@nest-boot/row-level-security 7.1.0 → 7.2.1

package/dist/row-level-security-migration.spec.js

@@ -12,11 +12,6 @@ class TestRowLevelSecurityMigration extends row_level_security_migration_1.RowLe
             command: policy_command_enum_1.PolicyCommand.SELECT,
             using: `((select app.get_context('user_id', null::bigint)) = "user_id")`,
         });
-        this.addDropPolicySql({
-            schemaName: "public",
-            tableName: "workspace_member",
-            policyName: "workspace_member_user_select_policy",
-        });
     }
 }
 describe("RowLevelSecurityMigration", () => {
@@ -24,17 +19,13 @@ describe("RowLevelSecurityMigration", () => {
         const migration = new TestRowLevelSecurityMigration({}, {});
         migration.up();
         const queries = migration.getQueries();
-        expect(migration.getQueries()).toHaveLength(12);
-        expect(queries[0]).toContain("create role authenticated nologin");
-        expect(queries[1]).toContain("create role anonymous nologin");
-        expect(queries[2]).toContain("grant authenticated to current_user");
-        expect(queries[3]).toContain("grant anonymous to current_user");
-        expect(queries[4]).toContain("create schema if not exists app");
-        expect(queries[7]).toContain("create or replace function app.get_context");
-        expect(queries[8]).toContain('alter table "public"."workspace_member" enable row level security;');
-        expect(queries[9]).toContain('drop policy if exists workspace_member_user_select_policy on "public"."workspace_member";');
-        expect(queries[10]).toContain("create policy workspace_member_user_select_policy");
-        expect(queries[11]).toContain("drop policy if exists workspace_member_user_select_policy");
+        expect(queries).toContainEqual(expect.stringContaining("create role anonymous nologin"));
+        expect(queries).toContainEqual(expect.stringContaining("grant anonymous to current_user"));
+        expect(queries).toContainEqual(expect.stringContaining("create schema if not exists app"));
+        expect(queries).toContainEqual(expect.stringContaining("create or replace function app.get_context"));
+        expect(queries).toContainEqual('alter table "public"."workspace_member" enable row level security;');
+        expect(queries).toContainEqual('drop policy if exists workspace_member_user_select_policy on "public"."workspace_member";');
+        expect(queries).toContainEqual(expect.stringContaining("create policy workspace_member_user_select_policy"));
     });
 });
 //# sourceMappingURL=row-level-security-migration.spec.js.map

package/dist/row-level-security-migration.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"row-level-security-migration.spec.js","sourceRoot":"","sources":["../src/row-level-security-migration.spec.ts"],"names":[],"mappings":";;AAAA,qEAA4D;AAC5D,iFAA2E;AAE3E,MAAM,6BAA8B,SAAQ,wDAAyB;IAC1D,EAAE;QACT,IAAI,CAAC,+BAA+B,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC;YAChB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;YACjD,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,iEAAiE;SACzE,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC;YACpB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;SAClD,CAAC,CAAC;IACL,CAAC;CACF;AAED,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,EAAW,EACX,EAAW,CACZ,CAAC;QAEF,SAAS,CAAC,EAAE,EAAE,CAAC;QAEf,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAc,CAAC;QAEnD,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,4CAA4C,CAAC,CAAC;QAC3E,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAC1B,oEAAoE,CACrE,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAC1B,2FAA2F,CAC5F,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3B,mDAAmD,CACpD,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3B,2DAA2D,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"row-level-security-migration.spec.js","sourceRoot":"","sources":["../src/row-level-security-migration.spec.ts"],"names":[],"mappings":";;AAAA,qEAA4D;AAC5D,iFAA2E;AAE3E,MAAM,6BAA8B,SAAQ,wDAAyB;IAC1D,EAAE;QACT,IAAI,CAAC,+BAA+B,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC;YAChB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,qCAAqC;YACjD,OAAO,EAAE,mCAAa,CAAC,MAAM;YAC7B,KAAK,EAAE,iEAAiE;SACzE,CAAC,CAAC;IACL,CAAC;CACF;AAED,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,EAAW,EACX,EAAW,CACZ,CAAC;QAEF,SAAS,CAAC,EAAE,EAAE,CAAC;QAEf,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAc,CAAC;QAEnD,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAC5B,MAAM,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,CACzD,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAC5B,MAAM,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,CAC3D,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAC5B,MAAM,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,CAC3D,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAC5B,MAAM,CAAC,gBAAgB,CAAC,4CAA4C,CAAC,CACtE,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAC5B,oEAAoE,CACrE,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAC5B,2FAA2F,CAC5F,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAC5B,MAAM,CAAC,gBAAgB,CACrB,mDAAmD,CACpD,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/row-level-security-migrator.d.ts

@@ -0,0 +1,13 @@
+import type { MigrationResult, MikroORM } from "@mikro-orm/core";
+import { Migrator } from "@mikro-orm/migrations";
+/** MikroORM migrator that also creates migrations for policy-only RLS changes. */
+export declare class RowLevelSecurityMigrator extends Migrator {
+    /** Registers the RLS-aware migrator extension with a MikroORM instance. */
+    static register(orm: MikroORM): void;
+    createMigration(path?: string, blank?: boolean, initial?: boolean, name?: string): Promise<MigrationResult>;
+    /** Checks whether schema or RLS policy changes require a new migration. */
+    checkMigrationNeeded(): Promise<boolean>;
+    private hasPendingPolicyChanges;
+    private getRowLevelSecurityGenerator;
+    private getInternals;
+}

package/dist/row-level-security-migrator.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RowLevelSecurityMigrator = void 0;
+const migrations_1 = require("@mikro-orm/migrations");
+const row_level_security_migration_generator_1 = require("./row-level-security-migration-generator");
+/** MikroORM migrator that also creates migrations for policy-only RLS changes. */
+class RowLevelSecurityMigrator extends migrations_1.Migrator {
+    /** Registers the RLS-aware migrator extension with a MikroORM instance. */
+    static register(orm) {
+        orm.config.registerExtension("@mikro-orm/migrator", () => new RowLevelSecurityMigrator(orm.em));
+    }
+    async createMigration(path, blank = false, initial = false, name) {
+        if (initial) {
+            return await super.createMigration(path, blank, initial, name);
+        }
+        const internals = this.getInternals();
+        await internals.ensureMigrationsDirExists();
+        const diff = await internals.getSchemaDiff(blank, initial);
+        if (diff.up.length === 0) {
+            const hasPolicyChanges = await this.hasPendingPolicyChanges(diff);
+            if (!hasPolicyChanges) {
+                return { fileName: "", code: "", diff };
+            }
+        }
+        const migration = await internals.generator.generate(diff, path, name);
+        await internals.storeCurrentSchema();
+        return {
+            fileName: migration[1],
+            code: migration[0],
+            diff,
+        };
+    }
+    /** Checks whether schema or RLS policy changes require a new migration. */
+    async checkMigrationNeeded() {
+        const internals = this.getInternals();
+        await internals.ensureMigrationsDirExists();
+        const diff = await internals.getSchemaDiff(false, false);
+        if (diff.up.length > 0) {
+            return true;
+        }
+        return await this.hasPendingPolicyChanges(diff);
+    }
+    async hasPendingPolicyChanges(diff) {
+        const generator = this.getRowLevelSecurityGenerator();
+        // TODO: Support MikroORM snapshot mode by comparing generated policy state
+        // instead of only live database policies.
+        return generator ? await generator.hasPendingPolicyChanges(diff) : false;
+    }
+    getRowLevelSecurityGenerator() {
+        const generator = this.getInternals().generator;
+        return generator instanceof row_level_security_migration_generator_1.RowLevelSecurityMigrationGenerator
+            ? generator
+            : undefined;
+    }
+    getInternals() {
+        return this;
+    }
+}
+exports.RowLevelSecurityMigrator = RowLevelSecurityMigrator;
+//# sourceMappingURL=row-level-security-migrator.js.map

package/dist/row-level-security-migrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-level-security-migrator.js","sourceRoot":"","sources":["../src/row-level-security-migrator.ts"],"names":[],"mappings":";;;AACA,sDAAiD;AAEjD,qGAA8F;AAiB9F,kFAAkF;AAClF,MAAa,wBAAyB,SAAQ,qBAAQ;IACpD,2EAA2E;IAC3E,MAAM,CAAU,QAAQ,CAAC,GAAa;QACpC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAC1B,qBAAqB,EACrB,GAAG,EAAE,CAAC,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAW,CAAC,CACpD,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,eAAe,CAC5B,IAAa,EACb,KAAK,GAAG,KAAK,EACb,OAAO,GAAG,KAAK,EACf,IAAa;QAEb,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,SAAS,CAAC,yBAAyB,EAAE,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAElE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEvE,MAAM,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACtB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YAClB,IAAI;SACL,CAAC;IACJ,CAAC;IAED,2EAA2E;IAClE,KAAK,CAAC,oBAAoB;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,SAAS,CAAC,yBAAyB,EAAE,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,IAAmB;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEtD,2EAA2E;QAC3E,0CAA0C;QAC1C,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC;IAEO,4BAA4B;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC;QAEhD,OAAO,SAAS,YAAY,2EAAkC;YAC5D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAEO,YAAY;QAClB,OAAO,IAAoC,CAAC;IAC9C,CAAC;CACF;AA9ED,4DA8EC"}

package/dist/row-level-security.d.ts

@@ -0,0 +1,29 @@
+import { RowLevelSecurityContextValue, SnakeCase } from "./utils/row-level-security-context-builder.types";
+/** Request-scoped row-level security execution mode. */
+export declare enum RowLevelSecurityMode {
+    /** Apply RLS only when a role or context value is present. */
+    AUTO = "auto",
+    /** Always apply RLS while request context is active. */
+    ENABLED = "enabled",
+    /** Never apply RLS, even when role or context values are present. */
+    DISABLED = "disabled"
+}
+/** Request-scoped row-level security mode, role, and context helpers. */
+export declare class RowLevelSecurity {
+    /** Stores the row-level security mode for the current request context. */
+    static setMode(mode: RowLevelSecurityMode): void;
+    /** Reads the request-scoped row-level security mode. */
+    static getMode(): RowLevelSecurityMode;
+    /** Stores the database role that should be applied to the next RLS query. */
+    static setRole(role: string): void;
+    /** Reads the request-scoped database role, if one is active. */
+    static getRole(): string | undefined;
+    /** Stores a context value that will be converted to a PostgreSQL setting. */
+    static setContext<S extends string>(key: SnakeCase<S>, value: RowLevelSecurityContextValue): void;
+    /** Reads a request-scoped context value by key. */
+    static getContext<S extends string>(key: SnakeCase<S>): RowLevelSecurityContextValue;
+    /** Returns all request-scoped context entries for RLS transaction setup. */
+    static entries(): [string, RowLevelSecurityContextValue][];
+    /** Clears request-scoped RLS mode, role, and context values. */
+    static clear(): void;
+}

package/dist/row-level-security.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RowLevelSecurity = exports.RowLevelSecurityMode = void 0;
+const request_context_1 = require("@nest-boot/request-context");
+const ROW_LEVEL_SECURITY_CONTEXT = Symbol("ROW_LEVEL_SECURITY_CONTEXT");
+const ROW_LEVEL_SECURITY_MODE = Symbol("ROW_LEVEL_SECURITY_MODE");
+const ROW_LEVEL_SECURITY_ROLE = Symbol("ROW_LEVEL_SECURITY_ROLE");
+/** Request-scoped row-level security execution mode. */
+var RowLevelSecurityMode;
+(function (RowLevelSecurityMode) {
+    /** Apply RLS only when a role or context value is present. */
+    RowLevelSecurityMode["AUTO"] = "auto";
+    /** Always apply RLS while request context is active. */
+    RowLevelSecurityMode["ENABLED"] = "enabled";
+    /** Never apply RLS, even when role or context values are present. */
+    RowLevelSecurityMode["DISABLED"] = "disabled";
+})(RowLevelSecurityMode || (exports.RowLevelSecurityMode = RowLevelSecurityMode = {}));
+/** Request-scoped row-level security mode, role, and context helpers. */
+class RowLevelSecurity {
+    /** Stores the row-level security mode for the current request context. */
+    static setMode(mode) {
+        request_context_1.RequestContext.set(ROW_LEVEL_SECURITY_MODE, mode);
+    }
+    /** Reads the request-scoped row-level security mode. */
+    static getMode() {
+        return request_context_1.RequestContext.isActive()
+            ? (request_context_1.RequestContext.get(ROW_LEVEL_SECURITY_MODE) ??
+                RowLevelSecurityMode.AUTO)
+            : RowLevelSecurityMode.AUTO;
+    }
+    /** Stores the database role that should be applied to the next RLS query. */
+    static setRole(role) {
+        request_context_1.RequestContext.set(ROW_LEVEL_SECURITY_ROLE, role);
+    }
+    /** Reads the request-scoped database role, if one is active. */
+    static getRole() {
+        return request_context_1.RequestContext.isActive()
+            ? request_context_1.RequestContext.get(ROW_LEVEL_SECURITY_ROLE)
+            : undefined;
+    }
+    /** Stores a context value that will be converted to a PostgreSQL setting. */
+    static setContext(key, value) {
+        const context = request_context_1.RequestContext.getOrSet(ROW_LEVEL_SECURITY_CONTEXT, new Map());
+        context.set(key, value);
+    }
+    /** Reads a request-scoped context value by key. */
+    static getContext(key) {
+        return request_context_1.RequestContext.isActive()
+            ? request_context_1.RequestContext.get(ROW_LEVEL_SECURITY_CONTEXT)?.get(key)
+            : undefined;
+    }
+    /** Returns all request-scoped context entries for RLS transaction setup. */
+    static entries() {
+        return request_context_1.RequestContext.isActive()
+            ? Array.from(request_context_1.RequestContext.get(ROW_LEVEL_SECURITY_CONTEXT) ?? [])
+            : [];
+    }
+    /** Clears request-scoped RLS mode, role, and context values. */
+    static clear() {
+        if (!request_context_1.RequestContext.isActive()) {
+            return;
+        }
+        request_context_1.RequestContext.set(ROW_LEVEL_SECURITY_MODE, RowLevelSecurityMode.AUTO);
+        request_context_1.RequestContext.set(ROW_LEVEL_SECURITY_ROLE, undefined);
+        request_context_1.RequestContext.set(ROW_LEVEL_SECURITY_CONTEXT, new Map());
+    }
+}
+exports.RowLevelSecurity = RowLevelSecurity;
+//# sourceMappingURL=row-level-security.js.map

package/dist/row-level-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-level-security.js","sourceRoot":"","sources":["../src/row-level-security.ts"],"names":[],"mappings":";;;AAAA,gEAA4D;AAS5D,MAAM,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AACxE,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAClE,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAElE,wDAAwD;AACxD,IAAY,oBAOX;AAPD,WAAY,oBAAoB;IAC9B,8DAA8D;IAC9D,qCAAa,CAAA;IACb,wDAAwD;IACxD,2CAAmB,CAAA;IACnB,qEAAqE;IACrE,6CAAqB,CAAA;AACvB,CAAC,EAPW,oBAAoB,oCAApB,oBAAoB,QAO/B;AAED,yEAAyE;AACzE,MAAa,gBAAgB;IAC3B,0EAA0E;IAC1E,MAAM,CAAC,OAAO,CAAC,IAA0B;QACvC,gCAAc,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,wDAAwD;IACxD,MAAM,CAAC,OAAO;QACZ,OAAO,gCAAc,CAAC,QAAQ,EAAE;YAC9B,CAAC,CAAC,CAAC,gCAAc,CAAC,GAAG,CAAuB,uBAAuB,CAAC;gBAChE,oBAAoB,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,OAAO,CAAC,IAAY;QACzB,gCAAc,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,gEAAgE;IAChE,MAAM,CAAC,OAAO;QACZ,OAAO,gCAAc,CAAC,QAAQ,EAAE;YAC9B,CAAC,CAAC,gCAAc,CAAC,GAAG,CAAS,uBAAuB,CAAC;YACrD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,UAAU,CACf,GAAiB,EACjB,KAAmC;QAEnC,MAAM,OAAO,GAAG,gCAAc,CAAC,QAAQ,CACrC,0BAA0B,EAC1B,IAAI,GAAG,EAAE,CACV,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,mDAAmD;IACnD,MAAM,CAAC,UAAU,CACf,GAAiB;QAEjB,OAAO,gCAAc,CAAC,QAAQ,EAAE;YAC9B,CAAC,CAAC,gCAAc,CAAC,GAAG,CAChB,0BAA0B,CAC3B,EAAE,GAAG,CAAC,GAAG,CAAC;YACb,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,OAAO;QACZ,OAAO,gCAAc,CAAC,QAAQ,EAAE;YAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,CACR,gCAAc,CAAC,GAAG,CAChB,0BAA0B,CAC3B,IAAI,EAAE,CACR;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAED,gEAAgE;IAChE,MAAM,CAAC,KAAK;QACV,IAAI,CAAC,gCAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,gCAAc,CAAC,GAAG,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvE,gCAAc,CAAC,GAAG,CAAqB,uBAAuB,EAAE,SAAS,CAAC,CAAC;QAC3E,gCAAc,CAAC,GAAG,CAChB,0BAA0B,EAC1B,IAAI,GAAG,EAAE,CACV,CAAC;IACJ,CAAC;CACF;AA1ED,4CA0EC"}

package/dist/row-level-security.spec.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const request_context_1 = require("@nest-boot/request-context");
+const row_level_security_1 = require("./row-level-security");
+describe("RowLevelSecurity", () => {
+    it("stores the database role in RequestContext", async () => {
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "http" }), () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            expect(row_level_security_1.RowLevelSecurity.getRole()).toBe("authenticated");
+        });
+    });
+    it("stores policy context values in RequestContext", async () => {
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "http" }), () => {
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", "42");
+            row_level_security_1.RowLevelSecurity.setContext("user_id", 7);
+            expect(row_level_security_1.RowLevelSecurity.getContext("tenant_id")).toBe("42");
+            expect(row_level_security_1.RowLevelSecurity.entries()).toEqual([
+                ["tenant_id", "42"],
+                ["user_id", 7],
+            ]);
+        });
+    });
+    it("defaults to auto mode and stores mode in RequestContext", async () => {
+        expect(row_level_security_1.RowLevelSecurity.getMode()).toBe(row_level_security_1.RowLevelSecurityMode.AUTO);
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "http" }), () => {
+            expect(row_level_security_1.RowLevelSecurity.getMode()).toBe(row_level_security_1.RowLevelSecurityMode.AUTO);
+            row_level_security_1.RowLevelSecurity.setMode(row_level_security_1.RowLevelSecurityMode.DISABLED);
+            expect(row_level_security_1.RowLevelSecurity.getMode()).toBe(row_level_security_1.RowLevelSecurityMode.DISABLED);
+            row_level_security_1.RowLevelSecurity.setMode(row_level_security_1.RowLevelSecurityMode.ENABLED);
+            expect(row_level_security_1.RowLevelSecurity.getMode()).toBe(row_level_security_1.RowLevelSecurityMode.ENABLED);
+        });
+    });
+    it("clears mode, role, and context values", async () => {
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "http" }), () => {
+            row_level_security_1.RowLevelSecurity.setMode(row_level_security_1.RowLevelSecurityMode.ENABLED);
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", "42");
+            row_level_security_1.RowLevelSecurity.clear();
+            expect(row_level_security_1.RowLevelSecurity.getMode()).toBe(row_level_security_1.RowLevelSecurityMode.AUTO);
+            expect(row_level_security_1.RowLevelSecurity.getRole()).toBeUndefined();
+            expect(row_level_security_1.RowLevelSecurity.getContext("tenant_id")).toBeUndefined();
+            expect(row_level_security_1.RowLevelSecurity.entries()).toEqual([]);
+        });
+    });
+    it("returns empty values when RequestContext is inactive", () => {
+        expect(row_level_security_1.RowLevelSecurity.getMode()).toBe(row_level_security_1.RowLevelSecurityMode.AUTO);
+        expect(row_level_security_1.RowLevelSecurity.getRole()).toBeUndefined();
+        expect(row_level_security_1.RowLevelSecurity.getContext("tenant_id")).toBeUndefined();
+        expect(row_level_security_1.RowLevelSecurity.entries()).toEqual([]);
+    });
+});
+//# sourceMappingURL=row-level-security.spec.js.map

package/dist/row-level-security.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-level-security.spec.js","sourceRoot":"","sources":["../src/row-level-security.spec.ts"],"names":[],"mappings":";;AAAA,gEAA4D;AAE5D,6DAA8E;AAE9E,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE;YAClE,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAE1C,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE;YAClE,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC/C,qCAAgB,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAE1C,MAAM,CAAC,qCAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;gBACzC,CAAC,WAAW,EAAE,IAAI,CAAC;gBACnB,CAAC,SAAS,EAAE,CAAC,CAAC;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAoB,CAAC,IAAI,CAAC,CAAC;QAEnE,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE;YAClE,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAoB,CAAC,IAAI,CAAC,CAAC;YAEnE,qCAAgB,CAAC,OAAO,CAAC,yCAAoB,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAoB,CAAC,QAAQ,CAAC,CAAC;YAEvE,qCAAgB,CAAC,OAAO,CAAC,yCAAoB,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAoB,CAAC,OAAO,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE;YAClE,qCAAgB,CAAC,OAAO,CAAC,yCAAoB,CAAC,OAAO,CAAC,CAAC;YACvD,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAE/C,qCAAgB,CAAC,KAAK,EAAE,CAAC;YAEzB,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAoB,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;YACnD,MAAM,CAAC,qCAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAoB,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,CAAC,qCAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACjE,MAAM,CAAC,qCAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}