@mikro-orm/sql 7.1.16-dev.1 → 7.1.16-dev.11

package/AbstractSqlConnection.d.ts

@@ -1,5 +1,5 @@
 import { type ControlledTransaction, type Dialect, Kysely } from 'kysely';
-import { type AnyEntity, Connection, type Dictionary, type EntityData, type IsolationLevel, type LogContext, type LoggingOptions, type MaybePromise, type QueryResult, type RawQueryFragment, type Transaction, type TransactionEventBroadcaster } from '@mikro-orm/core';
+import { type AnyEntity, Connection, type Dictionary, type EntityData, type IsolationLevel, type LogContext, type LoggingOptions, type MaybePromise, type QueryResult, type RawQueryFragment, type SessionContext, type Transaction, type TransactionEventBroadcaster } from '@mikro-orm/core';
 import type { AbstractSqlPlatform } from './AbstractSqlPlatform.js';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
 /** Base class for SQL database connections, built on top of Kysely. */
@@ -36,6 +36,13 @@ export declare abstract class AbstractSqlConnection extends Connection {
     getClient<T = any>(): Kysely<T>;
     /** Ensures the Kysely client is initialized, creating it asynchronously if needed. */
     initClient(): Promise<void>;
+    /**
+     * Guards `getNativeClient()` overrides — drivers only capture their client while building their
+     * own dialect, which `driverOptions` carrying a ready-made Kysely instance or dialect skips.
+     *
+     * @internal
+     */
+    protected requireNativeClient<T>(client: T | undefined | null): T;
     /** Executes a callback within a transaction, committing on success and rolling back on error. */
     transactional<T>(cb: (trx: Transaction<ControlledTransaction<any, any>>) => Promise<T>, options?: {
         isolationLevel?: IsolationLevel;
@@ -43,6 +50,7 @@ export declare abstract class AbstractSqlConnection extends Connection {
         ctx?: ControlledTransaction<any>;
         eventBroadcaster?: TransactionEventBroadcaster;
         loggerContext?: LogContext;
+        sessionContext?: SessionContext;
     }): Promise<T>;
     /** Begins a new transaction or creates a savepoint if a transaction context already exists. */
     begin(options?: {
@@ -51,7 +59,17 @@ export declare abstract class AbstractSqlConnection extends Connection {
         ctx?: ControlledTransaction<any, any>;
         eventBroadcaster?: TransactionEventBroadcaster;
         loggerContext?: LogContext;
+        sessionContext?: SessionContext;
     }): Promise<ControlledTransaction<any, any>>;
+    /** Applies session variables (`set_config`) and role (`set local role`) for the current transaction. */
+    private applySessionContext;
+    /**
+     * Quotes a role name as a single PostgreSQL identifier. Unlike `platform.quoteIdentifier`, which treats a dot as a
+     * schema qualifier, a role like `my.role` must be quoted whole (`"my.role"`) with embedded quotes doubled.
+     */
+    protected static quoteRole(role: string): string;
+    /** Serializes a session variable for `set_config()`; `Date` values use ISO 8601 so casts like `::timestamptz` parse. */
+    protected stringifySessionVariable(value: unknown): string;
     /** Commits the transaction or releases the savepoint. */
     commit(ctx: ControlledTransaction<any, any>, eventBroadcaster?: TransactionEventBroadcaster, loggerContext?: LogContext): Promise<void>;
     /** Rolls back the transaction or rolls back to the savepoint. */
@@ -67,9 +85,9 @@ export declare abstract class AbstractSqlConnection extends Connection {
     private waitForIdleTransaction;
     private prepareQuery;
     /** Executes a SQL query and returns the result based on the method: `'all'` for rows, `'get'` for single row, `'run'` for affected count. */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[], method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[] | Dictionary<unknown>, method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
     /** Executes a SQL query and returns an async iterable that yields results row by row. */
-    stream<T extends EntityData<AnyEntity>>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[], ctx?: Transaction<Kysely<any>>, loggerContext?: LoggingOptions, chunkSize?: number): AsyncIterableIterator<T>;
+    stream<T extends EntityData<AnyEntity>>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[] | Dictionary<unknown>, ctx?: Transaction<Kysely<any>>, loggerContext?: LoggingOptions, chunkSize?: number): AsyncIterableIterator<T>;
     /** @inheritDoc */
     executeDump(dump: string): Promise<void>;
     protected getSql(query: string, formatted: string, context?: LogContext): string;

package/AbstractSqlConnection.js

@@ -1,5 +1,5 @@
 import { CompiledQuery, Kysely } from 'kysely';
-import { Connection, EventType, isRaw, Utils, } from '@mikro-orm/core';
+import { Connection, EventType, isRaw, raw, Utils, } from '@mikro-orm/core';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
 /**
  * Pulls cancellation controls out of a `loggerContext` payload, returning the abort options
@@ -101,6 +101,18 @@ export class AbstractSqlConnection extends Connection {
             await this.createKysely();
         }
     }
+    /**
+     * Guards `getNativeClient()` overrides — drivers only capture their client while building their
+     * own dialect, which `driverOptions` carrying a ready-made Kysely instance or dialect skips.
+     *
+     * @internal
+     */
+    requireNativeClient(client) {
+        if (client == null) {
+            throw new Error('The native client is not available, as it is owned by the Kysely instance or dialect passed via `driverOptions`. Access it through the object you provided there instead.');
+        }
+        return client;
+    }
     /** Executes a callback within a transaction, committing on success and rolling back on error. */
     async transactional(cb, options = {}) {
         const trx = await this.begin(options);
@@ -149,9 +161,43 @@ export class AbstractSqlConnection extends Connection {
         for (const query of this.platform.getBeginTransactionSQL(options)) {
             this.logQuery(query, options.loggerContext);
         }
+        if (options.sessionContext) {
+            try {
+                await this.applySessionContext(trx, options.sessionContext, options.loggerContext);
+            }
+            catch (e) {
+                // roll back the freshly opened transaction so the pooled connection is released, not leaked
+                await trx.rollback().execute();
+                this.logQuery(this.platform.getRollbackTransactionSQL(), options.loggerContext);
+                throw e;
+            }
+        }
         await options.eventBroadcaster?.dispatchEvent(EventType.afterTransactionStart, trx);
         return trx;
     }
+    /** Applies session variables (`set_config`) and role (`set local role`) for the current transaction. */
+    async applySessionContext(trx, sessionContext, loggerContext) {
+        const variables = Object.entries(sessionContext.variables ?? {});
+        if (variables.length > 0) {
+            const parts = variables.map(() => 'set_config(?, ?, true)').join(', ');
+            const params = variables.flatMap(([key, value]) => [key, this.stringifySessionVariable(value)]);
+            await this.execute(`select ${parts}`, params, 'run', trx, loggerContext);
+        }
+        if (sessionContext.role) {
+            await this.execute(`set local role ${AbstractSqlConnection.quoteRole(sessionContext.role)}`, [], 'run', trx, loggerContext);
+        }
+    }
+    /**
+     * Quotes a role name as a single PostgreSQL identifier. Unlike `platform.quoteIdentifier`, which treats a dot as a
+     * schema qualifier, a role like `my.role` must be quoted whole (`"my.role"`) with embedded quotes doubled.
+     */
+    static quoteRole(role) {
+        return `"${role.replaceAll('"', '""')}"`;
+    }
+    /** Serializes a session variable for `set_config()`; `Date` values use ISO 8601 so casts like `::timestamptz` parse. */
+    stringifySessionVariable(value) {
+        return value instanceof Date ? value.toISOString() : String(value);
+    }
     /** Commits the transaction or releases the savepoint. */
     async commit(ctx, eventBroadcaster, loggerContext) {
         if (ctx.isRolledBack) {
@@ -197,13 +243,17 @@ export class AbstractSqlConnection extends Connection {
         if (query instanceof NativeQueryBuilder) {
             query = query.toRaw();
         }
+        if (typeof query === 'string' && !Array.isArray(params)) {
+            // plain object params hold named parameters, translate them via the `raw()` helper
+            query = raw(query, params);
+        }
         if (isRaw(query)) {
             params = query.params;
             query = query.sql;
         }
         query = this.config.get('onQuery')(query, params);
         const formatted = this.platform.formatQuery(query, params);
-        return { query, params, formatted };
+        return { query, params: params, formatted };
     }
     /** Executes a SQL query and returns the result based on the method: `'all'` for rows, `'get'` for single row, `'run'` for affected count. */
     async execute(query, params = [], method = 'all', ctx, loggerContext) {
@@ -237,7 +287,7 @@ export class AbstractSqlConnection extends Connection {
                 .stream(compiled, chunkSize ?? 100, abort ? { signal: abort.signal } : undefined);
             this.logQuery(sql, {
                 sql,
-                params,
+                params: q.params,
                 ...cleanCtx,
                 affected: Utils.isPlainObject(res) ? res.affectedRows : undefined,
             });
@@ -248,7 +298,7 @@ export class AbstractSqlConnection extends Connection {
             }
         }
         catch (e) {
-            this.logQuery(sql, { sql, params, ...cleanCtx, level: 'error' });
+            this.logQuery(sql, { sql, params: q.params, ...cleanCtx, level: 'error' });
             throw e;
         }
     }

package/AbstractSqlDriver.d.ts

@@ -100,7 +100,7 @@ export declare abstract class AbstractSqlDriver<Connection extends AbstractSqlCo
      */
     private convertOwnerPksForPivotQuery;
     private getPivotOrderBy;
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[], method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[] | Dictionary, method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
     stream<T extends object>(entityName: EntityName<T>, where: FilterQuery<T>, options: StreamOptions<T, any, any, any>): AsyncIterableIterator<T>;
     /**
      * 1:1 owner side needs to be marked for population so QB auto-joins the owner id

package/AbstractSqlDriver.js

@@ -183,7 +183,9 @@ export class AbstractSqlDriver extends DatabaseDriver {
         if (typeof meta.expression === 'string') {
             return this.wrapVirtualExpressionInSubquery(meta, meta.expression, where, options, type);
         }
-        const em = this.createEntityManager();
+        // fork the caller EM so the callback inherits its filters, filter params and session context — a fork never
+        // resolves back to the ambient RequestContext EM, which would ignore the transaction/session context set below
+        const em = (options.em?.fork() ?? this.createEntityManager(false));
         em.setTransactionContext(options.ctx);
         const res = meta.expression(em, where, options);
         if (typeof res === 'string') {
@@ -209,7 +211,8 @@ export class AbstractSqlDriver extends DatabaseDriver {
             yield* this.wrapVirtualExpressionInSubqueryStream(meta, meta.expression, where, options, QueryType.SELECT);
             return;
         }
-        const em = this.createEntityManager();
+        // fork the caller EM for the same reason as in `findFromVirtual`
+        const em = (options.em?.fork() ?? this.createEntityManager(false));
         em.setTransactionContext(options.ctx);
         const res = meta.expression(em, where, options, true);
         if (typeof res === 'string') {
@@ -239,7 +242,17 @@ export class AbstractSqlDriver extends DatabaseDriver {
         const asKeyword = this.platform.usesAsKeyword() ? ' as ' : ' ';
         native.from(raw(`(${expression})${asKeyword}${this.platform.quoteIdentifier(qb.alias)}`));
         const query = native.compile();
-        const res = await this.execute(query.sql, query.params, 'all', options.ctx, withAbortContext(options.loggerContext, options));
+        const loggerContext = withAbortContext(options.loggerContext, options);
+        // virtual entities execute directly (not via QueryBuilder), so wrap in a short implicit transaction outside an
+        // existing one when a session context (row level security) needs to apply — mirrors the QueryBuilder wrap
+        const sessionContext = options.ctx ? undefined : options.em?.getTransactionSessionContext();
+        const conn = this.getConnection(this.resolveConnectionType(options));
+        const res = await (sessionContext
+            ? conn.transactional(trx => this.execute(query.sql, query.params, 'all', trx, loggerContext), {
+                sessionContext,
+                loggerContext,
+            })
+            : this.execute(query.sql, query.params, 'all', options.ctx, loggerContext));
         if (type === QueryType.COUNT) {
             return res[0].count;
         }
@@ -1333,7 +1346,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
             ],
             populateWhere: undefined,
             _populateWhere: 'infer',
-            populateFilter: this.wrapPopulateFilter(options, pivotProp2.name),
+            populateFilter: this.wrapPopulateFilter(options, pivotProp1.name),
         };
         if (pivotFindOptions._partitionLimit) {
             pivotFindOptions._partitionLimit.partitionBy = pivotProp2.name;

package/AbstractSqlPlatform.d.ts

@@ -1,4 +1,4 @@
-import { type RawQueryFragment, type Constructor, type EntityManager, type EntityRepository, type IDatabaseDriver, type IsolationLevel, type MikroORM, Platform } from '@mikro-orm/core';
+import { type RawQueryFragment, type Constructor, type EntityManager, type EntityProperty, type EntityRepository, type FormulaColumns, type IDatabaseDriver, type IsolationLevel, type MikroORM, Platform } from '@mikro-orm/core';
 import { SqlSchemaGenerator } from './schema/SqlSchemaGenerator.js';
 import { type SchemaHelper } from './schema/SchemaHelper.js';
 import type { IndexDef } from './typings.js';
@@ -17,6 +17,8 @@ export declare abstract class AbstractSqlPlatform extends Platform {
     getSchemaGenerator(driver: IDatabaseDriver, em?: EntityManager): SqlSchemaGenerator;
     /** @internal */
     createNativeQueryBuilder(): NativeQueryBuilder;
+    /** @inheritDoc */
+    getThroughRelationFormula(prop: EntityProperty, columns: FormulaColumns<any>): string;
     getBeginTransactionSQL(options?: {
         isolationLevel?: IsolationLevel;
         readOnly?: boolean;

package/AbstractSqlPlatform.js

@@ -1,4 +1,4 @@
-import { isRaw, JsonProperty, Platform, raw, Utils, } from '@mikro-orm/core';
+import { isRaw, JsonProperty, Platform, raw, Utils, ValidationError, } from '@mikro-orm/core';
 import { SqlEntityRepository } from './SqlEntityRepository.js';
 import { SqlSchemaGenerator } from './schema/SqlSchemaGenerator.js';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
@@ -39,6 +39,37 @@ export class AbstractSqlPlatform extends Platform {
     createNativeQueryBuilder() {
         return new NativeQueryBuilder(this);
     }
+    /** @inheritDoc */
+    getThroughRelationFormula(prop, columns) {
+        const through = prop.through;
+        const driver = this.config.getDriver();
+        const alias = `${prop.name}_through`;
+        const qb = driver.createQueryBuilder(through.entity, undefined, 'read', true, undefined, alias);
+        const throughMeta = driver.getMetadata().get(through.entity);
+        const ownerProp = throughMeta.properties[through.ownerProperty];
+        const ownerMeta = driver.getMetadata().get(ownerProp.target);
+        ownerProp.fieldNames.forEach((fieldName, idx) => {
+            const referencedColumn = ownerProp.referencedColumnNames[idx];
+            const referencedProp = ownerProp.referencedPKs
+                .map(name => ownerMeta.properties[name])
+                .find(p => p.fieldNames.includes(referencedColumn));
+            // the column mapping resolves the right alias even for TPT owners, only the column name may differ for composite FK properties
+            const ownerAlias = columns[referencedProp.name].slice(0, columns[referencedProp.name].lastIndexOf('.'));
+            qb.andWhere(raw('?? = ??', [`${alias}.${fieldName}`, `${ownerAlias}.${referencedColumn}`]));
+        });
+        if (through.where) {
+            qb.andWhere(through.where);
+        }
+        if (through.orderBy) {
+            qb.orderBy(through.orderBy);
+        }
+        qb.select(through.targetProperty ?? throughMeta.primaryKeys[0]).limit(1);
+        const sql = qb.getFormattedQuery();
+        if (Object.keys(qb.state.joins).length > 0) {
+            throw new ValidationError(`The 'where' and 'orderBy' options of the through relation ${prop.name} can only reference own columns of ${throughMeta.className}`);
+        }
+        return `(${sql})`;
+    }
     getBeginTransactionSQL(options) {
         if (options?.isolationLevel) {
             return [`set transaction isolation level ${options.isolationLevel}`, 'begin'];

package/README.md

@@ -24,6 +24,7 @@ npm install @mikro-orm/mysql        # MySQL
 npm install @mikro-orm/mariadb      # MariaDB
 npm install @mikro-orm/sqlite       # SQLite
 npm install @mikro-orm/libsql       # libSQL / Turso
+npm install @mikro-orm/sql-js       # sql.js (in-memory SQLite in WASM)
 npm install @mikro-orm/mongodb      # MongoDB
 npm install @mikro-orm/mssql        # MS SQL Server
 npm install @mikro-orm/oracledb     # Oracle

package/SqlEntityManager.d.ts

@@ -60,14 +60,14 @@ export declare class SqlEntityManager<Driver extends AbstractSqlDriver = Abstrac
      * `signal` / `inflightQueryAbortStrategy` (set via `em.fork({ signal })`) is applied automatically.
      * For per-call cancellation use the options-bag overload below.
      */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[], method?: 'all' | 'get' | 'run', loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[] | Dictionary, method?: 'all' | 'get' | 'run', loggerContext?: LoggingOptions): Promise<T>;
     /**
      * Executes a raw SQL query with an options bag carrying `method`, `loggerContext`, `signal`
      * and `inflightQueryAbortStrategy`. Per-call `signal` / `inflightQueryAbortStrategy` override
      * the fork-level defaults set via `em.fork({ signal })`. The current transaction context is
      * applied automatically.
      */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params: any[], options: EmExecuteOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params: any[] | Dictionary, options: EmExecuteOptions): Promise<T>;
     /**
      * @inheritDoc
      */

package/SqlEntityManager.js

@@ -68,7 +68,7 @@ export class SqlEntityManager extends EntityManager {
             merged.signal = opts.signal ?? fork?.signal;
             merged.inflightQueryAbortStrategy = opts.inflightQueryAbortStrategy ?? fork?.inflightQueryAbortStrategy;
         }
-        return this.getDriver().execute(query, params, opts.method ?? 'all', context.getTransactionContext(), merged);
+        return context.withSessionContext(context.getTransactionContext(), ctx => this.getDriver().execute(query, params, opts.method ?? 'all', ctx, merged));
     }
     /**
      * @inheritDoc

package/dialects/mysql/BaseMySqlPlatform.d.ts

@@ -14,6 +14,8 @@ export declare class BaseMySqlPlatform extends AbstractSqlPlatform {
         readonly "desc nulls first": 'is not null';
         readonly "desc nulls last": 'is null';
     };
+    /** mysql and mariadb treat null as the lowest value when no placement is requested. */
+    sortsNullsLowest(): boolean;
     supportsMultiColumnCountDistinct(): boolean;
     /** @internal */
     createNativeQueryBuilder(): MySqlNativeQueryBuilder;

package/dialects/mysql/BaseMySqlPlatform.js

@@ -18,6 +18,10 @@ export class BaseMySqlPlatform extends AbstractSqlPlatform {
         [QueryOrder.desc_nulls_first]: 'is not null',
         [QueryOrder.desc_nulls_last]: 'is null',
     };
+    /** mysql and mariadb treat null as the lowest value when no placement is requested. */
+    sortsNullsLowest() {
+        return true;
+    }
     supportsMultiColumnCountDistinct() {
         return true;
     }

package/dialects/postgresql/BasePostgreSqlPlatform.d.ts

@@ -16,6 +16,8 @@ export declare class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     getEnumArrayCheckConstraintExpression(column: string, items: string[]): string;
     supportsMaterializedViews(): boolean;
     supportsPartitionedTables(): boolean;
+    supportsRowLevelSecurity(): boolean;
+    getCurrentSettingCast(mappedType: Type<unknown>): string | null;
     supportsCustomPrimaryKeyNames(): boolean;
     getCurrentTimestampSQL(length: number): string;
     getDateTimeTypeDeclarationSQL(column: {

package/dialects/postgresql/BasePostgreSqlPlatform.js

@@ -1,4 +1,4 @@
-import { ALIAS_REPLACEMENT, ARRAY_OPERATORS, raw, RawQueryFragment, Type, Utils, } from '@mikro-orm/core';
+import { ALIAS_REPLACEMENT, ARRAY_OPERATORS, BigIntType, BooleanType, DateTimeType, DateType, EnumType, IntegerType, raw, RawQueryFragment, SmallIntType, StringType, TextType, TimeType, TinyIntType, Type, Utils, UuidType, } from '@mikro-orm/core';
 import { AbstractSqlPlatform } from '../../AbstractSqlPlatform.js';
 import { PostgreSqlNativeQueryBuilder } from './PostgreSqlNativeQueryBuilder.js';
 import { PostgreSqlSchemaHelper } from './PostgreSqlSchemaHelper.js';
@@ -33,6 +33,38 @@ export class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     supportsPartitionedTables() {
         return true;
     }
+    supportsRowLevelSecurity() {
+        return true;
+    }
+    getCurrentSettingCast(mappedType) {
+        if (mappedType instanceof UuidType) {
+            return '::uuid';
+        }
+        if (mappedType instanceof BigIntType) {
+            return '::bigint';
+        }
+        // MediumIntType extends IntegerType, so it is covered here too
+        if (mappedType instanceof IntegerType || mappedType instanceof SmallIntType || mappedType instanceof TinyIntType) {
+            return '::int';
+        }
+        if (mappedType instanceof BooleanType) {
+            return '::boolean';
+        }
+        if (mappedType instanceof DateTimeType) {
+            return '::timestamptz';
+        }
+        if (mappedType instanceof DateType) {
+            return '::date';
+        }
+        if (mappedType instanceof TimeType) {
+            return '::time';
+        }
+        // current_setting() returns text already, so string-compatible types need no cast (CharacterType extends StringType)
+        if (mappedType instanceof StringType || mappedType instanceof TextType || mappedType instanceof EnumType) {
+            return '';
+        }
+        return null;
+    }
     supportsCustomPrimaryKeyNames() {
         return true;
     }

package/dialects/postgresql/PostgreSqlExceptionConverter.js

@@ -1,4 +1,4 @@
-import { DeadlockException, ExceptionConverter, ForeignKeyConstraintViolationException, InvalidFieldNameException, NonUniqueFieldNameException, NotNullConstraintViolationException, SyntaxErrorException, TableExistsException, TableNotFoundException, UniqueConstraintViolationException, CheckConstraintViolationException, } from '@mikro-orm/core';
+import { DeadlockException, ExceptionConverter, ForeignKeyConstraintViolationException, InvalidFieldNameException, NonUniqueFieldNameException, NotNullConstraintViolationException, RowLevelSecurityViolationException, SyntaxErrorException, TableExistsException, TableNotFoundException, UniqueConstraintViolationException, CheckConstraintViolationException, } from '@mikro-orm/core';
 export class PostgreSqlExceptionConverter extends ExceptionConverter {
     /**
      * @see http://www.postgresql.org/docs/9.4/static/errcodes-appendix.html
@@ -31,6 +31,13 @@ export class PostgreSqlExceptionConverter extends ExceptionConverter {
                 return new UniqueConstraintViolationException(exception);
             case '23514':
                 return new CheckConstraintViolationException(exception);
+            case '42501':
+                // 42501 is generic insufficient_privilege; only RLS write violations carry this message — the `routine`
+                // field covers servers with a non-english `lc_messages`, where the message check cannot match
+                if (exception.message.includes('row-level security policy') || exception.routine === 'ExecWithCheckOptions') {
+                    return new RowLevelSecurityViolationException(exception);
+                }
+                break;
             case '42601':
                 return new SyntaxErrorException(exception);
             case '42702':

package/dialects/postgresql/PostgreSqlSchemaHelper.d.ts

@@ -1,7 +1,7 @@
 import { type Dictionary, type Transaction } from '@mikro-orm/core';
 import { SchemaHelper } from '../../schema/SchemaHelper.js';
 import type { AbstractSqlConnection } from '../../AbstractSqlConnection.js';
-import type { CheckDef, Column, ForeignKey, IndexDef, Table, TableDifference, TablePartitioning, SqlTriggerDef, SqlRoutineDef } from '../../typings.js';
+import type { CheckDef, Column, ForeignKey, IndexDef, Table, TableDifference, TablePartitioning, SqlPolicyDef, SqlTriggerDef, SqlRoutineDef } from '../../typings.js';
 import type { DatabaseSchema } from '../../schema/DatabaseSchema.js';
 import type { DatabaseTable } from '../../schema/DatabaseTable.js';
 export declare class PostgreSqlSchemaHelper extends SchemaHelper {
@@ -71,6 +71,17 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
     dropTrigger(table: DatabaseTable, trigger: SqlTriggerDef): string;
     /** Flattens `;\n` inside the dollar-quoted blocks of a raw DDL expression, which are not statement boundaries. */
     private flattenDollarQuotedBodies;
+    getRlsCreateSQL(table: DatabaseTable): string[];
+    getRlsDropSQL(diff: TableDifference, safe?: boolean): string[];
+    getRlsAlterSQL(diff: TableDifference, safe?: boolean): string[];
+    /**
+     * Quotes a policy or role name as a single identifier. Unlike `quote()`/`platform.quoteIdentifier`, which treat
+     * a dot as a schema qualifier, these names are never schema-qualified, so `my.role` must render as `"my.role"`.
+     */
+    private quoteUnqualified;
+    private createPolicy;
+    private dropPolicy;
+    private formatPolicyRoles;
     createRoutine(routine: SqlRoutineDef): string;
     dropRoutine(routine: SqlRoutineDef): string;
     getAllRoutines(connection: AbstractSqlConnection, schemas?: string[]): Promise<SqlRoutineDef[]>;
@@ -87,6 +98,12 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
     getDatabaseCollation(connection: AbstractSqlConnection, ctx?: Transaction): Promise<string | undefined>;
     getAllTriggers(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>): Promise<Dictionary<SqlTriggerDef[]>>;
     private getTriggersSQL;
+    getAllPolicies(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>, ctx?: Transaction): Promise<Dictionary<{
+        policies: SqlPolicyDef[];
+        enabled: boolean;
+        forced: boolean;
+    }>>;
+    private parsePgRoles;
     getAllForeignKeys(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>, ctx?: Transaction): Promise<Dictionary<Dictionary<ForeignKey>>>;
     getNativeEnumDefinitions(connection: AbstractSqlConnection, schemas: string[], ctx?: Transaction): Promise<Dictionary<{
         name: string;

package/dialects/postgresql/PostgreSqlSchemaHelper.js

@@ -162,6 +162,7 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
         const fks = await this.getAllForeignKeys(connection, tablesBySchema, ctx);
         const partitionings = await this.getPartitions(connection, tablesBySchema, ctx);
         const triggers = await this.getAllTriggers(connection, tablesBySchema);
+        const policies = await this.getAllPolicies(connection, tablesBySchema, ctx);
         const dbCollation = await this.getDatabaseCollation(connection, ctx);
         for (const t of tables) {
             const key = this.getTableKey(t);
@@ -175,6 +176,12 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
             if (triggers[key]) {
                 table.setTriggers(triggers[key]);
             }
+            const rls = policies[key];
+            if (rls) {
+                table.setPolicies(rls.policies);
+                table.rlsEnabled = rls.enabled;
+                table.rlsForced = rls.forced;
+            }
             table.setPartitioning(partitionings[key]);
         }
     }
@@ -540,6 +547,83 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
         })
             .join('');
     }
+    getRlsCreateSQL(table) {
+        const ret = [];
+        if (table.rlsEnabled) {
+            ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+        }
+        if (table.rlsForced) {
+            ret.push(`alter table ${table.getQuotedName()} force row level security`);
+        }
+        for (const policy of table.getPolicies()) {
+            ret.push(this.createPolicy(table, policy));
+        }
+        return ret;
+    }
+    getRlsDropSQL(diff, safe) {
+        // a policy expression holds a dependency on the columns it references, so removed policies (including the
+        // old version of changed ones) must be dropped before the column drops emitted later in the diff;
+        // in safe mode only recreated policies (present in both removed + added) are dropped, so a policy that is
+        // merely removed is left untouched like removed triggers/columns
+        return Object.values(diff.removedPolicies)
+            .filter(policy => !safe || policy.name in diff.addedPolicies)
+            .map(policy => this.dropPolicy(diff.toTable, policy));
+    }
+    getRlsAlterSQL(diff, safe) {
+        const ret = [];
+        const table = diff.toTable;
+        if (diff.changedRlsEnabled === true) {
+            ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+        }
+        if (diff.changedRlsForced === true) {
+            ret.push(`alter table ${table.getQuotedName()} force row level security`);
+        }
+        else if (!safe && diff.changedRlsForced === false) {
+            ret.push(`alter table ${table.getQuotedName()} no force row level security`);
+        }
+        for (const policy of Object.values(diff.addedPolicies)) {
+            ret.push(this.createPolicy(table, policy));
+        }
+        // disable only after its policies are gone (removed ones were dropped via `getRlsDropSQL`); skipped in
+        // safe mode so a safe run never lifts row level security off an existing table
+        if (!safe && diff.changedRlsEnabled === false) {
+            ret.push(`alter table ${table.getQuotedName()} disable row level security`);
+        }
+        return ret;
+    }
+    /**
+     * Quotes a policy or role name as a single identifier. Unlike `quote()`/`platform.quoteIdentifier`, which treat
+     * a dot as a schema qualifier, these names are never schema-qualified, so `my.role` must render as `"my.role"`.
+     */
+    quoteUnqualified(name) {
+        return `"${name.replaceAll('"', '""')}"`;
+    }
+    createPolicy(table, policy) {
+        const parts = [`create policy ${this.quoteUnqualified(policy.name)} on ${table.getQuotedName()}`];
+        if (policy.type === 'restrictive') {
+            parts.push('as restrictive');
+        }
+        if (policy.command !== 'all') {
+            parts.push(`for ${policy.command}`);
+        }
+        if (policy.roles.length > 0) {
+            parts.push(`to ${this.formatPolicyRoles(policy.roles)}`);
+        }
+        if (policy.using) {
+            parts.push(`using (${policy.using})`);
+        }
+        if (policy.check) {
+            parts.push(`with check (${policy.check})`);
+        }
+        return parts.join(' ');
+    }
+    dropPolicy(table, policy) {
+        return `drop policy ${this.quoteUnqualified(policy.name)} on ${table.getQuotedName()}`;
+    }
+    // `public` is a keyword and must stay unquoted; other roles are quoted like any identifier
+    formatPolicyRoles(roles) {
+        return roles.map(role => (role === 'public' ? 'public' : this.quoteUnqualified(role))).join(', ');
+    }
     createRoutine(routine) {
         if (routine.expression) {
             return this.flattenDollarQuotedBodies(routine.expression);
@@ -732,6 +816,56 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
     where (${conditions.join(' or ')})
     order by t.trigger_name, t.event_manipulation`;
     }
+    async getAllPolicies(connection, tablesBySchemas, ctx) {
+        const conditionsFor = (schemaColumn, tableColumn) => [...tablesBySchemas.entries()].map(([schema, tables]) => {
+            const names = tables.map(t => this.platform.quoteValue(t.table_name)).join(', ');
+            const schemaName = this.platform.quoteValue(schema ?? this.platform.getDefaultSchemaName());
+            return `(${schemaColumn} = ${schemaName} and ${tableColumn} in (${names}))`;
+        });
+        const flagConditions = conditionsFor('ns.nspname', 'cls.relname');
+        const policyConditions = conditionsFor('schemaname', 'tablename');
+        // pg_class carries the enable/force flags (a table can enable RLS with zero policies)
+        const flagRows = await connection.execute(`select cls.relname as table_name, ns.nspname as schema_name, cls.relrowsecurity as enabled, cls.relforcerowsecurity as forced
+        from pg_class cls
+        join pg_namespace ns on ns.oid = cls.relnamespace
+        where (${flagConditions.join(' or ')})`, [], 'all', ctx);
+        const policyRows = await connection.execute(`select tablename as table_name, schemaname as schema_name, policyname as name, permissive, roles, cmd, qual, with_check
+        from pg_policies
+        where (${policyConditions.join(' or ')})
+        order by policyname`, [], 'all', ctx);
+        const policiesByTable = {};
+        for (const row of policyRows) {
+            const key = this.getTableKey(row);
+            (policiesByTable[key] ??= []).push({
+                name: row.name,
+                command: row.cmd.toLowerCase(),
+                type: row.permissive === 'PERMISSIVE' ? 'permissive' : 'restrictive',
+                roles: this.parsePgRoles(row.roles),
+                using: row.qual ?? undefined,
+                check: row.with_check ?? undefined,
+            });
+        }
+        const ret = {};
+        for (const row of flagRows) {
+            const key = this.getTableKey(row);
+            ret[key] = { policies: policiesByTable[key] ?? [], enabled: row.enabled, forced: row.forced };
+        }
+        return ret;
+    }
+    // node-postgres returns `pg_policies.roles` as an unparsed array literal (`{public}`), pglite as an array
+    parsePgRoles(value) {
+        if (Array.isArray(value)) {
+            return value;
+        }
+        // tokenize the array literal instead of splitting on commas — quoted role names can contain
+        // commas, and quoted elements escape `"` and `\` with a backslash
+        const roles = [];
+        const re = /"((?:[^"\\]|\\.)*)"|[^,]+/g;
+        for (const match of value.replace(/^\{|\}$/g, '').matchAll(re)) {
+            roles.push(match[1] != null ? match[1].replace(/\\(.)/g, '$1') : match[0]);
+        }
+        return roles;
+    }
     async getAllForeignKeys(connection, tablesBySchemas, ctx) {
         const sql = `select nsp1.nspname schema_name, cls1.relname table_name, nsp2.nspname referenced_schema_name,
       cls2.relname referenced_table_name, a.attname column_name, af.attname referenced_column_name, conname constraint_name,
@@ -966,6 +1100,24 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
             for (const { table: localTable, foreignKey } of inboundForeignKeys) {
                 this.append(ret, this.createForeignKey(localTable, foreignKey));
             }
+            // re-enable row level security and recreate the policies (createTable skips them during a rebuild);
+            // emitted after the data copy so `force row level security` can't block the owner's insert
+            this.append(ret, this.getRlsCreateSQL(table));
+            // with `ignorePolicies`, hand-written policies (and the RLS flags they imply) may exist only on the
+            // introspected side — recreate them verbatim, or the rebuild would silently strip them
+            if (this.options.ignorePolicies) {
+                if (diff.fromTable.rlsEnabled && !table.rlsEnabled) {
+                    ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+                }
+                if (diff.fromTable.rlsForced && !table.rlsForced) {
+                    ret.push(`alter table ${table.getQuotedName()} force row level security`);
+                }
+                for (const policy of diff.fromTable.getPolicies()) {
+                    if (!table.hasPolicy(policy.name)) {
+                        ret.push(this.createPolicy(table, policy));
+                    }
+                }
+            }
         }
         if (safe) {
             ret.push(`-- safe mode: original tables kept in schema "${tmpSchema}"; drop that schema manually once the data is verified`);