@geekmidas/db 1.0.0 → 1.0.2

package/dist/objection/pagination.mjs

@@ -0,0 +1,47 @@
+import { Direction, decodeCursor, encodeCursor } from "../pagination-BDLa7Yb_.mjs";
+
+//#region src/objection/pagination.ts
+/**
+* Cursor-based paginated search for Objection.js models.
+*
+* Accepts a pre-built QueryBuilder so callers can apply filters,
+* eager loading, and scopes before pagination is layered on top.
+*
+* @example
+* ```typescript
+* const result = await paginatedSearch({
+*   query: User.query(trx).where('orgId', orgId).withGraphFetched('roles'),
+*   cursor: previousCursor,
+*   limit: 20,
+*   cursorField: 'createdAt',
+*   cursorDirection: Direction.Desc,
+* });
+* ```
+*/
+async function paginatedSearch({ query, cursor, limit = 20, mapRow, cursorField = "id", cursorDirection = Direction.Asc }) {
+	const total = await query.resultSize();
+	let paginatedQuery = query.clone();
+	if (cursor) {
+		const operator = cursorDirection === Direction.Asc ? ">" : "<";
+		paginatedQuery = paginatedQuery.where(cursorField, operator, cursor);
+	}
+	const data = await paginatedQuery.orderBy(cursorField, cursorDirection).limit(limit + 1);
+	const hasMore = data.length > limit;
+	const rows = hasMore ? data.slice(0, limit) : data;
+	const lastRow = rows[rows.length - 1];
+	const nextCursor = hasMore && lastRow ? String(lastRow[cursorField]) : void 0;
+	const mapper = mapRow ?? ((row) => row);
+	const items = await Promise.all(rows.map(mapper));
+	return {
+		items,
+		pagination: {
+			total,
+			hasMore,
+			cursor: nextCursor
+		}
+	};
+}
+
+//#endregion
+export { Direction, decodeCursor, encodeCursor, paginatedSearch };
+//# sourceMappingURL=pagination.mjs.map

package/dist/objection/pagination.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.mjs","names":["row: TModel"],"sources":["../../src/objection/pagination.ts"],"sourcesContent":["import type { Model, QueryBuilder } from 'objection';\nimport {\n\tDirection,\n\tdecodeCursor,\n\tencodeCursor,\n\ttype PaginationResult,\n} from '../pagination';\n\nexport { Direction, decodeCursor, encodeCursor, type PaginationResult };\n\n/**\n * Options for paginated search with Objection.js models.\n */\nexport interface ObjectionPaginatedSearchOptions<\n\tTModel extends Model,\n\tTMapRow extends (row: TModel) => unknown = (row: TModel) => TModel,\n> {\n\t/** The Objection QueryBuilder to paginate (e.g. User.query(trx).where(...)) */\n\tquery: QueryBuilder<TModel>;\n\t/** Cursor value for pagination (value of cursorField from previous page) */\n\tcursor?: string;\n\t/** Maximum number of items per page (default: 20) */\n\tlimit?: number;\n\t/** Function to transform each row to the output format (default: identity) */\n\tmapRow?: TMapRow;\n\t/** Field to use for cursor pagination (default: 'id') */\n\tcursorField?: string;\n\t/** Sort direction for cursor field (default: Direction.Asc) */\n\tcursorDirection?: Direction;\n}\n\n/**\n * Cursor-based paginated search for Objection.js models.\n *\n * Accepts a pre-built QueryBuilder so callers can apply filters,\n * eager loading, and scopes before pagination is layered on top.\n *\n * @example\n * ```typescript\n * const result = await paginatedSearch({\n *   query: User.query(trx).where('orgId', orgId).withGraphFetched('roles'),\n *   cursor: previousCursor,\n *   limit: 20,\n *   cursorField: 'createdAt',\n *   cursorDirection: Direction.Desc,\n * });\n * ```\n */\nexport async function paginatedSearch<\n\tTModel extends Model,\n\tTMapRow extends (row: TModel) => unknown = (row: TModel) => TModel,\n>({\n\tquery,\n\tcursor,\n\tlimit = 20,\n\tmapRow,\n\tcursorField = 'id',\n\tcursorDirection = Direction.Asc,\n}: ObjectionPaginatedSearchOptions<TModel, TMapRow>): Promise<\n\tPaginationResult<Awaited<ReturnType<TMapRow>>>\n> {\n\t// Get total count (without cursor filtering)\n\tconst total = await query.resultSize();\n\n\t// Apply cursor if provided\n\tlet paginatedQuery = query.clone();\n\tif (cursor) {\n\t\tconst operator = cursorDirection === Direction.Asc ? '>' : '<';\n\t\tpaginatedQuery = paginatedQuery.where(cursorField, operator, cursor);\n\t}\n\n\t// Fetch one extra to determine if there are more results\n\tconst data = await paginatedQuery\n\t\t.orderBy(cursorField, cursorDirection)\n\t\t.limit(limit + 1);\n\n\tconst hasMore = data.length > limit;\n\tconst rows = hasMore ? data.slice(0, limit) : data;\n\tconst lastRow = rows[rows.length - 1];\n\tconst nextCursor =\n\t\thasMore && lastRow\n\t\t\t? String((lastRow as Record<string, unknown>)[cursorField])\n\t\t\t: undefined;\n\n\tconst mapper = mapRow ?? ((row: TModel) => row);\n\tconst items = (await Promise.all(rows.map(mapper))) as Awaited<\n\t\tReturnType<TMapRow>\n\t>[];\n\n\treturn {\n\t\titems,\n\t\tpagination: {\n\t\t\ttotal,\n\t\t\thasMore,\n\t\t\tcursor: nextCursor,\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgDA,eAAsB,gBAGpB,EACD,OACA,QACA,QAAQ,IACR,QACA,cAAc,MACd,kBAAkB,UAAU,KACsB,EAEjD;CAED,MAAM,QAAQ,MAAM,MAAM,YAAY;CAGtC,IAAI,iBAAiB,MAAM,OAAO;AAClC,KAAI,QAAQ;EACX,MAAM,WAAW,oBAAoB,UAAU,MAAM,MAAM;AAC3D,mBAAiB,eAAe,MAAM,aAAa,UAAU,OAAO;CACpE;CAGD,MAAM,OAAO,MAAM,eACjB,QAAQ,aAAa,gBAAgB,CACrC,MAAM,QAAQ,EAAE;CAElB,MAAM,UAAU,KAAK,SAAS;CAC9B,MAAM,OAAO,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG;CAC9C,MAAM,UAAU,KAAK,KAAK,SAAS;CACnC,MAAM,aACL,WAAW,UACR,OAAQ,QAAoC,aAAa;CAG7D,MAAM,SAAS,WAAW,CAACA,QAAgB;CAC3C,MAAM,QAAS,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO,CAAC;AAIlD,QAAO;EACN;EACA,YAAY;GACX;GACA;GACA,QAAQ;EACR;CACD;AACD"}

package/dist/pagination-BAFX7C1I.d.cts

@@ -0,0 +1,32 @@
+//#region src/pagination.d.ts
+/**
+ * Sort direction for cursor-based pagination.
+ */
+declare enum Direction {
+  Asc = "asc",
+  Desc = "desc",
+}
+/**
+ * Result of a paginated query.
+ */
+interface PaginationResult<TItem> {
+  items: TItem[];
+  pagination: {
+    total: number;
+    hasMore: boolean;
+    cursor?: string;
+  };
+}
+/**
+ * Encode a cursor value for safe URL transmission.
+ * Supports various types: string, number, Date, etc.
+ */
+declare function encodeCursor(value: unknown): string;
+/**
+ * Decode a cursor string back to its original value.
+ */
+declare function decodeCursor(cursor: string): unknown;
+//# sourceMappingURL=pagination.d.ts.map
+//#endregion
+export { Direction, PaginationResult, decodeCursor, encodeCursor };
+//# sourceMappingURL=pagination-BAFX7C1I.d.cts.map

package/dist/pagination-BAFX7C1I.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination-BAFX7C1I.d.cts","names":[],"sources":["../src/pagination.ts"],"sourcesContent":[],"mappings":";;AAGA;AAQA;AAagB,aArBJ,SAAA;EAgCI,GAAA,GAAA,KAAA;;;;;;UAxBC;SACT;;;;;;;;;;;iBAYQ,YAAA;;;;iBAWA,YAAA"}

package/dist/pagination-BDLa7Yb_.mjs

@@ -0,0 +1,37 @@
+//#region src/pagination.ts
+/**
+* Sort direction for cursor-based pagination.
+*/
+let Direction = /* @__PURE__ */ function(Direction$1) {
+	Direction$1["Asc"] = "asc";
+	Direction$1["Desc"] = "desc";
+	return Direction$1;
+}({});
+/**
+* Encode a cursor value for safe URL transmission.
+* Supports various types: string, number, Date, etc.
+*/
+function encodeCursor(value) {
+	const payload = {
+		v: value instanceof Date ? value.toISOString() : value,
+		t: value instanceof Date ? "date" : typeof value
+	};
+	return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+/**
+* Decode a cursor string back to its original value.
+*/
+function decodeCursor(cursor) {
+	try {
+		const json = Buffer.from(cursor, "base64url").toString("utf-8");
+		const payload = JSON.parse(json);
+		if (payload.t === "date") return new Date(payload.v);
+		return payload.v;
+	} catch {
+		throw new Error("Invalid cursor format");
+	}
+}
+
+//#endregion
+export { Direction, decodeCursor, encodeCursor };
+//# sourceMappingURL=pagination-BDLa7Yb_.mjs.map

package/dist/pagination-BDLa7Yb_.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination-BDLa7Yb_.mjs","names":["value: unknown","cursor: string"],"sources":["../src/pagination.ts"],"sourcesContent":["/**\n * Sort direction for cursor-based pagination.\n */\nexport enum Direction {\n\tAsc = 'asc',\n\tDesc = 'desc',\n}\n\n/**\n * Result of a paginated query.\n */\nexport interface PaginationResult<TItem> {\n\titems: TItem[];\n\tpagination: {\n\t\ttotal: number;\n\t\thasMore: boolean;\n\t\tcursor?: string;\n\t};\n}\n\n/**\n * Encode a cursor value for safe URL transmission.\n * Supports various types: string, number, Date, etc.\n */\nexport function encodeCursor(value: unknown): string {\n\tconst payload = {\n\t\tv: value instanceof Date ? value.toISOString() : value,\n\t\tt: value instanceof Date ? 'date' : typeof value,\n\t};\n\treturn Buffer.from(JSON.stringify(payload)).toString('base64url');\n}\n\n/**\n * Decode a cursor string back to its original value.\n */\nexport function decodeCursor(cursor: string): unknown {\n\ttry {\n\t\tconst json = Buffer.from(cursor, 'base64url').toString('utf-8');\n\t\tconst payload = JSON.parse(json);\n\n\t\tif (payload.t === 'date') {\n\t\t\treturn new Date(payload.v);\n\t\t}\n\n\t\treturn payload.v;\n\t} catch {\n\t\tthrow new Error('Invalid cursor format');\n\t}\n}\n"],"mappings":";;;;AAGA,IAAY,kDAAL;AACN;AACA;;AACA;;;;;AAkBD,SAAgB,aAAaA,OAAwB;CACpD,MAAM,UAAU;EACf,GAAG,iBAAiB,OAAO,MAAM,aAAa,GAAG;EACjD,GAAG,iBAAiB,OAAO,gBAAgB;CAC3C;AACD,QAAO,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC,CAAC,SAAS,YAAY;AACjE;;;;AAKD,SAAgB,aAAaC,QAAyB;AACrD,KAAI;EACH,MAAM,OAAO,OAAO,KAAK,QAAQ,YAAY,CAAC,SAAS,QAAQ;EAC/D,MAAM,UAAU,KAAK,MAAM,KAAK;AAEhC,MAAI,QAAQ,MAAM,OACjB,QAAO,IAAI,KAAK,QAAQ;AAGzB,SAAO,QAAQ;CACf,QAAO;AACP,QAAM,IAAI,MAAM;CAChB;AACD"}

package/dist/pagination-Bdoa4PVj.cjs

@@ -0,0 +1,55 @@
+
+//#region src/pagination.ts
+/**
+* Sort direction for cursor-based pagination.
+*/
+let Direction = /* @__PURE__ */ function(Direction$1) {
+	Direction$1["Asc"] = "asc";
+	Direction$1["Desc"] = "desc";
+	return Direction$1;
+}({});
+/**
+* Encode a cursor value for safe URL transmission.
+* Supports various types: string, number, Date, etc.
+*/
+function encodeCursor(value) {
+	const payload = {
+		v: value instanceof Date ? value.toISOString() : value,
+		t: value instanceof Date ? "date" : typeof value
+	};
+	return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+/**
+* Decode a cursor string back to its original value.
+*/
+function decodeCursor(cursor) {
+	try {
+		const json = Buffer.from(cursor, "base64url").toString("utf-8");
+		const payload = JSON.parse(json);
+		if (payload.t === "date") return new Date(payload.v);
+		return payload.v;
+	} catch {
+		throw new Error("Invalid cursor format");
+	}
+}
+
+//#endregion
+Object.defineProperty(exports, 'Direction', {
+  enumerable: true,
+  get: function () {
+    return Direction;
+  }
+});
+Object.defineProperty(exports, 'decodeCursor', {
+  enumerable: true,
+  get: function () {
+    return decodeCursor;
+  }
+});
+Object.defineProperty(exports, 'encodeCursor', {
+  enumerable: true,
+  get: function () {
+    return encodeCursor;
+  }
+});
+//# sourceMappingURL=pagination-Bdoa4PVj.cjs.map

package/dist/pagination-Bdoa4PVj.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination-Bdoa4PVj.cjs","names":["value: unknown","cursor: string"],"sources":["../src/pagination.ts"],"sourcesContent":["/**\n * Sort direction for cursor-based pagination.\n */\nexport enum Direction {\n\tAsc = 'asc',\n\tDesc = 'desc',\n}\n\n/**\n * Result of a paginated query.\n */\nexport interface PaginationResult<TItem> {\n\titems: TItem[];\n\tpagination: {\n\t\ttotal: number;\n\t\thasMore: boolean;\n\t\tcursor?: string;\n\t};\n}\n\n/**\n * Encode a cursor value for safe URL transmission.\n * Supports various types: string, number, Date, etc.\n */\nexport function encodeCursor(value: unknown): string {\n\tconst payload = {\n\t\tv: value instanceof Date ? value.toISOString() : value,\n\t\tt: value instanceof Date ? 'date' : typeof value,\n\t};\n\treturn Buffer.from(JSON.stringify(payload)).toString('base64url');\n}\n\n/**\n * Decode a cursor string back to its original value.\n */\nexport function decodeCursor(cursor: string): unknown {\n\ttry {\n\t\tconst json = Buffer.from(cursor, 'base64url').toString('utf-8');\n\t\tconst payload = JSON.parse(json);\n\n\t\tif (payload.t === 'date') {\n\t\t\treturn new Date(payload.v);\n\t\t}\n\n\t\treturn payload.v;\n\t} catch {\n\t\tthrow new Error('Invalid cursor format');\n\t}\n}\n"],"mappings":";;;;;AAGA,IAAY,kDAAL;AACN;AACA;;AACA;;;;;AAkBD,SAAgB,aAAaA,OAAwB;CACpD,MAAM,UAAU;EACf,GAAG,iBAAiB,OAAO,MAAM,aAAa,GAAG;EACjD,GAAG,iBAAiB,OAAO,gBAAgB;CAC3C;AACD,QAAO,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC,CAAC,SAAS,YAAY;AACjE;;;;AAKD,SAAgB,aAAaC,QAAyB;AACrD,KAAI;EACH,MAAM,OAAO,OAAO,KAAK,QAAQ,YAAY,CAAC,SAAS,QAAQ;EAC/D,MAAM,UAAU,KAAK,MAAM,KAAK;AAEhC,MAAI,QAAQ,MAAM,OACjB,QAAO,IAAI,KAAK,QAAQ;AAGzB,SAAO,QAAQ;CACf,QAAO;AACP,QAAM,IAAI,MAAM;CAChB;AACD"}

package/dist/pagination-BziGl-B8.d.mts

@@ -0,0 +1,32 @@
+//#region src/pagination.d.ts
+/**
+ * Sort direction for cursor-based pagination.
+ */
+declare enum Direction {
+  Asc = "asc",
+  Desc = "desc",
+}
+/**
+ * Result of a paginated query.
+ */
+interface PaginationResult<TItem> {
+  items: TItem[];
+  pagination: {
+    total: number;
+    hasMore: boolean;
+    cursor?: string;
+  };
+}
+/**
+ * Encode a cursor value for safe URL transmission.
+ * Supports various types: string, number, Date, etc.
+ */
+declare function encodeCursor(value: unknown): string;
+/**
+ * Decode a cursor string back to its original value.
+ */
+declare function decodeCursor(cursor: string): unknown;
+//# sourceMappingURL=pagination.d.ts.map
+//#endregion
+export { Direction, PaginationResult, decodeCursor, encodeCursor };
+//# sourceMappingURL=pagination-BziGl-B8.d.mts.map

package/dist/pagination-BziGl-B8.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination-BziGl-B8.d.mts","names":[],"sources":["../src/pagination.ts"],"sourcesContent":[],"mappings":";;AAGA;AAQA;AAagB,aArBJ,SAAA;EAgCI,GAAA,GAAA,KAAA;;;;;;UAxBC;SACT;;;;;;;;;;;iBAYQ,YAAA;;;;iBAWA,YAAA"}

package/dist/pagination.cjs

@@ -0,0 +1,5 @@
+const require_pagination = require('./pagination-Bdoa4PVj.cjs');
+
+exports.Direction = require_pagination.Direction;
+exports.decodeCursor = require_pagination.decodeCursor;
+exports.encodeCursor = require_pagination.encodeCursor;

package/dist/pagination.d.cts

@@ -0,0 +1,2 @@
+import { Direction, PaginationResult, decodeCursor, encodeCursor } from "./pagination-BAFX7C1I.cjs";
+export { Direction, PaginationResult, decodeCursor, encodeCursor };

package/dist/pagination.d.mts

@@ -0,0 +1,2 @@
+import { Direction, PaginationResult, decodeCursor, encodeCursor } from "./pagination-BziGl-B8.mjs";
+export { Direction, PaginationResult, decodeCursor, encodeCursor };

package/dist/pagination.mjs

@@ -0,0 +1,3 @@
+import { Direction, decodeCursor, encodeCursor } from "./pagination-BDLa7Yb_.mjs";
+
+export { Direction, decodeCursor, encodeCursor };

package/dist/rls.d.mts

@@ -1,4 +1,4 @@
-import { DatabaseConnection, TransactionSettings } from "./kysely-DUdsB0BP.mjs";
+import { DatabaseConnection, TransactionSettings } from "./kysely-Dm1w5gAY.mjs";
 import { Transaction } from "kysely";
 
 //#region src/rls.d.ts

package/package.json

@@ -1,23 +1,58 @@
 {
   "name": "@geekmidas/db",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "private": false,
   "type": "module",
   "exports": {
     "./kysely": {
-      "types": "./dist/kysely.d.ts",
-      "import": "./dist/kysely.mjs",
-      "require": "./dist/kysely.cjs"
+      "import": {
+        "types": "./dist/kysely.d.mts",
+        "default": "./dist/kysely.mjs"
+      },
+      "require": {
+        "types": "./dist/kysely.d.cts",
+        "default": "./dist/kysely.cjs"
+      }
     },
     "./kysely/pagination": {
-      "types": "./dist/kysely/pagination.d.ts",
-      "import": "./dist/kysely/pagination.mjs",
-      "require": "./dist/kysely/pagination.cjs"
+      "import": {
+        "types": "./dist/kysely/pagination.d.mts",
+        "default": "./dist/kysely/pagination.mjs"
+      },
+      "require": {
+        "types": "./dist/kysely/pagination.d.cts",
+        "default": "./dist/kysely/pagination.cjs"
+      }
+    },
+    "./pagination": {
+      "import": {
+        "types": "./dist/pagination.d.mts",
+        "default": "./dist/pagination.mjs"
+      },
+      "require": {
+        "types": "./dist/pagination.d.cts",
+        "default": "./dist/pagination.cjs"
+      }
+    },
+    "./objection/pagination": {
+      "import": {
+        "types": "./dist/objection/pagination.d.mts",
+        "default": "./dist/objection/pagination.mjs"
+      },
+      "require": {
+        "types": "./dist/objection/pagination.d.cts",
+        "default": "./dist/objection/pagination.cjs"
+      }
     },
     "./rls": {
-      "types": "./dist/rls.d.ts",
-      "import": "./dist/rls.mjs",
-      "require": "./dist/rls.cjs"
+      "import": {
+        "types": "./dist/rls.d.mts",
+        "default": "./dist/rls.mjs"
+      },
+      "require": {
+        "types": "./dist/rls.d.cts",
+        "default": "./dist/rls.cjs"
+      }
     }
   },
   "dependencies": {

package/src/__tests__/rls.spec.ts

@@ -20,6 +20,16 @@ interface TestDatabase {
 	};
 }
 
+interface RlsPolicyDatabase {
+	rlsPolicyItems: {
+		id: Generated<number>;
+		tenantId: string;
+		userId: string;
+		amount: number;
+		createdAt: Generated<Date>;
+	};
+}
+
 describe('RLS Utility - Integration Tests', () => {
 	let db: Kysely<TestDatabase>;
 
@@ -441,4 +451,266 @@ describe('RLS Utility - Integration Tests', () => {
 			expect(context.optional).toBe(undefined);
 		});
 	});
+
+	describe('RLS Policy Enforcement', () => {
+		let adminDb: Kysely<RlsPolicyDatabase>;
+		let userDb: Kysely<RlsPolicyDatabase>;
+
+		beforeAll(async () => {
+			// Admin connection (superuser bypasses RLS)
+			adminDb = new Kysely<RlsPolicyDatabase>({
+				dialect: new PostgresDialect({
+					pool: new pg.Pool({
+						...TEST_DATABASE_CONFIG,
+						database: 'postgres',
+					}),
+				}),
+				plugins: [new CamelCasePlugin()],
+			});
+
+			// Clean up from any previous failed runs
+			await sql`DROP TABLE IF EXISTS rls_policy_items CASCADE`.execute(adminDb);
+
+			// Create non-superuser role (RLS doesn't apply to superusers)
+			await sql`
+				DO $$ BEGIN
+					IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'rls_test_role') THEN
+						CREATE ROLE rls_test_role LOGIN PASSWORD 'rls_test_pass';
+					END IF;
+				END $$
+			`.execute(adminDb);
+
+			// Create table
+			await adminDb.schema
+				.createTable('rls_policy_items')
+				.addColumn('id', 'serial', (col) => col.primaryKey())
+				.addColumn('tenant_id', 'varchar', (col) => col.notNull())
+				.addColumn('user_id', 'varchar', (col) => col.notNull())
+				.addColumn('amount', 'numeric(10, 2)', (col) => col.notNull())
+				.addColumn('created_at', 'timestamp', (col) =>
+					col.defaultTo(sql`now()`).notNull(),
+				)
+				.execute();
+
+			// Enable RLS
+			await sql`ALTER TABLE rls_policy_items ENABLE ROW LEVEL SECURITY`.execute(
+				adminDb,
+			);
+
+			// Create tenant isolation policies
+			await sql`
+				CREATE POLICY tenant_select ON rls_policy_items
+					FOR SELECT USING (tenant_id = current_setting('app.tenant_id', true))
+			`.execute(adminDb);
+
+			await sql`
+				CREATE POLICY tenant_insert ON rls_policy_items
+					FOR INSERT WITH CHECK (tenant_id = current_setting('app.tenant_id', true))
+			`.execute(adminDb);
+
+			await sql`
+				CREATE POLICY tenant_update ON rls_policy_items
+					FOR UPDATE
+					USING (tenant_id = current_setting('app.tenant_id', true))
+					WITH CHECK (tenant_id = current_setting('app.tenant_id', true))
+			`.execute(adminDb);
+
+			await sql`
+				CREATE POLICY tenant_delete ON rls_policy_items
+					FOR DELETE USING (tenant_id = current_setting('app.tenant_id', true))
+			`.execute(adminDb);
+
+			// Grant permissions to test role
+			await sql`GRANT ALL ON rls_policy_items TO rls_test_role`.execute(
+				adminDb,
+			);
+			await sql`GRANT USAGE, SELECT ON SEQUENCE rls_policy_items_id_seq TO rls_test_role`.execute(
+				adminDb,
+			);
+
+			// Seed data as admin (superuser bypasses RLS)
+			await adminDb
+				.insertInto('rlsPolicyItems')
+				.values([
+					{ tenantId: 'tenant-a', userId: 'user-1', amount: 100 },
+					{ tenantId: 'tenant-a', userId: 'user-2', amount: 200 },
+					{ tenantId: 'tenant-b', userId: 'user-3', amount: 300 },
+					{ tenantId: 'tenant-b', userId: 'user-4', amount: 400 },
+					{ tenantId: 'tenant-c', userId: 'user-5', amount: 500 },
+				])
+				.execute();
+
+			// Create connection as non-superuser (subject to RLS policies)
+			userDb = new Kysely<RlsPolicyDatabase>({
+				dialect: new PostgresDialect({
+					pool: new pg.Pool({
+						host: TEST_DATABASE_CONFIG.host,
+						port: TEST_DATABASE_CONFIG.port,
+						user: 'rls_test_role',
+						password: 'rls_test_pass',
+						database: 'postgres',
+					}),
+				}),
+				plugins: [new CamelCasePlugin()],
+			});
+		});
+
+		afterAll(async () => {
+			await userDb.destroy();
+			await sql`DROP TABLE IF EXISTS rls_policy_items CASCADE`.execute(adminDb);
+			await sql`DROP ROLE IF EXISTS rls_test_role`.execute(adminDb);
+			await adminDb.destroy();
+		});
+
+		it('should only return rows matching the tenant context', async () => {
+			const rows = await withRlsContext(
+				userDb,
+				{ tenant_id: 'tenant-a' },
+				async (trx) => {
+					return trx.selectFrom('rlsPolicyItems').selectAll().execute();
+				},
+			);
+
+			expect(rows).toHaveLength(2);
+			expect(rows.every((r) => r.tenantId === 'tenant-a')).toBe(true);
+		});
+
+		it('should completely isolate tenants from each other', async () => {
+			const rows = await withRlsContext(
+				userDb,
+				{ tenant_id: 'tenant-b' },
+				async (trx) => {
+					return trx.selectFrom('rlsPolicyItems').selectAll().execute();
+				},
+			);
+
+			expect(rows).toHaveLength(2);
+			expect(rows.every((r) => r.tenantId === 'tenant-b')).toBe(true);
+			const userIds = rows.map((r) => r.userId);
+			expect(userIds).not.toContain('user-1');
+			expect(userIds).not.toContain('user-2');
+		});
+
+		it('should return no rows when tenant context is not set', async () => {
+			const rows = await withRlsContext(userDb, {}, async (trx) => {
+				return trx.selectFrom('rlsPolicyItems').selectAll().execute();
+			});
+
+			expect(rows).toHaveLength(0);
+		});
+
+		it('should allow inserting rows that match the tenant context', async () => {
+			const row = await withRlsContext(
+				userDb,
+				{ tenant_id: 'tenant-a' },
+				async (trx) => {
+					return trx
+						.insertInto('rlsPolicyItems')
+						.values({
+							tenantId: 'tenant-a',
+							userId: 'user-insert-test',
+							amount: 999,
+						})
+						.returningAll()
+						.executeTakeFirstOrThrow();
+				},
+			);
+
+			expect(row.tenantId).toBe('tenant-a');
+			expect(row.userId).toBe('user-insert-test');
+
+			// Clean up
+			await sql`DELETE FROM rls_policy_items WHERE user_id = 'user-insert-test'`.execute(
+				adminDb,
+			);
+		});
+
+		it('should reject inserting rows that violate the tenant policy', async () => {
+			await expect(
+				withRlsContext(userDb, { tenant_id: 'tenant-a' }, async (trx) => {
+					return trx
+						.insertInto('rlsPolicyItems')
+						.values({
+							tenantId: 'tenant-b',
+							userId: 'user-cross-tenant',
+							amount: 666,
+						})
+						.execute();
+				}),
+			).rejects.toThrow(/row-level security/i);
+		});
+
+		it('should not update rows belonging to another tenant', async () => {
+			const result = await withRlsContext(
+				userDb,
+				{ tenant_id: 'tenant-a' },
+				async (trx) => {
+					return trx
+						.updateTable('rlsPolicyItems')
+						.set({ amount: 111 })
+						.where('userId', '=', 'user-3') // belongs to tenant-b
+						.executeTakeFirst();
+				},
+			);
+
+			expect(Number(result.numUpdatedRows)).toBe(0);
+
+			// Verify row is unchanged
+			const unchanged = await sql<{ amount: string }>`
+				SELECT amount FROM rls_policy_items WHERE user_id = 'user-3'
+			`
+				.execute(adminDb)
+				.then((r) => r.rows[0]);
+
+			expect(Number(unchanged?.amount)).toBe(300);
+		});
+
+		it('should reject updates that reassign a row to another tenant', async () => {
+			await expect(
+				withRlsContext(userDb, { tenant_id: 'tenant-a' }, async (trx) => {
+					return trx
+						.updateTable('rlsPolicyItems')
+						.set({ tenantId: 'tenant-b' })
+						.where('userId', '=', 'user-1')
+						.execute();
+				}),
+			).rejects.toThrow(/row-level security/i);
+		});
+
+		it('should not delete rows belonging to another tenant', async () => {
+			const result = await withRlsContext(
+				userDb,
+				{ tenant_id: 'tenant-a' },
+				async (trx) => {
+					return trx
+						.deleteFrom('rlsPolicyItems')
+						.where('userId', '=', 'user-3') // belongs to tenant-b
+						.executeTakeFirst();
+				},
+			);
+
+			expect(Number(result.numDeletedRows)).toBe(0);
+		});
+
+		it('should allow deleting rows belonging to the current tenant', async () => {
+			// Insert a row to delete
+			await sql`
+				INSERT INTO rls_policy_items (tenant_id, user_id, amount)
+				VALUES ('tenant-a', 'user-to-delete', 999)
+			`.execute(adminDb);
+
+			const result = await withRlsContext(
+				userDb,
+				{ tenant_id: 'tenant-a' },
+				async (trx) => {
+					return trx
+						.deleteFrom('rlsPolicyItems')
+						.where('userId', '=', 'user-to-delete')
+						.executeTakeFirst();
+				},
+			);
+
+			expect(Number(result.numDeletedRows)).toBe(1);
+		});
+	});
 });