@nest-boot/row-level-security 7.0.0 → 7.2.0

package/dist/utils/create-policy-bootstrap-sql-statements.d.ts

@@ -1,2 +1,2 @@
-/** Creates SQL statements for shared RLS roles, grants, schema, and `app.get_context`. */
+/** Creates SQL statements for the shared RLS schema and `app.get_context` helper. */
 export declare function createPolicyBootstrapSqlStatements(): string[];

package/dist/utils/create-policy-bootstrap-sql-statements.js

@@ -1,16 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createPolicyBootstrapSqlStatements = createPolicyBootstrapSqlStatements;
-/** Creates SQL statements for shared RLS roles, grants, schema, and `app.get_context`. */
+/** Creates SQL statements for the shared RLS schema and `app.get_context` helper. */
 function createPolicyBootstrapSqlStatements() {
     return [
-        "do $$ begin if not exists (select 1 from pg_roles where rolname = 'authenticated') then create role authenticated nologin; end if; end $$;",
-        "do $$ begin if not exists (select 1 from pg_roles where rolname = 'anonymous') then create role anonymous nologin; end if; end $$;",
-        "grant authenticated to current_user;",
-        "grant anonymous to current_user;",
         "create schema if not exists app;",
-        "grant usage on schema app to authenticated;",
-        "grant usage on schema app to anonymous;",
         "create or replace function app.get_context(context_key text, context_type anyelement) returns anyelement as $$ declare context_value text; begin context_value := current_setting('app.' || context_key, true); if context_value is null or context_value = '' then return null; end if; execute format('select $1::%s', pg_typeof(context_type)::text) using context_value into context_type; return context_type; end; $$ language plpgsql stable;",
     ];
 }

package/dist/utils/create-policy-bootstrap-sql-statements.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-policy-bootstrap-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-bootstrap-sql-statements.ts"],"names":[],"mappings":";;AACA,gFAWC;AAZD,0FAA0F;AAC1F,SAAgB,kCAAkC;IAChD,OAAO;QACL,4IAA4I;QAC5I,oIAAoI;QACpI,sCAAsC;QACtC,kCAAkC;QAClC,kCAAkC;QAClC,6CAA6C;QAC7C,yCAAyC;QACzC,sbAAsb;KACvb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"create-policy-bootstrap-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-bootstrap-sql-statements.ts"],"names":[],"mappings":";;AACA,gFAKC;AAND,qFAAqF;AACrF,SAAgB,kCAAkC;IAChD,OAAO;QACL,kCAAkC;QAClC,sbAAsb;KACvb,CAAC;AACJ,CAAC"}

package/dist/utils/create-policy-privilege-down-sql-statements.d.ts

@@ -0,0 +1,8 @@
+import type { PolicySqlOptions } from "../interfaces/policy-sql-options.interface";
+/**
+ * Creates SQL that revokes table and sequence privileges emitted for a policy.
+ *
+ * Preserved policies keep overlapping privileges for the same schema, table,
+ * and role from being revoked during rollback.
+ */
+export declare function createPolicyPrivilegeDownSqlStatements(options: PolicySqlOptions, preservedPolicies?: PolicySqlOptions[]): string[];

package/dist/utils/create-policy-privilege-down-sql-statements.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPolicyPrivilegeDownSqlStatements = createPolicyPrivilegeDownSqlStatements;
+const policy_command_enum_1 = require("../enums/policy-command.enum");
+const assert_identifier_1 = require("./assert-identifier");
+const escape_sql_literal_1 = require("./escape-sql-literal");
+const quote_qualified_identifier_1 = require("./quote-qualified-identifier");
+/**
+ * Creates SQL that revokes table and sequence privileges emitted for a policy.
+ *
+ * Preserved policies keep overlapping privileges for the same schema, table,
+ * and role from being revoked during rollback.
+ */
+function createPolicyPrivilegeDownSqlStatements(options, preservedPolicies = []) {
+    const roles = getPolicySqlRoleNames(options.roles);
+    if (roles.length === 0) {
+        return [];
+    }
+    const tableIdentifier = (0, quote_qualified_identifier_1.quoteQualifiedIdentifier)(options.schemaName, options.tableName);
+    const command = options.command ?? policy_command_enum_1.PolicyCommand.ALL;
+    const statements = createTablePrivilegeRevokeSqlStatements(options, tableIdentifier, roles, preservedPolicies);
+    if (requiresSequencePrivileges(command)) {
+        const sequenceRevokeRoles = roles.filter((role) => !hasPreservedSequencePrivileges(options, role, preservedPolicies));
+        if (sequenceRevokeRoles.length > 0) {
+            statements.push(createSequenceRevokeSql(options, tableIdentifier, sequenceRevokeRoles.join(", ")));
+        }
+    }
+    return statements;
+}
+function createTablePrivilegeRevokeSqlStatements(options, tableIdentifier, roles, preservedPolicies) {
+    const command = options.command ?? policy_command_enum_1.PolicyCommand.ALL;
+    const privileges = getTablePrivileges(command);
+    const rolesByPrivileges = new Map();
+    for (const role of roles) {
+        const preservedPrivileges = getPreservedTablePrivileges(options, role, preservedPolicies);
+        const revocablePrivileges = privileges.filter((privilege) => !preservedPrivileges.has(privilege));
+        if (revocablePrivileges.length === 0) {
+            continue;
+        }
+        const privilegeSql = revocablePrivileges.join(", ");
+        const groupedRoles = rolesByPrivileges.get(privilegeSql) ?? [];
+        groupedRoles.push(role);
+        rolesByPrivileges.set(privilegeSql, groupedRoles);
+    }
+    return [...rolesByPrivileges].map(([privilegeSql, groupedRoles]) => `revoke ${privilegeSql} on table ${tableIdentifier} from ${groupedRoles.join(", ")};`);
+}
+function getTablePrivileges(command) {
+    if (command === policy_command_enum_1.PolicyCommand.SELECT) {
+        return ["select"];
+    }
+    if (command === policy_command_enum_1.PolicyCommand.INSERT) {
+        return ["insert"];
+    }
+    if (command === policy_command_enum_1.PolicyCommand.UPDATE) {
+        return ["select", "update"];
+    }
+    if (command === policy_command_enum_1.PolicyCommand.DELETE) {
+        return ["select", "delete"];
+    }
+    return ["select", "insert", "update", "delete"];
+}
+function requiresSequencePrivileges(command) {
+    return command === policy_command_enum_1.PolicyCommand.INSERT || command === policy_command_enum_1.PolicyCommand.ALL;
+}
+function getPreservedTablePrivileges(options, role, preservedPolicies) {
+    const privileges = new Set();
+    for (const preservedPolicy of getPreservedPoliciesForRole(options, role, preservedPolicies)) {
+        for (const privilege of getTablePrivileges(preservedPolicy.command ?? policy_command_enum_1.PolicyCommand.ALL)) {
+            privileges.add(privilege);
+        }
+    }
+    return privileges;
+}
+function hasPreservedSequencePrivileges(options, role, preservedPolicies) {
+    return getPreservedPoliciesForRole(options, role, preservedPolicies).some((preservedPolicy) => requiresSequencePrivileges(preservedPolicy.command ?? policy_command_enum_1.PolicyCommand.ALL));
+}
+function getPreservedPoliciesForRole(options, role, preservedPolicies) {
+    return preservedPolicies.filter((preservedPolicy) => isSamePolicyTarget(options, preservedPolicy) &&
+        getPolicySqlRoleNames(preservedPolicy.roles).includes(role));
+}
+function getPolicySqlRoleNames(roles) {
+    return [...new Set((roles ?? []).map((role) => (0, assert_identifier_1.assertIdentifier)(role)))];
+}
+function isSamePolicyTarget(left, right) {
+    return (left.schemaName === right.schemaName && left.tableName === right.tableName);
+}
+function createSequenceRevokeSql(options, tableIdentifier, roleSql) {
+    const tableLiteral = (0, escape_sql_literal_1.escapeSqlLiteral)(tableIdentifier);
+    const schemaName = (0, escape_sql_literal_1.escapeSqlLiteral)(options.schemaName);
+    const tableName = (0, escape_sql_literal_1.escapeSqlLiteral)(options.tableName);
+    return /* SQL */ `do $$ declare sequence_identifier text; begin for sequence_identifier in select pg_get_serial_sequence('${tableLiteral}', columns.column_name) from information_schema.columns where columns.table_schema = '${schemaName}' and columns.table_name = '${tableName}' and pg_get_serial_sequence('${tableLiteral}', columns.column_name) is not null loop execute format('revoke usage, select on sequence %s from ${roleSql}', sequence_identifier); end loop; end $$;`;
+}
+//# sourceMappingURL=create-policy-privilege-down-sql-statements.js.map

package/dist/utils/create-policy-privilege-down-sql-statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-policy-privilege-down-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-privilege-down-sql-statements.ts"],"names":[],"mappings":";;AAYA,wFAwCC;AApDD,sEAA6D;AAE7D,2DAAuD;AACvD,6DAAwD;AACxD,6EAAwE;AAExE;;;;;GAKG;AACH,SAAgB,sCAAsC,CACpD,OAAyB,EACzB,oBAAwC,EAAE;IAE1C,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,eAAe,GAAG,IAAA,qDAAwB,EAC9C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,uCAAuC,CACxD,OAAO,EACP,eAAe,EACf,KAAK,EACL,iBAAiB,CAClB,CAAC;IAEF,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,8BAA8B,CAAC,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,CACpE,CAAC;QAEF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CACb,uBAAuB,CACrB,OAAO,EACP,eAAe,EACf,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,uCAAuC,CAC9C,OAAyB,EACzB,eAAuB,EACvB,KAAe,EACf,iBAAqC;IAErC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,mBAAmB,GAAG,2BAA2B,CACrD,OAAO,EACP,IAAI,EACJ,iBAAiB,CAClB,CAAC;QACF,MAAM,mBAAmB,GAAG,UAAU,CAAC,MAAM,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CACnD,CAAC;QAEF,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAE/D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC,GAAG,CAC/B,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,CAC/B,UAAU,YAAY,aAAa,eAAe,SAAS,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsB;IAChD,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAsB;IACxD,OAAO,OAAO,KAAK,mCAAa,CAAC,MAAM,IAAI,OAAO,KAAK,mCAAa,CAAC,GAAG,CAAC;AAC3E,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAyB,EACzB,IAAY,EACZ,iBAAqC;IAErC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,eAAe,IAAI,2BAA2B,CACvD,OAAO,EACP,IAAI,EACJ,iBAAiB,CAClB,EAAE,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,kBAAkB,CACxC,eAAe,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAC7C,EAAE,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CACrC,OAAyB,EACzB,IAAY,EACZ,iBAAqC;IAErC,OAAO,2BAA2B,CAAC,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,CAAC,eAAe,EAAE,EAAE,CAClB,0BAA0B,CAAC,eAAe,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAyB,EACzB,IAAY,EACZ,iBAAqC;IAErC,OAAO,iBAAiB,CAAC,MAAM,CAC7B,CAAC,eAAe,EAAE,EAAE,CAClB,kBAAkB,CAAC,OAAO,EAAE,eAAe,CAAC;QAC5C,qBAAqB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA2B;IACxD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oCAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAsB,EAAE,KAAuB;IACzE,OAAO,CACL,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,MAAM,YAAY,GAAG,IAAA,qCAAgB,EAAC,eAAe,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAA,qCAAgB,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAA,qCAAgB,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAO,SAAS,CAAC,2GAA2G,YAAY,yFAAyF,UAAU,+BAA+B,SAAS,iCAAiC,YAAY,qGAAqG,OAAO,4CAA4C,CAAC;AAC3d,CAAC"}

package/dist/utils/create-policy-role-sql-statements.d.ts

@@ -0,0 +1,6 @@
+/** Creates SQL that ensures RLS roles and grants required runtime privileges. */
+export declare function createPolicyRoleUpSqlStatements(roles?: Iterable<string>): string[];
+/** Creates SQL that revokes schema and membership grants for the supplied roles. */
+export declare function createPolicyRoleDownSqlStatements(roles?: Iterable<string>): string[];
+/** Returns unique policy roles, always including the anonymous fallback role. */
+export declare function getPolicyRoleNames(roles?: Iterable<string>): string[];

package/dist/utils/create-policy-role-sql-statements.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPolicyRoleUpSqlStatements = createPolicyRoleUpSqlStatements;
+exports.createPolicyRoleDownSqlStatements = createPolicyRoleDownSqlStatements;
+exports.getPolicyRoleNames = getPolicyRoleNames;
+const row_level_security_role_enum_1 = require("../enums/row-level-security-role.enum");
+const assert_identifier_1 = require("./assert-identifier");
+const escape_sql_literal_1 = require("./escape-sql-literal");
+/** Creates SQL that ensures RLS roles and grants required runtime privileges. */
+function createPolicyRoleUpSqlStatements(roles = []) {
+    return getPolicyRoleNames(roles).flatMap((role) => {
+        const roleName = (0, assert_identifier_1.assertIdentifier)(role);
+        const roleLiteral = (0, escape_sql_literal_1.escapeSqlLiteral)(roleName);
+        return [
+            `do $$ begin if not exists (select 1 from pg_roles where rolname = '${roleLiteral}') then create role ${roleName} nologin; end if; end $$;`,
+            `grant ${roleName} to current_user;`,
+            `grant usage on schema app to ${roleName};`,
+        ];
+    });
+}
+/** Creates SQL that revokes schema and membership grants for the supplied roles. */
+function createPolicyRoleDownSqlStatements(roles = []) {
+    return [...getExplicitPolicyRoleNames(roles)].sort().flatMap((role) => {
+        const roleName = (0, assert_identifier_1.assertIdentifier)(role);
+        return [
+            `revoke usage on schema app from ${roleName};`,
+            `revoke ${roleName} from current_user;`,
+        ];
+    });
+}
+/** Returns unique policy roles, always including the anonymous fallback role. */
+function getPolicyRoleNames(roles = []) {
+    const roleNames = getExplicitPolicyRoleNames(roles);
+    roleNames.delete(row_level_security_role_enum_1.RowLevelSecurityRole.ANONYMOUS);
+    return [row_level_security_role_enum_1.RowLevelSecurityRole.ANONYMOUS, ...[...roleNames].sort()];
+}
+/** Returns unique explicit policy roles without adding fallback roles. */
+function getExplicitPolicyRoleNames(roles) {
+    const roleNames = new Set();
+    for (const role of roles) {
+        if (role.toLowerCase() === "public") {
+            continue;
+        }
+        roleNames.add((0, assert_identifier_1.assertIdentifier)(role));
+    }
+    return roleNames;
+}
+//# sourceMappingURL=create-policy-role-sql-statements.js.map

package/dist/utils/create-policy-role-sql-statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-policy-role-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-role-sql-statements.ts"],"names":[],"mappings":";;AAKA,0EAWC;AAGD,8EAWC;AAGD,gDAMC;AAvCD,wFAA6E;AAC7E,2DAAuD;AACvD,6DAAwD;AAExD,iFAAiF;AACjF,SAAgB,+BAA+B,CAAC,QAA0B,EAAE;IAC1E,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,IAAA,oCAAgB,EAAC,IAAI,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,IAAA,qCAAgB,EAAC,QAAQ,CAAC,CAAC;QAE/C,OAAO;YACL,sEAAsE,WAAW,uBAAuB,QAAQ,2BAA2B;YAC3I,SAAS,QAAQ,mBAAmB;YACpC,gCAAgC,QAAQ,GAAG;SAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,SAAgB,iCAAiC,CAC/C,QAA0B,EAAE;IAE5B,OAAO,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACpE,MAAM,QAAQ,GAAG,IAAA,oCAAgB,EAAC,IAAI,CAAC,CAAC;QAExC,OAAO;YACL,mCAAmC,QAAQ,GAAG;YAC9C,UAAU,QAAQ,qBAAqB;SACxC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,SAAgB,kBAAkB,CAAC,QAA0B,EAAE;IAC7D,MAAM,SAAS,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAEpD,SAAS,CAAC,MAAM,CAAC,mDAAoB,CAAC,SAAS,CAAC,CAAC;IAEjD,OAAO,CAAC,mDAAoB,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,0EAA0E;AAC1E,SAAS,0BAA0B,CAAC,KAAuB;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QAED,SAAS,CAAC,GAAG,CAAC,IAAA,oCAAgB,EAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/create-policy-up-sql-statements.js

@@ -102,13 +102,19 @@ function assertPolicyPredicates(command, predicates) {
 function getPolicyPredicateSql(command, predicates) {
     const fragments = [];
     if (command !== policy_command_enum_1.PolicyCommand.INSERT && predicates.using) {
-        fragments.push(`using ${predicates.using}`);
+        fragments.push(`using ${createPredicateExpressionSql(predicates.using)}`);
     }
     if (command !== policy_command_enum_1.PolicyCommand.SELECT &&
         command !== policy_command_enum_1.PolicyCommand.DELETE &&
         predicates.withCheck) {
-        fragments.push(`with check ${predicates.withCheck}`);
+        fragments.push(`with check ${createPredicateExpressionSql(predicates.withCheck)}`);
     }
     return fragments.join(" ");
 }
+function createPredicateExpressionSql(expression) {
+    return isParenthesizedExpression(expression) ? expression : `(${expression})`;
+}
+function isParenthesizedExpression(expression) {
+    return expression.startsWith("(") && expression.endsWith(")");
+}
 //# sourceMappingURL=create-policy-up-sql-statements.js.map

package/dist/utils/create-policy-up-sql-statements.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-policy-up-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-up-sql-statements.ts"],"names":[],"mappings":";;AAQA,kEAkBC;AA1BD,sEAA6D;AAC7D,gEAAuD;AAEvD,2DAAuD;AACvD,6DAAwD;AACxD,6EAAwE;AAExE,+EAA+E;AAC/E,SAAgB,2BAA2B,CAAC,OAAyB;IACnE,MAAM,eAAe,GAAG,IAAA,qDAAwB,EAC9C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,MAAM,UAAU,GAAG,IAAA,oCAAgB,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,6BAAU,CAAC,UAAU,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oCAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEhD,OAAO;QACL,eAAe,eAAe,6BAA6B;QAC3D,GAAG,iCAAiC,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC;QACvE,yBAAyB,UAAU,OAAO,eAAe,GAAG;QAC5D,iBAAiB,UAAU,OAAO,eAAe,OAAO,IAAI,QAAQ,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG;KAC/J,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,SAAS,UAAU,aAAa,eAAe,OAAO,OAAO,GAAG;KACjE,CAAC;IAEF,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsB;IAChD,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAsB;IACxD,OAAO,OAAO,KAAK,mCAAa,CAAC,MAAM,IAAI,OAAO,KAAK,mCAAa,CAAC,GAAG,CAAC;AAC3E,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,MAAM,YAAY,GAAG,IAAA,qCAAgB,EAAC,eAAe,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAA,qCAAgB,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAA,qCAAgB,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAO,SAAS,CAAC,2GAA2G,YAAY,yFAAyF,UAAU,+BAA+B,SAAS,iCAAiC,YAAY,kGAAkG,OAAO,4CAA4C,CAAC;AACxd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAyB;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG;QACjB,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;KAClD,CAAC;IAEF,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE5C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAAC,UAA8B;IACzD,MAAM,UAAU,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IAEtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAsB,EACtB,UAAkD;IAElD,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAsB,EACtB,UAAkD;IAElD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACzD,SAAS,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,IACE,OAAO,KAAK,mCAAa,CAAC,MAAM;QAChC,OAAO,KAAK,mCAAa,CAAC,MAAM;QAChC,UAAU,CAAC,SAAS,EACpB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"create-policy-up-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-up-sql-statements.ts"],"names":[],"mappings":";;AAQA,kEAkBC;AA1BD,sEAA6D;AAC7D,gEAAuD;AAEvD,2DAAuD;AACvD,6DAAwD;AACxD,6EAAwE;AAExE,+EAA+E;AAC/E,SAAgB,2BAA2B,CAAC,OAAyB;IACnE,MAAM,eAAe,GAAG,IAAA,qDAAwB,EAC9C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,MAAM,UAAU,GAAG,IAAA,oCAAgB,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,6BAAU,CAAC,UAAU,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oCAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEhD,OAAO;QACL,eAAe,eAAe,6BAA6B;QAC3D,GAAG,iCAAiC,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC;QACvE,yBAAyB,UAAU,OAAO,eAAe,GAAG;QAC5D,iBAAiB,UAAU,OAAO,eAAe,OAAO,IAAI,QAAQ,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG;KAC/J,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,SAAS,UAAU,aAAa,eAAe,OAAO,OAAO,GAAG;KACjE,CAAC;IAEF,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsB;IAChD,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAsB;IACxD,OAAO,OAAO,KAAK,mCAAa,CAAC,MAAM,IAAI,OAAO,KAAK,mCAAa,CAAC,GAAG,CAAC;AAC3E,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,MAAM,YAAY,GAAG,IAAA,qCAAgB,EAAC,eAAe,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAA,qCAAgB,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAA,qCAAgB,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAO,SAAS,CAAC,2GAA2G,YAAY,yFAAyF,UAAU,+BAA+B,SAAS,iCAAiC,YAAY,kGAAkG,OAAO,4CAA4C,CAAC;AACxd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAyB;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mCAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG;QACjB,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;KAClD,CAAC;IAEF,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE5C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAAC,UAA8B;IACzD,MAAM,UAAU,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IAEtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAsB,EACtB,UAAkD;IAElD,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAsB,EACtB,UAAkD;IAElD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACzD,SAAS,CAAC,IAAI,CAAC,SAAS,4BAA4B,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IACE,OAAO,KAAK,mCAAa,CAAC,MAAM;QAChC,OAAO,KAAK,mCAAa,CAAC,MAAM;QAChC,UAAU,CAAC,SAAS,EACpB,CAAC;QACD,SAAS,CAAC,IAAI,CACZ,cAAc,4BAA4B,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAkB;IACtD,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC;AAChF,CAAC;AAED,SAAS,yBAAyB,CAAC,UAAkB;IACnD,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC"}

package/dist/utils/create-row-level-security-transaction-setup.d.ts

@@ -0,0 +1,20 @@
+/** Instruction for row level security transaction setup. */
+export type RowLevelSecurityTransactionSetup = RowLevelSecurityApplyTransactionSetup | RowLevelSecurityClearTransactionSetup;
+/** SQL and cache key for applying row level security on a transaction. */
+export interface RowLevelSecurityApplyTransactionSetup {
+    /** Applies row level security state to the transaction. */
+    action: "apply";
+    /** Transaction-local SQL that applies the PostgreSQL role and context settings. */
+    sql: string;
+    /** Stable cache key used to skip repeated setup on the same transaction. */
+    signature: string;
+    /** Context setting keys emitted by this setup. */
+    contextKeys: string[];
+}
+/** Instruction to clear previously applied row level security state. */
+export interface RowLevelSecurityClearTransactionSetup {
+    /** Clears row level security state previously applied to the transaction. */
+    action: "clear";
+}
+/** Creates transaction-local SQL for the current row level security context. */
+export declare function createRowLevelSecurityTransactionSetup(): RowLevelSecurityTransactionSetup | undefined;

package/dist/utils/create-row-level-security-transaction-setup.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRowLevelSecurityTransactionSetup = createRowLevelSecurityTransactionSetup;
+const request_context_1 = require("@nest-boot/request-context");
+const row_level_security_role_enum_1 = require("../enums/row-level-security-role.enum");
+const row_level_security_1 = require("../row-level-security");
+const assert_snake_case_1 = require("./assert-snake-case");
+const row_level_security_context_builder_1 = require("./row-level-security-context-builder");
+/** Creates transaction-local SQL for the current row level security context. */
+function createRowLevelSecurityTransactionSetup() {
+    if (!request_context_1.RequestContext.isActive()) {
+        return;
+    }
+    const builder = new row_level_security_context_builder_1.RowLevelSecurityContextBuilder();
+    const mode = row_level_security_1.RowLevelSecurity.getMode();
+    const contextEntries = row_level_security_1.RowLevelSecurity.entries();
+    const role = row_level_security_1.RowLevelSecurity.getRole();
+    if (mode === row_level_security_1.RowLevelSecurityMode.DISABLED) {
+        return {
+            action: "clear",
+        };
+    }
+    if (mode === row_level_security_1.RowLevelSecurityMode.AUTO &&
+        !role &&
+        contextEntries.length === 0) {
+        return {
+            action: "clear",
+        };
+    }
+    appendContext(builder, contextEntries);
+    const databaseRole = role ?? row_level_security_role_enum_1.RowLevelSecurityRole.ANONYMOUS;
+    (0, assert_snake_case_1.assertSnakeCase)(databaseRole, "Row level security database role");
+    const contextSql = builder.entries().length > 0 ? builder.toSQL() : "";
+    const sql = [/* SQL */ `SET LOCAL ROLE ${databaseRole};`, contextSql]
+        .filter(Boolean)
+        .join("\n");
+    const signature = JSON.stringify({
+        context: builder.entries(),
+        role: databaseRole,
+    });
+    return {
+        action: "apply",
+        contextKeys: builder.entries().map(([key]) => key),
+        signature,
+        sql,
+    };
+}
+function appendContext(builder, context) {
+    for (const [key, value] of context ?? []) {
+        builder.set(key, value);
+    }
+}
+//# sourceMappingURL=create-row-level-security-transaction-setup.js.map

package/dist/utils/create-row-level-security-transaction-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-row-level-security-transaction-setup.js","sourceRoot":"","sources":["../../src/utils/create-row-level-security-transaction-setup.ts"],"names":[],"mappings":";;AAgCA,wFA+CC;AA/ED,gEAA4D;AAE5D,wFAA6E;AAC7E,8DAA+E;AAC/E,2DAAsD;AACtD,6FAAsF;AA0BtF,gFAAgF;AAChF,SAAgB,sCAAsC;IAGpD,IAAI,CAAC,gCAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,mEAA8B,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qCAAgB,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,qCAAgB,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,qCAAgB,CAAC,OAAO,EAAE,CAAC;IAExC,IAAI,IAAI,KAAK,yCAAoB,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,IACE,IAAI,KAAK,yCAAoB,CAAC,IAAI;QAClC,CAAC,IAAI;QACL,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,IAAI,mDAAoB,CAAC,SAAS,CAAC;IAC5D,IAAA,mCAAe,EAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;IAElE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,kBAAkB,YAAY,GAAG,EAAE,UAAU,CAAC;SAClE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;QAC1B,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAClD,SAAS;QACT,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAuC,EACvC,OAEa;IAEb,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/utils/index.d.ts

@@ -2,12 +2,11 @@ export * from "./assert-identifier";
 export * from "./assert-snake-case";
 export * from "./create-policy-bootstrap-sql-statements";
 export * from "./create-policy-down-sql";
+export * from "./create-policy-privilege-down-sql-statements";
+export * from "./create-policy-role-sql-statements";
 export * from "./create-policy-up-sql-statements";
-export * from "./default-row-level-security-options";
 export * from "./escape-sql-literal";
-export * from "./get-row-level-security-options";
 export * from "./quote-identifier";
 export * from "./quote-qualified-identifier";
 export * from "./row-level-security-context-builder";
 export type * from "./row-level-security-context-builder.types";
-export * from "./set-row-level-security-options";

package/dist/utils/index.js

@@ -18,12 +18,11 @@ __exportStar(require("./assert-identifier"), exports);
 __exportStar(require("./assert-snake-case"), exports);
 __exportStar(require("./create-policy-bootstrap-sql-statements"), exports);
 __exportStar(require("./create-policy-down-sql"), exports);
+__exportStar(require("./create-policy-privilege-down-sql-statements"), exports);
+__exportStar(require("./create-policy-role-sql-statements"), exports);
 __exportStar(require("./create-policy-up-sql-statements"), exports);
-__exportStar(require("./default-row-level-security-options"), exports);
 __exportStar(require("./escape-sql-literal"), exports);
-__exportStar(require("./get-row-level-security-options"), exports);
 __exportStar(require("./quote-identifier"), exports);
 __exportStar(require("./quote-qualified-identifier"), exports);
 __exportStar(require("./row-level-security-context-builder"), exports);
-__exportStar(require("./set-row-level-security-options"), exports);
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,sDAAoC;AACpC,2EAAyD;AACzD,2DAAyC;AACzC,oEAAkD;AAClD,uEAAqD;AACrD,uDAAqC;AACrC,mEAAiD;AACjD,qDAAmC;AACnC,+DAA6C;AAC7C,uEAAqD;AAErD,mEAAiD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,sDAAoC;AACpC,2EAAyD;AACzD,2DAAyC;AACzC,gFAA8D;AAC9D,sEAAoD;AACpD,oEAAkD;AAClD,uDAAqC;AACrC,qDAAmC;AACnC,+DAA6C;AAC7C,uEAAqD"}

package/dist/utils/policy-migration-sql.spec.js

@@ -4,23 +4,60 @@ const policy_command_enum_1 = require("../enums/policy-command.enum");
 const policy_mode_enum_1 = require("../enums/policy-mode.enum");
 const create_policy_bootstrap_sql_statements_1 = require("./create-policy-bootstrap-sql-statements");
 const create_policy_down_sql_1 = require("./create-policy-down-sql");
+const create_policy_privilege_down_sql_statements_1 = require("./create-policy-privilege-down-sql-statements");
+const create_policy_role_sql_statements_1 = require("./create-policy-role-sql-statements");
 const create_policy_up_sql_statements_1 = require("./create-policy-up-sql-statements");
 describe("policy migration SQL", () => {
     it("generates row level security bootstrap SQL", () => {
         const statements = (0, create_policy_bootstrap_sql_statements_1.createPolicyBootstrapSqlStatements)();
         expect(statements).toEqual([
-            "do $$ begin if not exists (select 1 from pg_roles where rolname = 'authenticated') then create role authenticated nologin; end if; end $$;",
-            "do $$ begin if not exists (select 1 from pg_roles where rolname = 'anonymous') then create role anonymous nologin; end if; end $$;",
-            "grant authenticated to current_user;",
-            "grant anonymous to current_user;",
             "create schema if not exists app;",
-            "grant usage on schema app to authenticated;",
-            "grant usage on schema app to anonymous;",
             "create or replace function app.get_context(context_key text, context_type anyelement) returns anyelement as $$ declare context_value text; begin context_value := current_setting('app.' || context_key, true); if context_value is null or context_value = '' then return null; end if; execute format('select $1::%s', pg_typeof(context_type)::text) using context_value into context_type; return context_type; end; $$ language plpgsql stable;",
         ]);
         expect(statements.join("\n")).not.toContain("grant all on all tables");
         expect(statements.join("\n")).not.toContain("get_policy_context");
     });
+    it("generates up-only role SQL for anonymous and custom policy roles", () => {
+        const statements = (0, create_policy_role_sql_statements_1.createPolicyRoleUpSqlStatements)([
+            "authenticated",
+            "workspace_admin",
+        ]);
+        expect(statements).toEqual([
+            "do $$ begin if not exists (select 1 from pg_roles where rolname = 'anonymous') then create role anonymous nologin; end if; end $$;",
+            "grant anonymous to current_user;",
+            "grant usage on schema app to anonymous;",
+            "do $$ begin if not exists (select 1 from pg_roles where rolname = 'authenticated') then create role authenticated nologin; end if; end $$;",
+            "grant authenticated to current_user;",
+            "grant usage on schema app to authenticated;",
+            "do $$ begin if not exists (select 1 from pg_roles where rolname = 'workspace_admin') then create role workspace_admin nologin; end if; end $$;",
+            "grant workspace_admin to current_user;",
+            "grant usage on schema app to workspace_admin;",
+        ]);
+    });
+    it("generates role down SQL that revokes grants without dropping roles", () => {
+        const statements = (0, create_policy_role_sql_statements_1.createPolicyRoleDownSqlStatements)(["workspace_admin"]);
+        expect(statements).toEqual([
+            "revoke usage on schema app from workspace_admin;",
+            "revoke workspace_admin from current_user;",
+        ]);
+        expect(statements.join("\n")).not.toContain("drop role");
+    });
+    it("generates role down SQL for an explicit anonymous role", () => {
+        const statements = (0, create_policy_role_sql_statements_1.createPolicyRoleDownSqlStatements)(["anonymous"]);
+        expect(statements).toEqual([
+            "revoke usage on schema app from anonymous;",
+            "revoke anonymous from current_user;",
+        ]);
+    });
+    it("normalizes policy role names with anonymous first and public skipped", () => {
+        expect((0, create_policy_role_sql_statements_1.getPolicyRoleNames)()).toEqual(["anonymous"]);
+        expect((0, create_policy_role_sql_statements_1.getPolicyRoleNames)([
+            "workspace_admin",
+            "public",
+            "authenticated",
+            "workspace_admin",
+        ])).toEqual(["anonymous", "authenticated", "workspace_admin"]);
+    });
     it("generates policy up SQL", () => {
         const statements = (0, create_policy_up_sql_statements_1.createPolicyUpSqlStatements)({
             schemaName: "public",
@@ -46,6 +83,17 @@ describe("policy migration SQL", () => {
         });
         expect(statements[2]).toBe('drop policy if exists workspace_member_user_select_policy on "public"."workspace_member";');
     });
+    it("wraps raw using predicates in parentheses", () => {
+        const statements = (0, create_policy_up_sql_statements_1.createPolicyUpSqlStatements)({
+            schemaName: "public",
+            tableName: "user",
+            policyName: "user_select_authenticated_policy",
+            command: policy_command_enum_1.PolicyCommand.SELECT,
+            using: "true",
+            roles: ["authenticated"],
+        });
+        expect(statements).toContain('create policy user_select_authenticated_policy on "public"."user" as permissive for select to authenticated using (true);');
+    });
     it("generates table grants for explicit policy roles", () => {
         const statements = (0, create_policy_up_sql_statements_1.createPolicyUpSqlStatements)({
             schemaName: "public",
@@ -77,6 +125,76 @@ describe("policy migration SQL", () => {
             expect.stringContaining("grant usage, select on sequence %s to authenticated"),
         ]));
     });
+    it.each([
+        [policy_command_enum_1.PolicyCommand.SELECT, "revoke select on table"],
+        [policy_command_enum_1.PolicyCommand.INSERT, "revoke insert on table"],
+        [policy_command_enum_1.PolicyCommand.UPDATE, "revoke select, update on table"],
+        [policy_command_enum_1.PolicyCommand.DELETE, "revoke select, delete on table"],
+        [policy_command_enum_1.PolicyCommand.ALL, "revoke select, insert, update, delete on table"],
+    ])("generates policy privilege revoke SQL for %s", (command, expected) => {
+        const statements = (0, create_policy_privilege_down_sql_statements_1.createPolicyPrivilegeDownSqlStatements)({
+            schemaName: "public",
+            tableName: "workspace_member",
+            policyName: "workspace_member_policy",
+            command,
+            roles: ["authenticated"],
+        });
+        expect(statements[0]).toContain(expected);
+        if (command === policy_command_enum_1.PolicyCommand.INSERT || command === policy_command_enum_1.PolicyCommand.ALL) {
+            expect(statements).toEqual(expect.arrayContaining([
+                expect.stringContaining("revoke usage, select on sequence %s from authenticated"),
+            ]));
+        }
+        else {
+            expect(statements).toHaveLength(1);
+        }
+    });
+    it("does not generate policy privilege revoke SQL without explicit roles", () => {
+        expect((0, create_policy_privilege_down_sql_statements_1.createPolicyPrivilegeDownSqlStatements)({
+            schemaName: "public",
+            tableName: "workspace_member",
+            policyName: "workspace_member_policy",
+        })).toEqual([]);
+    });
+    it("defaults policy privilege revoke SQL to all command privileges", () => {
+        expect((0, create_policy_privilege_down_sql_statements_1.createPolicyPrivilegeDownSqlStatements)({
+            schemaName: "public",
+            tableName: "workspace_member",
+            policyName: "workspace_member_policy",
+            roles: ["authenticated"],
+        })).toEqual(expect.arrayContaining([
+            expect.stringContaining('revoke select, insert, update, delete on table "public"."workspace_member" from authenticated;'),
+            expect.stringContaining("revoke usage, select on sequence %s from authenticated"),
+        ]));
+    });
+    it("keeps policy privilege grants required by preserved policies", () => {
+        const statements = (0, create_policy_privilege_down_sql_statements_1.createPolicyPrivilegeDownSqlStatements)({
+            schemaName: "public",
+            tableName: "workspace_member",
+            policyName: "workspace_member_all_policy",
+            command: policy_command_enum_1.PolicyCommand.ALL,
+            roles: ["authenticated", "workspace_admin"],
+        }, [
+            {
+                schemaName: "public",
+                tableName: "workspace_member",
+                policyName: "workspace_member_insert_policy",
+                command: policy_command_enum_1.PolicyCommand.INSERT,
+                withCheck: "true",
+                roles: ["authenticated"],
+            },
+        ]);
+        expect(statements).toEqual(expect.arrayContaining([
+            'revoke select, update, delete on table "public"."workspace_member" from authenticated;',
+            'revoke select, insert, update, delete on table "public"."workspace_member" from workspace_admin;',
+        ]));
+        expect(statements).toEqual(expect.arrayContaining([
+            expect.stringContaining("revoke usage, select on sequence %s from workspace_admin"),
+        ]));
+        expect(statements).toEqual(expect.not.arrayContaining([
+            expect.stringContaining("revoke usage, select on sequence %s from authenticated"),
+        ]));
+    });
     it("generates restrictive policy SQL", () => {
         const statements = (0, create_policy_up_sql_statements_1.createPolicyUpSqlStatements)({
             schemaName: "public",
@@ -95,7 +213,7 @@ describe("policy migration SQL", () => {
             command: policy_command_enum_1.PolicyCommand.INSERT,
             withCheck: ` true `,
         });
-        expect(statements[2]).toBe('create policy workspace_member_insert_policy on "public"."workspace_member" as permissive for insert with check true;');
+        expect(statements[2]).toBe('create policy workspace_member_insert_policy on "public"."workspace_member" as permissive for insert with check (true);');
     });
     it.each([
         [

package/dist/utils/policy-migration-sql.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-migration-sql.spec.js","sourceRoot":"","sources":["../../src/utils/policy-migration-sql.spec.ts"],"names":[],"mappings":";;AAAA,sEAA6D;AAC7D,gEAAuD;AACvD,qGAA8F;AAC9F,qEAA+D;AAC/D,uFAAgF;AAEhF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,UAAU,GAAG,IAAA,2EAAkC,GAAE,CAAC;QAExD,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,4IAA4I;YAC5I,oIAAoI;YACpI,sCAAsC;YACtC,kCAAkC;YAClC,kCAAkC;YAClC,6CAA6C;YAC7C,yCAAyC;YACzC,sbAAsb;SACvb,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;YACjD,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,iEAAiE;SACzE,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,oEAAoE;YACpE,2FAA2F;YAC3F,oLAAoL;SACrL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;YACjD,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,iEAAiE;YACxE,KAAK,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxB,2FAA2F,CAC5F,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;YACjD,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,iEAAiE;YACxE,KAAK,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,oEAAoE;YACpE,gFAAgF;YAChF,2FAA2F;YAC3F,gNAAgN;SACjN,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,gCAAgC;YAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,SAAS,EAAE,MAAM;YACjB,KAAK,EAAE,CAAC,eAAe,CAAC;SACzB,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAC1B,qEAAqE,CACtE,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CACxB,MAAM,CAAC,eAAe,CAAC;YACrB,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;YACjD,MAAM,CAAC,gBAAgB,CACrB,qDAAqD,CACtD;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,wBAAwB;YACpC,IAAI,EAAE,6BAAU,CAAC,WAAW;YAC5B,KAAK,EAAE,mEAAmE;SAC3E,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxB,uKAAuK,CACxK,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,gCAAgC;YAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxB,uHAAuH,CACxH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN;YACE,sBAAsB;YACtB;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;aAC9B;YACD,qCAAqC;SACtC;QACD;YACE,uBAAuB;YACvB;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;gBAC7B,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,MAAM;aAClB;YACD,4CAA4C;SAC7C;QACD;YACE,mBAAmB;YACnB;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;gBAC7B,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,MAAM;aAClB;YACD,wCAAwC;SACzC;QACD;YACE,0BAA0B;YAC1B;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;aAC9B;YACD,yCAAyC;SAC1C;QACD;YACE,wBAAwB;YACxB;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,6BAA6B;aAC1C;YACD,kDAAkD;SACnD;KACF,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6DAA2B,EAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAA,4CAAmB,EAAC;YAC9B,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;SAClD,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CACnB,0FAA0F,CAC3F,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"policy-migration-sql.spec.js","sourceRoot":"","sources":["../../src/utils/policy-migration-sql.spec.ts"],"names":[],"mappings":";;AAAA,sEAA6D;AAC7D,gEAAuD;AACvD,qGAA8F;AAC9F,qEAA+D;AAC/D,+GAAuG;AACvG,2FAI6C;AAC7C,uFAAgF;AAEhF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,UAAU,GAAG,IAAA,2EAAkC,GAAE,CAAC;QAExD,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,kCAAkC;YAClC,sbAAsb;SACvb,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,UAAU,GAAG,IAAA,mEAA+B,EAAC;YACjD,eAAe;YACf,iBAAiB;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,oIAAoI;YACpI,kCAAkC;YAClC,yCAAyC;YACzC,4IAA4I;YAC5I,sCAAsC;YACtC,6CAA6C;YAC7C,gJAAgJ;YAChJ,wCAAwC;YACxC,+CAA+C;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,UAAU,GAAG,IAAA,qEAAiC,EAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAE1E,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,kDAAkD;YAClD,2CAA2C;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,UAAU,GAAG,IAAA,qEAAiC,EAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAEpE,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,4CAA4C;YAC5C,qCAAqC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,IAAA,sDAAkB,GAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACpD,MAAM,CACJ,IAAA,sDAAkB,EAAC;YACjB,iBAAiB;YACjB,QAAQ;YACR,eAAe;YACf,iBAAiB;SAClB,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;YACjD,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,iEAAiE;SACzE,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,oEAAoE;YACpE,2FAA2F;YAC3F,oLAAoL;SACrL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;YACjD,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,iEAAiE;YACxE,KAAK,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxB,2FAA2F,CAC5F,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,kCAAkC;YAC9C,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,CAAC,eAAe,CAAC;SACzB,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAC1B,2HAA2H,CAC5H,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;YACjD,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,iEAAiE;YACxE,KAAK,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACzB,oEAAoE;YACpE,gFAAgF;YAChF,2FAA2F;YAC3F,gNAAgN;SACjN,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,gCAAgC;YAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,SAAS,EAAE,MAAM;YACjB,KAAK,EAAE,CAAC,eAAe,CAAC;SACzB,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAC1B,qEAAqE,CACtE,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CACxB,MAAM,CAAC,eAAe,CAAC;YACrB,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;YACjD,MAAM,CAAC,gBAAgB,CACrB,qDAAqD,CACtD;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,mCAAa,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAChD,CAAC,mCAAa,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAChD,CAAC,mCAAa,CAAC,MAAM,EAAE,gCAAgC,CAAC;QACxD,CAAC,mCAAa,CAAC,MAAM,EAAE,gCAAgC,CAAC;QACxD,CAAC,mCAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC;KACtE,CAAC,CAAC,8CAA8C,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACvE,MAAM,UAAU,GAAG,IAAA,oFAAsC,EAAC;YACxD,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,yBAAyB;YACrC,OAAO;YACP,KAAK,EAAE,CAAC,eAAe,CAAC;SACzB,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE1C,IAAI,OAAO,KAAK,mCAAa,CAAC,MAAM,IAAI,OAAO,KAAK,mCAAa,CAAC,GAAG,EAAE,CAAC;YACtE,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CACxB,MAAM,CAAC,eAAe,CAAC;gBACrB,MAAM,CAAC,gBAAgB,CACrB,wDAAwD,CACzD;aACF,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CACJ,IAAA,oFAAsC,EAAC;YACrC,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,yBAAyB;SACtC,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CACJ,IAAA,oFAAsC,EAAC;YACrC,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,yBAAyB;YACrC,KAAK,EAAE,CAAC,eAAe,CAAC;SACzB,CAAC,CACH,CAAC,OAAO,CACP,MAAM,CAAC,eAAe,CAAC;YACrB,MAAM,CAAC,gBAAgB,CACrB,gGAAgG,CACjG;YACD,MAAM,CAAC,gBAAgB,CACrB,wDAAwD,CACzD;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,UAAU,GAAG,IAAA,oFAAsC,EACvD;YACE,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,6BAA6B;YACzC,OAAO,EAAE,mCAAa,CAAC,GAAG;YAC1B,KAAK,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAC5C,EACD;YACE;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;gBAC7B,SAAS,EAAE,MAAM;gBACjB,KAAK,EAAE,CAAC,eAAe,CAAC;aACzB;SACF,CACF,CAAC;QAEF,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CACxB,MAAM,CAAC,eAAe,CAAC;YACrB,wFAAwF;YACxF,kGAAkG;SACnG,CAAC,CACH,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CACxB,MAAM,CAAC,eAAe,CAAC;YACrB,MAAM,CAAC,gBAAgB,CACrB,0DAA0D,CAC3D;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CACxB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;YACzB,MAAM,CAAC,gBAAgB,CACrB,wDAAwD,CACzD;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,wBAAwB;YACpC,IAAI,EAAE,6BAAU,CAAC,WAAW;YAC5B,KAAK,EAAE,mEAAmE;SAC3E,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxB,uKAAuK,CACxK,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,UAAU,GAAG,IAAA,6DAA2B,EAAC;YAC7C,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,gCAAgC;YAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxB,yHAAyH,CAC1H,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN;YACE,sBAAsB;YACtB;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;aAC9B;YACD,qCAAqC;SACtC;QACD;YACE,uBAAuB;YACvB;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;gBAC7B,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,MAAM;aAClB;YACD,4CAA4C;SAC7C;QACD;YACE,mBAAmB;YACnB;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;gBAC7B,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,MAAM;aAClB;YACD,wCAAwC;SACzC;QACD;YACE,0BAA0B;YAC1B;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,gCAAgC;gBAC5C,OAAO,EAAE,mCAAa,CAAC,MAAM;aAC9B;YACD,yCAAyC;SAC1C;QACD;YACE,wBAAwB;YACxB;gBACE,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kBAAkB;gBAC7B,UAAU,EAAE,6BAA6B;aAC1C;YACD,kDAAkD;SACnD;KACF,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6DAA2B,EAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAA,4CAAmB,EAAC;YAC9B,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;SAClD,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CACnB,0FAA0F,CAC3F,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nest-boot/row-level-security",
-  "version": "7.0.0",
+  "version": "7.2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/nest-boot/nest-boot.git",
@@ -38,7 +38,7 @@
     "@nestjs/core": "^11.1.11",
     "@nestjs/testing": "^11.1.11",
     "@types/jest": "^29.5.14",
-    "@types/node": "^22.18.6",
+    "@types/node": "^24.12.4",
     "dotenv": "^17.2.3",
     "eslint": "^9.39.3",
     "jest": "^29.7.0",
@@ -47,10 +47,10 @@
     "ts-jest": "^29.4.4",
     "typescript": "^5.9.3",
     "@nest-boot/eslint-config": "^7.0.3",
+    "@nest-boot/eslint-plugin": "^7.0.6",
     "@nest-boot/mikro-orm": "^7.4.0",
     "@nest-boot/request-context": "^7.4.3",
-    "@nest-boot/tsconfig": "^7.0.1",
-    "@nest-boot/eslint-plugin": "^7.0.5"
+    "@nest-boot/tsconfig": "^7.0.3"
   },
   "publishConfig": {
     "access": "public"

package/dist/interfaces/row-level-security-options.interface.d.ts

@@ -1,18 +0,0 @@
-import { RowLevelSecurityContextValue } from "../utils/row-level-security-context-builder.types";
-/** Value or promise-like value accepted by row-level security option hooks. */
-export type MaybePromise<T> = T | Promise<T>;
-/** Context entries converted to transaction-local PostgreSQL settings. */
-export type RowLevelSecurityContextEntries = Iterable<readonly [string, RowLevelSecurityContextValue]>;
-/** Runtime options used by {@link RowLevelSecurityEntityManager}. */
-export interface RowLevelSecurityOptions {
-    /** Database role used for authenticated requests. Defaults to `authenticated`. */
-    authenticatedRole?: string;
-    /** Database role used for anonymous requests. Defaults to `anonymous`. */
-    anonymousRole?: string;
-    /** Optional hook that can disable row-level security setup for a transaction. */
-    shouldApply?: () => MaybePromise<boolean>;
-    /** Optional hook used to infer the authenticated or anonymous role. */
-    isAuthenticated?: () => MaybePromise<boolean>;
-    /** Optional hook that contributes request context values to PostgreSQL settings. */
-    getContext?: () => MaybePromise<RowLevelSecurityContextEntries | undefined>;
-}