@rebasepro/common 0.7.0 → 0.9.0

package/src/util/permissions.ts

@@ -1,4 +1,6 @@
-import { CollectionWithRelations, Entity, EntityCollection, getDataSourceCapabilities, SecurityRule, User } from "@rebasepro/types";
+import { Entity, CollectionConfig, getDataSourceCapabilities, SecurityOperation, SecurityRule, User } from "@rebasepro/types";
+import { securityRuleToConditions } from "./policy/securityRuleToConditions";
+import { evaluatePolicy, PolicyEvalContext, TriState } from "./policy/evaluatePolicy";
 
 /**
  * Minimal auth context for permission checking.
@@ -9,200 +11,125 @@ export interface AuthContext<USER extends User = User> {
     user: USER | null;
 }
 
-function evaluateAST<USER extends User, M extends Record<string, unknown>>(sqlString: string, auth: AuthContext<USER>, entity: Entity<M> | null): boolean {
-    // This is a client-side SQL evaluator used *only* for optimistic UI updates.
-    // It parses basic AND / OR statements to evaluate RLS without backend roundtrips.
-    if (!entity) return true;
-
-    // 1. Clean outer parentheses
-    let cleanedSQL = sqlString.trim();
-    while (cleanedSQL.startsWith("(") && cleanedSQL.endsWith(")")) {
-        let openCount = 0;
-        let isEnclosing = true;
-        for (let i = 0; i < cleanedSQL.length - 1; i++) {
-            if (cleanedSQL[i] === "(") openCount++;
-            else if (cleanedSQL[i] === ")") openCount--;
-            if (openCount === 0) {
-                isEnclosing = false;
-                break;
-            }
-        }
-        if (isEnclosing) {
-            cleanedSQL = cleanedSQL.substring(1, cleanedSQL.length - 1).trim();
-        } else {
-            break;
-        }
-    }
-
-    // 2. Split top-level OR / AND
-    const splitByTopLevel = (str: string, delimiter: string) => {
-        const parts: string[] = [];
-        let current = "";
-        let openCount = 0;
-        let i = 0;
-        while (i < str.length) {
-            if (str[i] === "(") openCount++;
-            else if (str[i] === ")") openCount--;
-
-            if (openCount === 0 && str.substring(i).toUpperCase().startsWith(delimiter)) {
-                parts.push(current);
-                current = "";
-                i += delimiter.length;
-            } else {
-                current += str[i];
-                i++;
-            }
-        }
-        parts.push(current);
-        return parts;
-    };
-
-    const orParts = splitByTopLevel(cleanedSQL, " OR ");
-    if (orParts.length > 1) {
-        return orParts.some(part => evaluateAST(part, auth, entity));
-    }
-
-    const andParts = splitByTopLevel(cleanedSQL, " AND ");
-    if (andParts.length > 1) {
-        return andParts.every(part => evaluateAST(part, auth, entity));
-    }
-
-    const upperSQL = cleanedSQL.toUpperCase();
-
-    // 3. Fallback for unparseable complex queries
-    if (upperSQL.includes(" IN ") || upperSQL.includes(" EXISTS ")) {
-        return true;
-    }
-
-    // 4. Role array checks
-    // Pattern: `string_to_array(auth.roles(), ',') && ARRAY['admin', 'editor']`
-    const roleIntersectMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\[(.*?)\]/i);
-    if (roleIntersectMatch && roleIntersectMatch[1]) {
-        const requiredRoles = roleIntersectMatch[1].split(",").map(r => r.trim().replace(/'/g, ""));
-        const userRoles = auth.user?.roles || [];
-        return requiredRoles.some(r => userRoles.includes(r));
-    }
-
-    // Pattern: `string_to_array(auth.roles(), ',') @> ARRAY['admin']`
-    const roleContainMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\[(.*?)\]/i);
-    if (roleContainMatch && roleContainMatch[1]) {
-        const requiredRoles = roleContainMatch[1].split(",").map(r => r.trim().replace(/'/g, ""));
-        const userRoles = auth.user?.roles || [];
-        return requiredRoles.every(r => userRoles.includes(r));
-    }
-
-    // 5. Existing ID patterns
-    const pattern1 = new RegExp("^\\{?([a-zA-Z0-9_]+)\\}?\\s*=\\s*(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))");
-    const pattern2 = new RegExp("^(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))\\s*=\\s*\\{?([a-zA-Z0-9_]+)\\}?");
-
-    const match1 = cleanedSQL.match(pattern1);
-    if (match1 && match1[1]) {
-        return entity.values[match1[1]] === auth.user?.uid;
-    }
+/**
+ * How to resolve a policy result that cannot be decided client-side (a raw-SQL
+ * escape-hatch rule, or a row-column reference with no row in hand).
+ *
+ * - `"allow"` (default): optimistic — used for admin-UI gating, where Postgres
+ *   remains the authoritative gate and hiding a working action is worse than
+ *   showing one the server may reject.
+ * - `"deny"`: fail-closed — used by real enforcement callers (e.g. a driver
+ *   applying policies in-process), so an undecidable rule never silently allows.
+ */
+export type UnknownResolution = "allow" | "deny";
 
-    const match2 = cleanedSQL.match(pattern2);
-    if (match2 && match2[1]) {
-        return entity.values[match2[1]] === auth.user?.uid;
-    }
+export interface CheckOperationOptions {
+    onUnknown?: UnknownResolution;
+}
 
-    // 6. Simple equality
-    // Pattern: `field = 'value'` or `{field} != 'value'`
-    const simpleEqualityMatch = cleanedSQL.match(/^\{?([\w_]+)\}?\s*(=|!=)\s*'([^']+)'$/i);
-    if (simpleEqualityMatch) {
-        const field = simpleEqualityMatch[1];
-        const operator = simpleEqualityMatch[2];
-        const value = simpleEqualityMatch[3];
-        const entityValue = entity.values[field];
-        if (operator === "=") return entityValue === value;
-        if (operator === "!=") return entityValue !== value;
-    }
+/** Combine clause results with AND under three-valued (Kleene) logic. */
+function kleeneAnd(values: TriState[]): TriState {
+    if (values.some(v => v === false)) return false;
+    if (values.some(v => v === "unknown")) return "unknown";
+    return true;
+}
 
-    return true; // Optimistic fallback for anything else
+/** The operations a rule covers, mirroring the Postgres generator's resolution. */
+function ruleOperations(rule: SecurityRule): readonly SecurityOperation[] {
+    return rule.operations && rule.operations.length > 0
+        ? rule.operations
+        : [rule.operation ?? "all"];
 }
 
-function evaluateRule<USER extends User, M extends Record<string, unknown>>(rule: SecurityRule, auth: AuthContext<USER>, entity: Entity<M> | null): boolean {
+function ruleApplies(rule: SecurityRule, targetOperation: SecurityOperation): boolean {
+    const ops = ruleOperations(rule);
+    return ops.includes(targetOperation) || ops.includes("all");
+}
 
-    if (rule.access === "public") return true;
+/**
+ * Evaluate a single rule for one operation, returning a tri-state.
+ *
+ * A `null` clause (the rule contributes no condition for a required clause)
+ * denies — matching Postgres, which emits `USING (false)` / `WITH CHECK (false)`
+ * in that case. USING applies to SELECT/UPDATE/DELETE; WITH CHECK to
+ * INSERT/UPDATE; both must pass for UPDATE.
+ */
+function evaluateRuleForOperation(rule: SecurityRule, ctx: PolicyEvalContext, targetOperation: SecurityOperation): TriState {
+    const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+    const clause = (expr: typeof usingExpr): TriState => expr === null ? false : evaluatePolicy(expr, ctx);
 
-    if (rule.ownerField) {
-        if (!entity) {
-            // null entity: optimistic — we can't evaluate ownership without data
-            // Fall through to SQL checks below (if any). If none, will return true.
-        } else {
-            // Entity present: strictly check ownership. Fail immediately if mismatch.
-            if (entity.values[rule.ownerField] !== auth.user?.uid) return false;
-        }
-    }
+    const needsUsing = targetOperation !== "insert";
+    const needsWithCheck = targetOperation === "insert" || targetOperation === "update";
 
-    // In PostgreSQL RLS, USING and WITH CHECK have distinct semantics:
-    // USING applies to existing rows (SELECT/UPDATE/DELETE read phase)
-    // WITH CHECK applies to new/modified values (INSERT/UPDATE write phase)
-    // Both must pass. We evaluate both independently.
-    if (rule.using && !evaluateAST(rule.using, auth, entity)) return false;
-    if (rule.withCheck && !evaluateAST(rule.withCheck, auth, entity)) return false;
+    const results: TriState[] = [];
+    if (needsUsing) results.push(clause(usingExpr));
+    if (needsWithCheck) results.push(clause(withCheckExpr));
+    return kleeneAnd(results);
+}
 
-    return true;
+function resolveTriState(value: TriState, onUnknown: UnknownResolution): boolean {
+    if (value === "unknown") return onUnknown === "allow";
+    return value;
 }
 
+/**
+ * Decide whether an operation is permitted for a user on a (possibly null) row,
+ * by evaluating the collection's security rules with the shared policy model —
+ * the same model compiled to Postgres RLS DDL, so the decision matches database
+ * enforcement for every non-raw rule.
+ *
+ * @param options.onUnknown how to treat rules that cannot be decided
+ *   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
+ *   for optimistic UI gating; enforcement callers should pass `"deny"`.
+ */
 export function checkOperation<M extends Record<string, unknown>, USER extends User>(
-    collection: EntityCollection<M>,
+    collection: CollectionConfig<M>,
     authContext: AuthContext<USER>,
     entity: Entity<M> | null,
-    targetOperation: "select" | "insert" | "update" | "delete"
+    targetOperation: SecurityOperation,
+    options?: CheckOperationOptions
 ): boolean {
-    const securityRules = getDataSourceCapabilities(collection.driver).supportsRLS ? (collection as CollectionWithRelations).securityRules : undefined;
+    const onUnknown = options?.onUnknown ?? "allow";
+    const securityRules = getDataSourceCapabilities(collection.engine).supportsRLS ? collection.securityRules : undefined;
     if (!securityRules || securityRules.length === 0) {
         return true;
     }
 
-    const applicableRules = securityRules.filter((r: SecurityRule) =>
-        r.operation === targetOperation ||
-        r.operation === "all" ||
-        r.operations?.includes(targetOperation) ||
-        r.operations?.includes("all")
-    );
-
+    const applicableRules = securityRules.filter((r: SecurityRule) => ruleApplies(r, targetOperation));
     if (applicableRules.length === 0) return false;
 
-    const userRoleIds = authContext.user?.roles ?? [];
-    const userRoles = [...userRoleIds, "public"];
-    const roleApplicableRules = applicableRules.filter((rule: SecurityRule) => {
-        if (!rule.roles || rule.roles.length === 0) return true;
-        return rule.roles.some((r: string) => userRoles.includes(r));
-    });
-
-    if (roleApplicableRules.length === 0) return false;
+    const ctx: PolicyEvalContext = {
+        uid: authContext.user?.uid,
+        roles: authContext.user?.roles ?? [],
+        entity
+    };
 
     let grantedByPermissive = false;
     let deniedByRestrictive = false;
+    let hasPermissive = false;
 
-    for (const rule of roleApplicableRules) {
+    for (const rule of applicableRules) {
         const mode = rule.mode || "permissive";
-        const passed = evaluateRule(rule, authContext, entity);
+        const passed = resolveTriState(evaluateRuleForOperation(rule, ctx, targetOperation), onUnknown);
 
-        if (mode === "restrictive" && !passed) {
-            deniedByRestrictive = true;
-            break;
-        }
-
-        if (mode === "permissive" && passed) {
-            grantedByPermissive = true;
+        if (mode === "restrictive") {
+            if (!passed) {
+                deniedByRestrictive = true;
+                break;
+            }
+        } else {
+            hasPermissive = true;
+            if (passed) grantedByPermissive = true;
         }
     }
 
     if (deniedByRestrictive) return false;
-
-    const hasPermissive = roleApplicableRules.some((r: SecurityRule) => (r.mode || "permissive") === "permissive");
-    if (hasPermissive) {
-        return grantedByPermissive;
-    } else {
-        return false;
-    }
+    return hasPermissive ? grantedByPermissive : false;
 }
 
 export function canReadCollection<M extends Record<string, unknown>, USER extends User>
     (
-        collection: EntityCollection<M>,
+        collection: CollectionConfig<M>,
         authContext: AuthContext<USER>
     ): boolean {
     return checkOperation(collection, authContext, null, "select");
@@ -210,7 +137,7 @@ export function canReadCollection<M extends Record<string, unknown>, USER extend
 
 export function canEditEntity<M extends Record<string, unknown>, USER extends User>
     (
-        collection: EntityCollection<M>,
+        collection: CollectionConfig<M>,
         authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
@@ -220,7 +147,7 @@ export function canEditEntity<M extends Record<string, unknown>, USER extends Us
 
 export function canCreateEntity<M extends Record<string, unknown>, USER extends User>
     (
-        collection: EntityCollection<M>,
+        collection: CollectionConfig<M>,
         authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
@@ -230,7 +157,7 @@ export function canCreateEntity<M extends Record<string, unknown>, USER extends
 
 export function canDeleteEntity<M extends Record<string, unknown>, USER extends User>
     (
-        collection: EntityCollection<M>,
+        collection: CollectionConfig<M>,
         authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null

package/src/util/policy/evaluatePolicy.ts

@@ -0,0 +1,152 @@
+import { Entity, PolicyCompareOperator, PolicyExpression, PolicyOperand } from "@rebasepro/types";
+
+/**
+ * Result of evaluating a policy client-side. `"unknown"` means the expression
+ * could not be decided without more information — either a raw-SQL escape-hatch
+ * node (which the client deliberately never guesses) or a row-column reference
+ * with no entity in hand (e.g. list-level gating). Callers decide how to resolve
+ * `"unknown"`: fail-closed for an enforcement decision, optimistic for pure
+ * visibility gating.
+ */
+export type TriState = boolean | "unknown";
+
+/**
+ * Context for {@link evaluatePolicy}: the acting user (or none) and the row
+ * being evaluated (or none, for collection-level gating).
+ */
+export interface PolicyEvalContext {
+    /** The current user's id, or null/undefined when unauthenticated. */
+    uid?: string | null;
+    /** The current user's application roles. */
+    roles?: string[];
+    /** The row being evaluated, or null when no specific row is available. */
+    entity: Entity | null;
+}
+
+/**
+ * Evaluates a {@link PolicyExpression} against a user + row, using three-valued
+ * (Kleene) logic so that `"unknown"` sub-results propagate soundly.
+ *
+ * This is the JavaScript twin of {@link policyToPostgres}: both derive from the
+ * same expression, so the admin UI matches database enforcement by construction
+ * for every non-raw rule.
+ */
+export function evaluatePolicy(expr: PolicyExpression, ctx: PolicyEvalContext): TriState {
+    switch (expr.kind) {
+        case "true":
+            return true;
+        case "false":
+            return false;
+        case "and":
+            return kleeneAnd(expr.operands.map(o => evaluatePolicy(o, ctx)));
+        case "or":
+            return kleeneOr(expr.operands.map(o => evaluatePolicy(o, ctx)));
+        case "not":
+            return kleeneNot(evaluatePolicy(expr.operand, ctx));
+        case "compare":
+            return evaluateCompare(expr.op, expr.left, expr.right, ctx);
+        case "rolesOverlap": {
+            const userRoles = ctx.roles ?? [];
+            return expr.roles.some(r => r === "public" || userRoles.includes(r));
+        }
+        case "rolesContain": {
+            const userRoles = ctx.roles ?? [];
+            return expr.roles.every(r => r === "public" || userRoles.includes(r));
+        }
+        case "authenticated":
+            return ctx.uid != null;
+        case "existsIn":
+            // A membership subquery cannot be run client-side — server-authoritative.
+            return "unknown";
+        case "raw":
+            // Arbitrary SQL cannot be evaluated client-side — never guess.
+            return "unknown";
+    }
+}
+
+// ── Three-valued logic ───────────────────────────────────────────────
+
+function kleeneAnd(values: TriState[]): TriState {
+    if (values.some(v => v === false)) return false;
+    if (values.some(v => v === "unknown")) return "unknown";
+    return true;
+}
+
+function kleeneOr(values: TriState[]): TriState {
+    if (values.some(v => v === true)) return true;
+    if (values.some(v => v === "unknown")) return "unknown";
+    return false;
+}
+
+function kleeneNot(value: TriState): TriState {
+    if (value === "unknown") return "unknown";
+    return !value;
+}
+
+// ── Comparison ───────────────────────────────────────────────────────
+
+type ResolvedOperand = { known: false } | { known: true; value: unknown };
+
+function resolveOperand(operand: PolicyOperand, ctx: PolicyEvalContext): ResolvedOperand {
+    switch (operand.kind) {
+        case "literal":
+            return { known: true, value: operand.value };
+        case "authUid":
+            return { known: true, value: ctx.uid ?? null };
+        case "authRoles":
+            return { known: true, value: ctx.roles ?? [] };
+        case "field":
+            // Can't resolve a row column without the row.
+            if (!ctx.entity) return { known: false };
+            return { known: true, value: ctx.entity.values[operand.name] };
+        case "outerField":
+            // Only meaningful inside an `existsIn` subquery (server-authoritative).
+            return { known: false };
+    }
+}
+
+function evaluateCompare(
+    op: PolicyCompareOperator,
+    left: PolicyOperand,
+    right: PolicyOperand,
+    ctx: PolicyEvalContext
+): TriState {
+    const l = resolveOperand(left, ctx);
+    const r = resolveOperand(right, ctx);
+    if (!l.known || !r.known) return "unknown";
+
+    const a = l.value;
+    const b = r.value;
+
+    if (a === null || b === null) {
+        if (op === "eq") return false;
+        if (op === "neq") return true;
+        return "unknown";
+    }
+
+    if (op === "eq") return a === b;
+    if (op === "neq") return a !== b;
+
+    if (typeof a === "string" && typeof b === "string") {
+        if (op === "lt") return a < b;
+        if (op === "lte") return a <= b;
+        if (op === "gt") return a > b;
+        if (op === "gte") return a >= b;
+    }
+
+    if (typeof a === "number" && typeof b === "number") {
+        if (op === "lt") return a < b;
+        if (op === "lte") return a <= b;
+        if (op === "gt") return a > b;
+        if (op === "gte") return a >= b;
+    }
+
+    if (typeof a === "bigint" && typeof b === "bigint") {
+        if (op === "lt") return a < b;
+        if (op === "lte") return a <= b;
+        if (op === "gt") return a > b;
+        if (op === "gte") return a >= b;
+    }
+
+    return "unknown";
+}

package/src/util/policy/index.ts

@@ -0,0 +1,3 @@
+export * from "./securityRuleToConditions";
+export * from "./policyToPostgres";
+export * from "./evaluatePolicy";

package/src/util/policy/policyToPostgres.ts

@@ -0,0 +1,165 @@
+import { CollectionConfig, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property, ExistsInPolicyExpression } from "@rebasepro/types";
+import { toSnakeCase } from "@rebasepro/utils";
+import { getTableName } from "../relations";
+
+/**
+ * Options for {@link policyToPostgres}.
+ */
+export interface PolicyCompileOptions {
+    /**
+     * Resolve a collection by slug. Required to compile
+     * {@link ExistsInPolicyExpression} (`policy.existsIn`) — the compiler needs
+     * the joined collection to derive its table name / schema. When omitted, the
+     * join table falls back to a snake_cased slug.
+     */
+    resolveCollection?: (slug: string) => CollectionConfig | undefined;
+}
+
+/**
+ * The lexical scope threaded through compilation. It changes when we descend
+ * into an `existsIn` subquery: inside it, `field` refers to the joined table
+ * (aliased) while `outerField` refers to the outer RLS row (table-qualified).
+ */
+interface CompileScope {
+    /** Collection whose columns a bare `field` operand resolves against. */
+    fieldCollection?: CollectionConfig;
+    /** SQL prefix for `field` operands (`""` at top level, `"alias".` in a subquery). */
+    fieldPrefix: string;
+    /** The outer RLS collection, for `outerField` operands. */
+    outerCollection?: CollectionConfig;
+    /** SQL prefix for `outerField` operands (`""` at top level, `"schema"."table".` in a subquery). */
+    outerPrefix: string;
+    resolveCollection?: (slug: string) => CollectionConfig | undefined;
+    /** Monotonic counter for generating unique subquery aliases. */
+    alias: { n: number };
+}
+
+/**
+ * Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
+ * suitable for a `USING (...)` / `WITH CHECK (...)` clause.
+ *
+ * This is one of the two consumers of the shared policy model (the other being
+ * {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
+ * and the admin UI derive from the exact same expression.
+ */
+export function policyToPostgres(expr: PolicyExpression, collection?: CollectionConfig, options?: PolicyCompileOptions): string {
+    return compile(expr, {
+        fieldCollection: collection,
+        fieldPrefix: "",
+        outerCollection: collection,
+        outerPrefix: "",
+        resolveCollection: options?.resolveCollection,
+        alias: { n: 0 }
+    });
+}
+
+function compile(expr: PolicyExpression, scope: CompileScope): string {
+    switch (expr.kind) {
+        case "true":
+            return "true";
+        case "false":
+            return "false";
+        case "and":
+            return expr.operands.length === 0
+                ? "true"
+                : expr.operands.map(o => `(${compile(o, scope)})`).join(" AND ");
+        case "or":
+            return expr.operands.length === 0
+                ? "false"
+                : expr.operands.map(o => `(${compile(o, scope)})`).join(" OR ");
+        case "not":
+            // Render the common `auth.uid() IS NULL` (unauthenticated) form directly.
+            if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
+            return `NOT (${compile(expr.operand, scope)})`;
+        case "compare":
+            return `${operandToSql(expr.left, scope)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, scope)}`;
+        case "rolesOverlap":
+            return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
+        case "rolesContain":
+            return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
+        case "authenticated":
+            return "auth.uid() IS NOT NULL";
+        case "existsIn":
+            return compileExistsIn(expr, scope);
+        case "raw":
+            // Full-power escape hatch: `{column}` references resolve to the bare
+            // column name (matching the previous raw-SQL behavior).
+            return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+    }
+}
+
+/**
+ * Compiles `existsIn` to a correlated `EXISTS (SELECT 1 FROM <join> WHERE ...)`.
+ * Inside the subquery, `field` operands bind to the aliased join table and
+ * `outerField` operands bind to the (table-qualified) outer RLS row.
+ */
+function compileExistsIn(expr: ExistsInPolicyExpression, scope: CompileScope): string {
+    const join = scope.resolveCollection?.(expr.collection);
+    const joinTable = join ? getTableName(join) : toSnakeCase(expr.collection);
+    const joinSchema = schemaOf(join) ?? schemaOf(scope.outerCollection) ?? "public";
+    const alias = `_ex${scope.alias.n++}`;
+
+    // `outerField` inside the subquery must be qualified with the outer table,
+    // otherwise a bare column name would bind to the joined table instead.
+    const outerTable = scope.outerCollection ? getTableName(scope.outerCollection) : undefined;
+    const outerSchema = schemaOf(scope.outerCollection) ?? "public";
+    const outerPrefix = outerTable ? `"${outerSchema}"."${outerTable}".` : "";
+
+    const innerScope: CompileScope = {
+        fieldCollection: join,
+        fieldPrefix: `"${alias}".`,
+        outerCollection: scope.outerCollection,
+        outerPrefix,
+        resolveCollection: scope.resolveCollection,
+        alias: scope.alias
+    };
+    return `EXISTS (SELECT 1 FROM "${joinSchema}"."${joinTable}" "${alias}" WHERE ${compile(expr.where, innerScope)})`;
+}
+
+const COMPARE_SQL: Record<PolicyCompareOperator, string> = {
+    eq: "=",
+    neq: "!=",
+    lt: "<",
+    lte: "<=",
+    gt: ">",
+    gte: ">="
+};
+
+function operandToSql(operand: PolicyOperand, scope: CompileScope): string {
+    switch (operand.kind) {
+        case "field":
+            return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
+        case "outerField":
+            return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
+        case "literal":
+            return quoteLiteral(operand.value);
+        case "authUid":
+            return "auth.uid()";
+        case "authRoles":
+            return "string_to_array(auth.roles(), ',')";
+    }
+}
+
+function schemaOf(collection?: CollectionConfig): string | undefined {
+    return (collection as { schema?: string } | undefined)?.schema || undefined;
+}
+
+function resolveColumnName(propName: string, collection?: CollectionConfig): string {
+    const prop = collection?.properties?.[propName] as Property | undefined;
+    if (prop && "columnName" in prop && typeof (prop as { columnName?: unknown }).columnName === "string") {
+        return (prop as { columnName: string }).columnName;
+    }
+    return toSnakeCase(propName);
+}
+
+function quoteLiteral(value: string | number | boolean | null): string {
+    if (value === null) return "NULL";
+    if (typeof value === "boolean") return value ? "true" : "false";
+    if (typeof value === "number") return String(value);
+    return `'${value.replace(/'/g, "''")}'`;
+}
+
+/** Sorted, single-quoted `ARRAY['a','b']` — matches the generators' output. */
+function rolesArraySql(roles: readonly string[]): string {
+    return `ARRAY[${[...roles].sort().map(r => `'${r}'`).join(",")}]`;
+}