@dotdo/postgres 0.1.0

package/src/rls/generator.test.ts

@@ -0,0 +1,829 @@
+/**
+ * RLS Generator Security Tests
+ *
+ * RED phase: These tests verify security-critical aspects of the RLS generator.
+ * SECURITY CRITICAL: These tests protect against unauthorized data access.
+ *
+ * Tests verify:
+ * 1. Generated policies are syntactically correct
+ * 2. Policies cannot be bypassed
+ * 3. USING and WITH CHECK clauses are correct
+ * 4. Multi-tenant isolation is enforced
+ * 5. Generated SQL is injection-safe
+ */
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import {
+  generatePolicySQL,
+  generateDropPolicySQL,
+  generateEnableRLSSQL,
+  generateDisableRLSSQL,
+  applyPolicy,
+  enableRLS,
+  disableRLS,
+  dropPolicy,
+} from './generator'
+import { createPolicy, createTenantPolicy, type RLSPolicy } from './policy'
+
+// Mock PGlite interface for testing
+interface MockPGlite {
+  exec: ReturnType<typeof vi.fn>
+  query: ReturnType<typeof vi.fn>
+}
+
+const createMockPGlite = (): MockPGlite => ({
+  exec: vi.fn(),
+  query: vi.fn(),
+})
+
+describe('RLS Generator Security Tests', () => {
+  /**
+   * SECTION 1: Syntactically Correct Policy Generation
+   * Verifies that generated SQL is valid PostgreSQL syntax
+   */
+  describe('Syntactic Correctness', () => {
+    it('should generate valid CREATE POLICY syntax for SELECT', () => {
+      const policy = createPolicy({
+        name: 'users_read_own',
+        table: 'users',
+        operation: 'SELECT',
+        using: "user_id = current_setting('app.user_id')::uuid",
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // Must match PostgreSQL CREATE POLICY syntax exactly
+      expect(sql).toMatch(/^CREATE POLICY\s+/)
+      expect(sql).toMatch(/\bON\s+users\b/)
+      expect(sql).toMatch(/\bAS\s+(PERMISSIVE|RESTRICTIVE)\b/)
+      expect(sql).toMatch(/\bFOR\s+SELECT\b/)
+      expect(sql).toMatch(/\bTO\s+/)
+      expect(sql).toMatch(/\bUSING\s*\(/)
+    })
+
+    it('should generate valid CREATE POLICY syntax for INSERT', () => {
+      const policy = createPolicy({
+        name: 'users_create',
+        table: 'users',
+        operation: 'INSERT',
+        check: "user_id = current_setting('app.user_id')::uuid",
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toMatch(/\bFOR\s+INSERT\b/)
+      expect(sql).toMatch(/\bWITH\s+CHECK\s*\(/)
+      // INSERT policies should NOT have USING clause
+      expect(sql).not.toMatch(/\bUSING\s*\(/)
+    })
+
+    it('should generate valid CREATE POLICY syntax for UPDATE with both clauses', () => {
+      const policy = createPolicy({
+        name: 'users_modify',
+        table: 'users',
+        operation: 'UPDATE',
+        using: "user_id = current_setting('app.user_id')::uuid",
+        check: "user_id = current_setting('app.user_id')::uuid",
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toMatch(/\bFOR\s+UPDATE\b/)
+      expect(sql).toMatch(/\bUSING\s*\(/)
+      expect(sql).toMatch(/\bWITH\s+CHECK\s*\(/)
+    })
+
+    it('should generate valid CREATE POLICY syntax for DELETE', () => {
+      const policy = createPolicy({
+        name: 'users_remove',
+        table: 'users',
+        operation: 'DELETE',
+        using: "user_id = current_setting('app.user_id')::uuid",
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toMatch(/\bFOR\s+DELETE\b/)
+      expect(sql).toMatch(/\bUSING\s*\(/)
+      // DELETE policies should NOT have WITH CHECK clause
+      expect(sql).not.toMatch(/\bWITH\s+CHECK\s*\(/)
+    })
+
+    it('should generate valid CREATE POLICY syntax for ALL operations', () => {
+      const policy = createPolicy({
+        name: 'tenant_all_access',
+        table: 'resources',
+        operation: 'ALL',
+        using: "tenant_id = current_setting('app.tenant_id')::uuid",
+        check: "tenant_id = current_setting('app.tenant_id')::uuid",
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toMatch(/\bFOR\s+ALL\b/)
+      expect(sql).toMatch(/\bUSING\s*\(/)
+      expect(sql).toMatch(/\bWITH\s+CHECK\s*\(/)
+    })
+
+    it('should generate valid DROP POLICY syntax', () => {
+      const sql = generateDropPolicySQL('users_read_own', 'users')
+
+      expect(sql).toMatch(/^DROP POLICY\s+/)
+      expect(sql).toMatch(/\bON\s+users$/)
+    })
+
+    it('should generate valid DROP POLICY IF EXISTS syntax', () => {
+      const sql = generateDropPolicySQL('users_read_own', 'users', true)
+
+      expect(sql).toMatch(/^DROP POLICY IF EXISTS\s+/)
+    })
+
+    it('should generate valid ENABLE ROW LEVEL SECURITY syntax', () => {
+      const sql = generateEnableRLSSQL('users')
+
+      expect(sql).toBe('ALTER TABLE users ENABLE ROW LEVEL SECURITY')
+    })
+
+    it('should generate valid FORCE ROW LEVEL SECURITY syntax', () => {
+      const sql = generateEnableRLSSQL('users', { force: true })
+
+      expect(sql).toBe('ALTER TABLE users FORCE ROW LEVEL SECURITY')
+    })
+
+    it('should generate valid DISABLE ROW LEVEL SECURITY syntax', () => {
+      const sql = generateDisableRLSSQL('users')
+
+      expect(sql).toBe('ALTER TABLE users DISABLE ROW LEVEL SECURITY')
+    })
+
+    it('should generate valid NO FORCE ROW LEVEL SECURITY syntax', () => {
+      const sql = generateDisableRLSSQL('users', { removeForce: true })
+
+      expect(sql).toBe('ALTER TABLE users NO FORCE ROW LEVEL SECURITY')
+    })
+  })
+
+  /**
+   * SECTION 2: Policy Bypass Prevention
+   * SECURITY CRITICAL: Verifies that policies cannot be circumvented
+   */
+  describe('Policy Bypass Prevention', () => {
+    it('should not allow empty USING clause for SELECT operations', () => {
+      const policy: RLSPolicy = {
+        name: 'unsafe_select',
+        table: 'users',
+        operation: 'SELECT',
+        using: '',
+        roles: ['public'],
+        type: 'permissive',
+      }
+
+      const sql = generatePolicySQL(policy)
+
+      // Empty USING clause means no restriction - should either:
+      // 1. Throw an error, OR
+      // 2. Generate valid SQL that PostgreSQL will reject
+      // The generator should NOT produce: USING ()
+      expect(sql).not.toMatch(/USING\s*\(\s*\)/)
+    })
+
+    it('should not allow empty WITH CHECK clause for INSERT operations', () => {
+      const policy: RLSPolicy = {
+        name: 'unsafe_insert',
+        table: 'users',
+        operation: 'INSERT',
+        check: '',
+        roles: ['public'],
+        type: 'permissive',
+      }
+
+      const sql = generatePolicySQL(policy)
+
+      // Empty WITH CHECK clause is dangerous - should not produce: WITH CHECK ()
+      expect(sql).not.toMatch(/WITH\s+CHECK\s*\(\s*\)/)
+    })
+
+    it('should require USING clause for SELECT operations', () => {
+      const policy: RLSPolicy = {
+        name: 'missing_using',
+        table: 'users',
+        operation: 'SELECT',
+        using: undefined,
+        roles: ['public'],
+        type: 'permissive',
+      }
+
+      // The generator should ensure SELECT policies have USING clause
+      // or the resulting SQL should be invalid
+      const sql = generatePolicySQL(policy)
+
+      // SELECT without USING would allow all rows - verify it's handled
+      // Either no USING clause at all (PostgreSQL defaults to true) is intentional
+      // OR we should explicitly have a clause
+      expect(sql).toContain('FOR SELECT')
+    })
+
+    it('should require WITH CHECK clause for INSERT operations', () => {
+      const policy: RLSPolicy = {
+        name: 'missing_check',
+        table: 'users',
+        operation: 'INSERT',
+        check: undefined,
+        roles: ['public'],
+        type: 'permissive',
+      }
+
+      // INSERT without WITH CHECK allows inserting any row - dangerous
+      const sql = generatePolicySQL(policy)
+
+      // Verify the generator handles missing check clause appropriately
+      expect(sql).toContain('FOR INSERT')
+    })
+
+    it('should not allow USING true without explicit intent', () => {
+      // USING (true) allows all rows - while valid, it should be flagged
+      const policy = createPolicy({
+        name: 'allow_all',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'true',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // The SQL will be valid, but this test documents that USING (true)
+      // is generated as-is (this should be caught by validatePolicy, not generator)
+      expect(sql).toContain('USING (true)')
+    })
+
+    it('should preserve parentheses in complex USING expressions', () => {
+      const policy = createPolicy({
+        name: 'complex_condition',
+        table: 'documents',
+        operation: 'SELECT',
+        using: "(owner_id = current_user_id()) OR (is_public = true AND deleted_at IS NULL)",
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // Must preserve the parentheses to maintain correct boolean logic
+      expect(sql).toContain('USING ((owner_id = current_user_id()) OR (is_public = true AND deleted_at IS NULL))')
+    })
+
+    it('should handle restrictive policies correctly', () => {
+      // Restrictive policies are AND-ed together, not OR-ed
+      const policy = createPolicy({
+        name: 'restrict_active',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'is_active = true',
+        type: 'restrictive',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toContain('AS RESTRICTIVE')
+    })
+  })
+
+  /**
+   * SECTION 3: USING and WITH CHECK Clause Correctness
+   * Verifies clauses are applied to correct operations
+   */
+  describe('USING and WITH CHECK Clause Correctness', () => {
+    it('should only include USING clause for SELECT (not WITH CHECK)', () => {
+      const policy = createPolicy({
+        name: 'select_policy',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'user_id = 1',
+        check: 'user_id = 1', // This should be ignored for SELECT
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toContain('USING (user_id = 1)')
+      // SELECT should NOT have WITH CHECK
+      expect(sql).not.toContain('WITH CHECK')
+    })
+
+    it('should only include WITH CHECK clause for INSERT (not USING)', () => {
+      const policy = createPolicy({
+        name: 'insert_policy',
+        table: 'users',
+        operation: 'INSERT',
+        using: 'user_id = 1', // This should be ignored for INSERT
+        check: 'user_id = 1',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toContain('WITH CHECK (user_id = 1)')
+      // INSERT should NOT have USING clause
+      expect(sql).not.toContain('USING')
+    })
+
+    it('should include both USING and WITH CHECK for UPDATE', () => {
+      const policy = createPolicy({
+        name: 'update_policy',
+        table: 'users',
+        operation: 'UPDATE',
+        using: 'user_id = current_user_id()',
+        check: 'user_id = current_user_id()',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toContain('USING (user_id = current_user_id())')
+      expect(sql).toContain('WITH CHECK (user_id = current_user_id())')
+    })
+
+    it('should only include USING clause for DELETE (not WITH CHECK)', () => {
+      const policy = createPolicy({
+        name: 'delete_policy',
+        table: 'users',
+        operation: 'DELETE',
+        using: 'user_id = current_user_id()',
+        check: 'user_id = current_user_id()', // This should be ignored for DELETE
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toContain('USING (user_id = current_user_id())')
+      // DELETE should NOT have WITH CHECK
+      expect(sql).not.toContain('WITH CHECK')
+    })
+
+    it('should include both clauses for ALL operations', () => {
+      const policy = createPolicy({
+        name: 'all_policy',
+        table: 'users',
+        operation: 'ALL',
+        using: 'owner_id = current_user_id()',
+        check: 'owner_id = current_user_id()',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toContain('USING (owner_id = current_user_id())')
+      expect(sql).toContain('WITH CHECK (owner_id = current_user_id())')
+    })
+
+    it('should handle different USING and CHECK conditions for UPDATE', () => {
+      // UPDATE can have different conditions for reading vs writing
+      const policy = createPolicy({
+        name: 'update_different_conditions',
+        table: 'documents',
+        operation: 'UPDATE',
+        using: 'owner_id = current_user_id() OR is_editable = true',
+        check: 'owner_id = current_user_id()',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // USING controls which rows can be seen for update
+      expect(sql).toContain('USING (owner_id = current_user_id() OR is_editable = true)')
+      // WITH CHECK controls what the new row values can be
+      expect(sql).toContain('WITH CHECK (owner_id = current_user_id())')
+    })
+  })
+
+  /**
+   * SECTION 4: Multi-Tenant Isolation
+   * SECURITY CRITICAL: Verifies tenant data cannot leak across tenants
+   */
+  describe('Multi-Tenant Isolation', () => {
+    it('should generate tenant isolation policy with correct USING clause', () => {
+      const policy = createTenantPolicy('orders', 'tenant_id')
+
+      // Handle both single policy and array result
+      const singlePolicy = Array.isArray(policy) ? policy[0] : policy
+      const sql = generatePolicySQL(singlePolicy)
+
+      // Must include tenant_id column in USING
+      expect(sql).toContain('USING')
+      expect(singlePolicy.using).toContain('tenant_id')
+      expect(singlePolicy.using).toContain('current_setting')
+      expect(singlePolicy.using).toContain('app.tenant_id')
+    })
+
+    it('should generate tenant isolation policy with correct WITH CHECK clause', () => {
+      const policy = createTenantPolicy('orders', 'tenant_id')
+
+      // Handle both single policy and array result
+      const singlePolicy = Array.isArray(policy) ? policy[0] : policy
+
+      // Must include tenant_id column in WITH CHECK for INSERT/UPDATE
+      expect(singlePolicy.check).toContain('tenant_id')
+      expect(singlePolicy.check).toContain('current_setting')
+    })
+
+    it('should enforce tenant isolation for all CRUD operations', () => {
+      const policies = createTenantPolicy('orders', 'tenant_id', {
+        operations: ['SELECT', 'INSERT', 'UPDATE', 'DELETE'],
+      })
+
+      expect(Array.isArray(policies)).toBe(true)
+      expect(policies).toHaveLength(4)
+
+      // Verify each operation has proper tenant isolation
+      const policiesArray = policies as RLSPolicy[]
+
+      // SELECT should have USING with tenant check
+      const selectPolicy = policiesArray.find((p) => p.operation === 'SELECT')
+      expect(selectPolicy?.using).toContain('tenant_id')
+      expect(selectPolicy?.check).toBeUndefined()
+
+      // INSERT should have WITH CHECK with tenant check (no USING)
+      const insertPolicy = policiesArray.find((p) => p.operation === 'INSERT')
+      expect(insertPolicy?.check).toContain('tenant_id')
+      expect(insertPolicy?.using).toBeUndefined()
+
+      // UPDATE should have both USING and WITH CHECK
+      const updatePolicy = policiesArray.find((p) => p.operation === 'UPDATE')
+      expect(updatePolicy?.using).toContain('tenant_id')
+      expect(updatePolicy?.check).toContain('tenant_id')
+
+      // DELETE should have USING with tenant check
+      const deletePolicy = policiesArray.find((p) => p.operation === 'DELETE')
+      expect(deletePolicy?.using).toContain('tenant_id')
+      expect(deletePolicy?.check).toBeUndefined()
+    })
+
+    it('should properly cast tenant ID to correct type', () => {
+      const uuidPolicy = createTenantPolicy('orders', 'tenant_id', {
+        columnType: 'uuid',
+      }) as RLSPolicy
+
+      const intPolicy = createTenantPolicy('orders', 'tenant_id', {
+        columnType: 'integer',
+      }) as RLSPolicy
+
+      const textPolicy = createTenantPolicy('orders', 'tenant_id', {
+        columnType: 'text',
+      }) as RLSPolicy
+
+      // UUID type should cast
+      expect(uuidPolicy.using).toContain('::uuid')
+
+      // Integer type should cast
+      expect(intPolicy.using).toContain('::integer')
+
+      // Text type should NOT cast (avoid double conversion)
+      expect(textPolicy.using).not.toContain('::uuid')
+      expect(textPolicy.using).not.toContain('::integer')
+    })
+
+    it('should handle super-tenant bypass safely', () => {
+      const policy = createTenantPolicy('orders', 'tenant_id', {
+        superTenantBypass: 'SYSTEM_ADMIN',
+      }) as RLSPolicy
+
+      const sql = generatePolicySQL(policy)
+
+      // Super-tenant check should be OR-ed with normal tenant check
+      expect(policy.using).toContain('SYSTEM_ADMIN')
+      expect(policy.using).toContain('OR')
+      // The bypass should check the session variable, not a hardcoded role
+      expect(policy.using).toContain("current_setting('app.tenant_id') = 'SYSTEM_ADMIN'")
+    })
+
+    it('should handle nullable tenant columns safely', () => {
+      const policy = createTenantPolicy('shared_resources', 'tenant_id', {
+        allowNull: true,
+      }) as RLSPolicy
+
+      // NULL tenant_id rows should be accessible
+      expect(policy.using).toContain('IS NULL')
+      expect(policy.using).toContain('OR')
+      // But normal tenant check should still apply
+      expect(policy.using).toContain('current_setting')
+    })
+
+    it('should not allow tenant ID manipulation through SQL injection in policy', () => {
+      // This tests that the policy expression itself is safe
+      const policy = createTenantPolicy('orders', 'tenant_id') as RLSPolicy
+
+      // The policy should use parameterized session variables, not string interpolation
+      expect(policy.using).toContain('current_setting(')
+      // Should NOT contain direct string interpolation patterns
+      expect(policy.using).not.toContain("'${")
+      expect(policy.using).not.toContain("' + ")
+      expect(policy.using).not.toContain("' || ")
+    })
+  })
+
+  /**
+   * SECTION 5: SQL Injection Safety
+   * SECURITY CRITICAL: Verifies generated SQL cannot be manipulated
+   */
+  describe('SQL Injection Safety', () => {
+    it('should properly quote identifiers with special characters', () => {
+      const policy = createPolicy({
+        name: 'my-policy-name',
+        table: 'my-table-name',
+        operation: 'SELECT',
+        using: 'true',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // Identifiers with hyphens must be quoted
+      expect(sql).toContain('"my-policy-name"')
+      expect(sql).toContain('"my-table-name"')
+    })
+
+    it('should properly quote schema-qualified table names', () => {
+      const policy = createPolicy({
+        name: 'schema_policy',
+        table: 'myschema.mytable',
+        operation: 'SELECT',
+        using: 'true',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // Schema-qualified names should be properly formatted
+      expect(sql).toContain('ON myschema.mytable')
+    })
+
+    it('should escape quotes in policy names', () => {
+      const policy = createPolicy({
+        name: 'policy"with"quotes',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'true',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // Quotes in identifiers should be escaped
+      expect(sql).toContain('"policy')
+      // Should not allow quote injection
+      expect(sql).not.toContain('policy"with"quotes ON')
+    })
+
+    it('should reject table names with SQL injection attempts', async () => {
+      const mockPGlite = createMockPGlite()
+
+      // Attempt SQL injection through table name
+      await expect(
+        enableRLS(mockPGlite, "users; DROP TABLE users; --")
+      ).rejects.toThrow('Invalid table name')
+    })
+
+    it('should reject table names with comment injection', async () => {
+      const mockPGlite = createMockPGlite()
+
+      await expect(
+        enableRLS(mockPGlite, "users -- comment")
+      ).rejects.toThrow('Invalid table name')
+    })
+
+    it('should reject table names with multi-line injection', async () => {
+      const mockPGlite = createMockPGlite()
+
+      await expect(
+        enableRLS(mockPGlite, "users\nDROP TABLE secrets")
+      ).rejects.toThrow('Invalid table name')
+    })
+
+    it('should properly escape single quotes in expressions', () => {
+      const policy = createPolicy({
+        name: 'quote_test',
+        table: 'users',
+        operation: 'SELECT',
+        using: "name = 'O''Brien'", // Properly escaped single quote
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // The expression should be preserved as-is in USING clause
+      expect(sql).toContain("USING (name = 'O''Brien')")
+    })
+
+    it('should handle unicode characters in identifiers', () => {
+      const policy = createPolicy({
+        name: 'policy_with_unicode',
+        table: 'usuarios', // Spanish
+        operation: 'SELECT',
+        using: 'true',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // Unicode table name should be preserved
+      expect(sql).toContain('usuarios')
+    })
+
+    it('should prevent policy name length overflow attacks', () => {
+      // PostgreSQL has a 63 character limit for identifiers
+      const longName = 'a'.repeat(100)
+
+      const policy = createPolicy({
+        name: longName,
+        table: 'users',
+        operation: 'SELECT',
+        using: 'true',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // The name should be preserved (validation is separate concern)
+      // but verify no truncation causes unexpected SQL
+      expect(sql).toContain(longName)
+    })
+
+    it('should handle empty role array safely', () => {
+      const policy: RLSPolicy = {
+        name: 'empty_roles',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'true',
+        roles: [],
+        type: 'permissive',
+      }
+
+      const sql = generatePolicySQL(policy)
+
+      // Empty roles should not produce invalid SQL like "TO "
+      // Should either default to public or handle appropriately
+      expect(sql).toContain('TO')
+      // Should not have "TO " followed by space then another keyword
+      expect(sql).not.toMatch(/TO\s+(?:USING|WITH|AS|FOR|ON)/)
+    })
+
+    it('should handle roles with special characters', () => {
+      const policy = createPolicy({
+        name: 'special_role_policy',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'true',
+        roles: ['user-role', 'admin_role', 'role.with.dots'],
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // Roles with special characters should be handled
+      expect(sql).toContain('TO')
+    })
+  })
+
+  /**
+   * SECTION 6: Edge Cases and Boundary Conditions
+   */
+  describe('Edge Cases', () => {
+    it('should handle policy with all optional fields undefined', () => {
+      const policy: RLSPolicy = {
+        name: 'minimal_policy',
+        table: 'users',
+        operation: 'SELECT',
+        using: undefined,
+        check: undefined,
+        roles: ['public'],
+        type: 'permissive',
+      }
+
+      // Should not throw, but generate potentially problematic SQL
+      // (which would be caught at apply time by PostgreSQL)
+      expect(() => generatePolicySQL(policy)).not.toThrow()
+    })
+
+    it('should handle policy with whitespace-only expressions', () => {
+      const policy: RLSPolicy = {
+        name: 'whitespace_policy',
+        table: 'users',
+        operation: 'SELECT',
+        using: '   ',
+        roles: ['public'],
+        type: 'permissive',
+      }
+
+      const sql = generatePolicySQL(policy)
+
+      // Whitespace-only USING is effectively empty - should be handled
+      // Either by trimming or by generating SQL that PostgreSQL rejects
+      expect(sql).toBeDefined()
+    })
+
+    it('should handle deeply nested boolean expressions', () => {
+      const policy = createPolicy({
+        name: 'nested_policy',
+        table: 'complex_table',
+        operation: 'SELECT',
+        using: '((((a = 1) AND (b = 2)) OR ((c = 3) AND (d = 4))) AND (e = 5))',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // All parentheses should be preserved
+      expect(sql).toContain('USING (((((a = 1) AND (b = 2)) OR ((c = 3) AND (d = 4))) AND (e = 5)))')
+    })
+
+    it('should handle USING clause with subquery', () => {
+      const policy = createPolicy({
+        name: 'subquery_policy',
+        table: 'documents',
+        operation: 'SELECT',
+        using: 'owner_id IN (SELECT user_id FROM team_members WHERE team_id = current_setting(\'app.team_id\')::uuid)',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      // Subquery should be preserved exactly
+      expect(sql).toContain('SELECT user_id FROM team_members')
+    })
+
+    it('should handle USING clause with CTE reference', () => {
+      // Note: CTEs in RLS policies are limited but the generator should handle the syntax
+      const policy = createPolicy({
+        name: 'cte_policy',
+        table: 'documents',
+        operation: 'SELECT',
+        using: 'EXISTS (SELECT 1 FROM permissions WHERE document_id = documents.id)',
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toContain('EXISTS (SELECT 1 FROM permissions')
+    })
+
+    it('should handle USING clause with function calls', () => {
+      const policy = createPolicy({
+        name: 'function_policy',
+        table: 'users',
+        operation: 'SELECT',
+        using: "auth.uid() = user_id AND auth.role() = 'authenticated'",
+      })
+
+      const sql = generatePolicySQL(policy)
+
+      expect(sql).toContain('auth.uid()')
+      expect(sql).toContain('auth.role()')
+    })
+
+    it('should handle multiple consecutive special characters', () => {
+      const sql = generateDropPolicySQL('policy--name', 'table--name', true)
+
+      // Double hyphens could be interpreted as SQL comments
+      // Names with consecutive special chars should be quoted
+      expect(sql).toContain('"policy--name"')
+      expect(sql).toContain('"table--name"')
+    })
+  })
+
+  /**
+   * SECTION 7: Integration with applyPolicy
+   */
+  describe('Apply Policy Integration', () => {
+    let mockPGlite: MockPGlite
+
+    beforeEach(() => {
+      mockPGlite = createMockPGlite()
+    })
+
+    it('should execute generated SQL through applyPolicy', async () => {
+      const policy = createPolicy({
+        name: 'test_policy',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'user_id = 1',
+      })
+
+      await applyPolicy(mockPGlite, policy)
+
+      expect(mockPGlite.exec).toHaveBeenCalledTimes(1)
+      const executedSQL = mockPGlite.exec.mock.calls[0][0]
+      expect(executedSQL).toContain('CREATE POLICY')
+      expect(executedSQL).toContain('test_policy')
+    })
+
+    it('should drop and recreate when replace is true', async () => {
+      const policy = createPolicy({
+        name: 'test_policy',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'user_id = 1',
+      })
+
+      await applyPolicy(mockPGlite, policy, { replace: true })
+
+      expect(mockPGlite.exec).toHaveBeenCalledTimes(2)
+      expect(mockPGlite.exec.mock.calls[0][0]).toContain('DROP POLICY')
+      expect(mockPGlite.exec.mock.calls[1][0]).toContain('CREATE POLICY')
+    })
+
+    it('should add IF NOT EXISTS when specified', async () => {
+      const policy = createPolicy({
+        name: 'test_policy',
+        table: 'users',
+        operation: 'SELECT',
+        using: 'user_id = 1',
+      })
+
+      await applyPolicy(mockPGlite, policy, { ifNotExists: true })
+
+      const executedSQL = mockPGlite.exec.mock.calls[0][0]
+      expect(executedSQL).toContain('IF NOT EXISTS')
+    })
+  })
+})