@lark-apaas/express-datapaas 0.0.1

package/LICENSE

@@ -0,0 +1,13 @@
+MIT License
+
+Copyright (c) 2024 Lark Technologies Pte. Ltd. and/or its affiliates
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted,provided that the above copyright notice and this permission notice appear in all copies.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE
+INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO
+EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -0,0 +1,148 @@
+# @lark-apaas/express-datapaas
+
+基于 Drizzle ORM 封装的 PostgreSQL 数据库模块，为 Express 应用提供连接管理与 RLS（行级安全）支持。
+
+## 功能特性
+
+- 基于 Drizzle ORM + postgres-js 的数据库连接管理
+- 自动在 pg session 层面注入用户上下文，无感支持 RLS
+- 简洁的函数式 API，`createDatabase` 返回可直接使用的 `db` 实例
+- Express 中间件形式的 RLS 上下文注入
+
+## 安装
+
+```bash
+npm install @lark-apaas/express-datapaas
+```
+
+### Peer Dependencies
+
+需要同时安装以下依赖：
+
+```bash
+npm install drizzle-orm@0.44.6 express
+```
+
+> **注意**: drizzle-orm 版本必须为 `0.44.6`，安装后会自动通过 postinstall 脚本打补丁以支持 RLS 功能。
+
+## 快速开始
+
+### 1. 创建数据库实例
+
+```typescript
+import { createDatabase } from '@lark-apaas/express-datapaas';
+import * as schema from './schema';
+
+const { db, close } = createDatabase({
+  connectionString: process.env.DATABASE_URL!,
+  schema,
+  logger: false,
+  maxConnections: 1,
+  idleTimeout: 20,
+  connectionTimeout: 10,
+  ssl: false,
+});
+
+// 应用退出时关闭连接
+process.on('SIGTERM', async () => {
+  await close();
+});
+```
+
+### 2. 注册 RLS 中间件
+
+```typescript
+import express from 'express';
+import { createRlsMiddleware } from '@lark-apaas/express-datapaas';
+
+const app = express();
+
+// 在 userContext 中间件之后注册
+app.use(createRlsMiddleware());
+```
+
+中间件会从 `req.userContext` 读取用户信息，自动为后续的数据库查询设置 RLS 上下文。
+
+### 3. 使用数据库
+
+```typescript
+import { db } from './database';
+import { users } from './schema';
+
+app.get('/api/users', async (req, res) => {
+  // db 查询自动携带 RLS 上下文
+  const result = await db.select().from(users);
+  res.json(result);
+});
+```
+
+## API 参考
+
+### createDatabase(config)
+
+创建数据库连接实例。
+
+**参数 `CreateDatabaseConfig`：**
+
+| 字段 | 类型 | 必填 | 默认值 | 说明 |
+|------|------|------|--------|------|
+| `connectionString` | `string` | 是 | - | PostgreSQL 连接串 |
+| `schema` | `object` | 否 | - | Drizzle schema 对象 |
+| `logger` | `boolean \| Logger` | 否 | `false` | 是否启用 SQL 日志 |
+| `maxConnections` | `number` | 否 | `1` | 最大连接数 |
+| `idleTimeout` | `number` | 否 | `20` | 空闲连接超时（秒） |
+| `connectionTimeout` | `number` | 否 | `10` | 连接超时（秒） |
+| `ssl` | `string \| boolean \| object` | 否 | `false` | SSL 配置，连接串含 `sslmode=require` 时自动启用 |
+
+**返回值 `DatabaseInstance`：**
+
+| 字段 | 类型 | 说明 |
+|------|------|------|
+| `db` | `PostgresJsDatabase` | Drizzle 数据库实例，可直接用于查询 |
+| `close` | `() => Promise<void>` | 关闭数据库连接 |
+
+### createRlsMiddleware(options?)
+
+创建 Express RLS 中间件。
+
+**参数 `RlsMiddlewareOptions`（可选）：**
+
+| 字段 | 类型 | 说明 |
+|------|------|------|
+| `roleSchema` | `string` | 角色 schema 标识。省略时自动使用 `createDatabase` 从连接串解析的值 |
+
+**UserContext 结构：**
+
+中间件从 `req.userContext` 读取以下字段：
+
+```typescript
+interface UserContext {
+  userId?: string;        // 用户 ID
+  tenantId?: number;      // 租户 ID
+  appId?: string;         // 应用 ID
+  roles?: string[];       // 用户角色列表
+  isSystemAccount: boolean; // 是否系统账号
+  userType?: string;      // 用户类型
+}
+```
+
+**RLS 行为：**
+
+| 场景 | 设置的 PostgreSQL 角色 |
+|------|----------------------|
+| 系统账号 (`isSystemAccount: true`) | `service_role_{schema}` |
+| 已登录用户 (`userId` 存在) | `authenticated_{schema}` |
+| 匿名用户 | `anon_{schema}` |
+
+同时会设置 `app.user_id`、`app.role_ids`、`app.user_type` 等会话变量。
+
+## 注意事项
+
+1. **drizzle-orm 版本锁定**：必须使用 `drizzle-orm@0.44.6`，该版本已通过 patch-package 打补丁以支持 RLS 上下文注入
+2. **应用层不要单独安装 drizzle-orm**：如果需要 drizzle-orm 的类型导出，直接从 `@lark-apaas/express-datapaas` 导入（如 `PostgresJsDatabase`）
+3. **中间件顺序**：`createRlsMiddleware()` 必须在设置 `req.userContext` 的中间件之后注册
+4. **连接关闭**：应用退出时务必调用 `close()` 释放连接资源
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,173 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  createDatabase: () => createDatabase,
+  createRlsMiddleware: () => createRlsMiddleware
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/create-database.ts
+var import_postgres_js = require("drizzle-orm/postgres-js");
+var import_postgres = __toESM(require("postgres"), 1);
+
+// src/utils.ts
+function parseConnectionInfo(connectionString, config) {
+  const { maxConnections, idleTimeout, connectionTimeout, ssl, logger } = config || {};
+  let parsedConfigFromUrl = null;
+  try {
+    parsedConfigFromUrl = new URL(connectionString);
+    const temp = new URL(connectionString);
+    temp.searchParams.delete("schema");
+    connectionString = temp.toString();
+  } catch (error) {
+    throw new Error("Failed to parse connection info");
+  }
+  const { username, password, hostname, port, pathname } = parsedConfigFromUrl;
+  const connectionConfig = {
+    username: decodeURIComponent(username),
+    password: decodeURIComponent(password),
+    host: [
+      hostname
+    ],
+    port: [
+      parseInt(port) || 5432
+    ],
+    pathname: decodeURIComponent(pathname),
+    max: maxConnections || 1,
+    idle_timeout: idleTimeout || 20,
+    connect_timeout: connectionTimeout || 10,
+    ssl,
+    onnotice: logger ? console.log : void 0
+  };
+  return {
+    connectionString,
+    connectionConfig
+  };
+}
+__name(parseConnectionInfo, "parseConnectionInfo");
+function parseRoleSchema(connectionString) {
+  try {
+    const url = new URL(connectionString);
+    const roleSchema = url.searchParams.get("schema") || "";
+    const sslModeRequired = url.searchParams.get("sslmode") === "require";
+    return {
+      roleSchema,
+      sslModeRequired
+    };
+  } catch {
+    return {
+      roleSchema: "",
+      sslModeRequired: false
+    };
+  }
+}
+__name(parseRoleSchema, "parseRoleSchema");
+
+// src/create-database.ts
+var _cachedRoleSchema = "";
+function _getRoleSchema() {
+  return _cachedRoleSchema;
+}
+__name(_getRoleSchema, "_getRoleSchema");
+function verifyDrizzlePatched() {
+  try {
+    const session2 = require("drizzle-orm/postgres-js");
+    const ok = session2 && typeof session2.getAuthContextStore === "function" && typeof session2.runWithAuthContext === "function";
+    if (!ok) {
+      throw new Error("drizzle-orm \u672A\u68C0\u6D4B\u5230\u8865\u4E01\u5BFC\u51FA\uFF1AgetAuthContextStore/runWithAuthContext");
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`drizzle-orm \u8865\u4E01\u672A\u751F\u6548\u6216\u7248\u672C\u4E0D\u5339\u914D\uFF1A${reason}`);
+  }
+}
+__name(verifyDrizzlePatched, "verifyDrizzlePatched");
+function createDatabase(config) {
+  verifyDrizzlePatched();
+  const { roleSchema, sslModeRequired } = parseRoleSchema(config.connectionString);
+  _cachedRoleSchema = roleSchema;
+  const resolvedSsl = config.ssl || (sslModeRequired ? "require" : false);
+  const { connectionString, connectionConfig } = parseConnectionInfo(config.connectionString, {
+    maxConnections: config.maxConnections,
+    idleTimeout: config.idleTimeout,
+    connectionTimeout: config.connectionTimeout,
+    ssl: resolvedSsl,
+    logger: typeof config.logger === "boolean" ? config.logger : false
+  });
+  const sql = (0, import_postgres.default)(connectionString, connectionConfig);
+  const db = (0, import_postgres_js.drizzle)(sql, {
+    schema: config.schema,
+    logger: config.logger
+  });
+  return {
+    db,
+    close: /* @__PURE__ */ __name(async () => {
+      await sql.end();
+    }, "close")
+  };
+}
+__name(createDatabase, "createDatabase");
+
+// src/create-rls-middleware.ts
+var session = __toESM(require("drizzle-orm/postgres-js"), 1);
+function createRlsMiddleware(options) {
+  return /* @__PURE__ */ __name(function rlsMiddleware(req, _res, next) {
+    const roleSchema = options?.roleSchema ?? _getRoleSchema();
+    const userContext = req.userContext;
+    if (!userContext) {
+      return next();
+    }
+    const roles = (userContext.roles || []).join(",");
+    const userId = userContext.userId;
+    const isSystemAccount = userContext.isSystemAccount;
+    const userType = userContext.userType;
+    const sqls = [
+      userId ? `SET LOCAL app.user_id = '${userId}'` : `SET LOCAL app.user_id = ''`,
+      isSystemAccount ? `SET LOCAL ROLE 'service_role_${roleSchema}'` : userId ? `SET LOCAL ROLE 'authenticated_${roleSchema}'` : `SET LOCAL ROLE 'anon_${roleSchema}'`,
+      roles ? `SET LOCAL app.role_ids = '${roles}'` : `SET LOCAL app.role_ids = ''`,
+      userType ? `SET LOCAL app.user_type = '${userType}'` : `SET LOCAL app.user_type = ''`
+    ].filter(Boolean).join(";");
+    session.runWithAuthContext({
+      preSql: sqls
+    }, () => {
+      next();
+    });
+  }, "rlsMiddleware");
+}
+__name(createRlsMiddleware, "createRlsMiddleware");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createDatabase,
+  createRlsMiddleware
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/create-database.ts","../src/utils.ts","../src/create-rls-middleware.ts"],"sourcesContent":["export { createDatabase } from './create-database';\nexport { createRlsMiddleware } from './create-rls-middleware';\nexport type { CreateDatabaseConfig, DatabaseInstance, UserContext } from './types';\nexport type { RlsMiddlewareOptions } from './create-rls-middleware';\nexport type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\n","import { drizzle } from 'drizzle-orm/postgres-js';\nimport postgres from 'postgres';\nimport { parseConnectionInfo, parseRoleSchema } from './utils';\nimport type { CreateDatabaseConfig, DatabaseInstance } from './types';\n\n// 模块级缓存，供 createRlsMiddleware 零参数调用时读取\nlet _cachedRoleSchema = '';\n\nexport function _getRoleSchema(): string {\n  return _cachedRoleSchema;\n}\n\nfunction verifyDrizzlePatched(): void {\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const session = require('drizzle-orm/postgres-js');\n    const ok =\n      session &&\n      typeof session.getAuthContextStore === 'function' &&\n      typeof session.runWithAuthContext === 'function';\n    if (!ok) {\n      throw new Error(\n        'drizzle-orm 未检测到补丁导出：getAuthContextStore/runWithAuthContext',\n      );\n    }\n  } catch (err) {\n    const reason = err instanceof Error ? err.message : String(err);\n    throw new Error(`drizzle-orm 补丁未生效或版本不匹配：${reason}`);\n  }\n}\n\nexport function createDatabase(config: CreateDatabaseConfig): DatabaseInstance {\n  verifyDrizzlePatched();\n\n  const { roleSchema, sslModeRequired } = parseRoleSchema(config.connectionString);\n  _cachedRoleSchema = roleSchema;\n\n  const resolvedSsl = config.ssl || (sslModeRequired ? 'require' : false);\n\n  const { connectionString, connectionConfig } = parseConnectionInfo(config.connectionString, {\n    maxConnections: config.maxConnections,\n    idleTimeout: config.idleTimeout,\n    connectionTimeout: config.connectionTimeout,\n    ssl: resolvedSsl,\n    logger: typeof config.logger === 'boolean' ? config.logger : false,\n  });\n\n  const sql = postgres(connectionString, connectionConfig);\n  const db = drizzle(sql, { schema: config.schema, logger: config.logger });\n\n  return {\n    db,\n    close: async () => {\n      await sql.end();\n    },\n  };\n}\n","import { type PostgresOptions } from './types';\n\ninterface ConnectionConfig {\n  maxConnections?: number;\n  idleTimeout?: number;\n  connectionTimeout?: number;\n  ssl?: PostgresOptions['ssl'];\n  logger?: boolean;\n}\n\nexport function parseConnectionInfo(connectionString: string, config?: ConnectionConfig) {\n  const { maxConnections, idleTimeout, connectionTimeout, ssl, logger } = config || {};\n\n  let parsedConfigFromUrl = null;\n  try {\n    parsedConfigFromUrl = new URL(connectionString);\n    const temp = new URL(connectionString);\n    temp.searchParams.delete('schema');\n    connectionString = temp.toString();\n  } catch (error) {\n    throw new Error('Failed to parse connection info');\n  }\n\n  const { username, password, hostname, port, pathname } = parsedConfigFromUrl;\n  const connectionConfig = {\n    username: decodeURIComponent(username),\n    password: decodeURIComponent(password),\n    host: [hostname] as unknown as string,\n    port: [parseInt(port) || 5432] as unknown as number,\n    pathname: decodeURIComponent(pathname),\n    max: maxConnections || 1,\n    idle_timeout: idleTimeout || 20,\n    connect_timeout: connectionTimeout || 10,\n    ssl,\n    onnotice: logger ? console.log : undefined,\n  };\n\n  return { connectionString, connectionConfig };\n}\n\nexport function parseRoleSchema(connectionString: string): { roleSchema: string; sslModeRequired: boolean } {\n  try {\n    const url = new URL(connectionString);\n    const roleSchema = url.searchParams.get('schema') || '';\n    const sslModeRequired = url.searchParams.get('sslmode') === 'require';\n    return { roleSchema, sslModeRequired };\n  } catch {\n    return { roleSchema: '', sslModeRequired: false };\n  }\n}\n","import { type Request, type Response, type NextFunction } from 'express';\nimport * as session from 'drizzle-orm/postgres-js';\nimport { _getRoleSchema } from './create-database';\nimport type { UserContext } from './types';\n\nexport interface RlsMiddlewareOptions {\n  roleSchema?: string;\n}\n\nexport function createRlsMiddleware(options?: RlsMiddlewareOptions) {\n  return function rlsMiddleware(req: Request, _res: Response, next: NextFunction) {\n    const roleSchema = options?.roleSchema ?? _getRoleSchema();\n    const userContext = (req as unknown as { userContext: UserContext }).userContext;\n\n    if (!userContext) {\n      return next();\n    }\n\n    const roles = (userContext.roles || []).join(',');\n    const userId = userContext.userId;\n    const isSystemAccount = userContext.isSystemAccount;\n    const userType = userContext.userType;\n\n    const sqls = [\n      userId\n        ? `SET LOCAL app.user_id = '${userId}'`\n        : `SET LOCAL app.user_id = ''`,\n      isSystemAccount\n        ? `SET LOCAL ROLE 'service_role_${roleSchema}'`\n        : userId\n          ? `SET LOCAL ROLE 'authenticated_${roleSchema}'`\n          : `SET LOCAL ROLE 'anon_${roleSchema}'`,\n      roles\n        ? `SET LOCAL app.role_ids = '${roles}'`\n        : `SET LOCAL app.role_ids = ''`,\n      userType\n        ? `SET LOCAL app.user_type = '${userType}'`\n        : `SET LOCAL app.user_type = ''`,\n    ]\n      .filter(Boolean)\n      .join(';');\n\n    (session as unknown as { runWithAuthContext: (store: { preSql: string }, fn: () => void) => void })\n      .runWithAuthContext({ preSql: sqls }, () => {\n        next();\n      });\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;ACAA,yBAAwB;AACxB,sBAAqB;;;ACSd,SAASA,oBAAoBC,kBAA0BC,QAAyB;AACrF,QAAM,EAAEC,gBAAgBC,aAAaC,mBAAmBC,KAAKC,OAAM,IAAKL,UAAU,CAAC;AAEnF,MAAIM,sBAAsB;AAC1B,MAAI;AACFA,0BAAsB,IAAIC,IAAIR,gBAAAA;AAC9B,UAAMS,OAAO,IAAID,IAAIR,gBAAAA;AACrBS,SAAKC,aAAaC,OAAO,QAAA;AACzBX,uBAAmBS,KAAKG,SAAQ;EAClC,SAASC,OAAO;AACd,UAAM,IAAIC,MAAM,iCAAA;EAClB;AAEA,QAAM,EAAEC,UAAUC,UAAUC,UAAUC,MAAMC,SAAQ,IAAKZ;AACzD,QAAMa,mBAAmB;IACvBL,UAAUM,mBAAmBN,QAAAA;IAC7BC,UAAUK,mBAAmBL,QAAAA;IAC7BM,MAAM;MAACL;;IACPC,MAAM;MAACK,SAASL,IAAAA,KAAS;;IACzBC,UAAUE,mBAAmBF,QAAAA;IAC7BK,KAAKtB,kBAAkB;IACvBuB,cAActB,eAAe;IAC7BuB,iBAAiBtB,qBAAqB;IACtCC;IACAsB,UAAUrB,SAASsB,QAAQC,MAAMC;EACnC;AAEA,SAAO;IAAE9B;IAAkBoB;EAAiB;AAC9C;AA5BgBrB;AA8BT,SAASgC,gBAAgB/B,kBAAwB;AACtD,MAAI;AACF,UAAMgC,MAAM,IAAIxB,IAAIR,gBAAAA;AACpB,UAAMiC,aAAaD,IAAItB,aAAawB,IAAI,QAAA,KAAa;AACrD,UAAMC,kBAAkBH,IAAItB,aAAawB,IAAI,SAAA,MAAe;AAC5D,WAAO;MAAED;MAAYE;IAAgB;EACvC,QAAQ;AACN,WAAO;MAAEF,YAAY;MAAIE,iBAAiB;IAAM;EAClD;AACF;AATgBJ;;;ADlChB,IAAIK,oBAAoB;AAEjB,SAASC,iBAAAA;AACd,SAAOD;AACT;AAFgBC;AAIhB,SAASC,uBAAAA;AACP,MAAI;AAEF,UAAMC,WAAUC,QAAQ,yBAAA;AACxB,UAAMC,KACJF,YACA,OAAOA,SAAQG,wBAAwB,cACvC,OAAOH,SAAQI,uBAAuB;AACxC,QAAI,CAACF,IAAI;AACP,YAAM,IAAIG,MACR,0GAAA;IAEJ;EACF,SAASC,KAAK;AACZ,UAAMC,SAASD,eAAeD,QAAQC,IAAIE,UAAUC,OAAOH,GAAAA;AAC3D,UAAM,IAAID,MAAM,uFAA2BE,MAAAA,EAAQ;EACrD;AACF;AAjBSR;AAmBF,SAASW,eAAeC,QAA4B;AACzDZ,uBAAAA;AAEA,QAAM,EAAEa,YAAYC,gBAAe,IAAKC,gBAAgBH,OAAOI,gBAAgB;AAC/ElB,sBAAoBe;AAEpB,QAAMI,cAAcL,OAAOM,QAAQJ,kBAAkB,YAAY;AAEjE,QAAM,EAAEE,kBAAkBG,iBAAgB,IAAKC,oBAAoBR,OAAOI,kBAAkB;IAC1FK,gBAAgBT,OAAOS;IACvBC,aAAaV,OAAOU;IACpBC,mBAAmBX,OAAOW;IAC1BL,KAAKD;IACLO,QAAQ,OAAOZ,OAAOY,WAAW,YAAYZ,OAAOY,SAAS;EAC/D,CAAA;AAEA,QAAMC,UAAMC,gBAAAA,SAASV,kBAAkBG,gBAAAA;AACvC,QAAMQ,SAAKC,4BAAQH,KAAK;IAAEI,QAAQjB,OAAOiB;IAAQL,QAAQZ,OAAOY;EAAO,CAAA;AAEvE,SAAO;IACLG;IACAG,OAAO,mCAAA;AACL,YAAML,IAAIM,IAAG;IACf,GAFO;EAGT;AACF;AAzBgBpB;;;AE9BhB,cAAyB;AAQlB,SAASqB,oBAAoBC,SAA8B;AAChE,SAAO,gCAASC,cAAcC,KAAcC,MAAgBC,MAAkB;AAC5E,UAAMC,aAAaL,SAASK,cAAcC,eAAAA;AAC1C,UAAMC,cAAeL,IAAgDK;AAErE,QAAI,CAACA,aAAa;AAChB,aAAOH,KAAAA;IACT;AAEA,UAAMI,SAASD,YAAYC,SAAS,CAAA,GAAIC,KAAK,GAAA;AAC7C,UAAMC,SAASH,YAAYG;AAC3B,UAAMC,kBAAkBJ,YAAYI;AACpC,UAAMC,WAAWL,YAAYK;AAE7B,UAAMC,OAAO;MACXH,SACI,4BAA4BA,MAAAA,MAC5B;MACJC,kBACI,gCAAgCN,UAAAA,MAChCK,SACE,iCAAiCL,UAAAA,MACjC,wBAAwBA,UAAAA;MAC9BG,QACI,6BAA6BA,KAAAA,MAC7B;MACJI,WACI,8BAA8BA,QAAAA,MAC9B;MAEHE,OAAOC,OAAAA,EACPN,KAAK,GAAA;AAEPO,IACEC,2BAAmB;MAAEC,QAAQL;IAAK,GAAG,MAAA;AACpCT,WAAAA;IACF,CAAA;EACJ,GApCO;AAqCT;AAtCgBL;","names":["parseConnectionInfo","connectionString","config","maxConnections","idleTimeout","connectionTimeout","ssl","logger","parsedConfigFromUrl","URL","temp","searchParams","delete","toString","error","Error","username","password","hostname","port","pathname","connectionConfig","decodeURIComponent","host","parseInt","max","idle_timeout","connect_timeout","onnotice","console","log","undefined","parseRoleSchema","url","roleSchema","get","sslModeRequired","_cachedRoleSchema","_getRoleSchema","verifyDrizzlePatched","session","require","ok","getAuthContextStore","runWithAuthContext","Error","err","reason","message","String","createDatabase","config","roleSchema","sslModeRequired","parseRoleSchema","connectionString","resolvedSsl","ssl","connectionConfig","parseConnectionInfo","maxConnections","idleTimeout","connectionTimeout","logger","sql","postgres","db","drizzle","schema","close","end","createRlsMiddleware","options","rlsMiddleware","req","_res","next","roleSchema","_getRoleSchema","userContext","roles","join","userId","isSystemAccount","userType","sqls","filter","Boolean","session","runWithAuthContext","preSql"]}

package/dist/index.d.cts

@@ -0,0 +1,37 @@
+import { Options } from 'postgres';
+import { Logger } from 'drizzle-orm';
+import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+export { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import { Request, Response, NextFunction } from 'express';
+
+type PostgresOptions = Options<any>;
+interface CreateDatabaseConfig {
+    connectionString: string;
+    schema?: any;
+    logger?: boolean | Logger;
+    maxConnections?: number;
+    idleTimeout?: number;
+    connectionTimeout?: number;
+    ssl?: PostgresOptions['ssl'];
+}
+interface DatabaseInstance {
+    db: PostgresJsDatabase;
+    close: () => Promise<void>;
+}
+interface UserContext {
+    userId?: string;
+    tenantId?: number;
+    appId?: string;
+    roles?: string[];
+    isSystemAccount: boolean;
+    userType?: string;
+}
+
+declare function createDatabase(config: CreateDatabaseConfig): DatabaseInstance;
+
+interface RlsMiddlewareOptions {
+    roleSchema?: string;
+}
+declare function createRlsMiddleware(options?: RlsMiddlewareOptions): (req: Request, _res: Response, next: NextFunction) => void;
+
+export { type CreateDatabaseConfig, type DatabaseInstance, type RlsMiddlewareOptions, type UserContext, createDatabase, createRlsMiddleware };

package/dist/index.d.ts

@@ -0,0 +1,37 @@
+import { Options } from 'postgres';
+import { Logger } from 'drizzle-orm';
+import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+export { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import { Request, Response, NextFunction } from 'express';
+
+type PostgresOptions = Options<any>;
+interface CreateDatabaseConfig {
+    connectionString: string;
+    schema?: any;
+    logger?: boolean | Logger;
+    maxConnections?: number;
+    idleTimeout?: number;
+    connectionTimeout?: number;
+    ssl?: PostgresOptions['ssl'];
+}
+interface DatabaseInstance {
+    db: PostgresJsDatabase;
+    close: () => Promise<void>;
+}
+interface UserContext {
+    userId?: string;
+    tenantId?: number;
+    appId?: string;
+    roles?: string[];
+    isSystemAccount: boolean;
+    userType?: string;
+}
+
+declare function createDatabase(config: CreateDatabaseConfig): DatabaseInstance;
+
+interface RlsMiddlewareOptions {
+    roleSchema?: string;
+}
+declare function createRlsMiddleware(options?: RlsMiddlewareOptions): (req: Request, _res: Response, next: NextFunction) => void;
+
+export { type CreateDatabaseConfig, type DatabaseInstance, type RlsMiddlewareOptions, type UserContext, createDatabase, createRlsMiddleware };

package/dist/index.js

@@ -0,0 +1,143 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/create-database.ts
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+
+// src/utils.ts
+function parseConnectionInfo(connectionString, config) {
+  const { maxConnections, idleTimeout, connectionTimeout, ssl, logger } = config || {};
+  let parsedConfigFromUrl = null;
+  try {
+    parsedConfigFromUrl = new URL(connectionString);
+    const temp = new URL(connectionString);
+    temp.searchParams.delete("schema");
+    connectionString = temp.toString();
+  } catch (error) {
+    throw new Error("Failed to parse connection info");
+  }
+  const { username, password, hostname, port, pathname } = parsedConfigFromUrl;
+  const connectionConfig = {
+    username: decodeURIComponent(username),
+    password: decodeURIComponent(password),
+    host: [
+      hostname
+    ],
+    port: [
+      parseInt(port) || 5432
+    ],
+    pathname: decodeURIComponent(pathname),
+    max: maxConnections || 1,
+    idle_timeout: idleTimeout || 20,
+    connect_timeout: connectionTimeout || 10,
+    ssl,
+    onnotice: logger ? console.log : void 0
+  };
+  return {
+    connectionString,
+    connectionConfig
+  };
+}
+__name(parseConnectionInfo, "parseConnectionInfo");
+function parseRoleSchema(connectionString) {
+  try {
+    const url = new URL(connectionString);
+    const roleSchema = url.searchParams.get("schema") || "";
+    const sslModeRequired = url.searchParams.get("sslmode") === "require";
+    return {
+      roleSchema,
+      sslModeRequired
+    };
+  } catch {
+    return {
+      roleSchema: "",
+      sslModeRequired: false
+    };
+  }
+}
+__name(parseRoleSchema, "parseRoleSchema");
+
+// src/create-database.ts
+var _cachedRoleSchema = "";
+function _getRoleSchema() {
+  return _cachedRoleSchema;
+}
+__name(_getRoleSchema, "_getRoleSchema");
+function verifyDrizzlePatched() {
+  try {
+    const session2 = __require("drizzle-orm/postgres-js");
+    const ok = session2 && typeof session2.getAuthContextStore === "function" && typeof session2.runWithAuthContext === "function";
+    if (!ok) {
+      throw new Error("drizzle-orm \u672A\u68C0\u6D4B\u5230\u8865\u4E01\u5BFC\u51FA\uFF1AgetAuthContextStore/runWithAuthContext");
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`drizzle-orm \u8865\u4E01\u672A\u751F\u6548\u6216\u7248\u672C\u4E0D\u5339\u914D\uFF1A${reason}`);
+  }
+}
+__name(verifyDrizzlePatched, "verifyDrizzlePatched");
+function createDatabase(config) {
+  verifyDrizzlePatched();
+  const { roleSchema, sslModeRequired } = parseRoleSchema(config.connectionString);
+  _cachedRoleSchema = roleSchema;
+  const resolvedSsl = config.ssl || (sslModeRequired ? "require" : false);
+  const { connectionString, connectionConfig } = parseConnectionInfo(config.connectionString, {
+    maxConnections: config.maxConnections,
+    idleTimeout: config.idleTimeout,
+    connectionTimeout: config.connectionTimeout,
+    ssl: resolvedSsl,
+    logger: typeof config.logger === "boolean" ? config.logger : false
+  });
+  const sql = postgres(connectionString, connectionConfig);
+  const db = drizzle(sql, {
+    schema: config.schema,
+    logger: config.logger
+  });
+  return {
+    db,
+    close: /* @__PURE__ */ __name(async () => {
+      await sql.end();
+    }, "close")
+  };
+}
+__name(createDatabase, "createDatabase");
+
+// src/create-rls-middleware.ts
+import * as session from "drizzle-orm/postgres-js";
+function createRlsMiddleware(options) {
+  return /* @__PURE__ */ __name(function rlsMiddleware(req, _res, next) {
+    const roleSchema = options?.roleSchema ?? _getRoleSchema();
+    const userContext = req.userContext;
+    if (!userContext) {
+      return next();
+    }
+    const roles = (userContext.roles || []).join(",");
+    const userId = userContext.userId;
+    const isSystemAccount = userContext.isSystemAccount;
+    const userType = userContext.userType;
+    const sqls = [
+      userId ? `SET LOCAL app.user_id = '${userId}'` : `SET LOCAL app.user_id = ''`,
+      isSystemAccount ? `SET LOCAL ROLE 'service_role_${roleSchema}'` : userId ? `SET LOCAL ROLE 'authenticated_${roleSchema}'` : `SET LOCAL ROLE 'anon_${roleSchema}'`,
+      roles ? `SET LOCAL app.role_ids = '${roles}'` : `SET LOCAL app.role_ids = ''`,
+      userType ? `SET LOCAL app.user_type = '${userType}'` : `SET LOCAL app.user_type = ''`
+    ].filter(Boolean).join(";");
+    session.runWithAuthContext({
+      preSql: sqls
+    }, () => {
+      next();
+    });
+  }, "rlsMiddleware");
+}
+__name(createRlsMiddleware, "createRlsMiddleware");
+export {
+  createDatabase,
+  createRlsMiddleware
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/create-database.ts","../src/utils.ts","../src/create-rls-middleware.ts"],"sourcesContent":["import { drizzle } from 'drizzle-orm/postgres-js';\nimport postgres from 'postgres';\nimport { parseConnectionInfo, parseRoleSchema } from './utils';\nimport type { CreateDatabaseConfig, DatabaseInstance } from './types';\n\n// 模块级缓存，供 createRlsMiddleware 零参数调用时读取\nlet _cachedRoleSchema = '';\n\nexport function _getRoleSchema(): string {\n  return _cachedRoleSchema;\n}\n\nfunction verifyDrizzlePatched(): void {\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const session = require('drizzle-orm/postgres-js');\n    const ok =\n      session &&\n      typeof session.getAuthContextStore === 'function' &&\n      typeof session.runWithAuthContext === 'function';\n    if (!ok) {\n      throw new Error(\n        'drizzle-orm 未检测到补丁导出：getAuthContextStore/runWithAuthContext',\n      );\n    }\n  } catch (err) {\n    const reason = err instanceof Error ? err.message : String(err);\n    throw new Error(`drizzle-orm 补丁未生效或版本不匹配：${reason}`);\n  }\n}\n\nexport function createDatabase(config: CreateDatabaseConfig): DatabaseInstance {\n  verifyDrizzlePatched();\n\n  const { roleSchema, sslModeRequired } = parseRoleSchema(config.connectionString);\n  _cachedRoleSchema = roleSchema;\n\n  const resolvedSsl = config.ssl || (sslModeRequired ? 'require' : false);\n\n  const { connectionString, connectionConfig } = parseConnectionInfo(config.connectionString, {\n    maxConnections: config.maxConnections,\n    idleTimeout: config.idleTimeout,\n    connectionTimeout: config.connectionTimeout,\n    ssl: resolvedSsl,\n    logger: typeof config.logger === 'boolean' ? config.logger : false,\n  });\n\n  const sql = postgres(connectionString, connectionConfig);\n  const db = drizzle(sql, { schema: config.schema, logger: config.logger });\n\n  return {\n    db,\n    close: async () => {\n      await sql.end();\n    },\n  };\n}\n","import { type PostgresOptions } from './types';\n\ninterface ConnectionConfig {\n  maxConnections?: number;\n  idleTimeout?: number;\n  connectionTimeout?: number;\n  ssl?: PostgresOptions['ssl'];\n  logger?: boolean;\n}\n\nexport function parseConnectionInfo(connectionString: string, config?: ConnectionConfig) {\n  const { maxConnections, idleTimeout, connectionTimeout, ssl, logger } = config || {};\n\n  let parsedConfigFromUrl = null;\n  try {\n    parsedConfigFromUrl = new URL(connectionString);\n    const temp = new URL(connectionString);\n    temp.searchParams.delete('schema');\n    connectionString = temp.toString();\n  } catch (error) {\n    throw new Error('Failed to parse connection info');\n  }\n\n  const { username, password, hostname, port, pathname } = parsedConfigFromUrl;\n  const connectionConfig = {\n    username: decodeURIComponent(username),\n    password: decodeURIComponent(password),\n    host: [hostname] as unknown as string,\n    port: [parseInt(port) || 5432] as unknown as number,\n    pathname: decodeURIComponent(pathname),\n    max: maxConnections || 1,\n    idle_timeout: idleTimeout || 20,\n    connect_timeout: connectionTimeout || 10,\n    ssl,\n    onnotice: logger ? console.log : undefined,\n  };\n\n  return { connectionString, connectionConfig };\n}\n\nexport function parseRoleSchema(connectionString: string): { roleSchema: string; sslModeRequired: boolean } {\n  try {\n    const url = new URL(connectionString);\n    const roleSchema = url.searchParams.get('schema') || '';\n    const sslModeRequired = url.searchParams.get('sslmode') === 'require';\n    return { roleSchema, sslModeRequired };\n  } catch {\n    return { roleSchema: '', sslModeRequired: false };\n  }\n}\n","import { type Request, type Response, type NextFunction } from 'express';\nimport * as session from 'drizzle-orm/postgres-js';\nimport { _getRoleSchema } from './create-database';\nimport type { UserContext } from './types';\n\nexport interface RlsMiddlewareOptions {\n  roleSchema?: string;\n}\n\nexport function createRlsMiddleware(options?: RlsMiddlewareOptions) {\n  return function rlsMiddleware(req: Request, _res: Response, next: NextFunction) {\n    const roleSchema = options?.roleSchema ?? _getRoleSchema();\n    const userContext = (req as unknown as { userContext: UserContext }).userContext;\n\n    if (!userContext) {\n      return next();\n    }\n\n    const roles = (userContext.roles || []).join(',');\n    const userId = userContext.userId;\n    const isSystemAccount = userContext.isSystemAccount;\n    const userType = userContext.userType;\n\n    const sqls = [\n      userId\n        ? `SET LOCAL app.user_id = '${userId}'`\n        : `SET LOCAL app.user_id = ''`,\n      isSystemAccount\n        ? `SET LOCAL ROLE 'service_role_${roleSchema}'`\n        : userId\n          ? `SET LOCAL ROLE 'authenticated_${roleSchema}'`\n          : `SET LOCAL ROLE 'anon_${roleSchema}'`,\n      roles\n        ? `SET LOCAL app.role_ids = '${roles}'`\n        : `SET LOCAL app.role_ids = ''`,\n      userType\n        ? `SET LOCAL app.user_type = '${userType}'`\n        : `SET LOCAL app.user_type = ''`,\n    ]\n      .filter(Boolean)\n      .join(';');\n\n    (session as unknown as { runWithAuthContext: (store: { preSql: string }, fn: () => void) => void })\n      .runWithAuthContext({ preSql: sqls }, () => {\n        next();\n      });\n  };\n}\n"],"mappings":";;;;;;;;;;AAAA,SAASA,eAAe;AACxB,OAAOC,cAAc;;;ACSd,SAASC,oBAAoBC,kBAA0BC,QAAyB;AACrF,QAAM,EAAEC,gBAAgBC,aAAaC,mBAAmBC,KAAKC,OAAM,IAAKL,UAAU,CAAC;AAEnF,MAAIM,sBAAsB;AAC1B,MAAI;AACFA,0BAAsB,IAAIC,IAAIR,gBAAAA;AAC9B,UAAMS,OAAO,IAAID,IAAIR,gBAAAA;AACrBS,SAAKC,aAAaC,OAAO,QAAA;AACzBX,uBAAmBS,KAAKG,SAAQ;EAClC,SAASC,OAAO;AACd,UAAM,IAAIC,MAAM,iCAAA;EAClB;AAEA,QAAM,EAAEC,UAAUC,UAAUC,UAAUC,MAAMC,SAAQ,IAAKZ;AACzD,QAAMa,mBAAmB;IACvBL,UAAUM,mBAAmBN,QAAAA;IAC7BC,UAAUK,mBAAmBL,QAAAA;IAC7BM,MAAM;MAACL;;IACPC,MAAM;MAACK,SAASL,IAAAA,KAAS;;IACzBC,UAAUE,mBAAmBF,QAAAA;IAC7BK,KAAKtB,kBAAkB;IACvBuB,cAActB,eAAe;IAC7BuB,iBAAiBtB,qBAAqB;IACtCC;IACAsB,UAAUrB,SAASsB,QAAQC,MAAMC;EACnC;AAEA,SAAO;IAAE9B;IAAkBoB;EAAiB;AAC9C;AA5BgBrB;AA8BT,SAASgC,gBAAgB/B,kBAAwB;AACtD,MAAI;AACF,UAAMgC,MAAM,IAAIxB,IAAIR,gBAAAA;AACpB,UAAMiC,aAAaD,IAAItB,aAAawB,IAAI,QAAA,KAAa;AACrD,UAAMC,kBAAkBH,IAAItB,aAAawB,IAAI,SAAA,MAAe;AAC5D,WAAO;MAAED;MAAYE;IAAgB;EACvC,QAAQ;AACN,WAAO;MAAEF,YAAY;MAAIE,iBAAiB;IAAM;EAClD;AACF;AATgBJ;;;ADlChB,IAAIK,oBAAoB;AAEjB,SAASC,iBAAAA;AACd,SAAOD;AACT;AAFgBC;AAIhB,SAASC,uBAAAA;AACP,MAAI;AAEF,UAAMC,WAAUC,UAAQ,yBAAA;AACxB,UAAMC,KACJF,YACA,OAAOA,SAAQG,wBAAwB,cACvC,OAAOH,SAAQI,uBAAuB;AACxC,QAAI,CAACF,IAAI;AACP,YAAM,IAAIG,MACR,0GAAA;IAEJ;EACF,SAASC,KAAK;AACZ,UAAMC,SAASD,eAAeD,QAAQC,IAAIE,UAAUC,OAAOH,GAAAA;AAC3D,UAAM,IAAID,MAAM,uFAA2BE,MAAAA,EAAQ;EACrD;AACF;AAjBSR;AAmBF,SAASW,eAAeC,QAA4B;AACzDZ,uBAAAA;AAEA,QAAM,EAAEa,YAAYC,gBAAe,IAAKC,gBAAgBH,OAAOI,gBAAgB;AAC/ElB,sBAAoBe;AAEpB,QAAMI,cAAcL,OAAOM,QAAQJ,kBAAkB,YAAY;AAEjE,QAAM,EAAEE,kBAAkBG,iBAAgB,IAAKC,oBAAoBR,OAAOI,kBAAkB;IAC1FK,gBAAgBT,OAAOS;IACvBC,aAAaV,OAAOU;IACpBC,mBAAmBX,OAAOW;IAC1BL,KAAKD;IACLO,QAAQ,OAAOZ,OAAOY,WAAW,YAAYZ,OAAOY,SAAS;EAC/D,CAAA;AAEA,QAAMC,MAAMC,SAASV,kBAAkBG,gBAAAA;AACvC,QAAMQ,KAAKC,QAAQH,KAAK;IAAEI,QAAQjB,OAAOiB;IAAQL,QAAQZ,OAAOY;EAAO,CAAA;AAEvE,SAAO;IACLG;IACAG,OAAO,mCAAA;AACL,YAAML,IAAIM,IAAG;IACf,GAFO;EAGT;AACF;AAzBgBpB;;;AE9BhB,YAAYqB,aAAa;AAQlB,SAASC,oBAAoBC,SAA8B;AAChE,SAAO,gCAASC,cAAcC,KAAcC,MAAgBC,MAAkB;AAC5E,UAAMC,aAAaL,SAASK,cAAcC,eAAAA;AAC1C,UAAMC,cAAeL,IAAgDK;AAErE,QAAI,CAACA,aAAa;AAChB,aAAOH,KAAAA;IACT;AAEA,UAAMI,SAASD,YAAYC,SAAS,CAAA,GAAIC,KAAK,GAAA;AAC7C,UAAMC,SAASH,YAAYG;AAC3B,UAAMC,kBAAkBJ,YAAYI;AACpC,UAAMC,WAAWL,YAAYK;AAE7B,UAAMC,OAAO;MACXH,SACI,4BAA4BA,MAAAA,MAC5B;MACJC,kBACI,gCAAgCN,UAAAA,MAChCK,SACE,iCAAiCL,UAAAA,MACjC,wBAAwBA,UAAAA;MAC9BG,QACI,6BAA6BA,KAAAA,MAC7B;MACJI,WACI,8BAA8BA,QAAAA,MAC9B;MAEHE,OAAOC,OAAAA,EACPN,KAAK,GAAA;AAEPO,IACEC,2BAAmB;MAAEC,QAAQL;IAAK,GAAG,MAAA;AACpCT,WAAAA;IACF,CAAA;EACJ,GApCO;AAqCT;AAtCgBL;","names":["drizzle","postgres","parseConnectionInfo","connectionString","config","maxConnections","idleTimeout","connectionTimeout","ssl","logger","parsedConfigFromUrl","URL","temp","searchParams","delete","toString","error","Error","username","password","hostname","port","pathname","connectionConfig","decodeURIComponent","host","parseInt","max","idle_timeout","connect_timeout","onnotice","console","log","undefined","parseRoleSchema","url","roleSchema","get","sslModeRequired","_cachedRoleSchema","_getRoleSchema","verifyDrizzlePatched","session","require","ok","getAuthContextStore","runWithAuthContext","Error","err","reason","message","String","createDatabase","config","roleSchema","sslModeRequired","parseRoleSchema","connectionString","resolvedSsl","ssl","connectionConfig","parseConnectionInfo","maxConnections","idleTimeout","connectionTimeout","logger","sql","postgres","db","drizzle","schema","close","end","session","createRlsMiddleware","options","rlsMiddleware","req","_res","next","roleSchema","_getRoleSchema","userContext","roles","join","userId","isSystemAccount","userType","sqls","filter","Boolean","session","runWithAuthContext","preSql"]}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@lark-apaas/express-datapaas",
+  "version": "0.0.1",
+  "description": "Drizzle ORM + PostgreSQL with RLS support for Express",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "keywords": [
+    "plugin",
+    "express",
+    "server",
+    "typescript",
+    "drizzle",
+    "postgres"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "files": [
+    "dist",
+    "patches",
+    "scripts"
+  ],
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "postinstall": "npm run apply-patch",
+    "apply-patch": "node scripts/apply-patch.js",
+    "dev": "tsup --watch",
+    "clean": "rm -rf dist",
+    "lint": "eslint src/**/*.ts",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "patch-package": "^8.0.0",
+    "postgres": "^3.4.3"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/node": "^20.0.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.0.0",
+    "vitest": "^3.2.4"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "0.44.6",
+    "express": "^4.0.0 || ^5.0.0"
+  }
+}

package/patches/drizzle-orm+0.44.6.patch

@@ -0,0 +1,178 @@
+diff --git a/node_modules/drizzle-orm/postgres-js/session.cjs b/node_modules/drizzle-orm/postgres-js/session.cjs
+index dac222a..7708081 100644
+--- a/node_modules/drizzle-orm/postgres-js/session.cjs
++++ b/node_modules/drizzle-orm/postgres-js/session.cjs
+@@ -20,9 +20,12 @@ var session_exports = {};
+ __export(session_exports, {
+   PostgresJsPreparedQuery: () => PostgresJsPreparedQuery,
+   PostgresJsSession: () => PostgresJsSession,
+-  PostgresJsTransaction: () => PostgresJsTransaction
++  PostgresJsTransaction: () => PostgresJsTransaction,
++  getAuthContextStore: () => getAuthContextStore,
++  runWithAuthContext: () => runWithAuthContext,
+ });
+ module.exports = __toCommonJS(session_exports);
++var { AsyncLocalStorage } = require('node:async_hooks');
+ var import_core = require("../cache/core/index.cjs");
+ var import_entity = require("../entity.cjs");
+ var import_logger = require("../logger.cjs");
+@@ -31,10 +34,24 @@ var import_session = require("../pg-core/session.cjs");
+ var import_sql = require("../sql/sql.cjs");
+ var import_tracing = require("../tracing.cjs");
+ var import_utils = require("../utils.cjs");
++
++const asyncLocalStorage = new AsyncLocalStorage();
++
++function getAuthContextStore() {
++  return asyncLocalStorage.getStore();
++}
++
++function runWithAuthContext(store, fn) {
++  return asyncLocalStorage.run(store, fn);
++}
++
+ class PostgresJsPreparedQuery extends import_session.PgPreparedQuery {
+   constructor(client, queryString, params, logger, cache, queryMetadata, cacheConfig, fields, _isResponseInArrayMode, customResultMapper) {
+     super({ sql: queryString, params }, cache, queryMetadata, cacheConfig);
+     this.client = client;
++    const authContextStore = getAuthContextStore();
++    this.preSql = authContextStore?.preSql;
++    this.postSql = authContextStore?.postSql;
+     this.queryString = queryString;
+     this.params = params;
+     this.logger = logger;
+@@ -51,21 +68,103 @@ class PostgresJsPreparedQuery extends import_session.PgPreparedQuery {
+         "drizzle.query.params": JSON.stringify(params)
+       });
+       this.logger.logQuery(this.queryString, params);
+-      const { fields, queryString: query, client, joinsNotNullableMap, customResultMapper } = this;
++      const { fields, client, joinsNotNullableMap, customResultMapper, preSql, postSql } = this;
++      
++      // 在同一事务中依次执行：preSql（可选）→ 主查询 → postSql（可选）
++      if (preSql || postSql) {
++        return import_tracing.tracer.startActiveSpan("drizzle.driver.execute.transactional", async () => {
++          // 若当前不在事务中（client 有 begin 方法），则开启事务；否则复用当前事务
++          if (typeof client.begin === 'function') {
++            return client.begin(async (tx) => {
++              // 若存在 preSql，则执行
++              if (preSql) {
++                await import_tracing.tracer.startActiveSpan("drizzle.driver.execute.pre", () => tx.unsafe(preSql));
++              }
++              
++              // 执行主查询
++              let result;
++              if (!fields && !customResultMapper) {
++                result = await import_tracing.tracer.startActiveSpan("drizzle.driver.execute.main", () => {
++                  return this.queryWithCache(this.queryString, params, async () => {
++                    return await tx.unsafe(this.queryString, params);
++                  });
++                });
++              } else {
++                const rows = await import_tracing.tracer.startActiveSpan("drizzle.driver.execute.main", () => {
++                  span?.setAttributes({
++                    "drizzle.query.text": this.queryString,
++                    "drizzle.query.params": JSON.stringify(params)
++                  });
++                  return this.queryWithCache(this.queryString, params, async () => {
++                    return await tx.unsafe(this.queryString, params).values();
++                  });;
++                });
++                result = import_tracing.tracer.startActiveSpan("drizzle.mapResponse", () => {
++                  return customResultMapper ? customResultMapper(rows) : rows.map((row) => (0, import_utils.mapResultRow)(fields, row, joinsNotNullableMap));
++                });
++              }
++              
++              // 若存在 postSql，则执行
++              if (postSql) {
++                await import_tracing.tracer.startActiveSpan("drizzle.driver.execute.post", () => tx.unsafe(postSql));
++              }
++              
++              return result;
++            });
++          } else {
++            // 已在事务中，直接执行
++            // 若存在 preSql，则执行
++            if (preSql) {
++              await import_tracing.tracer.startActiveSpan("drizzle.driver.execute.pre", () => client.unsafe(preSql));
++            }
++            
++            // 执行主查询
++            let result;
++            if (!fields && !customResultMapper) {
++              result = await import_tracing.tracer.startActiveSpan("drizzle.driver.execute.main", () => {
++                return this.queryWithCache(this.queryString, params, async () => {
++                  return await client.unsafe(this.queryString, params);
++                });
++              });
++            } else {
++              const rows = await import_tracing.tracer.startActiveSpan("drizzle.driver.execute.main", () => {
++                span?.setAttributes({
++                  "drizzle.query.text": this.queryString,
++                  "drizzle.query.params": JSON.stringify(params)
++                });
++                return this.queryWithCache(this.queryString, params, async () => {
++                  return await client.unsafe(this.queryString, params).values();
++                });
++              });
++              result = import_tracing.tracer.startActiveSpan("drizzle.mapResponse", () => {
++                return customResultMapper ? customResultMapper(rows) : rows.map((row) => (0, import_utils.mapResultRow)(fields, row, joinsNotNullableMap));
++              });
++            }
++            
++            // 若存在 postSql，则执行
++            if (postSql) {
++              await import_tracing.tracer.startActiveSpan("drizzle.driver.execute.post", () => client.unsafe(postSql));
++            }
++            
++            return result;
++          }
++        });
++      }
++      // 单语句执行（原始逻辑）
+       if (!fields && !customResultMapper) {
+         return import_tracing.tracer.startActiveSpan("drizzle.driver.execute", () => {
+-          return this.queryWithCache(query, params, async () => {
+-            return await client.unsafe(query, params);
++          return this.queryWithCache(this.queryString, params, async () => {
++            return await client.unsafe(this.queryString, params);
+           });
+         });
+       }
+       const rows = await import_tracing.tracer.startActiveSpan("drizzle.driver.execute", () => {
+         span?.setAttributes({
+-          "drizzle.query.text": query,
++          "drizzle.query.text": this.queryString,
+           "drizzle.query.params": JSON.stringify(params)
+         });
+-        return this.queryWithCache(query, params, async () => {
+-          return await client.unsafe(query, params).values();
++        return this.queryWithCache(this.queryString, params, async () => {
++          return await client.unsafe(this.queryString, params).values();
+         });
+       });
+       return import_tracing.tracer.startActiveSpan("drizzle.mapResponse", () => {
+@@ -169,6 +268,8 @@ class PostgresJsTransaction extends import_pg_core.PgTransaction {
+ 0 && (module.exports = {
+   PostgresJsPreparedQuery,
+   PostgresJsSession,
+-  PostgresJsTransaction
++  PostgresJsTransaction,
++  getAuthContextStore,
++  runWithAuthContext,
+ });
+ //# sourceMappingURL=session.cjs.map
+
+diff --git a/node_modules/drizzle-orm/postgres-js/session.d.ts b/node_modules/drizzle-orm/postgres-js/session.d.ts
+index bccaa53..b07425b 100644
+--- a/node_modules/drizzle-orm/postgres-js/session.d.ts
++++ b/node_modules/drizzle-orm/postgres-js/session.d.ts
+@@ -58,3 +58,8 @@ export declare class PostgresJsTransaction<TFullSchema extends Record<string, un
+ export interface PostgresJsQueryResultHKT extends PgQueryResultHKT {
+     type: RowList<Assume<this['row'], Row>[]>;
+ }
++export interface RequestSessionContext {
++    preSql?: string;
++}
++export declare function getAuthContextStore(): RequestSessionContext | undefined;
++export declare function runWithAuthContext(store: RequestSessionContext, fn: () => void): void;
+

package/scripts/apply-patch.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { execSync } from "child_process";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const sdkRoot = path.resolve(__dirname, "..");
+const hostRoot = path.resolve(sdkRoot, "../../.."); // npm、yarn 场景下，安装在 node_modules/@lark-apaas/express-datapaas
+
+console.log(`[patch] Applying drizzle-orm patch at host: ${hostRoot}`);
+
+try {
+  execSync(
+    "npx patch-package --patch-dir node_modules/@lark-apaas/express-datapaas/patches",
+    { stdio: "inherit", cwd: hostRoot }
+  );
+  console.log("[patch] drizzle-orm patched ✅");
+} catch (err) {
+  console.error("[patch] Failed to apply drizzle-orm patch ❌", err);
+  process.exit(1);
+}