@kysera/rls 0.8.6 → 0.8.8

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RLSSchema, O as Operation, P as PolicyCondition, a as PolicyHints, b as PolicyActivationCondition, C as ConditionalPolicyDefinition, F as FilterCondition, T as TableRLSConfig, c as PolicyDefinition, d as CompiledPolicy, e as CompiledFilterPolicy, f as RLSContext, g as RLSAuthContext, h as RLSRequestContext, i as PolicyEvaluationContext } from './types-CyqksFKU.js';
-export { k as PolicyActivationContext, j as PolicyType } from './types-CyqksFKU.js';
+import { R as RLSSchema, O as Operation, P as PolicyCondition, a as PolicyHints, b as PolicyActivationCondition, C as ConditionalPolicyDefinition, F as FilterCondition, T as TableRLSConfig, c as PolicyDefinition, d as CompiledPolicy, e as CompiledFilterPolicy, f as RLSContext, g as RLSAuthContext, h as RLSRequestContext, i as PolicyEvaluationContext } from './types-D3hQINlj.js';
+export { k as PolicyActivationContext, j as PolicyType } from './types-D3hQINlj.js';
 import { KyseraLogger, DatabaseError, ErrorCode } from '@kysera/core';
 import { Plugin } from '@kysera/executor';
 import { z } from 'zod';
@@ -663,8 +663,14 @@ interface RLSPluginOptions<DB = unknown> {
     /** RLS policy schema */
     schema: RLSSchema<DB>;
     /**
-     * Tables to exclude from RLS (always bypass policies)
-     * @default []
+     * Whitelist of tables to apply RLS to.
+     * If provided, only these tables will have RLS enforced.
+     * Takes precedence over excludeTables when both are provided.
+     */
+    tables?: string[];
+    /**
+     * Tables to exclude from RLS (always bypass policies).
+     * Ignored if `tables` whitelist is provided.
      */
     excludeTables?: string[];
     /** Roles that bypass RLS entirely (e.g., ['admin', 'superuser']) */
@@ -719,6 +725,7 @@ interface RLSPluginOptions<DB = unknown> {
  * Note: 'schema' and 'onViolation' are not included as they are complex runtime objects.
  */
 declare const RLSPluginOptionsSchema: z.ZodObject<{
+    tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     excludeTables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     bypassRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     requireContext: z.ZodOptional<z.ZodBoolean>;

package/dist/index.js

@@ -1,7 +1,7 @@
-import { DatabaseError, silentLogger } from '@kysera/core';
+import { DatabaseError, silentLogger, shouldApplyToTable } from '@kysera/core';
 import { isRepositoryLike, getRawDb } from '@kysera/executor';
 import { z } from 'zod';
-import { AsyncLocalStorage } from 'async_hooks';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { sql } from 'kysely';
 
 // src/errors.ts
@@ -1173,9 +1173,9 @@ var MutationGuard = class {
     if (skipFor.some((role) => ctx.auth.roles.includes(role))) {
       return;
     }
+    const evalCtx = this.createEvalContext(ctx, table, operation, row, data);
     const denies = this.registry.getDenies(table, operation);
     for (const deny2 of denies) {
-      const evalCtx = this.createEvalContext(ctx, table, operation, row, data);
       const result = await this.evaluatePolicy(deny2.evaluate, evalCtx, deny2.name);
       if (result) {
         throw new RLSPolicyViolation(operation, table, `Denied by policy: ${deny2.name}`);
@@ -1184,7 +1184,6 @@ var MutationGuard = class {
     if ((operation === "create" || operation === "update") && data) {
       const validates = this.registry.getValidates(table, operation);
       for (const validate2 of validates) {
-        const evalCtx = this.createEvalContext(ctx, table, operation, row, data);
         const result = await this.evaluatePolicy(validate2.evaluate, evalCtx, validate2.name);
         if (!result) {
           throw new RLSPolicyViolation(operation, table, `Validation failed: ${validate2.name}`);
@@ -1199,7 +1198,6 @@ var MutationGuard = class {
     if (allows.length > 0) {
       let allowed = false;
       for (const allow2 of allows) {
-        const evalCtx = this.createEvalContext(ctx, table, operation, row, data);
         const result = await this.evaluatePolicy(allow2.evaluate, evalCtx, allow2.name);
         if (result) {
           allowed = true;
@@ -1292,6 +1290,7 @@ var MutationGuard = class {
 var RAW_VERSION = "__VERSION__";
 var VERSION = RAW_VERSION.startsWith("__") ? "0.0.0-dev" : RAW_VERSION;
 var RLSPluginOptionsSchema = z.object({
+  tables: z.array(z.string()).optional(),
   excludeTables: z.array(z.string()).optional(),
   bypassRoles: z.array(z.string()).optional(),
   requireContext: z.boolean().optional(),
@@ -1302,7 +1301,8 @@ var RLSPluginOptionsSchema = z.object({
 function rlsPlugin(options) {
   const {
     schema,
-    excludeTables = [],
+    tables,
+    excludeTables,
     bypassRoles = [],
     logger = silentLogger,
     requireContext = true,
@@ -1319,8 +1319,8 @@ function rlsPlugin(options) {
   return {
     name: "@kysera/rls",
     version: VERSION,
-    // Run after soft-delete (priority 0), before audit
-    priority: 50,
+    // SECURITY plugin: must run FIRST to enforce access policies before other plugins
+    priority: 1e3,
     // No dependencies by default
     dependencies: [],
     /**
@@ -1329,7 +1329,7 @@ function rlsPlugin(options) {
     onInit(_executor) {
       logger.info?.("[RLS] Initializing RLS plugin", {
         tables: Object.keys(schema).length,
-        excludeTables: excludeTables.length,
+        excludeTables: excludeTables?.length ?? 0,
         bypassRoles: bypassRoles.length
       });
       registry = new PolicyRegistry(schema);
@@ -1344,7 +1344,6 @@ function rlsPlugin(options) {
     onDestroy() {
       registry.clear();
       logger.info?.("[RLS] RLS plugin destroyed, cleared policy registry");
-      return Promise.resolve();
     },
     /**
      * Intercept queries to apply RLS filtering
@@ -1355,7 +1354,7 @@ function rlsPlugin(options) {
      */
     interceptQuery(qb, context) {
       const { operation, table, metadata } = context;
-      if (excludeTables.includes(table)) {
+      if (!shouldApplyToTable(table, { tables, excludeTables })) {
         logger.debug?.(`[RLS] Skipping RLS for excluded table: ${table}`);
         return qb;
       }
@@ -1438,7 +1437,7 @@ function rlsPlugin(options) {
       }
       const baseRepo = repo;
       const table = baseRepo.tableName;
-      if (excludeTables.includes(table)) {
+      if (!shouldApplyToTable(table, { tables, excludeTables })) {
         logger.debug?.(`[RLS] Skipping repository extension for excluded table: ${table}`);
         return repo;
       }