorm::model]` macro automatically implements:
 - `Serialize` - for JSON serialization
 - `Deserialize` - for JSON deserialization
 
+### Reserved Attribute Names
+
+`params` is reserved for presenter payloads.
+
+When TideORM builds `to_hash_map()` output and the serialized `params` value is
+an object or array, it is omitted from the resulting map. Avoid using `params`
+for presenter-facing structured model attributes if you need that data to appear
+in `to_hash_map()` output.
+
 ### Custom Implementations (When Needed)
 
 If you need custom implementations, use `skip_derives` and provide your own:
@@ -860,12 +869,15 @@ let has_manager = manager_rel.exists().await?;
 let reports = reports_rel.load().await?;
 let count = reports_rel.count().await?;
 
-// Load entire subtree recursively
+// Load entire subtree recursively in one recursive CTE query
 let tree = reports_rel.load_tree(3).await?;  // 3 levels deep
 ```
 
 Note: `SelfRef` and `SelfRefMany` are runtime wrappers today. The derive macro does not yet provide `#[tideorm(self_ref = ...)]` or `#[tideorm(self_ref_many = ...)]` field wiring.
 
+`SelfRefMany::load_tree()` respects the configured `local_key` and fetches the
+tree in one query, which avoids one SELECT per node on large hierarchies.
+
 ### Nested Save (Cascade Operations)
 
 Save parent and related models together with automatic foreign key handling:

src/config.rs

@@ -38,7 +38,7 @@ use crate::tide_info;
 static GLOBAL_CONFIG: OnceLock<RwLock<Config>> = OnceLock::new();
 
 /// Global schema file path (set via TideConfig::schema_file())
-static SCHEMA_FILE_PATH: OnceLock<RwLock<Option<&'static str>>> = OnceLock::new();
+static SCHEMA_FILE_PATH: OnceLock<RwLock<Option<String>>> = OnceLock::new();
 
 /// File URL generator function type
 ///
@@ -66,7 +66,7 @@ thread_local! {
     static LOCAL_CONFIG: RefCell<Option<Config>> = const { RefCell::new(None) };
     static LOCAL_DB_TYPE: Cell<Option<DatabaseType>> = const { Cell::new(None) };
     static LOCAL_POOL_CONFIG: RefCell<Option<PoolConfig>> = const { RefCell::new(None) };
-    static LOCAL_SCHEMA_FILE_PATH: Cell<Option<&'static str>> = const { Cell::new(None) };
+    static LOCAL_SCHEMA_FILE_PATH: RefCell<Option<String>> = const { RefCell::new(None) };
     #[cfg(feature = "attachments")]
     static LOCAL_FILE_URL_GENERATOR: Cell<Option<FileUrlGenerator>> = const { Cell::new(None) };
 }
@@ -79,7 +79,7 @@ fn global_pool_config_state() -> &'static RwLock<Option<PoolConfig>> {
     GLOBAL_POOL_CONFIG.get_or_init(|| RwLock::new(None))
 }
 
-fn global_schema_file_path_state() -> &'static RwLock<Option<&'static str>> {
+fn global_schema_file_path_state() -> &'static RwLock<Option<String>> {
     SCHEMA_FILE_PATH.get_or_init(|| RwLock::new(None))
 }
 
@@ -88,10 +88,6 @@ fn global_file_url_generator_state() -> &'static RwLock<Option<FileUrlGenerator>
     GLOBAL_FILE_URL_GENERATOR.get_or_init(|| RwLock::new(None))
 }
 
-fn leak_schema_path(path: String) -> &'static str {
-    Box::leak(path.into_boxed_str())
-}
-
 /// Supported database types
 ///
 /// TideORM supports multiple database backends. Each has its own
@@ -1363,15 +1359,14 @@ impl TideConfig {
         // Generate schema file if configured
         if let Some(path) = &self.schema_file {
             // Store schema path
-            let leaked_path = leak_schema_path(path.clone());
-            *global_schema_file_path_state().write() = Some(leaked_path);
-            LOCAL_SCHEMA_FILE_PATH.with(|slot| slot.set(Some(leaked_path)));
+            *global_schema_file_path_state().write() = Some(path.clone());
+            LOCAL_SCHEMA_FILE_PATH.with(|slot| *slot.borrow_mut() = Some(path.clone()));
 
             // Auto-generate schema file from database introspection
             crate::schema::SchemaWriter::write_schema(path).await?;
         } else {
             *global_schema_file_path_state().write() = None;
-            LOCAL_SCHEMA_FILE_PATH.with(|slot| slot.set(None));
+            LOCAL_SCHEMA_FILE_PATH.with(|slot| slot.borrow_mut().take());
         }
 
         Ok(db_ref)
@@ -1402,9 +1397,8 @@ impl TideConfig {
         *global_pool_config_state().write() = Some(self.pool.clone());
         LOCAL_POOL_CONFIG.with(|slot| *slot.borrow_mut() = Some(self.pool));
 
-        let leaked_path = self.schema_file.map(leak_schema_path);
-        *global_schema_file_path_state().write() = leaked_path;
-        LOCAL_SCHEMA_FILE_PATH.with(|slot| slot.set(leaked_path));
+        *global_schema_file_path_state().write() = self.schema_file.clone();
+        LOCAL_SCHEMA_FILE_PATH.with(|slot| *slot.borrow_mut() = self.schema_file);
     }
 
     /// Reset global and current-thread TideORM configuration state.
@@ -1420,7 +1414,7 @@ impl TideConfig {
         LOCAL_POOL_CONFIG.with(|slot| slot.borrow_mut().take());
 
         *global_schema_file_path_state().write() = None;
-        LOCAL_SCHEMA_FILE_PATH.with(|slot| slot.set(None));
+        LOCAL_SCHEMA_FILE_PATH.with(|slot| slot.borrow_mut().take());
 
         #[cfg(feature = "attachments")]
         {
@@ -1442,7 +1436,7 @@ impl TideConfig {
     /// ```rust,ignore
     /// let db = TideConfig::db()?;
     /// ```
-    pub fn db() -> crate::error::Result<&'static Database> {
+    pub fn db() -> crate::error::Result<Database> {
         crate::database::require_db()
     }
 
@@ -1457,7 +1451,7 @@ impl TideConfig {
     ///     // use db...
     /// }
     /// ```
-    pub fn try_db() -> Option<&'static Database> {
+    pub fn try_db() -> Option<Database> {
         crate::database::try_db()
     }
 
@@ -1536,11 +1530,14 @@ impl TideConfig {
             .unwrap_or_default()
     }
 
-    /// Get the configured schema file path (if any)
-    pub fn schema_file_path() -> Option<&'static str> {
+    /// Get the configured schema file path (if any).
+    ///
+    /// Returns an owned path so repeated `apply()` or `connect()` calls can
+    /// replace the stored schema path without leaking memory.
+    pub fn schema_file_path() -> Option<String> {
         LOCAL_SCHEMA_FILE_PATH
-            .with(|slot| slot.get())
-            .or_else(|| *global_schema_file_path_state().read())
+            .with(|slot| slot.borrow().clone())
+            .or_else(|| global_schema_file_path_state().read().clone())
     }
 
     /// Write schema to the configured file
@@ -1605,7 +1602,7 @@ impl TideConfig {
     async fn detect_server_version(db: &Database) -> Result<String> {
         use crate::internal::{ConnectionTrait, DbBackend, Statement};
 
-        let conn = db.__internal_connection();
+        let conn = db.__internal_connection()?;
         let backend = conn.get_database_backend();
 
         // Only probe MySQL-type connections