@mikro-orm/sql 7.2.0-dev.13 → 7.2.0-dev.15

package/schema/SchemaComparator.js

@@ -328,6 +328,7 @@ export class SchemaComparator {
             addedIndexes: {},
             addedChecks: {},
             addedTriggers: {},
+            addedPolicies: {},
             changedColumns: {},
             changedForeignKeys: {},
             changedIndexes: {},
@@ -338,6 +339,7 @@ export class SchemaComparator {
             removedIndexes: {},
             removedChecks: {},
             removedTriggers: {},
+            removedPolicies: {},
             renamedColumns: {},
             renamedIndexes: {},
             fromTable,
@@ -517,6 +519,9 @@ export class SchemaComparator {
                 }
             }
         }
+        if (this.#platform.supportsRowLevelSecurity()) {
+            changes += this.diffPolicies(fromTable, toTable, tableDifferences);
+        }
         const fromForeignKeys = { ...fromTable.getForeignKeys() };
         const toForeignKeys = { ...toTable.getForeignKeys() };
         for (const fromConstraint of Object.values(fromForeignKeys)) {
@@ -908,6 +913,10 @@ export class SchemaComparator {
                 // multi word type names in casts, the generic `::\w+` below only covers single word ones
                 // the precision is kept, so `timestamptz(3)` and `timestamp(3) with time zone` leave the same residue
                 .replace(/::\s*(?:character\s+varying|bit\s+varying|double\s+precision|(?:timestamp|time)\b(\s*\(\d+\))?(?:\s+with(?:out)?\s+time\s+zone)?)/gi, '$1')
+                // Protect dots inside string literals before the quote strip below, or the alias-prefix normalization
+                // would mangle literal contents — `current_setting('app.tenant')` and `current_setting('req.tenant')`
+                // must not both collapse to `current_settingtenant`
+                .replace(/'([^']*)'/g, (_, inner) => `'${inner.replaceAll('.', '\u0000')}'`)
                 // Remove quotes first so we can process identifiers
                 .replace(/['"`]/g, '')
                 // MySQL adds table/alias prefixes to columns (e.g., a.name or table_name.column vs just column)
@@ -963,13 +972,13 @@ export class SchemaComparator {
     }
     diffTrigger(from, to) {
         // Raw DDL expression cannot be meaningfully compared to introspected
-        // trigger metadata, so skip diffing when the metadata side uses it.
-        if (to.expression) {
+        // trigger metadata, so it needs special handling when either side uses it.
+        if (from.expression || to.expression) {
             // Both sides have expression — compare the raw DDL directly
-            if (from.expression) {
+            if (from.expression && to.expression) {
                 return this.diffExpression(from.expression, to.expression);
             }
-            // Only metadata side has expression — the raw DDL cannot be compared to
+            // Only one side has expression — the raw DDL cannot be compared to
             // introspected metadata. Changes to the expression value won't be detected;
             // drop and recreate the trigger manually to apply expression changes.
             return false;
@@ -985,6 +994,87 @@ export class SchemaComparator {
         }
         return this.diffExpression(from.body, to.body);
     }
+    diffPolicies(fromTable, toTable, diff) {
+        let changes = 0;
+        // `ignorePolicies` makes RLS create-only: declared policies are still added and RLS is still enabled/forced,
+        // but existing policies are never diffed for drop/alter and RLS is never disabled or unforced — this protects
+        // hand-written policies on databases that adopted RLS before the ORM managed it
+        const ignorePolicies = this.#platform.getConfig().get('schemaGenerator').ignorePolicies;
+        // postgres rejects `alter column ... type` on a column referenced by any policy, so a type change forces us to
+        // drop every still-present policy around the alter (dropped before via `getRlsDropSQL`, recreated after via
+        // `getRlsAlterSQL`) even when the policy itself is otherwise unchanged; a `generated`-only change is emitted
+        // as a drop + re-add of the same column, which a policy's column dependency blocks the same way
+        const hasColumnTypeChange = Object.values(diff.changedColumns).some(c => c.changedProperties.has('type')) ||
+            Object.keys(diff.removedColumns).some(name => name in diff.addedColumns);
+        for (const policy of toTable.getPolicies()) {
+            if (!fromTable.hasPolicy(policy.name)) {
+                diff.addedPolicies[policy.name] = policy;
+                this.log(`policy ${policy.name} added to table ${diff.name}`, { policy });
+                changes++;
+            }
+        }
+        if (fromTable.rlsEnabled !== toTable.rlsEnabled && (!ignorePolicies || toTable.rlsEnabled)) {
+            diff.changedRlsEnabled = toTable.rlsEnabled;
+            changes++;
+        }
+        if (fromTable.rlsForced !== toTable.rlsForced && (!ignorePolicies || toTable.rlsForced)) {
+            diff.changedRlsForced = toTable.rlsForced;
+            changes++;
+        }
+        if (ignorePolicies) {
+            // existing policies are unmanaged here, but a type change still needs them dropped and recreated for the
+            // alter to succeed — recreate each verbatim from introspection so the hand-written definition is preserved
+            if (hasColumnTypeChange) {
+                for (const policy of fromTable.getPolicies()) {
+                    diff.removedPolicies[policy.name] = policy;
+                    diff.addedPolicies[policy.name] = policy;
+                    changes += 2;
+                }
+            }
+            return changes;
+        }
+        for (const policy of fromTable.getPolicies()) {
+            const toPolicy = toTable.getPolicy(policy.name);
+            if (!toPolicy) {
+                diff.removedPolicies[policy.name] = policy;
+                this.log(`policy ${policy.name} removed from table ${diff.name}`);
+                changes++;
+                continue;
+            }
+            // changed policies are always dropped (before column drops, which the old expression can block via its
+            // column dependencies) and recreated (after column adds) — postgres could alter some of the changes in
+            // place, but not a policy's command or type, nor unset an expression
+            if (this.diffPolicy(policy, toPolicy)) {
+                diff.removedPolicies[policy.name] = policy;
+                diff.addedPolicies[policy.name] = toPolicy;
+                this.log(`policy ${policy.name} recreated in table ${diff.name}`, { from: policy, to: toPolicy });
+                changes += 2;
+                continue;
+            }
+            // an unchanged policy still blocks a type change on any column, so drop + recreate it around the alter
+            if (hasColumnTypeChange) {
+                diff.removedPolicies[policy.name] = policy;
+                diff.addedPolicies[policy.name] = toPolicy;
+                this.log(`policy ${policy.name} recreated around a column type change in table ${diff.name}`);
+                changes += 2;
+            }
+        }
+        return changes;
+    }
+    diffPolicy(from, to) {
+        // normalize so an omitted `roles` matches introspected `{public}`
+        const normalizeRoles = (roles) => DatabaseTable.isDefaultPolicyRoles(roles) ? '' : [...roles].sort().join(',');
+        if (from.command !== to.command || from.type !== to.type) {
+            return true;
+        }
+        if (normalizeRoles(from.roles) !== normalizeRoles(to.roles)) {
+            return true;
+        }
+        if (this.diffExpression(from.using ?? '', to.using ?? '')) {
+            return true;
+        }
+        return this.diffExpression(from.check ?? '', to.check ?? '');
+    }
     parseJsonDefault(defaultValue) {
         /* v8 ignore next */
         if (!defaultValue) {

package/schema/SchemaHelper.d.ts

@@ -154,6 +154,12 @@ export declare abstract class SchemaHelper {
     getChangeColumnCommentSQL(tableName: string, to: Column, schemaName?: string): string;
     /** Whether the column comment is part of the column declaration, as opposed to a separate statement. */
     protected hasInlineColumnComment(): boolean;
+    /** Row level security DDL for a freshly created table (enable/force + create policies). Postgres only. */
+    getRlsCreateSQL(table: DatabaseTable): string[];
+    /** Drops removed/changed row level security policies; emitted in the pre-alter phase, before any column drop or type alter a policy expression can block. Postgres only. */
+    getRlsDropSQL(diff: TableDifference, safe?: boolean): string[];
+    /** Row level security DDL for a table difference (enable/disable/force transitions + policy creation). Postgres only. */
+    getRlsAlterSQL(diff: TableDifference, safe?: boolean): string[];
     getNamespaces(connection: AbstractSqlConnection, ctx?: Transaction): Promise<string[]>;
     protected mapIndexes(indexes: IndexDef[]): Promise<IndexDef[]>;
     mapForeignKeys(fks: any[], tableName: string, schemaName?: string): Dictionary;

package/schema/SchemaHelper.js

@@ -504,6 +504,7 @@ export class SchemaHelper {
         if ('changedComment' in diff) {
             ret.push(this.alterTableComment(diff.toTable, diff.changedComment));
         }
+        this.append(ret, this.getRlsAlterSQL(diff, safe));
         return ret;
     }
     /** Returns SQL to add columns to an existing table. */
@@ -646,6 +647,18 @@ export class SchemaHelper {
     hasInlineColumnComment() {
         return false;
     }
+    /** Row level security DDL for a freshly created table (enable/force + create policies). Postgres only. */
+    getRlsCreateSQL(table) {
+        return [];
+    }
+    /** Drops removed/changed row level security policies; emitted in the pre-alter phase, before any column drop or type alter a policy expression can block. Postgres only. */
+    getRlsDropSQL(diff, safe) {
+        return [];
+    }
+    /** Row level security DDL for a table difference (enable/disable/force transitions + policy creation). Postgres only. */
+    getRlsAlterSQL(diff, safe) {
+        return [];
+    }
     async getNamespaces(connection, ctx) {
         return [];
     }
@@ -801,6 +814,8 @@ export class SchemaHelper {
             for (const trigger of table.getTriggers()) {
                 this.append(ret, this.createTrigger(table, trigger));
             }
+            // RLS policies can reference other tables, so they are deferred until every table exists (see the
+            // callers of getRlsCreateSQL in SqlSchemaGenerator) rather than emitted inline here
         }
         return ret;
     }

package/schema/SqlSchemaGenerator.js

@@ -94,6 +94,10 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
                 this.append(ret, fks, true);
             }
         }
+        // RLS policies are deferred until every table exists, so a policy expression can reference another table
+        for (const table of toSchema.getTables()) {
+            this.append(ret, this.helper.getRlsCreateSQL(table));
+        }
         const sortedViews = this.sortViewsByDependencies(toSchema.getViews());
         for (const view of sortedViews) {
             this.appendViewCreation(ret, view);
@@ -351,6 +355,7 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
                 for (const trigger of newTable.getTriggers()) {
                     this.append(sql, this.helper.createTrigger(newTable, trigger));
                 }
+                this.append(sql, this.helper.getRlsCreateSQL(newTable));
                 this.append(ret, sql, true);
             }
         }
@@ -410,6 +415,9 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
     }
     preAlterTable(diff, safe) {
         const ret = [];
+        // removed/changed policies must be dropped before any column type alter, including the pre-alter
+        // uuid-to-text cast on postgres — a policy expression blocks type changes on the columns it references
+        this.append(ret, this.helper.getRlsDropSQL(diff, safe));
         this.append(ret, this.helper.getPreAlterTable(diff, safe));
         for (const foreignKey of Object.values(diff.removedForeignKeys)) {
             ret.push(this.helper.dropForeignKey(diff.toTable.getShortestName(), foreignKey.constraintName));

package/typings.d.ts

@@ -114,6 +114,15 @@ export interface CheckDef<T = unknown> {
     definition?: string;
     columnName?: string;
 }
+/** Resolved row level security policy for schema operations (all callbacks resolved to strings). */
+export interface SqlPolicyDef {
+    name: string;
+    command: 'select' | 'insert' | 'update' | 'delete' | 'all';
+    type: 'permissive' | 'restrictive';
+    roles: string[];
+    using?: string;
+    check?: string;
+}
 /** Resolved trigger definition for schema operations (all callbacks resolved to strings). */
 export interface SqlTriggerDef {
     name: string;
@@ -191,6 +200,13 @@ export interface TableDifference {
     addedTriggers: Dictionary<SqlTriggerDef>;
     changedTriggers: Dictionary<SqlTriggerDef>;
     removedTriggers: Dictionary<SqlTriggerDef>;
+    addedPolicies: Dictionary<SqlPolicyDef>;
+    /** Changed policies surface as `removedPolicies` + `addedPolicies` pairs (drop + recreate). */
+    removedPolicies: Dictionary<SqlPolicyDef>;
+    /** New RLS enable state, present only when it changed. */
+    changedRlsEnabled?: boolean;
+    /** New RLS force state, present only when it changed. */
+    changedRlsForced?: boolean;
     addedForeignKeys: Dictionary<ForeignKey>;
     changedForeignKeys: Dictionary<ForeignKey>;
     removedForeignKeys: Dictionary<ForeignKey>;
@@ -277,6 +293,8 @@ export interface IQueryBuilder<T> {
     with(name: string, query: AnyQueryBuilder | NativeQueryBuilder | RawQueryFragment, options?: CteOptions): this;
     withRecursive(name: string, query: AnyQueryBuilder | NativeQueryBuilder | RawQueryFragment, options?: CteOptions): this;
     scheduleFilterCheck(path: string): void;
+    /** @internal */
+    ensureTPTJoins(): void;
     withSchema(schema: string): this;
 }
 export interface ICriteriaNodeProcessOptions {