@mikro-orm/sql 7.1.16-dev.1 → 7.1.16-dev.11

package/schema/SqlSchemaGenerator.js

@@ -94,6 +94,10 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
                 this.append(ret, fks, true);
             }
         }
+        // RLS policies are deferred until every table exists, so a policy expression can reference another table
+        for (const table of toSchema.getTables()) {
+            this.append(ret, this.helper.getRlsCreateSQL(table));
+        }
         const sortedViews = this.sortViewsByDependencies(toSchema.getViews());
         for (const view of sortedViews) {
             this.appendViewCreation(ret, view);
@@ -351,6 +355,7 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
                 for (const trigger of newTable.getTriggers()) {
                     this.append(sql, this.helper.createTrigger(newTable, trigger));
                 }
+                this.append(sql, this.helper.getRlsCreateSQL(newTable));
                 this.append(ret, sql, true);
             }
         }
@@ -410,6 +415,9 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
     }
     preAlterTable(diff, safe) {
         const ret = [];
+        // removed/changed policies must be dropped before any column type alter, including the pre-alter
+        // uuid-to-text cast on postgres — a policy expression blocks type changes on the columns it references
+        this.append(ret, this.helper.getRlsDropSQL(diff, safe));
         this.append(ret, this.helper.getPreAlterTable(diff, safe));
         for (const foreignKey of Object.values(diff.removedForeignKeys)) {
             ret.push(this.helper.dropForeignKey(diff.toTable.getShortestName(), foreignKey.constraintName));

package/typings.d.ts

@@ -114,6 +114,15 @@ export interface CheckDef<T = unknown> {
     definition?: string;
     columnName?: string;
 }
+/** Resolved row level security policy for schema operations (all callbacks resolved to strings). */
+export interface SqlPolicyDef {
+    name: string;
+    command: 'select' | 'insert' | 'update' | 'delete' | 'all';
+    type: 'permissive' | 'restrictive';
+    roles: string[];
+    using?: string;
+    check?: string;
+}
 /** Resolved trigger definition for schema operations (all callbacks resolved to strings). */
 export interface SqlTriggerDef {
     name: string;
@@ -191,6 +200,13 @@ export interface TableDifference {
     addedTriggers: Dictionary<SqlTriggerDef>;
     changedTriggers: Dictionary<SqlTriggerDef>;
     removedTriggers: Dictionary<SqlTriggerDef>;
+    addedPolicies: Dictionary<SqlPolicyDef>;
+    /** Changed policies surface as `removedPolicies` + `addedPolicies` pairs (drop + recreate). */
+    removedPolicies: Dictionary<SqlPolicyDef>;
+    /** New RLS enable state, present only when it changed. */
+    changedRlsEnabled?: boolean;
+    /** New RLS force state, present only when it changed. */
+    changedRlsForced?: boolean;
     addedForeignKeys: Dictionary<ForeignKey>;
     changedForeignKeys: Dictionary<ForeignKey>;
     removedForeignKeys: Dictionary<ForeignKey>;