Ecto 3.10

Apply the Elixir 1.20 and Erlang/OTP 29 prompts first. These rules cover Ecto 3.10 with Ecto SQL 3.10 and Postgrex: changesets, queries, repositories, transactions, tenancy, database connections, and migrations.

Changesets

• Write the permitted fields of every cast/4 call as a literal list, with separate changesets for separate roles and forms. Never compute it from params keys, __schema__(:fields), or request input.
• Leave tenant, owner, role, price, balance, and approval fields out of user-facing cast/4 lists and set them from the authenticated context. Ecto 3.10 can't mark a field read-only, so add a test that a forged value in an update is ignored.
• Reserve change/2, put_change/3, force_change/3, and put_assoc/4 for server-built values; they skip casting and field filtering.
• Set redact: true on secret-bearing fields to hide them from struct and changeset inspection. Query logs and telemetry still contain their raw values.
• Cast children through cast_assoc/3 or cast_embed/3 with an explicit :with changeset, after preloading only children the user may edit. on_replace: :delete or :delete_if_exists deletes a child the params leave out. The :drop_param and :sort_param options, new in 3.10, let the request delete children by index and add entries for unknown indexes, so turn them on only where the user may do both to every preloaded child.
• Back unsafe_validate_unique/4 with a unique index and unique_constraint/3; the pre-check races. Pass a tenant-scoped :query when uniqueness is per tenant, or the check matches other tenants'