@mikro-orm/sql 7.2.0-dev.13 → 7.2.0-dev.15

package/query/QueryBuilder.js

@@ -397,7 +397,10 @@ export class QueryBuilder {
      * @internal
      */
     scheduleFilterCheck(path) {
-        this.#state.autoJoinedPaths.push(path);
+        // deduplicate so filters forming a relation cycle cannot reschedule an already visited path forever
+        if (!this.#state.autoJoinedPaths.includes(path)) {
+            this.#state.autoJoinedPaths.push(path);
+        }
     }
     /**
      * @internal
@@ -492,7 +495,10 @@ export class QueryBuilder {
             return cond.some(c => this.condReferencesAlias(c, alias));
         }
         if (Utils.isPlainObject(cond)) {
-            return Object.entries(cond).some(([key, value]) => key.startsWith(`${alias}.`) || this.condReferencesAlias(value, alias));
+            return Object.entries(cond).some(([key, value]) => {
+                const [keyAlias, field] = this.helper.splitField(key);
+                return this.helper.getTPTAliasForProperty(field, keyAlias) === alias || this.condReferencesAlias(value, alias);
+            });
         }
         return false;
     }
@@ -901,6 +907,8 @@ export class QueryBuilder {
         if (this.type === QueryType.INSERT) {
             const returningProps = meta.hydrateProps
                 .filter(prop => prop.returning || (prop.persist !== false && ((prop.primary && prop.autoincrement) || prop.defaultRaw)))
+                // a TPT table can only return its own columns
+                .filter(prop => meta.inheritanceType !== 'tpt' || prop.primary || meta.ownProps.some(p => p.name === prop.name))
                 .filter(prop => !data || !(prop.name in data));
             if (returningProps.length > 0) {
                 qb.returning(Utils.flatten(returningProps.map(prop => prop.fieldNames)));
@@ -990,12 +998,13 @@ export class QueryBuilder {
         }
         if (!join && options?.ignoreBranching) {
             join = joins.find(j => {
-                return j.path?.replace(/\[\d+]/g, '') === path.replace(/\[\d+]/g, '');
+                return j.path?.replace(/\[\d+]/g, '') === path.replace(/\[\d+]/g, '') && !this.branchesConflict(j.path, path);
             });
         }
         if (!join && options?.matchPopulateJoins && options?.ignoreBranching) {
             join = joins.find(j => {
-                return j.path?.replace(/\[\d+]|\[populate]/g, '') === path.replace(/\[\d+]|\[populate]/g, '');
+                return (j.path?.replace(/\[\d+]|\[populate]/g, '') === path.replace(/\[\d+]|\[populate]/g, '') &&
+                    !this.branchesConflict(j.path, path));
             });
         }
         if (!join && options?.matchPopulateJoins) {
@@ -1005,6 +1014,12 @@ export class QueryBuilder {
         }
         return join;
     }
+    /** Branch-insensitive path matching still must not cross branches — segments with different explicit branch markers (e.g. `Mobile[0]` vs `Mobile[1]`) belong to sibling joins. */
+    branchesConflict(path1, path2) {
+        const markers = (path) => path.split('.').map(segment => /\[(\d+)]/.exec(segment)?.[1]);
+        const markers2 = markers(path2);
+        return markers(path1).some((m, idx) => m != null && markers2[idx] != null && m !== markers2[idx]);
+    }
     /**
      * @internal
      */
@@ -1050,17 +1065,26 @@ export class QueryBuilder {
             this.limit(1);
         }
         const query = this.toQuery();
-        const cached = await this.em?.tryCache(this.mainAlias.entityName, this.#state.cache, [
-            'qb.execute',
-            query.sql,
-            query.params,
-            method,
-        ]);
+        const cacheKey = ['qb.execute', query.sql, query.params, method];
+        // session context (row level security) scopes cached rows per tenant/role, avoiding cross-context serves
+        const qbSessionContext = this.em?.getSessionContext();
+        if (qbSessionContext) {
+            cacheKey.push(qbSessionContext);
+        }
+        const cached = await this.em?.tryCache(this.mainAlias.entityName, this.#state.cache, cacheKey);
         if (cached?.data !== undefined) {
             return cached.data;
         }
         const loggerContext = { id: this.em?.id, ...this.loggerContext, ...this.#abortOptions };
-        const res = await this.getConnection().execute(query.sql, query.params, method, this.context, loggerContext);
+        const conn = this.getConnection();
+        // outside a transaction, wrap in a short implicit one so RLS `set local` session context applies (no-op when unset)
+        const sessionContext = this.context ? undefined : this.em?.getTransactionSessionContext();
+        const res = await (sessionContext
+            ? conn.transactional(trx => conn.execute(query.sql, query.params, method, trx, loggerContext), {
+                sessionContext,
+                loggerContext,
+            })
+            : conn.execute(query.sql, query.params, method, this.context, loggerContext));
         const meta = this.mainAlias.meta;
         if (!options.mapResults || !meta) {
             await this.em?.storeCache(this.#state.cache, cached, res);
@@ -1110,6 +1134,11 @@ export class QueryBuilder {
      * ```
      */
     async *stream(options) {
+        // mirror EntityManager.stream — a stream can't open the implicit session-context transaction, so under the
+        // 'transaction' strategy fail closed instead of silently running the cursor without the staged context
+        if (!this.context && this.em?.getTransactionSessionContext()) {
+            throw ValidationError.sessionContextStreamRequiresTransaction();
+        }
         options ??= {};
         options.mergeResults ??= true;
         options.mapResults ??= true;
@@ -1410,19 +1439,19 @@ export class QueryBuilder {
                 prop.targetMeta = field.mainAlias.meta;
                 field = field.getNativeQuery();
             }
-            if (isRaw(field)) {
-                field = this.platform.formatQuery(field.sql, field.params);
-            }
             const key = `${this.alias}.${prop.name}#${alias}`;
-            this.#state.joins[key] = {
-                prop,
-                alias,
-                type,
-                cond,
-                schema,
-                subquery: field.toString(),
-                ownerAlias: this.alias,
-            };
+            const join = { prop, alias, type, cond, schema, ownerAlias: this.alias };
+            // `sql.ref('...')` is a bare table/CTE reference, join it by name instead of wrapping it as a sub-query
+            if (isRaw(field) && field.sql === '??' && field.params.length === 1) {
+                join.table = String(field.params[0]);
+            }
+            else {
+                if (isRaw(field)) {
+                    field = this.platform.formatQuery(field.sql, field.params);
+                }
+                join.subquery = field.toString();
+            }
+            this.#state.joins[key] = join;
             return { prop, key };
         }
         if (!subquery && type.includes('lateral')) {
@@ -1483,9 +1512,31 @@ export class QueryBuilder {
             this.#state.joins[aliasedName] = this.helper.joinManyToOneReference(prop, ownerAlias, alias, type, cond, schema);
             this.#state.joins[aliasedName].path ??= path;
         }
+        if (prop.targetMeta.inheritanceType === 'tpt' && prop.targetMeta.tptParent) {
+            this.addTPTParentJoins(prop.targetMeta, alias, path);
+        }
         this.nestReferencedJoins(this.#state.joins[aliasedName]);
         return { prop, key: aliasedName };
     }
+    /**
+     * Walks the TPT inheritance chain of `leafMeta` and INNER JOINs each parent table.
+     * Registers the parent aliases in `state.tptAlias` so column resolution finds them
+     * when conditions reference parent-table columns.
+     * @internal
+     */
+    addTPTParentJoins(leafMeta, leafAlias, basePath) {
+        let childAlias = leafAlias;
+        let childMeta = leafMeta;
+        while (childMeta.tptParent) {
+            const parentMeta = childMeta.tptParent;
+            const parentAlias = this.getNextAlias(parentMeta.className);
+            this.createAlias(parentMeta.class, parentAlias);
+            this.#state.tptAlias[`${leafAlias}:${parentMeta.className}`] = parentAlias;
+            this.addPropertyJoin(childMeta.tptParentProp, childAlias, parentAlias, JoinType.innerJoin, `${basePath}.[tpt]${childMeta.className}`);
+            childAlias = parentAlias;
+            childMeta = parentMeta;
+        }
+    }
     prepareFields(fields, type = 'where', schema) {
         const ret = [];
         const getFieldName = (name, customAlias) => {
@@ -2038,6 +2089,13 @@ export class QueryBuilder {
         for (const k of Object.keys(cond)) {
             if (Utils.isOperator(k)) {
                 if (Array.isArray(cond[k])) {
+                    if (k === '$or' && !this.canDistributeOrBranches(cond[k], joins)) {
+                        // entity filters have no other sink, so their `$or` is kept intact on the outermost targeted join instead
+                        if (filter) {
+                            this.mergeFilterOrCondition(cond[k], joins);
+                        }
+                        continue;
+                    }
                     cond[k].forEach((c) => this.mergeOnConditions(joins, c, filter, k));
                 }
                 /* v8 ignore next */
@@ -2068,8 +2126,66 @@ export class QueryBuilder {
                 else {
                     join.cond = { ...join.cond, [k]: cond[k] };
                 }
+                this.nestReferencedJoins(join);
+            }
+        }
+    }
+    /**
+     * `$or` branches can be moved to a join's `on` clause only when they all target that same join
+     * and stay flat — a partial `$or` in the `on` clause would drop rows matching a sibling branch,
+     * and nested operators cannot be preserved inside a distributed disjunction, as `mergeOnConditions`
+     * would flatten them into `and` conjuncts.
+     */
+    canDistributeOrBranches(branches, joins) {
+        const aliases = this.getOrBranchAliases(branches);
+        const targeted = joins.filter(j => aliases.has(j.alias));
+        const flat = branches.every(branch => Object.keys(branch).every(k => !Utils.isOperator(k)));
+        return aliases.size === 1 && targeted.length === 1 && flat;
+    }
+    getOrBranchAliases(branches) {
+        const aliases = new Set();
+        const collectAliases = (cond) => {
+            for (const k of Object.keys(cond)) {
+                if (Utils.isOperator(k)) {
+                    Utils.asArray(cond[k]).forEach((c) => collectAliases(c));
+                }
+                else {
+                    aliases.add(this.helper.splitField(k)[0]);
+                }
+            }
+        };
+        branches.forEach(collectAliases);
+        return aliases;
+    }
+    /**
+     * An entity filter's `$or` that cannot be distributed is applied intact to the `on` clause of the
+     * outermost join common to all targeted joins, nesting the targeted joins under it so the clause
+     * can reference their aliases.
+     */
+    mergeFilterOrCondition(branches, joins) {
+        const aliases = this.getOrBranchAliases(branches);
+        const chainOf = (join) => {
+            const parent = joins.find(j => j.alias === join.ownerAlias);
+            return parent ? [join, ...chainOf(parent)] : [join];
+        };
+        // chains go from each targeted join up to its root, so the first join present in all of them is the outermost common one
+        const chains = joins.filter(j => aliases.has(j.alias)).map(chainOf);
+        const anchor = chains[0]?.find(a => chains.every(chain => chain.includes(a)));
+        /* v8 ignore next 3 */
+        if (!anchor) {
+            return;
+        }
+        for (const chain of chains) {
+            // nest the chain below the anchor, so the anchor's `on` clause can reference the nested aliases
+            for (let i = 0; chain[i] !== anchor; i++) {
+                const nested = (chain[i + 1].nested ??= new Set());
+                if (!nested.has(chain[i])) {
+                    chain[i].type = chain[i].type === JoinType.innerJoin ? JoinType.nestedInnerJoin : JoinType.nestedLeftJoin;
+                    nested.add(chain[i]);
+                }
             }
         }
+        anchor.cond = anchor.cond.$or ? { $and: [anchor.cond, { $or: branches }] } : { ...anchor.cond, $or: branches };
     }
     /**
      * When adding an inner join on a left joined relation, we need to nest them,

package/query/QueryBuilderHelper.d.ts

@@ -14,6 +14,11 @@ export declare class QueryBuilderHelper {
      * Returns the main alias if not a TPT property or if the property belongs to the main entity.
      */
     getTPTAliasForProperty(propName: string, defaultAlias: string): string;
+    /**
+     * Replaces `ALIAS_REPLACEMENT` placeholders, resolving column-qualified ones via
+     * `getTPTAliasForProperty()` so TPT inherited columns map to their owning table.
+     */
+    replaceAliases(sql: string, alias?: string): string;
     mapper(field: string | Raw | RawQueryFragmentSymbol, type?: QueryType): string;
     mapper(field: string | Raw | RawQueryFragmentSymbol, type?: QueryType, value?: any, alias?: string | null, schema?: string): string;
     processData(data: Dictionary, convertCustomTypes: boolean, multi?: boolean): any;

package/query/QueryBuilderHelper.js

@@ -1,5 +1,7 @@
 import { ALIAS_REPLACEMENT, ALIAS_REPLACEMENT_RE, ArrayType, JsonType, inspect, isRaw, LockMode, OptimisticLockError, QueryOperator, QueryOrderNumeric, raw, Raw, QueryHelper, ReferenceKind, Utils, ValidationError, } from '@mikro-orm/core';
 import { EMBEDDABLE_ARRAY_OPS, JoinType, QueryType } from './enums.js';
+/** Captures the column name that follows the alias placeholder. */
+const QUALIFYING_ALIAS_RE = new RegExp(ALIAS_REPLACEMENT_RE + '(?=["\'`\\]]*\\.["\'`\\[]?([\\w$]+))', 'g');
 /**
  * @internal
  */
@@ -49,6 +51,15 @@ export class QueryBuilderHelper {
         // Property not found in hierarchy, return default alias
         return defaultAlias;
     }
+    /**
+     * Replaces `ALIAS_REPLACEMENT` placeholders, resolving column-qualified ones via
+     * `getTPTAliasForProperty()` so TPT inherited columns map to their owning table.
+     */
+    replaceAliases(sql, alias = this.#alias) {
+        return sql
+            .replace(QUALIFYING_ALIAS_RE, (_, column) => this.getTPTAliasForProperty(column, alias))
+            .replaceAll(ALIAS_REPLACEMENT, alias);
+    }
     mapper(field, type = QueryType.SELECT, value, alias, schema) {
         if (isRaw(field)) {
             return raw(field.sql, field.params);
@@ -97,7 +108,6 @@ export class QueryBuilderHelper {
         // Only apply TPT resolution when `a` is an actual table alias (in aliasMap),
         // not when it's an embedded property name like 'profile1.identity.links'
         const isTableAlias = !!this.#aliasMap[a];
-        const baseAlias = isTableAlias ? a : this.#alias;
         const resolvedAlias = isTableAlias ? this.getTPTAliasForProperty(prop?.name ?? f, a) : this.#alias;
         const aliasPrefix = isTableNameAliasRequired ? resolvedAlias + '.' : '';
         const fkIdx2 = prop?.fieldNames.findIndex(name => name === f) ?? -1;
@@ -249,7 +259,13 @@ export class QueryBuilderHelper {
         }[join.type] ?? join.type;
         const conditions = [];
         const params = [];
-        schema = join.schema === '*' ? schema : (join.schema ?? schemaOverride);
+        if (join.prop.name === '__subquery__') {
+            // bare table/CTE references (`sql.ref()` joins) keep their literal name, only an explicit schema applies
+            schema = join.schema === '*' ? undefined : join.schema;
+        }
+        else {
+            schema = join.schema === '*' ? schema : (join.schema ?? schemaOverride);
+        }
         if (schema && schema !== this.#platform.getDefaultSchemaName()) {
             table = `${schema}.${table}`;
         }
@@ -465,7 +481,7 @@ export class QueryBuilderHelper {
         const op = cond[key] === null ? 'is' : '=';
         if (Raw.isKnownFragmentSymbol(key)) {
             const raw = Raw.getKnownFragment(key);
-            const sql = raw.sql.replaceAll(ALIAS_REPLACEMENT, this.#alias);
+            const sql = this.replaceAliases(raw.sql);
             const value = Utils.asArray(cond[key]);
             params.push(...raw.params);
             if (value.length > 0) {
@@ -517,6 +533,11 @@ export class QueryBuilderHelper {
         const replacement = this.getOperatorReplacement(op, value);
         const rawField = Raw.isKnownFragmentSymbol(key);
         const fields = rawField ? [key] : Utils.splitPrimaryKeys(key);
+        // a raw key's arity is opaque, so the row-value form is detected from the payload instead
+        const rowValues = rawField &&
+            ['$in', '$nin'].includes(op) &&
+            Array.isArray(value[op]) &&
+            value[op].every((v) => Array.isArray(v));
         if (fields.length > 1 && Array.isArray(value[op])) {
             const singleTuple = !value[op].every((v) => Array.isArray(v));
             if (!this.#platform.allowsComparingTuples()) {
@@ -576,7 +597,7 @@ export class QueryBuilderHelper {
             if (opValueIsRaw || typeof opValue?.toRaw === 'function') {
                 const query = opValueIsRaw ? opValue : opValue.toRaw();
                 const mappedKey = this.mapper(key, type, query, null);
-                let sql = query.sql.replaceAll(ALIAS_REPLACEMENT, this.#alias);
+                let sql = this.replaceAliases(query.sql);
                 if (['$in', '$nin'].includes(op)) {
                     sql = `(${sql})`;
                 }
@@ -585,15 +606,15 @@ export class QueryBuilderHelper {
             }
             else {
                 const mappedKey = this.mapper(key, type, opValue, null);
-                const val = this.getValueReplacement(fields, opValue, params, op, prop);
+                const val = this.getValueReplacement(fields, opValue, params, op, prop, rowValues);
                 parts.push(`${this.#platform.quoteIdentifier(mappedKey)} ${replacement} ${val}`);
             }
         }
         return { sql: parts.join(' and '), params };
     }
-    getValueReplacement(fields, value, params, key, prop) {
+    getValueReplacement(fields, value, params, key, prop, rowValues = false) {
         if (Array.isArray(value)) {
-            if (fields.length > 1) {
+            if (fields.length > 1 || rowValues) {
                 const tmp = [];
                 for (const field of value) {
                     tmp.push(`(${field.map(() => '?').join(', ')})`);
@@ -742,7 +763,7 @@ export class QueryBuilderHelper {
     }
     updateVersionProperty(qb, data) {
         const meta = this.#metadata.find(this.#entityName);
-        if (!meta?.versionProperty || meta.versionProperty in data) {
+        if (!meta?.ownsVersionProperty() || meta.versionProperty in data) {
             return;
         }
         const versionProperty = meta.properties[meta.versionProperty];

package/schema/DatabaseSchema.d.ts

@@ -48,6 +48,10 @@ export declare class DatabaseSchema {
     /** Separate from `create()` so the comparator only pays for routine introspection when the user actually defined routines. SQLite/libSQL helpers return []. */
     loadRoutines(connection: AbstractSqlConnection, platform: AbstractSqlPlatform, schemas?: string[]): Promise<void>;
     static fromMetadata(metadata: EntityMetadata[], platform: AbstractSqlPlatform, config: Configuration, schemaName?: string, em?: any): DatabaseSchema;
+    /** Compiles an `rls`-flagged filter's condition into a resolved policy backed by `current_setting()` lookups. */
+    private static compileRlsFilterPolicy;
+    /** Truncates the base first so the collision suffix survives the identifier limit. */
+    private static uniquePolicyName;
     /** Separate from {@link fromMetadata} so the comparator only walks routines when the user defined any. */
     addRoutinesFromMetadata(routines: readonly Routine[], platform: AbstractSqlPlatform, em?: any): void;
     /**

package/schema/DatabaseSchema.js

@@ -1,4 +1,4 @@
-import { ReferenceKind, isRaw, } from '@mikro-orm/core';
+import { ReferenceKind, MetadataError, QueryHelper, Utils, isRaw, } from '@mikro-orm/core';
 import { DatabaseTable } from './DatabaseTable.js';
 import { normalizeViewDefinition } from './SchemaHelper.js';
 import { getTablePartitioning } from './partitioning.js';
@@ -262,9 +262,115 @@ export class DatabaseSchema {
                     expression: trigger.expression,
                 });
             }
+            // non-empty policies imply RLS; `rowLevelSecurity: 'force'` enforces it for the table owner too, but an
+            // explicit `rowLevelSecurity: false` keeps RLS disabled even when policies are staged (they stay dormant)
+            table.rlsEnabled = meta.rowLevelSecurity !== false && (meta.policies.length > 0 || !!meta.rowLevelSecurity);
+            table.rlsForced = meta.rowLevelSecurity === 'force';
+            const usedPolicyNames = new Set();
+            const resolve = (raw) => {
+                if (raw == null) {
+                    return undefined;
+                }
+                return isRaw(raw) ? platform.formatQuery(raw.sql, raw.params) : raw;
+            };
+            for (const policy of meta.policies) {
+                const command = policy.command ?? 'all';
+                // deterministic default name derived from table + command + collision index, truncated the
+                // same way check names are, so the introspected (engine-truncated) name matches metadata
+                const max = platform.getMaxIdentifierLength();
+                let name = policy.name;
+                if (!name) {
+                    name = this.uniquePolicyName(`${meta.collection}_${command}_policy`, platform, usedPolicyNames);
+                }
+                else {
+                    name = name.substring(0, max);
+                    // explicit names skip the collision suffixing, so a duplicate would otherwise die with a raw pg error
+                    // on create or be silently swallowed by the name-keyed diff dictionaries — reject it up front
+                    if (usedPolicyNames.has(name)) {
+                        throw MetadataError.duplicatePolicyName(meta, name);
+                    }
+                    usedPolicyNames.add(name);
+                }
+                table.addPolicy({
+                    name,
+                    command,
+                    type: policy.type ?? 'permissive',
+                    roles: policy.roles ?? [],
+                    using: resolve(policy.using),
+                    check: resolve(policy.check),
+                });
+            }
+            // rls-flagged filters materialize as additional permissive policies (app-level WHERE + DB-level policy);
+            // filters inherited from a TPT parent are skipped — the policy already lives on the parent table, and the
+            // child table may not even have the referenced columns
+            const rlsFilters = Object.values(meta.filters).filter(filter => filter.rls && !(meta.tptParent && Object.values(meta.tptParent.filters).includes(filter)));
+            if (rlsFilters.length > 0) {
+                // an explicit `rowLevelSecurity: false` still stages the filter's policy but keeps RLS off (dormant)
+                table.rlsEnabled = meta.rowLevelSecurity !== false;
+                for (const filter of rlsFilters) {
+                    table.addPolicy(this.compileRlsFilterPolicy(meta, filter, table, platform, usedPolicyNames));
+                }
+            }
         }
         return schema;
     }
+    /** Compiles an `rls`-flagged filter's condition into a resolved policy backed by `current_setting()` lookups. */
+    static compileRlsFilterPolicy(meta, filter, table, platform, usedPolicyNames) {
+        const accessed = new Set();
+        const cond = QueryHelper.resolveRlsFilterCond(filter, accessed, meta.className);
+        const setting = typeof filter.rls === 'object' ? filter.rls.setting : undefined;
+        if (setting && accessed.size > 1) {
+            throw MetadataError.rlsFilterMultiArgSetting(filter.name, [...accessed]);
+        }
+        // the config-bound driver is always an `AbstractSqlDriver` here, like in `DatabaseTable.processIndexWhere`
+        const driver = platform.getConfig().getDriver();
+        let sql = driver.renderPartialIndexWhere(meta.class, cond);
+        const prefix = QueryHelper.RLS_SENTINEL_PREFIX;
+        const suffix = QueryHelper.RLS_SENTINEL_SUFFIX;
+        // match `"<column>" <op> '<sentinel>'` — the LHS is always a quoted column emitted from this entity's own
+        // where; group 1 keeps the column + operator so only the sentinel literal is swapped for the session lookup
+        const re = new RegExp(`("([^"]+)"\\s*(?:!=|>=|<=|=|>|<)\\s*)'${prefix}(\\w+)${suffix}'`, 'g');
+        sql = sql.replace(re, (_whole, lhs, column, arg) => {
+            const col = table.getColumn(column);
+            // the condition can reference a property that renders a field name without a managed column
+            // (`persist: false`, `skipColumns`) — fail with a descriptive error instead of a crash
+            if (!col) {
+                throw MetadataError.rlsFilterUnmanagedColumn(filter.name, column);
+            }
+            // native enum columns compare against the enum type itself, `current_setting()` text won't coerce implicitly
+            const cast = col.nativeEnumName
+                ? `::${platform.quoteIdentifier(col.nativeEnumName)}`
+                : platform.getCurrentSettingCast(col.mappedType);
+            if (cast === null) {
+                throw MetadataError.rlsFilterUncastableType(filter.name, col.type);
+            }
+            // a sentinel implies the arg was accessed, and multi-arg custom settings were already rejected above
+            const name = setting || Utils.getRlsSettingName(filter.name, arg);
+            return `${lhs}current_setting(${platform.quoteValue(name)})${cast}`;
+        });
+        // a leftover sentinel means an argument appeared somewhere other than a direct comparison, which we can't compile
+        if (sql.includes(prefix)) {
+            throw MetadataError.rlsFilterUnsupportedCond(filter.name);
+        }
+        return {
+            name: this.uniquePolicyName(`${meta.collection}_${filter.name}_policy`, platform, usedPolicyNames),
+            command: 'all',
+            type: 'permissive',
+            roles: [],
+            using: sql,
+        };
+    }
+    /** Truncates the base first so the collision suffix survives the identifier limit. */
+    static uniquePolicyName(base, platform, used) {
+        const max = platform.getMaxIdentifierLength();
+        let name = base.substring(0, max);
+        for (let i = 2; used.has(name); i++) {
+            const suffix = `_${i}`;
+            name = base.substring(0, max - suffix.length) + suffix;
+        }
+        used.add(name);
+        return name;
+    }
     /** Separate from {@link fromMetadata} so the comparator only walks routines when the user defined any. */
     addRoutinesFromMetadata(routines, platform, em) {
         const resolveBody = (raw) => {

package/schema/DatabaseTable.d.ts

@@ -1,6 +1,6 @@
 import { type Configuration, type DeferMode, type Dictionary, type EntityMetadata, type EntityProperty, type IndexCallback, type NamingStrategy } from '@mikro-orm/core';
 import type { SchemaHelper } from './SchemaHelper.js';
-import type { CheckDef, Column, ForeignKey, IndexDef, TablePartitioning, SqlTriggerDef } from '../typings.js';
+import type { CheckDef, Column, ForeignKey, IndexDef, TablePartitioning, SqlPolicyDef, SqlTriggerDef } from '../typings.js';
 import type { AbstractSqlPlatform } from '../AbstractSqlPlatform.js';
 /**
  * @internal
@@ -15,6 +15,10 @@ export declare class DatabaseTable {
         items: string[];
     }>;
     comment?: string;
+    /** Whether row level security is enabled on the table (postgres only). */
+    rlsEnabled: boolean;
+    /** Whether row level security is also enforced for the table owner (postgres `force`). */
+    rlsForced: boolean;
     partitioning?: TablePartitioning;
     /**
      * Effective collation the column defaults to when no explicit `COLLATE` is set on a column.
@@ -34,6 +38,11 @@ export declare class DatabaseTable {
     /** @internal */
     setPartitioning(partitioning?: TablePartitioning): void;
     getTriggers(): SqlTriggerDef[];
+    getPolicies(): SqlPolicyDef[];
+    /** `[]` and `['public']` both mean PUBLIC — a single predicate so metadata, introspection and codegen agree. */
+    static isDefaultPolicyRoles(roles: string[]): boolean;
+    /** @internal */
+    setPolicies(policies: SqlPolicyDef[]): void;
     /** @internal */
     setIndexes(indexes: IndexDef[]): void;
     /** @internal */
@@ -65,6 +74,8 @@ export declare class DatabaseTable {
     hasCheck(checkName: string): boolean;
     getTrigger(triggerName: string): SqlTriggerDef | undefined;
     hasTrigger(triggerName: string): boolean;
+    getPolicy(policyName: string): SqlPolicyDef | undefined;
+    hasPolicy(policyName: string): boolean;
     getPrimaryKey(): IndexDef | undefined;
     hasPrimaryKey(): boolean;
     private getForeignKeyDeclaration;
@@ -99,5 +110,6 @@ export declare class DatabaseTable {
     private processIndexWhere;
     addCheck(check: CheckDef): void;
     addTrigger(trigger: SqlTriggerDef): void;
+    addPolicy(policy: SqlPolicyDef): void;
     toJSON(): Dictionary;
 }

package/schema/DatabaseTable.js

@@ -10,10 +10,15 @@ export class DatabaseTable {
     #indexes = [];
     #checks = [];
     #triggers = [];
+    #policies = [];
     #foreignKeys = {};
     #platform;
     nativeEnums = {}; // for postgres
     comment;
+    /** Whether row level security is enabled on the table (postgres only). */
+    rlsEnabled = false;
+    /** Whether row level security is also enforced for the table owner (postgres `force`). */
+    rlsForced = false;
     partitioning;
     /**
      * Effective collation the column defaults to when no explicit `COLLATE` is set on a column.
@@ -55,6 +60,17 @@ export class DatabaseTable {
     getTriggers() {
         return this.#triggers;
     }
+    getPolicies() {
+        return this.#policies;
+    }
+    /** `[]` and `['public']` both mean PUBLIC — a single predicate so metadata, introspection and codegen agree. */
+    static isDefaultPolicyRoles(roles) {
+        return roles.length === 0 || (roles.length === 1 && roles[0] === 'public');
+    }
+    /** @internal */
+    setPolicies(policies) {
+        this.#policies = policies;
+    }
     /** @internal */
     setIndexes(indexes) {
         this.#indexes = indexes;
@@ -670,6 +686,12 @@ export class DatabaseTable {
     hasTrigger(triggerName) {
         return !!this.getTrigger(triggerName);
     }
+    getPolicy(policyName) {
+        return this.#policies.find(p => p.name === policyName);
+    }
+    hasPolicy(policyName) {
+        return !!this.getPolicy(policyName);
+    }
     getPrimaryKey() {
         return this.#indexes.find(i => i.primary);
     }
@@ -990,6 +1012,9 @@ export class DatabaseTable {
     addTrigger(trigger) {
         this.#triggers.push(trigger);
     }
+    addPolicy(policy) {
+        this.#policies.push(policy);
+    }
     toJSON() {
         const columns = this.#columns;
         // locale-independent comparison so the snapshot is stable across machines
@@ -1123,13 +1148,26 @@ export class DatabaseTable {
             }
             return out;
         };
+        const normalizePolicy = (policy) => {
+            const out = { name: policy.name, command: policy.command, type: policy.type };
+            if (!DatabaseTable.isDefaultPolicyRoles(policy.roles)) {
+                out.roles = [...policy.roles].sort(byString);
+            }
+            for (const field of ['using', 'check']) {
+                if (policy[field]) {
+                    out[field] = policy[field];
+                }
+            }
+            return out;
+        };
         const sortedIndexes = [...this.#indexes].sort((a, b) => byString(a.keyName, b.keyName)).map(normalizeIndex);
         const sortedChecks = [...this.#checks].sort((a, b) => byString(a.name, b.name)).map(normalizeCheck);
         const sortedTriggers = [...this.#triggers].sort((a, b) => byString(a.name, b.name));
+        const sortedPolicies = [...this.#policies].sort((a, b) => byString(a.name, b.name)).map(normalizePolicy);
         const sortedForeignKeys = Object.fromEntries(Object.entries(this.#foreignKeys)
             .sort(([a], [b]) => byString(a, b))
             .map(([k, v]) => [k, normalizeFk(v)]));
-        return {
+        const ret = {
             name: this.name,
             schema: this.schema,
             columns: columnsMapped,
@@ -1142,5 +1180,16 @@ export class DatabaseTable {
             // platforms that can't read comments back (sqlite), where keeping it would flip the snapshot
             comment: supportsComments ? this.comment || null : null,
         };
+        // emit RLS state only when set, so snapshots of non-RLS tables stay byte-for-byte unchanged
+        if (sortedPolicies.length > 0) {
+            ret.policies = sortedPolicies;
+        }
+        if (this.rlsEnabled) {
+            ret.rlsEnabled = true;
+        }
+        if (this.rlsForced) {
+            ret.rlsForced = true;
+        }
+        return ret;
     }
 }

package/schema/SchemaComparator.d.ts

@@ -88,6 +88,8 @@ export declare class SchemaComparator {
      */
     private diffViewExpression;
     private diffTrigger;
+    private diffPolicies;
+    private diffPolicy;
     parseJsonDefault(defaultValue?: string | null): Dictionary | string | null;
     private parseDecimalDefault;
     hasSameDefaultValue(from: Column, to: Column): boolean;