@mikro-orm/sql 7.2.0-dev.13 → 7.2.0-dev.15

package/AbstractSqlConnection.d.ts

@@ -1,5 +1,5 @@
 import { type ControlledTransaction, type Dialect, Kysely } from 'kysely';
-import { type AnyEntity, Connection, type Dictionary, type EntityData, type IsolationLevel, type LogContext, type LoggingOptions, type MaybePromise, type QueryResult, type RawQueryFragment, type Transaction, type TransactionEventBroadcaster } from '@mikro-orm/core';
+import { type AnyEntity, Connection, type Dictionary, type EntityData, type IsolationLevel, type LogContext, type LoggingOptions, type MaybePromise, type QueryResult, type RawQueryFragment, type SessionContext, type Transaction, type TransactionEventBroadcaster } from '@mikro-orm/core';
 import type { AbstractSqlPlatform } from './AbstractSqlPlatform.js';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
 /** Base class for SQL database connections, built on top of Kysely. */
@@ -50,6 +50,7 @@ export declare abstract class AbstractSqlConnection extends Connection {
         ctx?: ControlledTransaction<any>;
         eventBroadcaster?: TransactionEventBroadcaster;
         loggerContext?: LogContext;
+        sessionContext?: SessionContext;
     }): Promise<T>;
     /** Begins a new transaction or creates a savepoint if a transaction context already exists. */
     begin(options?: {
@@ -58,7 +59,17 @@ export declare abstract class AbstractSqlConnection extends Connection {
         ctx?: ControlledTransaction<any, any>;
         eventBroadcaster?: TransactionEventBroadcaster;
         loggerContext?: LogContext;
+        sessionContext?: SessionContext;
     }): Promise<ControlledTransaction<any, any>>;
+    /** Applies session variables (`set_config`) and role (`set local role`) for the current transaction. */
+    private applySessionContext;
+    /**
+     * Quotes a role name as a single PostgreSQL identifier. Unlike `platform.quoteIdentifier`, which treats a dot as a
+     * schema qualifier, a role like `my.role` must be quoted whole (`"my.role"`) with embedded quotes doubled.
+     */
+    protected static quoteRole(role: string): string;
+    /** Serializes a session variable for `set_config()`; `Date` values use ISO 8601 so casts like `::timestamptz` parse. */
+    protected stringifySessionVariable(value: unknown): string;
     /** Commits the transaction or releases the savepoint. */
     commit(ctx: ControlledTransaction<any, any>, eventBroadcaster?: TransactionEventBroadcaster, loggerContext?: LogContext): Promise<void>;
     /** Rolls back the transaction or rolls back to the savepoint. */

package/AbstractSqlConnection.js

@@ -161,9 +161,43 @@ export class AbstractSqlConnection extends Connection {
         for (const query of this.platform.getBeginTransactionSQL(options)) {
             this.logQuery(query, options.loggerContext);
         }
+        if (options.sessionContext) {
+            try {
+                await this.applySessionContext(trx, options.sessionContext, options.loggerContext);
+            }
+            catch (e) {
+                // roll back the freshly opened transaction so the pooled connection is released, not leaked
+                await trx.rollback().execute();
+                this.logQuery(this.platform.getRollbackTransactionSQL(), options.loggerContext);
+                throw e;
+            }
+        }
         await options.eventBroadcaster?.dispatchEvent(EventType.afterTransactionStart, trx);
         return trx;
     }
+    /** Applies session variables (`set_config`) and role (`set local role`) for the current transaction. */
+    async applySessionContext(trx, sessionContext, loggerContext) {
+        const variables = Object.entries(sessionContext.variables ?? {});
+        if (variables.length > 0) {
+            const parts = variables.map(() => 'set_config(?, ?, true)').join(', ');
+            const params = variables.flatMap(([key, value]) => [key, this.stringifySessionVariable(value)]);
+            await this.execute(`select ${parts}`, params, 'run', trx, loggerContext);
+        }
+        if (sessionContext.role) {
+            await this.execute(`set local role ${AbstractSqlConnection.quoteRole(sessionContext.role)}`, [], 'run', trx, loggerContext);
+        }
+    }
+    /**
+     * Quotes a role name as a single PostgreSQL identifier. Unlike `platform.quoteIdentifier`, which treats a dot as a
+     * schema qualifier, a role like `my.role` must be quoted whole (`"my.role"`) with embedded quotes doubled.
+     */
+    static quoteRole(role) {
+        return `"${role.replaceAll('"', '""')}"`;
+    }
+    /** Serializes a session variable for `set_config()`; `Date` values use ISO 8601 so casts like `::timestamptz` parse. */
+    stringifySessionVariable(value) {
+        return value instanceof Date ? value.toISOString() : String(value);
+    }
     /** Commits the transaction or releases the savepoint. */
     async commit(ctx, eventBroadcaster, loggerContext) {
         if (ctx.isRolledBack) {

package/AbstractSqlDriver.d.ts

@@ -118,13 +118,6 @@ export declare abstract class AbstractSqlDriver<Connection extends AbstractSqlCo
     mergeJoinedResult<T extends object>(rawResults: EntityData<T>[], meta: EntityMetadata<T>, joinedProps: PopulateOptions<T>[]): EntityData<T>[];
     protected shouldHaveColumn<T, U>(meta: EntityMetadata<T>, prop: EntityProperty<U>, populate: readonly PopulateOptions<U>[], fields?: readonly InternalField<U>[], exclude?: readonly InternalField<U>[]): boolean;
     protected getFieldsForJoinedLoad<T extends object>(qb: AnyQueryBuilder<T>, meta: EntityMetadata<T>, options: FieldsForJoinedLoadOptions<T>): InternalField<T>[];
-    /**
-     * Walks the TPT inheritance chain of `leafMeta` and INNER JOINs each parent table.
-     * Registers the parent aliases in `qb.state.tptAlias` so column resolution finds them
-     * when filter conditions reference parent-table columns.
-     * @internal
-     */
-    protected addTPTParentJoinsForRelation<T extends object>(qb: AnyQueryBuilder<T>, leafMeta: EntityMetadata, leafAlias: string, basePath: string): void;
     /**
      * Adds LEFT JOINs and fields for TPT polymorphic loading when populating a relation to a TPT base class.
      * @internal

package/AbstractSqlDriver.js

@@ -183,7 +183,9 @@ export class AbstractSqlDriver extends DatabaseDriver {
         if (typeof meta.expression === 'string') {
             return this.wrapVirtualExpressionInSubquery(meta, meta.expression, where, options, type);
         }
-        const em = this.createEntityManager();
+        // fork the caller EM so the callback inherits its filters, filter params and session context — a fork never
+        // resolves back to the ambient RequestContext EM, which would ignore the transaction/session context set below
+        const em = (options.em?.fork() ?? this.createEntityManager(false));
         em.setTransactionContext(options.ctx);
         const res = meta.expression(em, where, options);
         if (typeof res === 'string') {
@@ -209,7 +211,8 @@ export class AbstractSqlDriver extends DatabaseDriver {
             yield* this.wrapVirtualExpressionInSubqueryStream(meta, meta.expression, where, options, QueryType.SELECT);
             return;
         }
-        const em = this.createEntityManager();
+        // fork the caller EM for the same reason as in `findFromVirtual`
+        const em = (options.em?.fork() ?? this.createEntityManager(false));
         em.setTransactionContext(options.ctx);
         const res = meta.expression(em, where, options, true);
         if (typeof res === 'string') {
@@ -239,7 +242,17 @@ export class AbstractSqlDriver extends DatabaseDriver {
         const asKeyword = this.platform.usesAsKeyword() ? ' as ' : ' ';
         native.from(raw(`(${expression})${asKeyword}${this.platform.quoteIdentifier(qb.alias)}`));
         const query = native.compile();
-        const res = await this.execute(query.sql, query.params, 'all', options.ctx, withAbortContext(options.loggerContext, options));
+        const loggerContext = withAbortContext(options.loggerContext, options);
+        // virtual entities execute directly (not via QueryBuilder), so wrap in a short implicit transaction outside an
+        // existing one when a session context (row level security) needs to apply — mirrors the QueryBuilder wrap
+        const sessionContext = options.ctx ? undefined : options.em?.getTransactionSessionContext();
+        const conn = this.getConnection(this.resolveConnectionType(options));
+        const res = await (sessionContext
+            ? conn.transactional(trx => this.execute(query.sql, query.params, 'all', trx, loggerContext), {
+                sessionContext,
+                loggerContext,
+            })
+            : this.execute(query.sql, query.params, 'all', options.ctx, loggerContext));
         if (type === QueryType.COUNT) {
             return res[0].count;
         }
@@ -915,7 +928,11 @@ export class AbstractSqlDriver extends DatabaseDriver {
         if (!options.upsert && options.unionWhere?.length) {
             where = (await this.applyUnionWhere(meta, where, options, true));
         }
-        if (Utils.hasObjectKeys(data)) {
+        if (options.upsert && meta.tptParent) {
+            res = await this.nativeUpdateMany(entityName, [where], [data], options);
+        }
+        else if (Utils.hasObjectKeys(data) || (meta.inheritanceType === 'tpt' && meta.ownsVersionProperty())) {
+            // a TPT table declaring the version property is bumped even when only other tables of the hierarchy changed
             const qb = this.createQueryBuilder(entityName, options.ctx, 'write', options.convertCustomTypes, options.loggerContext).withSchema(this.getSchemaName(meta, options));
             qb.setAbortOptions(pickAbortOptions(options));
             if (options.upsert) {
@@ -941,7 +958,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
                 qb.update(data).where(where);
                 // reload generated columns and version fields
                 const returning = [];
-                meta.props
+                this.getTableProps(meta)
                     .filter(prop => (prop.generated && !prop.primary) || prop.version)
                     .forEach(prop => returning.push(prop.name));
                 qb.returning(returning);
@@ -957,13 +974,38 @@ export class AbstractSqlDriver extends DatabaseDriver {
         options.convertCustomTypes ??= true;
         const meta = this.metadata.get(entityName);
         if (options.upsert) {
+            if (meta.tptParent) {
+                // TPT parent tables go first, the PK they provide is the conflict target of this table
+                await this.nativeUpdateMany(meta.tptParent.class, where, data, options);
+                for (const [i, row] of data.entries()) {
+                    if (meta.primaryKeys.some(pk => row[pk] == null)) {
+                        const found = await this.findOne(meta.tptParent.class, where[i], {
+                            fields: meta.primaryKeys,
+                            ctx: options.ctx,
+                            connectionType: 'write',
+                            schema: options.schema,
+                        });
+                        meta.primaryKeys.forEach(pk => (row[pk] = found?.[pk]));
+                    }
+                }
+                options = { ...options, onConflictFields: meta.primaryKeys, onConflictWhere: undefined };
+            }
             const uniqueFields = options.onConflictFields ??
                 (Utils.isPlainObject(where[0])
                     ? Object.keys(where[0]).flatMap(key => Utils.splitPrimaryKeys(key))
                     : meta.primaryKeys);
             const qb = this.createQueryBuilder(entityName, options.ctx, 'write', options.convertCustomTypes, options.loggerContext).withSchema(this.getSchemaName(meta, options));
             qb.setAbortOptions(pickAbortOptions(options));
-            const returning = getOnConflictReturningFields(meta, data[0], uniqueFields, options);
+            let returning = getOnConflictReturningFields(meta, data[0], uniqueFields, options);
+            if (meta.inheritanceType === 'tpt') {
+                // each TPT table only carries its own columns, the entity is reloaded instead of mapping the returned rows
+                const own = (key) => meta.primaryKeys.includes(key) ||
+                    this.getTableProps(meta).some(prop => prop.name === key.split('.')[0]);
+                data = data.map(row => Object.fromEntries(Object.entries(row).filter(([key]) => own(key))));
+                options.onConflictMergeFields = options.onConflictMergeFields?.filter(f => own(f));
+                options.onConflictExcludeFields = options.onConflictExcludeFields?.filter(f => own(f));
+                returning = [];
+            }
             qb.insert(data)
                 .onConflict(uniqueFields)
                 .returning(returning);
@@ -977,7 +1019,8 @@ export class AbstractSqlDriver extends DatabaseDriver {
             if (options.onConflictWhere) {
                 qb.where(options.onConflictWhere);
             }
-            return this.rethrow(qb.execute('run', false));
+            const res = await this.rethrow(qb.execute('run', false));
+            return meta.inheritanceType === 'tpt' ? { ...res, row: undefined, rows: [] } : res;
         }
         const collections = options.processCollections ? data.map(d => this.extractManyToMany(meta, d)) : [];
         const keys = new Set();
@@ -992,7 +1035,10 @@ export class AbstractSqlDriver extends DatabaseDriver {
             }
         }
         // reload generated columns and version fields
-        meta.props.filter(prop => prop.generated || prop.version || prop.primary).forEach(prop => returning.add(prop.name));
+        meta.getPrimaryProps().forEach(prop => returning.add(prop.name));
+        this.getTableProps(meta)
+            .filter(prop => prop.generated || prop.version)
+            .forEach(prop => returning.add(prop.name));
         const pkCond = Utils.flatten(meta.primaryKeys.map(pk => meta.properties[pk].fieldNames))
             .map(pk => `${this.platform.quoteIdentifier(pk)} = ?`)
             .join(' and ');
@@ -1050,7 +1096,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
                 return sql;
             });
         }
-        if (meta.versionProperty) {
+        if (meta.ownsVersionProperty()) {
             const versionProperty = meta.properties[meta.versionProperty];
             const quotedFieldName = this.platform.quoteIdentifier(versionProperty.fieldNames[0]);
             sql += `${quotedFieldName} = `;
@@ -1063,7 +1109,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
             sql += `, `;
         }
         sql = sql.substring(0, sql.length - 2) + ' where ';
-        const pkProps = meta.primaryKeys.concat(...meta.concurrencyCheckKeys);
+        const pkProps = meta.primaryKeys.concat(...meta.getOwnConcurrencyCheckKeys());
         const pks = Utils.flatten(pkProps.map(pk => meta.properties[pk].fieldNames));
         const useTupleIn = pks.length <= 1 || this.platform.allowsComparingTuples();
         const condTemplate = useTupleIn
@@ -1649,6 +1695,11 @@ export class AbstractSqlDriver extends DatabaseDriver {
             if (prop.kind === ReferenceKind.ONE_TO_ONE && prop.mapToPk && prop.owner) {
                 return false;
             }
+            // Polymorphic to-one flattened from an object embeddable lives inside a JSON column, so the join
+            // conditions would need JSON extraction for both the discriminator and the FK; fall back to SELECT_IN.
+            if (prop.polymorphic && prop.object && prop.embedded) {
+                return false;
+            }
             if (strategy !== LoadStrategy.JOINED) {
                 // force joined strategy for explicit 1:1 owner populate hint as it would require a join anyway
                 return prop.kind === ReferenceKind.ONE_TO_ONE && !prop.owner;
@@ -1779,7 +1830,7 @@ export class AbstractSqlDriver extends DatabaseDriver {
                     // INNER JOINs get nested inside the polymorphic LEFT JOIN by processNestedJoins, which
                     // keeps the resulting query valid for rows pointing to other polymorphic targets.
                     if (targetMeta.inheritanceType === 'tpt' && targetMeta.tptParent) {
-                        this.addTPTParentJoinsForRelation(qb, targetMeta, tableAlias, targetPath);
+                        qb.addTPTParentJoins(targetMeta, tableAlias, targetPath);
                     }
                     // For polymorphic targets that are TPT base classes, also LEFT JOIN
                     // all descendant tables so child-specific fields can be selected.
@@ -1827,10 +1878,6 @@ export class AbstractSqlDriver extends DatabaseDriver {
                         : JoinType.leftJoin;
             const schema = prop.targetMeta.schema === '*' ? (options?.schema ?? this.config.get('schema')) : prop.targetMeta.schema;
             qb.join(field, tableAlias, {}, joinType, path, schema);
-            // For relations to TPT child entities, INNER JOIN parent tables (GH #7469)
-            if (meta2.inheritanceType === 'tpt' && meta2.tptParent) {
-                this.addTPTParentJoinsForRelation(qb, meta2, tableAlias, path);
-            }
             // For relations to TPT base classes, add LEFT JOINs for all child tables (polymorphic loading)
             if (meta2.inheritanceType === 'tpt' && meta2.tptChildren?.length && !ref) {
                 // Use the registry metadata to ensure allTPTDescendants is available
@@ -1877,25 +1924,6 @@ export class AbstractSqlDriver extends DatabaseDriver {
         }
         return fields;
     }
-    /**
-     * Walks the TPT inheritance chain of `leafMeta` and INNER JOINs each parent table.
-     * Registers the parent aliases in `qb.state.tptAlias` so column resolution finds them
-     * when filter conditions reference parent-table columns.
-     * @internal
-     */
-    addTPTParentJoinsForRelation(qb, leafMeta, leafAlias, basePath) {
-        let childAlias = leafAlias;
-        let childMeta = leafMeta;
-        while (childMeta.tptParent) {
-            const parentMeta = childMeta.tptParent;
-            const parentAlias = qb.getNextAlias(parentMeta.className);
-            qb.createAlias(parentMeta.class, parentAlias);
-            qb.state.tptAlias[`${leafAlias}:${parentMeta.className}`] = parentAlias;
-            qb.addPropertyJoin(childMeta.tptParentProp, childAlias, parentAlias, JoinType.innerJoin, `${basePath}.[tpt]${childMeta.className}`);
-            childAlias = parentAlias;
-            childMeta = parentMeta;
-        }
-    }
     /**
      * Adds LEFT JOINs and fields for TPT polymorphic loading when populating a relation to a TPT base class.
      * @internal

package/AbstractSqlPlatform.d.ts

@@ -28,7 +28,7 @@ export declare abstract class AbstractSqlPlatform extends Platform {
     getReleaseSavepointSQL(savepointName: string): string;
     quoteValue(value: any): string;
     getSearchJsonPropertySQL(path: string, type: string, aliased: boolean): string | RawQueryFragment;
-    getSearchJsonPropertyKey(path: string[], type: string, aliased: boolean, value?: unknown): string | RawQueryFragment;
+    getSearchJsonPropertyKey(path: string[], type: string, aliased: boolean | string, value?: unknown): string | RawQueryFragment;
     /**
      * Quotes a key for use inside a JSON path expression (e.g. `$.key`).
      * Simple alphanumeric keys are left unquoted; others are wrapped in double quotes

package/AbstractSqlPlatform.js

@@ -75,6 +75,9 @@ export class AbstractSqlPlatform extends Platform {
     getSearchJsonPropertyKey(path, type, aliased, value) {
         const [a, ...b] = path;
         const jsonPath = this.quoteValue(`$.${b.map(this.quoteJsonKey).join('.')}`);
+        if (typeof aliased === 'string') {
+            return raw(`json_extract(${this.quoteIdentifier(`${aliased}.${a}`)}, ${jsonPath})`);
+        }
         if (aliased) {
             return raw(alias => `json_extract(${this.quoteIdentifier(`${alias}.${a}`)}, ${jsonPath})`);
         }

package/SqlEntityManager.js

@@ -68,7 +68,7 @@ export class SqlEntityManager extends EntityManager {
             merged.signal = opts.signal ?? fork?.signal;
             merged.inflightQueryAbortStrategy = opts.inflightQueryAbortStrategy ?? fork?.inflightQueryAbortStrategy;
         }
-        return this.getDriver().execute(query, params, opts.method ?? 'all', context.getTransactionContext(), merged);
+        return context.withSessionContext(context.getTransactionContext(), ctx => this.getDriver().execute(query, params, opts.method ?? 'all', ctx, merged));
     }
     /**
      * @inheritDoc
@@ -81,7 +81,9 @@ export class SqlEntityManager extends EntityManager {
         const { where: rawWhere, ...countOptions } = options;
         await em.tryFlush(entityName, options);
         const where = await em.processWhere(entityName, rawWhere ?? {}, options, 'read');
-        const qb = em.createQueryBuilder(meta.class);
+        // match `em.count()` semantics: an active transaction always wins over the requested connection type
+        const connectionType = em.getTransactionContext() ? 'write' : options.connectionType;
+        const qb = em.createQueryBuilder(meta.class, undefined, connectionType);
         qb
             .select([...fields, raw('count(*) as cnt')])
             .where(where)

package/dialects/postgresql/BasePostgreSqlPlatform.d.ts

@@ -16,6 +16,8 @@ export declare class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     getEnumArrayCheckConstraintExpression(column: string, items: string[]): string;
     supportsMaterializedViews(): boolean;
     supportsPartitionedTables(): boolean;
+    supportsRowLevelSecurity(): boolean;
+    getCurrentSettingCast(mappedType: Type<unknown>): string | null;
     supportsCustomPrimaryKeyNames(): boolean;
     getCurrentTimestampSQL(length: number): string;
     getDateTimeTypeDeclarationSQL(column: {
@@ -88,7 +90,7 @@ export declare class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     }): string;
     getBlobDeclarationSQL(): string;
     getJsonDeclarationSQL(): string;
-    getSearchJsonPropertyKey(path: string[], type: string | undefined | Type, aliased: boolean, value?: unknown): string | RawQueryFragment;
+    getSearchJsonPropertyKey(path: string[], type: string | undefined | Type, aliased: boolean | string, value?: unknown): string | RawQueryFragment;
     getJsonIndexDefinition(index: IndexDef): string[];
     quoteIdentifier(id: string | {
         toString: () => string;

package/dialects/postgresql/BasePostgreSqlPlatform.js

@@ -1,4 +1,4 @@
-import { ALIAS_REPLACEMENT, ARRAY_OPERATORS, raw, RawQueryFragment, Type, Utils, } from '@mikro-orm/core';
+import { ALIAS_REPLACEMENT, ARRAY_OPERATORS, BigIntType, BooleanType, DateTimeType, DateType, EnumType, IntegerType, raw, RawQueryFragment, SmallIntType, StringType, TextType, TimeType, TinyIntType, Type, Utils, UuidType, } from '@mikro-orm/core';
 import { AbstractSqlPlatform } from '../../AbstractSqlPlatform.js';
 import { PostgreSqlNativeQueryBuilder } from './PostgreSqlNativeQueryBuilder.js';
 import { PostgreSqlSchemaHelper } from './PostgreSqlSchemaHelper.js';
@@ -33,6 +33,38 @@ export class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     supportsPartitionedTables() {
         return true;
     }
+    supportsRowLevelSecurity() {
+        return true;
+    }
+    getCurrentSettingCast(mappedType) {
+        if (mappedType instanceof UuidType) {
+            return '::uuid';
+        }
+        if (mappedType instanceof BigIntType) {
+            return '::bigint';
+        }
+        // MediumIntType extends IntegerType, so it is covered here too
+        if (mappedType instanceof IntegerType || mappedType instanceof SmallIntType || mappedType instanceof TinyIntType) {
+            return '::int';
+        }
+        if (mappedType instanceof BooleanType) {
+            return '::boolean';
+        }
+        if (mappedType instanceof DateTimeType) {
+            return '::timestamptz';
+        }
+        if (mappedType instanceof DateType) {
+            return '::date';
+        }
+        if (mappedType instanceof TimeType) {
+            return '::time';
+        }
+        // current_setting() returns text already, so string-compatible types need no cast (CharacterType extends StringType)
+        if (mappedType instanceof StringType || mappedType instanceof TextType || mappedType instanceof EnumType) {
+            return '';
+        }
+        return null;
+    }
     supportsCustomPrimaryKeyNames() {
         return true;
     }
@@ -285,7 +317,8 @@ export class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     getSearchJsonPropertyKey(path, type, aliased, value) {
         const first = path.shift();
         const last = path.pop();
-        const root = this.quoteIdentifier(aliased ? `${ALIAS_REPLACEMENT}.${first}` : first);
+        const alias = typeof aliased === 'string' ? aliased : ALIAS_REPLACEMENT;
+        const root = this.quoteIdentifier(aliased ? `${alias}.${first}` : first);
         type = typeof type === 'string' ? this.getMappedType(type).runtimeType : String(type);
         const cast = (key) => raw(type in this.#jsonTypeCasts ? `(${key})::${this.#jsonTypeCasts[type]}` : key);
         let lastOperator = '->>';

package/dialects/postgresql/PostgreSqlExceptionConverter.js

@@ -1,4 +1,4 @@
-import { DeadlockException, ExceptionConverter, ForeignKeyConstraintViolationException, InvalidFieldNameException, NonUniqueFieldNameException, NotNullConstraintViolationException, SyntaxErrorException, TableExistsException, TableNotFoundException, UniqueConstraintViolationException, CheckConstraintViolationException, } from '@mikro-orm/core';
+import { DeadlockException, ExceptionConverter, ForeignKeyConstraintViolationException, InvalidFieldNameException, NonUniqueFieldNameException, NotNullConstraintViolationException, RowLevelSecurityViolationException, SyntaxErrorException, TableExistsException, TableNotFoundException, UniqueConstraintViolationException, CheckConstraintViolationException, } from '@mikro-orm/core';
 export class PostgreSqlExceptionConverter extends ExceptionConverter {
     /**
      * @see http://www.postgresql.org/docs/9.4/static/errcodes-appendix.html
@@ -31,6 +31,13 @@ export class PostgreSqlExceptionConverter extends ExceptionConverter {
                 return new UniqueConstraintViolationException(exception);
             case '23514':
                 return new CheckConstraintViolationException(exception);
+            case '42501':
+                // 42501 is generic insufficient_privilege; only RLS write violations carry this message — the `routine`
+                // field covers servers with a non-english `lc_messages`, where the message check cannot match
+                if (exception.message.includes('row-level security policy') || exception.routine === 'ExecWithCheckOptions') {
+                    return new RowLevelSecurityViolationException(exception);
+                }
+                break;
             case '42601':
                 return new SyntaxErrorException(exception);
             case '42702':

package/dialects/postgresql/PostgreSqlSchemaHelper.d.ts

@@ -1,7 +1,7 @@
 import { type Dictionary, type Transaction } from '@mikro-orm/core';
 import { SchemaHelper } from '../../schema/SchemaHelper.js';
 import type { AbstractSqlConnection } from '../../AbstractSqlConnection.js';
-import type { CheckDef, Column, ForeignKey, IndexDef, Table, TableDifference, TablePartitioning, SqlTriggerDef, SqlRoutineDef } from '../../typings.js';
+import type { CheckDef, Column, ForeignKey, IndexDef, Table, TableDifference, TablePartitioning, SqlPolicyDef, SqlTriggerDef, SqlRoutineDef } from '../../typings.js';
 import type { DatabaseSchema } from '../../schema/DatabaseSchema.js';
 import type { DatabaseTable } from '../../schema/DatabaseTable.js';
 export declare class PostgreSqlSchemaHelper extends SchemaHelper {
@@ -71,6 +71,17 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
     dropTrigger(table: DatabaseTable, trigger: SqlTriggerDef): string;
     /** Flattens `;\n` inside the dollar-quoted blocks of a raw DDL expression, which are not statement boundaries. */
     private flattenDollarQuotedBodies;
+    getRlsCreateSQL(table: DatabaseTable): string[];
+    getRlsDropSQL(diff: TableDifference, safe?: boolean): string[];
+    getRlsAlterSQL(diff: TableDifference, safe?: boolean): string[];
+    /**
+     * Quotes a policy or role name as a single identifier. Unlike `quote()`/`platform.quoteIdentifier`, which treat
+     * a dot as a schema qualifier, these names are never schema-qualified, so `my.role` must render as `"my.role"`.
+     */
+    private quoteUnqualified;
+    private createPolicy;
+    private dropPolicy;
+    private formatPolicyRoles;
     createRoutine(routine: SqlRoutineDef): string;
     dropRoutine(routine: SqlRoutineDef): string;
     getAllRoutines(connection: AbstractSqlConnection, schemas?: string[]): Promise<SqlRoutineDef[]>;
@@ -87,6 +98,12 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
     getDatabaseCollation(connection: AbstractSqlConnection, ctx?: Transaction): Promise<string | undefined>;
     getAllTriggers(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>): Promise<Dictionary<SqlTriggerDef[]>>;
     private getTriggersSQL;
+    getAllPolicies(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>, ctx?: Transaction): Promise<Dictionary<{
+        policies: SqlPolicyDef[];
+        enabled: boolean;
+        forced: boolean;
+    }>>;
+    private parsePgRoles;
     getAllForeignKeys(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>, ctx?: Transaction): Promise<Dictionary<Dictionary<ForeignKey>>>;
     getNativeEnumDefinitions(connection: AbstractSqlConnection, schemas: string[], ctx?: Transaction): Promise<Dictionary<{
         name: string;