@prisma-next/target-postgres 0.14.0-dev.11 → 0.14.0-dev.12

package/src/contract-free/checks.ts

@@ -345,6 +345,79 @@ export function extensionExistsAst(extensionName: string): ExtensionExistsCheckB
   };
 }
 
+export interface RlsPolicyExistsCheckBuilder {
+  policyPresent(): SelectAst;
+  policyAbsent(): SelectAst;
+}
+
+/**
+ * Typed RLS-policy existence check over `pg_policies`, with schema, table,
+ * and policy names bound as text parameters (never inlined). The `schema`
+ * coordinate is the resolved live-database schema name (e.g. `'public'`),
+ * compared against `pg_policies.schemaname` as a bound parameter.
+ */
+export function rlsPolicyExistsAst(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly policyName: string;
+}): RlsPolicyExistsCheckBuilder {
+  const inner = () =>
+    exprSelect()
+      .from(cfTable('pg_policies'))
+      .project('one', cfExpr.lit(1))
+      .where(
+        cfExpr.allOf([
+          cfExpr.identifierRef('schemaname').eqParam(options.schema, PG_TEXT_CODEC_ID),
+          cfExpr.identifierRef('tablename').eqParam(options.table, PG_TEXT_CODEC_ID),
+          cfExpr.identifierRef('policyname').eqParam(options.policyName, PG_TEXT_CODEC_ID),
+        ]),
+      );
+  return {
+    policyPresent: () => exprSelect().project('result', cfExpr.exists(inner())).build(),
+    policyAbsent: () => exprSelect().project('result', cfExpr.notExists(inner())).build(),
+  };
+}
+
+export interface RlsEnabledCheckBuilder {
+  rlsEnabled(): SelectAst;
+  rlsDisabled(): SelectAst;
+}
+
+/**
+ * Typed row-level-security enabled check over `pg_class` joined to
+ * `pg_namespace`, comparing `pg_class.relrowsecurity` against the expected
+ * boolean. Schema and table names are bound as text parameters.
+ */
+export function rlsEnabledAst(schema: string, table: string): RlsEnabledCheckBuilder {
+  const inner = (enabled: boolean) =>
+    exprSelect()
+      .from(cfTable('pg_class', 'c'))
+      .join(
+        cfTable('pg_namespace', 'n'),
+        cfExpr.columnRef('n', 'oid').eqExpr(cfExpr.columnRef('c', 'relnamespace')),
+      )
+      .project('one', cfExpr.lit(1))
+      .where(
+        cfExpr.allOf([
+          cfExpr.columnRef('n', 'nspname').eqParam(schema, PG_TEXT_CODEC_ID),
+          cfExpr.columnRef('c', 'relname').eqParam(table, PG_TEXT_CODEC_ID),
+          enabled
+            ? cfExpr.columnRef('c', 'relrowsecurity')
+            : cfExpr.columnRef('c', 'relrowsecurity').not(),
+        ]),
+      );
+  return {
+    rlsEnabled: () =>
+      exprSelect()
+        .project('result', cfExpr.exists(inner(true)))
+        .build(),
+    rlsDisabled: () =>
+      exprSelect()
+        .project('result', cfExpr.exists(inner(false)))
+        .build(),
+  };
+}
+
 export interface IndexExistsCheckBuilder {
   indexPresent(): SelectAst;
   indexAbsent(): SelectAst;

package/src/contract-free/ddl.ts

@@ -3,8 +3,11 @@ import {
   AddColumnAction,
   type AnyAlterTableAction,
   PostgresAlterTable,
+  PostgresCreatePolicy,
   PostgresCreateSchema,
   PostgresCreateTable,
+  PostgresDropPolicy,
+  type RlsPolicyOperation,
 } from '../core/ddl/nodes';
 
 /**
@@ -62,3 +65,35 @@ export function alterTable(options: {
 }): PostgresAlterTable {
   return new PostgresAlterTable(options);
 }
+
+/**
+ * Build a Postgres `CREATE POLICY` DDL node.
+ *
+ * Identifiers (`schema`, `table`, `name`) are quoted by the renderer.
+ * `using` and `withCheck` are emitted verbatim as predicate SQL — callers
+ * must supply safe, pre-validated SQL expressions.
+ */
+export function createPolicy(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: readonly string[];
+  readonly using?: string;
+  readonly withCheck?: string;
+}): PostgresCreatePolicy {
+  return new PostgresCreatePolicy(options);
+}
+
+/**
+ * Build a Postgres `DROP POLICY` DDL node.
+ * Identifiers (`schema`, `table`, `name`) are quoted by the renderer.
+ */
+export function dropPolicy(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+}): PostgresDropPolicy {
+  return new PostgresDropPolicy(options);
+}

package/src/core/authoring.ts

@@ -1,13 +1,94 @@
 import { temporalAuthoringPresets } from '@prisma-next/family-sql/control';
 import type {
+  AuthoringEntityContext,
   AuthoringEntityTypeNamespace,
   AuthoringFieldNamespace,
+  AuthoringPslBlockDescriptorNamespace,
   AuthoringTypeNamespace,
+  PslExtensionBlock,
 } from '@prisma-next/framework-components/authoring';
+import { PostgresRlsPolicy } from './postgres-rls-policy';
+import { PostgresRole, type PostgresRoleInput } from './postgres-role';
+import { PostgresRlsPolicySchema, PostgresRoleSchema } from './postgres-validators';
+import { computeContentHash, normalizePredicate } from './rls/canonicalize';
 
 export const postgresAuthoringTypes = {} as const satisfies AuthoringTypeNamespace;
 
-export const postgresAuthoringEntityTypes = {} as const satisfies AuthoringEntityTypeNamespace;
+export interface RlsPolicyExtensionBlock extends PslExtensionBlock {
+  readonly namespaceId: string;
+}
+
+function readRefParam(block: PslExtensionBlock, key: string): string | undefined {
+  const param = block.parameters[key];
+  return param?.kind === 'ref' ? param.identifier : undefined;
+}
+
+function readValueParam(block: PslExtensionBlock, key: string): string | undefined {
+  const param = block.parameters[key];
+  return param?.kind === 'value' ? param.raw : undefined;
+}
+
+function readListRefParams(block: PslExtensionBlock, key: string): string[] {
+  const param = block.parameters[key];
+  if (param?.kind !== 'list') return [];
+  return param.items.flatMap((item) => (item.kind === 'ref' ? [item.identifier] : []));
+}
+
+function unwrapQuotedString(raw: string): string {
+  if (raw.startsWith('"') && raw.endsWith('"') && raw.length >= 2) {
+    return raw.slice(1, -1).replace(/\\"/g, '"');
+  }
+  return raw;
+}
+
+function lowerRlsPolicyFromBlock(
+  block: RlsPolicyExtensionBlock,
+  _ctx: AuthoringEntityContext,
+): PostgresRlsPolicy {
+  const prefix = block.name;
+  const targetModelName = readRefParam(block, 'target') ?? '';
+  const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);
+  const roles = [...readListRefParams(block, 'roles')].sort();
+  const using = unwrapQuotedString(readValueParam(block, 'using') ?? '');
+
+  const wireHash = computeContentHash({
+    using: normalizePredicate(using),
+    roles,
+    operation: 'select',
+    permissive: true,
+  });
+  const wireName = `${prefix}_${wireHash}`;
+
+  return new PostgresRlsPolicy({
+    name: wireName,
+    prefix,
+    tableName,
+    namespaceId: block.namespaceId,
+    operation: 'select',
+    roles,
+    using,
+    permissive: true,
+  });
+}
+
+export const postgresAuthoringEntityTypes = {
+  role: {
+    kind: 'entity',
+    discriminator: 'role',
+    validatorSchema: PostgresRoleSchema,
+    output: {
+      factory: (input: PostgresRoleInput): PostgresRole => new PostgresRole(input),
+    },
+  },
+  policy: {
+    kind: 'entity',
+    discriminator: 'policy',
+    validatorSchema: PostgresRlsPolicySchema,
+    output: {
+      factory: lowerRlsPolicyFromBlock,
+    },
+  },
+} as const satisfies AuthoringEntityTypeNamespace;
 
 /**
  * Field presets contributed by the Postgres target pack.
@@ -22,6 +103,39 @@ export const postgresAuthoringEntityTypes = {} as const satisfies AuthoringEntit
  * portability use `uuidString` / `id.uuidv4String` / `id.uuidv7String` from
  * the family pack instead.
  */
+/**
+ * PSL block descriptor for `policy_select`.
+ *
+ * The parser learns the block shape from this descriptor; lowering from
+ * `PslExtensionBlock` to `PostgresRlsPolicy` is wired in the PSL
+ * interpreter (a later dispatch). The `discriminator` matches
+ * `PostgresRlsPolicy.kind` so the parsed block node carries the same
+ * discriminant as the IR class it will lower to.
+ *
+ * The `roles` list uses `scope:'cross-space'` because same-namespace
+ * role ref resolution requires PSL namespace entries keyed by `refKind`
+ * (i.e. `'role'`), which in turn requires the role block discriminator to
+ * equal `'role'`. Aligning discriminator with refKind is tracked for
+ * slice 4 (cross-space roles). Until then cross-space passes validation
+ * unconditionally and the authored role names flow through unchanged.
+ */
+export const postgresAuthoringPslBlockDescriptors = {
+  policy_select: {
+    kind: 'pslBlock',
+    keyword: 'policy_select',
+    discriminator: 'policy',
+    name: { required: true },
+    parameters: {
+      target: { kind: 'ref', refKind: 'model', scope: 'same-namespace', required: true },
+      roles: {
+        kind: 'list',
+        of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },
+      },
+      using: { kind: 'value', codecId: 'pg/text@1', required: true },
+    },
+  },
+} as const satisfies AuthoringPslBlockDescriptorNamespace;
+
 export const postgresAuthoringFieldPresets = {
   text: {
     kind: 'fieldPreset',

package/src/core/ddl/nodes.ts

@@ -3,6 +3,7 @@ import {
   DdlNode,
   type DdlTableConstraint,
 } from '@prisma-next/sql-relational-core/ast';
+import type { RlsPolicyOperation } from '../rls/canonicalize';
 
 // ---------------------------------------------------------------------------
 // AlterTableAction — nested polymorphic hierarchy
@@ -42,6 +43,8 @@ export interface PostgresDdlVisitor<R> {
   createTable(node: PostgresCreateTable): R;
   createSchema(node: PostgresCreateSchema): R;
   alterTable(node: PostgresAlterTable): R;
+  createPolicy(node: PostgresCreatePolicy): R;
+  dropPolicy(node: PostgresDropPolicy): R;
 }
 
 export abstract class PostgresDdlNode extends DdlNode {
@@ -127,4 +130,68 @@ export class PostgresAlterTable extends PostgresDdlNode {
   }
 }
 
-export type AnyPostgresDdlNode = PostgresCreateTable | PostgresCreateSchema | PostgresAlterTable;
+export type { RlsPolicyOperation };
+
+export class PostgresCreatePolicy extends PostgresDdlNode {
+  readonly kind = 'create-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: ReadonlyArray<string>;
+  readonly using: string | undefined;
+  readonly withCheck: string | undefined;
+
+  constructor(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly name: string;
+    readonly permissive: boolean;
+    readonly operation: RlsPolicyOperation;
+    readonly roles: readonly string[];
+    readonly using?: string;
+    readonly withCheck?: string;
+  }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.permissive = options.permissive;
+    this.operation = options.operation;
+    this.roles = Object.freeze([...options.roles]);
+    this.using = options.using;
+    this.withCheck = options.withCheck;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.createPolicy(this);
+  }
+}
+
+export class PostgresDropPolicy extends PostgresDdlNode {
+  readonly kind = 'drop-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+
+  constructor(options: { readonly schema: string; readonly table: string; readonly name: string }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.dropPolicy(this);
+  }
+}
+
+export type AnyPostgresDdlNode =
+  | PostgresCreateTable
+  | PostgresCreateSchema
+  | PostgresAlterTable
+  | PostgresCreatePolicy
+  | PostgresDropPolicy;

package/src/core/descriptor-meta.ts

@@ -2,9 +2,11 @@ import type { CodecTypes } from '../exports/codec-types';
 import {
   postgresAuthoringEntityTypes,
   postgresAuthoringFieldPresets,
+  postgresAuthoringPslBlockDescriptors,
   postgresAuthoringTypes,
 } from './authoring';
 import { postgresTargetDescriptorMetaRuntime } from './descriptor-meta-runtime';
+import { postgresCreateNamespace } from './postgres-schema';
 
 const postgresTargetDescriptorMetaBase = {
   ...postgresTargetDescriptorMetaRuntime,
@@ -13,6 +15,8 @@ const postgresTargetDescriptorMetaBase = {
     type: postgresAuthoringTypes,
     field: postgresAuthoringFieldPresets,
     entityTypes: postgresAuthoringEntityTypes,
+    pslBlockDescriptors: postgresAuthoringPslBlockDescriptors,
+    createNamespace: postgresCreateNamespace,
   },
 } as const;
 

package/src/core/entity-kinds.ts

@@ -0,0 +1,16 @@
+import type { EntityKindDescriptor } from '@prisma-next/framework-components/ir';
+import { PostgresRlsPolicy, type PostgresRlsPolicyInput } from './postgres-rls-policy';
+import { PostgresRole, type PostgresRoleInput } from './postgres-role';
+import { PostgresRlsPolicySchema, PostgresRoleSchema } from './postgres-validators';
+
+export const policyEntityKind: EntityKindDescriptor<PostgresRlsPolicyInput, PostgresRlsPolicy> = {
+  kind: 'policy',
+  schema: PostgresRlsPolicySchema,
+  construct: (input) => new PostgresRlsPolicy(input),
+};
+
+export const roleEntityKind: EntityKindDescriptor<PostgresRoleInput, PostgresRole> = {
+  kind: 'role',
+  schema: PostgresRoleSchema,
+  construct: (input) => new PostgresRole(input),
+};

package/src/core/migrations/control-policy.ts

@@ -21,6 +21,8 @@ import type { PostgresOpFactoryCall } from './op-factory-call';
 const OBJECT_CREATION_FACTORIES: ReadonlySet<string> = new Set<string>([
   'createTable',
   'createSchema',
+  'createRlsPolicy',
+  'enableRowLevelSecurity',
 ]);
 
 function createsNewTopLevelObject(call: PostgresOpFactoryCall): boolean {
@@ -151,6 +153,7 @@ export function resolvePostgresCallControlPolicySubject(
 const POSTGRES_ISSUE_CREATION_FACTORY: Readonly<Record<string, string>> = Object.freeze({
   missing_schema: 'createSchema',
   missing_table: 'createTable',
+  missing_rls_policy: 'createRlsPolicy',
 });
 
 export function resolvePostgresIssueCreationFactoryName(issue: SchemaIssue): string | undefined {

package/src/core/migrations/issue-planner.ts

@@ -695,6 +695,8 @@ type CallCategory =
   | 'dep'
   | 'drop'
   | 'table'
+  | 'rlsEnable'
+  | 'rlsPolicy'
   | 'column'
   | 'alter'
   | 'primaryKey'
@@ -724,6 +726,12 @@ function classifyCall(call: PostgresOpFactoryCall): CallCategory {
       return 'unique'; // after uniques, before indexes
     case 'createTable':
       return 'table';
+    case 'enableRowLevelSecurity':
+      return 'rlsEnable';
+    case 'createRlsPolicy':
+      return 'rlsPolicy';
+    case 'dropRlsPolicy':
+      return 'drop';
     case 'addColumn':
       return 'column';
     case 'alterColumnType':

package/src/core/migrations/op-factory-call.ts

@@ -40,6 +40,7 @@ import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { columnExistsAst, tableExistsAst } from '../../contract-free/checks';
 import * as contractFreeDdl from '../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../postgres-rls-policy';
 import { escapeLiteral, quoteIdentifier } from '../sql-utils';
 import type { PostgresColumnDefault } from '../types';
 import {
@@ -61,6 +62,7 @@ import {
 } from './operations/constraints';
 import { createExtension } from './operations/dependencies';
 import { createIndex, dropIndex } from './operations/indexes';
+import { createRlsPolicy, dropRlsPolicy, enableRowLevelSecurity } from './operations/rls';
 import type { ForeignKeySpec } from './operations/shared';
 import { step, targetDetails } from './operations/shared';
 import { dropTable } from './operations/tables';
@@ -1376,6 +1378,97 @@ export class DataTransformCall extends PostgresOpFactoryCallNode {
   }
 }
 
+export class CreatePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'createRlsPolicy' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policy: PostgresRlsPolicy;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policy: PostgresRlsPolicy) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policy = policy;
+    this.label = `Create RLS policy "${policy.name}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `CreatePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policy.name}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return createRlsPolicy(this.schemaName, this.tableName, this.policy, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `createRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policy)})`;
+  }
+}
+
+export class DropPostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'dropRlsPolicy' as const;
+  readonly operationClass = 'destructive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policyName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policyName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policyName = policyName;
+    this.label = `Drop RLS policy "${policyName}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `DropPostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return dropRlsPolicy(this.schemaName, this.tableName, this.policyName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `dropRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policyName)})`;
+  }
+}
+
+export class EnableRowLevelSecurityCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'enableRowLevelSecurity' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.label = `Enable row-level security on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `EnableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return enableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `enableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+  }
+}
+
 export type PostgresOpFactoryCall =
   | CreateTableCall
   | DropTableCall
@@ -1399,4 +1492,7 @@ export type PostgresOpFactoryCall =
   | RawSqlCall
   | CreateExtensionCall
   | CreateSchemaCall
+  | CreatePostgresRlsPolicyCall
+  | DropPostgresRlsPolicyCall
+  | EnableRowLevelSecurityCall
   | DataTransformCall;

package/src/core/migrations/operations/rls.ts

@@ -0,0 +1,106 @@
+import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
+import { ifDefined } from '@prisma-next/utils/defined';
+import { rlsEnabledAst, rlsPolicyExistsAst } from '../../../contract-free/checks';
+import { createPolicy, dropPolicy } from '../../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../../postgres-rls-policy';
+import { qualifyTableName } from '../planner-sql-checks';
+import { type Op, step, targetDetails } from './shared';
+
+const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+
+function validateRoleName(role: string): string {
+  if (!PLAIN_IDENTIFIER.test(role)) {
+    throw new Error(
+      `Invalid role name ${JSON.stringify(role)}: role names must be plain SQL identifiers matching ^[A-Za-z_][A-Za-z0-9_$]*$`,
+    );
+  }
+  return role;
+}
+
+export async function createRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policy: PostgresRlsPolicy,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const validatedRoles = policy.roles.map(validateRoleName);
+  const ddlNode = createPolicy({
+    schema: schemaName,
+    table: tableName,
+    name: policy.name,
+    permissive: policy.permissive,
+    operation: policy.operation,
+    roles: validatedRoles,
+    ...ifDefined('using', policy.using),
+    ...ifDefined('withCheck', policy.withCheck),
+  });
+  const checks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: policy.name,
+  });
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policy.name}`,
+    label: `Create RLS policy "${policy.name}" on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rlsPolicy', policy.name, schemaName, tableName),
+    precheck: [
+      step(`ensure RLS policy "${policy.name}" does not exist`, absent.sql, absent.params),
+    ],
+    execute: [step(`create RLS policy "${policy.name}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policy.name}" exists`, present.sql, present.params)],
+  };
+}
+
+export async function dropRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policyName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = dropPolicy({ schema: schemaName, table: tableName, name: policyName });
+  const checks = rlsPolicyExistsAst({ schema: schemaName, table: tableName, policyName });
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policyName}.drop`,
+    label: `Drop RLS policy "${policyName}" on "${tableName}"`,
+    operationClass: 'destructive',
+    target: targetDetails('rlsPolicy', policyName, schemaName, tableName),
+    precheck: [step(`ensure RLS policy "${policyName}" exists`, present.sql, present.params)],
+    execute: [step(`drop RLS policy "${policyName}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policyName}" is absent`, absent.sql, absent.params)],
+  };
+}
+
+export async function enableRowLevelSecurity(
+  schemaName: string,
+  tableName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const checks = rlsEnabledAst(schemaName, tableName);
+  const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+  const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+  return {
+    id: `rowLevelSecurity.${schemaName}.${tableName}`,
+    label: `Enable row-level security on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rowLevelSecurity', tableName, schemaName),
+    precheck: [
+      step(`check RLS is not already enabled on "${tableName}"`, disabled.sql, disabled.params),
+    ],
+    execute: [
+      step(
+        `enable row-level security on "${tableName}"`,
+        `ALTER TABLE ${qualifyTableName(schemaName, tableName)} ENABLE ROW LEVEL SECURITY`,
+      ),
+    ],
+    postcheck: [
+      step(`verify row-level security is enabled on "${tableName}"`, enabled.sql, enabled.params),
+    ],
+  };
+}

package/src/core/migrations/planner-target-details.ts

@@ -9,7 +9,9 @@ export type OperationClass =
   | 'unique'
   | 'index'
   | 'foreignKey'
-  | 'checkConstraint';
+  | 'checkConstraint'
+  | 'rlsPolicy'
+  | 'rowLevelSecurity';
 
 export interface PostgresPlanTargetDetails {
   readonly schema: string;