@rebasepro/studio 0.22.0 → 0.24.0

package/dist/MonacoEditor-CUxy5_k5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MonacoEditor-CUxy5_k5.js","names":[],"sources":["../src/components/SQLEditor/MonacoEditor.tsx"],"sourcesContent":["import React, { useImperativeHandle, useRef } from \"react\";\nimport Editor, { Monaco, OnMount } from \"@monaco-editor/react\";\nimport type { editor, Position, IRange } from \"monaco-editor\";\nimport { cls, defaultBorderMixin } from \"@rebasepro/ui\";\nimport { useModeController } from \"@rebasepro/app\";\n\n/**\n * What a host can ask of the editor outside its own key bindings.\n *\n * The toolbar's buttons need the selection that Cmd+Enter already reads: a\n * button that runs the whole buffer while the shortcut beside it runs only the\n * highlighted statement is two answers to one question.\n */\nexport interface MonacoEditorHandle {\n    /** The selected text, trimmed — `undefined` when nothing is selected. */\n    getSelectedText: () => string | undefined;\n}\n\n/** The editor's selection, trimmed — `undefined` when there is none. */\nfunction selectedTextOf(instance: editor.IStandaloneCodeEditor): string | undefined {\n    const selection = instance.getSelection();\n    if (!selection || selection.isEmpty()) return undefined;\n    return instance.getModel()?.getValueInRange(selection)?.trim() || undefined;\n}\n\nexport type MonacoEditorProps = {\n    ref?: React.Ref<MonacoEditorHandle>;\n    value: string;\n    onChange: (value: string | undefined) => void;\n    onRun?: (selectedText?: string) => void;\n    className?: string;\n    readOnly?: boolean;\n    autoFocus?: boolean;\n    schemas?: Record<string, { schemaName: string, tableName: string, columns: { name: string, dataType: string }[] }[]>;\n};\n\nexport const MonacoEditor = ({\n    ref,\n    value,\n    onChange,\n    onRun,\n    className,\n    readOnly = false,\n    autoFocus = true,\n    schemas\n}: MonacoEditorProps) => {\n    const { mode } = useModeController();\n    const editorRef = useRef<editor.IStandaloneCodeEditor | null>(null);\n    const monacoRef = useRef<Monaco | null>(null);\n    const onRunRef = useRef(onRun);\n    onRunRef.current = onRun;\n\n    const schemasRef = useRef(schemas);\n    schemasRef.current = schemas;\n\n    useImperativeHandle(ref, () => ({\n        getSelectedText: () => (editorRef.current ? selectedTextOf(editorRef.current) : undefined)\n    }), []);\n\n    const handleEditorOnMount: OnMount = (editor, monaco) => {\n        editorRef.current = editor;\n        monacoRef.current = monaco;\n\n        editor.addAction({\n            id: \"run-query\",\n            label: \"Run Query\",\n            keybindings: [monaco.KeyMod.CtrlCmd + monaco.KeyCode.Enter],\n            contextMenuGroupId: \"operation\",\n            contextMenuOrder: 0,\n            run: () => {\n                onRunRef.current?.(selectedTextOf(editor));\n            }\n        });\n\n        // Register custom autocomplete for tables, columns, and SQL keywords\n        const sqlKeywords = [\n            \"SELECT\", \"FROM\", \"WHERE\", \"INSERT INTO\", \"VALUES\", \"UPDATE\", \"SET\",\n            \"DELETE FROM\", \"JOIN\", \"INNER JOIN\", \"LEFT JOIN\", \"RIGHT JOIN\", \"FULL JOIN\",\n            \"ON\", \"GROUP BY\", \"HAVING\", \"ORDER BY\", \"ASC\", \"DESC\", \"LIMIT\", \"OFFSET\",\n            \"AS\", \"AND\", \"OR\", \"NOT\", \"IN\", \"BETWEEN\", \"LIKE\", \"IS NULL\", \"IS NOT NULL\",\n            \"CREATE TABLE\", \"ALTER TABLE\", \"DROP TABLE\", \"PRIMARY KEY\", \"FOREIGN KEY\",\n            \"COUNT\", \"SUM\", \"AVG\", \"MIN\", \"MAX\", \"DISTINCT\", \"UNION\", \"ALL\", \"EXISTS\",\n            \"CASE\", \"WHEN\", \"THEN\", \"ELSE\", \"END\", \"CAST\", \"COALESCE\"\n        ];\n\n        monaco.languages.registerCompletionItemProvider(\"pgsql\", {\n            triggerCharacters: [\".\", \" \", \"A\", \"B\", \"C\", \"D\", \"E\", \"F\", \"G\", \"H\", \"I\", \"J\", \"K\", \"L\", \"M\", \"N\", \"O\", \"P\", \"Q\", \"R\", \"S\", \"T\", \"U\", \"V\", \"W\", \"X\", \"Y\", \"Z\", \"a\", \"b\", \"c\", \"d\", \"e\", \"f\", \"g\", \"h\", \"i\", \"j\", \"k\", \"l\", \"m\", \"n\", \"o\", \"p\", \"q\", \"r\", \"s\", \"t\", \"u\", \"v\", \"w\", \"x\", \"y\", \"z\"],\n            provideCompletionItems: (model: editor.ITextModel, position: Position) => {\n                const word = model.getWordUntilPosition(position);\n                const range = {\n                    startLineNumber: position.lineNumber,\n                    endLineNumber: position.lineNumber,\n                    startColumn: word.startColumn,\n                    endColumn: word.endColumn\n                };\n\n                const textUntilPosition = model.getValueInRange({\n                    startLineNumber: position.lineNumber,\n                    startColumn: 1,\n                    endLineNumber: position.lineNumber,\n                    endColumn: position.column\n                });\n\n                // Check if user is typing `tableName.`\n                const match = textUntilPosition.match(/([a-zA-Z0-9_]+)\\.$/);\n                const tableNameMatch = match ? match[1] : null;\n\n                const suggestions: { label: string; kind: number; insertText: string; range: IRange; detail: string; sortText: string }[] = [];\n                const allSchemas = schemasRef.current || {};\n\n                if (tableNameMatch) {\n                    // Provide columns for the matched table\n                    for (const [, tables] of Object.entries(allSchemas)) {\n                        const table = tables.find(t => t.tableName === tableNameMatch);\n                        if (table) {\n                            table.columns.forEach(col => {\n                                suggestions.push({\n                                    label: col.name,\n                                    kind: monaco.languages.CompletionItemKind.Field,\n                                    insertText: col.name,\n                                    range,\n                                    detail: \"Column\",\n                                    sortText: \"1\"\n                                });\n                            });\n                        }\n                    }\n                } else {\n                    // Provide table names\n                    for (const [sName, tables] of Object.entries(allSchemas)) {\n                        tables.forEach(table => {\n                            suggestions.push({\n                                label: table.tableName,\n                                kind: monaco.languages.CompletionItemKind.Class,\n                                insertText: table.tableName,\n                                range,\n                                detail: `Table (${sName})`,\n                                sortText: \"2\"\n                            });\n                        });\n                    }\n\n                    // Provide SQL keywords\n                    sqlKeywords.forEach(keyword => {\n                        suggestions.push({\n                            label: keyword,\n                            kind: monaco.languages.CompletionItemKind.Keyword,\n                            insertText: keyword + \" \",\n                            range,\n                            detail: \"SQL Keyword\",\n                            sortText: \"3\"\n                        });\n                    });\n\n                    // Heuristic: Suggest columns for tables that are mentioned in the current editor text\n                    const fullText = model.getValue();\n                    const activeTables = new Set<string>();\n                    for (const [, tables] of Object.entries(allSchemas)) {\n                        tables.forEach(table => {\n                            const regex = new RegExp(`\\\\b${table.tableName}\\\\b`, \"i\");\n                            if (regex.test(fullText)) {\n                                activeTables.add(table.tableName);\n                            }\n                        });\n                    }\n\n                    const addedColumns = new Set<string>();\n                    for (const [, tables] of Object.entries(allSchemas)) {\n                        tables.forEach(table => {\n                            if (activeTables.has(table.tableName)) {\n                                table.columns.forEach(col => {\n                                    if (!addedColumns.has(col.name)) {\n                                        addedColumns.add(col.name);\n                                        suggestions.push({\n                                            label: col.name,\n                                            kind: monaco.languages.CompletionItemKind.Field,\n                                            insertText: col.name,\n                                            range,\n                                            detail: `Column (${table.tableName})`,\n                                            sortText: \"1\" // Prioritize columns from active tables\n                                        });\n                                    }\n                                });\n                            }\n                        });\n                    }\n                }\n\n                return { suggestions };\n\n            }\n        });\n\n        if (autoFocus) {\n            editor.focus();\n        }\n    };\n\n    return (\n        <div className={cls(\"relative w-full h-full overflow-hidden\", className)}>\n            <Editor\n                height=\"100%\"\n                defaultLanguage=\"pgsql\"\n                value={value}\n                onChange={onChange}\n                onMount={handleEditorOnMount}\n                theme={mode === \"dark\" ? \"vs-dark\" : \"vs\"}\n                options={{\n                    minimap: { enabled: false },\n                    fontSize: 14,\n                    lineNumbers: \"on\",\n                    scrollBeyondLastLine: false,\n                    automaticLayout: true,\n                    readOnly,\n                    tabSize: 2,\n                    wordWrap: \"on\"\n                }}\n            />\n        </div>\n    );\n};\n"],"mappings":";;;;;;;AAmBA,SAAS,eAAe,UAA4D;CAChF,MAAM,YAAY,SAAS,aAAa;CACxC,IAAI,CAAC,aAAa,UAAU,QAAQ,GAAG,OAAO,KAAA;CAC9C,OAAO,SAAS,SAAS,CAAC,EAAE,gBAAgB,SAAS,CAAC,EAAE,KAAK,KAAK,KAAA;AACtE;AAaA,IAAa,gBAAgB,EACzB,KACA,OACA,UACA,OACA,WACA,WAAW,OACX,YAAY,MACZ,cACqB;CACrB,MAAM,EAAE,SAAS,kBAAkB;CACnC,MAAM,YAAY,OAA4C,IAAI;CAClE,MAAM,YAAY,OAAsB,IAAI;CAC5C,MAAM,WAAW,OAAO,KAAK;CAC7B,SAAS,UAAU;CAEnB,MAAM,aAAa,OAAO,OAAO;CACjC,WAAW,UAAU;CAErB,oBAAoB,YAAY,EAC5B,uBAAwB,UAAU,UAAU,eAAe,UAAU,OAAO,IAAI,KAAA,EACpF,IAAI,CAAC,CAAC;CAEN,MAAM,uBAAgC,QAAQ,WAAW;EACrD,UAAU,UAAU;EACpB,UAAU,UAAU;EAEpB,OAAO,UAAU;GACb,IAAI;GACJ,OAAO;GACP,aAAa,CAAC,OAAO,OAAO,UAAU,OAAO,QAAQ,KAAK;GAC1D,oBAAoB;GACpB,kBAAkB;GAClB,WAAW;IACP,SAAS,UAAU,eAAe,MAAM,CAAC;GAC7C;EACJ,CAAC;EAGD,MAAM,cAAc;GAChB;GAAU;GAAQ;GAAS;GAAe;GAAU;GAAU;GAC9D;GAAe;GAAQ;GAAc;GAAa;GAAc;GAChE;GAAM;GAAY;GAAU;GAAY;GAAO;GAAQ;GAAS;GAChE;GAAM;GAAO;GAAM;GAAO;GAAM;GAAW;GAAQ;GAAW;GAC9D;GAAgB;GAAe;GAAc;GAAe;GAC5D;GAAS;GAAO;GAAO;GAAO;GAAO;GAAY;GAAS;GAAO;GACjE;GAAQ;GAAQ;GAAQ;GAAQ;GAAO;GAAQ;EACnD;EAEA,OAAO,UAAU,+BAA+B,SAAS;GACrD,mBAAmB;IAAC;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;GAAG;GAChS,yBAAyB,OAA0B,aAAuB;IACtE,MAAM,OAAO,MAAM,qBAAqB,QAAQ;IAChD,MAAM,QAAQ;KACV,iBAAiB,SAAS;KAC1B,eAAe,SAAS;KACxB,aAAa,KAAK;KAClB,WAAW,KAAK;IACpB;IAUA,MAAM,QARoB,MAAM,gBAAgB;KAC5C,iBAAiB,SAAS;KAC1B,aAAa;KACb,eAAe,SAAS;KACxB,WAAW,SAAS;IACxB,CAGc,CAAA,CAAkB,MAAM,oBAAoB;IAC1D,MAAM,iBAAiB,QAAQ,MAAM,KAAK;IAE1C,MAAM,cAAsH,CAAC;IAC7H,MAAM,aAAa,WAAW,WAAW,CAAC;IAE1C,IAAI,gBAEA,KAAK,MAAM,GAAG,WAAW,OAAO,QAAQ,UAAU,GAAG;KACjD,MAAM,QAAQ,OAAO,MAAK,MAAK,EAAE,cAAc,cAAc;KAC7D,IAAI,OACA,MAAM,QAAQ,SAAQ,QAAO;MACzB,YAAY,KAAK;OACb,OAAO,IAAI;OACX,MAAM,OAAO,UAAU,mBAAmB;OAC1C,YAAY,IAAI;OAChB;OACA,QAAQ;OACR,UAAU;MACd,CAAC;KACL,CAAC;IAET;SACG;KAEH,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,UAAU,GACnD,OAAO,SAAQ,UAAS;MACpB,YAAY,KAAK;OACb,OAAO,MAAM;OACb,MAAM,OAAO,UAAU,mBAAmB;OAC1C,YAAY,MAAM;OAClB;OACA,QAAQ,UAAU,MAAM;OACxB,UAAU;MACd,CAAC;KACL,CAAC;KAIL,YAAY,SAAQ,YAAW;MAC3B,YAAY,KAAK;OACb,OAAO;OACP,MAAM,OAAO,UAAU,mBAAmB;OAC1C,YAAY,UAAU;OACtB;OACA,QAAQ;OACR,UAAU;MACd,CAAC;KACL,CAAC;KAGD,MAAM,WAAW,MAAM,SAAS;KAChC,MAAM,+BAAe,IAAI,IAAY;KACrC,KAAK,MAAM,GAAG,WAAW,OAAO,QAAQ,UAAU,GAC9C,OAAO,SAAQ,UAAS;MAEpB,IAAI,IADc,OAAO,MAAM,MAAM,UAAU,MAAM,GACjD,CAAA,CAAM,KAAK,QAAQ,GACnB,aAAa,IAAI,MAAM,SAAS;KAExC,CAAC;KAGL,MAAM,+BAAe,IAAI,IAAY;KACrC,KAAK,MAAM,GAAG,WAAW,OAAO,QAAQ,UAAU,GAC9C,OAAO,SAAQ,UAAS;MACpB,IAAI,aAAa,IAAI,MAAM,SAAS,GAChC,MAAM,QAAQ,SAAQ,QAAO;OACzB,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,GAAG;QAC7B,aAAa,IAAI,IAAI,IAAI;QACzB,YAAY,KAAK;SACb,OAAO,IAAI;SACX,MAAM,OAAO,UAAU,mBAAmB;SAC1C,YAAY,IAAI;SAChB;SACA,QAAQ,WAAW,MAAM,UAAU;SACnC,UAAU;QACd,CAAC;OACL;MACJ,CAAC;KAET,CAAC;IAET;IAEA,OAAO,EAAE,YAAY;GAEzB;EACJ,CAAC;EAED,IAAI,WACA,OAAO,MAAM;CAErB;CAEA,OACI,oBAAC,OAAD;EAAK,WAAW,IAAI,0CAA0C,SAAS;YACnE,oBAAC,QAAD;GACI,QAAO;GACP,iBAAgB;GACT;GACG;GACV,SAAS;GACT,OAAO,SAAS,SAAS,YAAY;GACrC,SAAS;IACL,SAAS,EAAE,SAAS,MAAM;IAC1B,UAAU;IACV,aAAa;IACb,sBAAsB;IACtB,iBAAiB;IACjB;IACA,SAAS;IACT,UAAU;GACd;EACH,CAAA;CACA,CAAA;AAEb"}

package/dist/{RLSEditor-B-qrgdHy.js → RLSEditor-BlLLV6xs.js}

@@ -1,11 +1,11 @@
-import { t as MonacoEditor } from "./MonacoEditor-D0_QljcX.js";
+import { t as MonacoEditor } from "./MonacoEditor-CUxy5_k5.js";
 import { ConfirmationDialog, ErrorView, useApiBase, useApiConfig, useRebaseContext, useSnackbarController, useStudioCapabilities, useStudioCollectionRegistry, useStudioSchemaEditing, useTranslation } from "@rebasepro/app";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { Alert, AlertTriangleIcon, Button, Chip, CircularProgress, DatabaseIcon, Dialog, DialogActions, DialogContent, DialogTitle, HelpCircleIcon, IconButton, KeyIcon, Link2Icon, LockIcon, MultiSelect, MultiSelectItem, Paper, RefreshCwIcon, ResizablePanels, Select, SelectItem, ShieldIcon, Tab, Tabs, TextField, Tooltip, Trash2Icon, Typography, cls, defaultBorderMixin, iconSize } from "@rebasepro/ui";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { RLS_JWT_SQL, RLS_ROLES_SQL, RLS_UID_SQL, isPostgresCollectionConfig, policy } from "@rebasepro/types";
 import { getPolicyNamesForRule, getPolicyNamesForRules, getPolicyOperations } from "@rebasepro/utils";
-import { JUNCTION_TABLES_SQL, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_USER_ROLE, getEffectiveSecurityRules, getJunctionSecurityRules, policyToPostgres, resolveJunctionSpecs } from "@rebasepro/common";
+import { JUNCTION_TABLES_SQL, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_USER_ROLE, compileRulePolicies, getEffectiveSecurityRules, getInjectedSecurityRules, getJunctionSecurityRules, getTableName, policyToPostgres, policyToSecurityRule, resolveJunctionSpecs } from "@rebasepro/common";
 //#region src/components/RLSEditor/policy-presets.ts
 /**
 * What the RLS editor offers before the user types anything: the roles a `TO`
@@ -506,23 +506,20 @@ var PolicyEditor = ({ policy, schema, table, roleOptions, onSave, onCancel }) =>
 										}),
 										/* @__PURE__ */ jsxs("ul", {
 											className: "list-disc pl-5 space-y-1 text-sm text-text-secondary dark:text-text-secondary-dark",
-											children: [
-												/* @__PURE__ */ jsxs("li", { children: [
-													/* @__PURE__ */ jsx("strong", { children: "public" }),
-													": ",
-													t("studio_policy_help_role_public")
-												] }),
-												/* @__PURE__ */ jsxs("li", { children: [
-													/* @__PURE__ */ jsx("strong", { children: "authenticated" }),
-													": ",
-													t("studio_policy_help_role_authenticated")
-												] }),
-												/* @__PURE__ */ jsxs("li", { children: [
-													/* @__PURE__ */ jsx("strong", { children: "anon" }),
-													": ",
-													t("studio_policy_help_role_anon")
-												] })
-											]
+											children: [/* @__PURE__ */ jsxs("li", { children: [
+												/* @__PURE__ */ jsx("strong", { children: "public" }),
+												": ",
+												t("studio_policy_help_role_public")
+											] }), /* @__PURE__ */ jsxs("li", { children: [
+												/* @__PURE__ */ jsx("strong", { children: REBASE_USER_ROLE }),
+												": ",
+												t("studio_policy_help_role_rebase_user")
+											] })]
+										}),
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "text-text-secondary dark:text-text-secondary-dark mt-1",
+											children: t("studio_policy_help_roles_not_users")
 										})
 									]
 								}),
@@ -760,7 +757,215 @@ function isCancellation(err) {
 	return err instanceof Error && err.name === "SchemaChangeCancelled";
 }
 //#endregion
+//#region src/components/RLSEditor/policyRules.ts
+/**
+* Write an edit of one policy back to the declared rule it compiles from.
+*
+* The rule is found by the policy names it compiles to, not by `rule.name`:
+* an unnamed rule's policy is `<table>_<op>_<hash>`, and a rule over several
+* operations names each `<name>_<op>`. Matching on `name` missed both, saved
+* the rules unchanged and reported success.
+*
+* A rule over several operations is refused rather than split: taking one
+* operation out renames every policy the rule compiles to.
+*
+* @param declared  The collection's `securityRules`, as written.
+* @param effective Every rule the generator compiles for the table — the
+*                  declared ones plus what Rebase adds — to tell a generated
+*                  policy from one that exists only in the database.
+*/
+function applyPolicyEdit(declared, effective, tableName, original, edited) {
+	const compilesTo = (rule) => getPolicyNamesForRule(rule, tableName).includes(original.policyname);
+	const index = declared.findIndex(compilesTo);
+	if (index === -1) return {
+		ok: false,
+		reason: effective.some(compilesTo) ? "generated" : "not_declared"
+	};
+	const rule = declared[index];
+	if (getPolicyOperations(rule).length > 1) return {
+		ok: false,
+		reason: "several_operations"
+	};
+	return {
+		ok: true,
+		rules: declared.map((r, i) => i === index ? editedRule(r, original, edited) : r)
+	};
+}
+/**
+* The rule with what the editor changed, and nothing else.
+*
+* The editor shows a rule as a policy — name, command, mode, `TO` list and raw
+* USING / WITH CHECK — and an `ownerField` or `access` rule has no raw clause
+* to show. So a field is only written when it differs from what the editor was
+* opened with: renaming an `access: "public"` rule keeps it public, and an
+* unnamed rule stays unnamed unless the name was changed. A condition typed in
+* replaces the rule's condition whole — the forms are exclusive.
+*/
+function editedRule(rule, original, edited) {
+	const next = policyToSecurityRule(edited);
+	const result = { ...rule };
+	if ((edited.policyname ?? "") !== original.policyname) if (next.name) result.name = next.name;
+	else delete result.name;
+	if (edited.cmd !== original.cmd) {
+		delete result.operations;
+		result.operation = next.operation;
+	}
+	if (edited.permissive !== original.permissive) result.mode = next.mode;
+	if (!sameRoles$1(edited.roles, original.roles)) if (next.pgRoles) result.pgRoles = next.pgRoles;
+	else delete result.pgRoles;
+	if ((edited.qual || null) !== (original.qual || null) || (edited.with_check || null) !== (original.with_check || null)) {
+		delete result.ownerField;
+		delete result.access;
+		delete result.condition;
+		delete result.check;
+		delete result.using;
+		delete result.withCheck;
+		if (next.using) result.using = next.using;
+		if (next.withCheck) result.withCheck = next.withCheck;
+	}
+	return result;
+}
+function sameRoles$1(a, b) {
+	const left = [...a ?? []].sort();
+	const right = [...b ?? []].sort();
+	return left.length === right.length && left.every((role, i) => role === right[i]);
+}
+//#endregion
+//#region src/components/RLSEditor/policyListing.ts
+var COMMANDS = {
+	select: "SELECT",
+	insert: "INSERT",
+	update: "UPDATE",
+	delete: "DELETE",
+	all: "ALL"
+};
+/** A compiled policy, in the shape `pg_policies` describes one. */
+function asPostgresPolicy(compiled, tableName) {
+	return {
+		policyname: compiled.name,
+		tablename: tableName,
+		permissive: compiled.mode === "restrictive" ? "RESTRICTIVE" : "PERMISSIVE",
+		cmd: COMMANDS[compiled.operation],
+		roles: compiled.roles,
+		qual: compiled.using,
+		with_check: compiled.withCheck
+	};
+}
+/**
+* The rule's own clauses, for a rule the compiler could not compile — an
+* `existsIn` naming a collection the registry does not hold, say. Only ever a
+* `code_only` row's content: nothing is compared against it.
+*/
+function uncompiledPolicy(rule, operation, name, tableName) {
+	return {
+		policyname: name,
+		tablename: tableName,
+		permissive: rule.mode === "restrictive" ? "RESTRICTIVE" : "PERMISSIVE",
+		cmd: COMMANDS[operation],
+		roles: [...rule.pgRoles ?? ["public"]],
+		qual: rule.using || null,
+		with_check: rule.withCheck || null
+	};
+}
+function sameRoles(a, b) {
+	const left = [...a].sort();
+	const right = [...b].sort();
+	return left.length === right.length && left.every((role, i) => role === right[i]);
+}
+/**
+* Where a live policy differs from the one the code compiles to.
+*
+* The same comparison `rebase doctor` makes: the `TO` list, the command, the
+* mode, and whether each clause is there at all. Never the clause text —
+* Postgres rewrites an expression when it stores it, so the text of a policy
+* that matches its declaration exactly still differs from the declaration's.
+* A clause that is missing is not a rewrite, though: a `USING` that is gone
+* changes who the policy admits.
+*/
+function policyDrift(declared, live) {
+	const drift = [];
+	if (!sameRoles(declared.roles, live.roles)) drift.push("roles");
+	if (declared.cmd !== live.cmd) drift.push("command");
+	if (declared.permissive !== live.permissive) drift.push("mode");
+	if (declared.qual != null !== (live.qual != null)) drift.push("USING");
+	if (declared.with_check != null !== (live.with_check != null)) drift.push("WITH CHECK");
+	return drift;
+}
+/**
+* The policies of one table: every policy the database has, as the database
+* has it, and every policy the code declares for the table that it does not.
+*
+* A policy in both keeps the database's fields — this list is what Postgres
+* enforces — and carries the declaration beside them, with where the two
+* differ.
+*
+* @param live        The table's `pg_policies` rows.
+* @param collection  The collection the table belongs to, if any.
+* @param collections Every collection, to resolve the ones a rule refers to.
+*/
+function listPolicies(live, collection, tableName, collections) {
+	const listed = /* @__PURE__ */ new Map();
+	for (const policy of live) listed.set(policy.policyname, {
+		...policy,
+		status: "live"
+	});
+	if (!collection || !isPostgresCollectionConfig(collection)) return [...listed.values()];
+	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+	const injectedNames = getPolicyNamesForRules(getInjectedSecurityRules(collection), tableName);
+	const livePolicies = new Map(live.map((policy) => [policy.policyname, policy]));
+	for (const rule of getEffectiveSecurityRules(collection)) {
+		const operations = getPolicyOperations(rule);
+		let compiled;
+		try {
+			compiled = compileRulePolicies(collection, rule, { resolveCollection });
+		} catch {
+			compiled = void 0;
+		}
+		getPolicyNamesForRule(rule, tableName).forEach((name, index) => {
+			const declared = compiled ? asPostgresPolicy(compiled[index], tableName) : void 0;
+			const generated = injectedNames.has(name);
+			const existing = livePolicies.get(name);
+			if (existing) listed.set(name, {
+				...existing,
+				status: "both",
+				declared,
+				drift: declared ? policyDrift(declared, existing) : void 0,
+				generated
+			});
+			else listed.set(name, {
+				...declared ?? uncompiledPolicy(rule, operations[index] ?? "all", name, tableName),
+				status: "code_only",
+				generated
+			});
+		});
+	}
+	return [...listed.values()];
+}
+//#endregion
 //#region src/components/RLSEditor/RLSEditor.tsx
+/**
+* Whether `collection` is the one `db push` writes `table` for: the table
+* `getTableName` derives, in the schema the collection declares or `public` —
+* the planner's own resolution.
+*
+* This matched a table to any collection whose `id`, `path`, `table`, `slug`
+* or `collectionId` equalled its name, in any schema. So an unmapped table
+* named like another collection's slug, or a same-named table in another
+* schema, was taken for that collection: it listed the collection's policies
+* as missing from the table, and offered to import the table's own policies
+* into the collection. And a collection that leaves `table` to a slug that is
+* not already snake case mapped nothing.
+*/
+function mapsTable(collection, table) {
+	if (!isPostgresCollectionConfig(collection)) return false;
+	return getTableName(collection) === table.tableName && (collection.schema || "public") === table.schemaName;
+}
+/** What the editor says when an edit has no declared rule to go back to. */
+var POLICY_EDIT_REFUSALS = {
+	generated: "studio_rls_edit_generated",
+	not_declared: "studio_rls_edit_not_declared",
+	several_operations: "studio_rls_edit_several_operations"
+};
 function classifyTableClient(tableName, schemaName, junctionTableNames, isMappedToCollection) {
 	if (isMappedToCollection) return "collection";
 	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "internal";
@@ -1092,7 +1297,7 @@ var RLSEditor = ({ apiUrl = "" }) => {
 			other: []
 		};
 		tables.forEach((table) => {
-			const isMapped = !!collectionRegistry.collections?.find((c) => c.id === table.tableName || c.path === table.tableName || c.table === table.tableName || c.slug === table.tableName || c.collectionId === table.tableName);
+			const isMapped = !!collectionRegistry.collections?.some((c) => mapsTable(c, table));
 			const cat = classifyTableClient(table.tableName, table.schemaName, junctionTableNames, isMapped);
 			groups[cat].push(table);
 		});
@@ -1104,7 +1309,7 @@ var RLSEditor = ({ apiUrl = "" }) => {
 	]);
 	const activeCollection = useMemo(() => {
 		if (!activeTableData) return null;
-		return collectionRegistry.collections?.find((c) => c.id === activeTableData.tableName || c.path === activeTableData.tableName || c.table === activeTableData.tableName || c.slug === activeTableData.tableName || c.collectionId === activeTableData.tableName) || null;
+		return collectionRegistry.collections?.find((c) => mapsTable(c, activeTableData)) || null;
 	}, [activeTableData, collectionRegistry.collections]);
 	/** The category of the currently selected table. */
 	const activeTableCategory = useMemo(() => {
@@ -1116,41 +1321,55 @@ var RLSEditor = ({ apiUrl = "" }) => {
 		activeCollection,
 		junctionTableNames
 	]);
+	/**
+	* The junction a relation derives this table as, when it is one. Its
+	* policies are Rebase's — derived from the endpoints' relations — and the
+	* server re-creates them on every start, like a collection's. `null` when
+	* the registry's collections carry no resolvable relations (serialized
+	* configs without relation closures).
+	*/
+	const activeJunctionSpec = useMemo(() => {
+		if (!activeTableData || activeCollection) return null;
+		try {
+			return resolveJunctionSpecs(collectionRegistry.collections ?? []).get(activeTableData.tableName) ?? null;
+		} catch {
+			return null;
+		}
+	}, [
+		activeTableData,
+		activeCollection,
+		collectionRegistry.collections
+	]);
+	/**
+	* Whether the server re-asserts this table's RLS on every start: it switches
+	* RLS back on and re-creates every policy the project declares for it.
+	*/
+	const activeTableManaged = Boolean(activeCollection || activeJunctionSpec);
+	/**
+	* What Postgres enforces on the selected table, and what the code declares
+	* that it does not have yet.
+	*
+	* A policy in both is listed with the *database's* fields, and the
+	* declaration rides beside it with where the two differ (`listPolicies`).
+	* The declaration's fields in their place would make a policy changed in
+	* SQL look exactly like its declaration, and would show every rule written
+	* as a structured condition — all of Rebase's own policies — with no USING.
+	*/
 	const mergedPolicies = useMemo(() => {
 		if (!activeTableData) return [];
-		const policiesMap = {};
-		(activeTableData.policies || []).forEach((p) => {
-			policiesMap[p.policyname] = {
-				...p,
-				status: "live"
-			};
-		});
-		if (activeCollection && isPostgresCollectionConfig(activeCollection)) getEffectiveSecurityRules(activeCollection).forEach((rule) => {
-			const ops = getPolicyOperations(rule);
-			getPolicyNamesForRule(rule, activeTableData.tableName).forEach((policyName, opIdx) => {
-				policiesMap[policyName] = {
-					policyname: policyName,
-					tablename: activeTableData.tableName,
-					permissive: (rule.mode || "permissive").toUpperCase(),
-					cmd: (ops[opIdx] ?? rule.operation ?? "ALL").toUpperCase(),
-					roles: [...rule.pgRoles ?? ["public"]],
-					qual: rule.using || null,
-					with_check: rule.withCheck || null,
-					status: policiesMap[policyName] ? "both" : "code_only"
-				};
-			});
-		});
-		if (!activeCollection) try {
-			const spec = resolveJunctionSpecs(collectionRegistry.collections ?? []).get(activeTableData.tableName);
-			if (spec) {
-				const generatedNames = getPolicyNamesForRules(getJunctionSecurityRules(spec), spec.table);
-				for (const p of Object.values(policiesMap)) if (generatedNames.has(p.policyname)) p.status = "both";
+		const listed = listPolicies(activeTableData.policies || [], activeCollection, activeTableData.tableName, collectionRegistry.collections ?? []);
+		if (activeJunctionSpec) {
+			const generatedNames = getPolicyNamesForRules(getJunctionSecurityRules(activeJunctionSpec), activeJunctionSpec.table);
+			for (const p of listed) if (generatedNames.has(p.policyname)) {
+				p.status = "both";
+				p.generated = true;
 			}
-		} catch {}
-		return Object.values(policiesMap).sort((a, b) => a.policyname.localeCompare(b.policyname));
+		}
+		return listed.sort((a, b) => a.policyname.localeCompare(b.policyname));
 	}, [
 		activeTableData,
 		activeCollection,
+		activeJunctionSpec,
 		collectionRegistry.collections
 	]);
 	const rlsStats = useMemo(() => {
@@ -1451,7 +1670,8 @@ var RLSEditor = ({ apiUrl = "" }) => {
 									onClick: () => setConfirmToggleRls({
 										table: activeTableData.tableName,
 										schema: activeTableData.schemaName,
-										enabled: activeTableData.rlsEnabled
+										enabled: activeTableData.rlsEnabled,
+										managed: activeTableManaged
 									}),
 									children: activeTableData.rlsEnabled ? t("studio_rls_disable_rls") : t("studio_rls_enable_rls")
 								}),
@@ -1509,20 +1729,29 @@ var RLSEditor = ({ apiUrl = "" }) => {
 						roleOptions: pgRoleOptions,
 						onSave: async (newPolicy) => {
 							if (activeCollection && hasCodebase) {
-								const rule = {
-									name: newPolicy.policyname,
-									operation: newPolicy.cmd?.toLowerCase(),
-									mode: newPolicy.permissive?.toLowerCase(),
-									using: newPolicy.qual || void 0,
-									withCheck: newPolicy.with_check || void 0,
-									...newPolicy.roles && !(newPolicy.roles.length === 1 && newPolicy.roles[0] === "public") ? { pgRoles: newPolicy.roles } : {}
-								};
 								const existingRules = (isPostgresCollectionConfig(activeCollection) ? activeCollection.securityRules : void 0) || [];
 								let newRules;
-								if (editingPolicy === "new") newRules = [...existingRules, rule];
-								else newRules = existingRules.map((r) => r.name === editingPolicy.policyname ? rule : r);
+								if (editingPolicy === "new") newRules = [...existingRules, policyToSecurityRule(newPolicy)];
+								else {
+									const edit = applyPolicyEdit(existingRules, getEffectiveSecurityRules(activeCollection), activeTableData.tableName, editingPolicy, newPolicy);
+									if (!edit.ok) {
+										snackbarController.open({
+											type: "error",
+											message: t(POLICY_EDIT_REFUSALS[edit.reason], { policy: editingPolicy.policyname })
+										});
+										return;
+									}
+									newRules = edit.rules;
+									if (JSON.stringify(newRules) === JSON.stringify(existingRules)) {
+										snackbarController.open({
+											type: "info",
+											message: t("studio_rls_nothing_changed")
+										});
+										return;
+									}
+								}
 								try {
-									await saveSecurityRules(activeCollection.id || activeCollection.path || activeCollection.alias || activeTableData.tableName, newRules);
+									await saveSecurityRules(activeCollection.slug, newRules);
 									snackbarController.open({
 										type: "success",
 										message: "Policy saved successfully"
@@ -1532,31 +1761,40 @@ var RLSEditor = ({ apiUrl = "" }) => {
 								} catch (e) {
 									reportSaveFailure(e);
 								}
-							} else try {
-								const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(activeTableData.tableName)}`;
-								const policyName = sanitizeSqlIdentifier(newPolicy.policyname || "unnamed_policy");
-								const cmd = newPolicy.cmd || "ALL";
-								const permissive = (newPolicy.permissive || "PERMISSIVE") === "PERMISSIVE" ? "PERMISSIVE" : "RESTRICTIVE";
-								const roles = newPolicy.roles && newPolicy.roles.length > 0 ? newPolicy.roles.map((r) => sanitizeSqlIdentifier(r)).join(", ") : "public";
-								if (editingPolicy !== "new") await databaseAdmin.executeSql(`DROP POLICY IF EXISTS ${policyName} ON ${qualifiedTable}`);
-								let sql = `CREATE POLICY ${policyName} ON ${qualifiedTable}`;
-								sql += ` AS ${permissive}`;
-								sql += ` FOR ${cmd}`;
-								sql += ` TO ${roles}`;
-								if (newPolicy.qual) sql += ` USING (${newPolicy.qual})`;
-								if (newPolicy.with_check) sql += ` WITH CHECK (${newPolicy.with_check})`;
-								await databaseAdmin.executeSql(sql);
-								snackbarController.open({
-									type: "success",
-									message: `Policy "${newPolicy.policyname}" applied to the database`
-								});
-								setEditingPolicy(null);
-								fetchRLSData();
-							} catch (e) {
-								snackbarController.open({
-									type: "error",
-									message: e instanceof Error ? e.message : String(e)
-								});
+							} else {
+								if (editingPolicy !== "new" && editingPolicy.generated) {
+									snackbarController.open({
+										type: "error",
+										message: t(POLICY_EDIT_REFUSALS.generated, { policy: editingPolicy.policyname })
+									});
+									return;
+								}
+								try {
+									const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(activeTableData.tableName)}`;
+									const policyName = sanitizeSqlIdentifier(newPolicy.policyname || "unnamed_policy");
+									const cmd = newPolicy.cmd || "ALL";
+									const permissive = (newPolicy.permissive || "PERMISSIVE") === "PERMISSIVE" ? "PERMISSIVE" : "RESTRICTIVE";
+									const roles = newPolicy.roles && newPolicy.roles.length > 0 ? newPolicy.roles.map((r) => sanitizeSqlIdentifier(r)).join(", ") : "public";
+									let sql = `CREATE POLICY ${policyName} ON ${qualifiedTable}`;
+									sql += ` AS ${permissive}`;
+									sql += ` FOR ${cmd}`;
+									sql += ` TO ${roles}`;
+									if (newPolicy.qual) sql += ` USING (${newPolicy.qual})`;
+									if (newPolicy.with_check) sql += ` WITH CHECK (${newPolicy.with_check})`;
+									if (editingPolicy !== "new") sql = `DROP POLICY IF EXISTS ${sanitizeSqlIdentifier(editingPolicy.policyname)} ON ${qualifiedTable}; ${sql}`;
+									await databaseAdmin.executeSql(sql);
+									snackbarController.open({
+										type: "success",
+										message: `Policy "${newPolicy.policyname}" applied to the database`
+									});
+									setEditingPolicy(null);
+									fetchRLSData();
+								} catch (e) {
+									snackbarController.open({
+										type: "error",
+										message: e instanceof Error ? e.message : String(e)
+									});
+								}
 							}
 						},
 						onCancel: () => setEditingPolicy(null)
@@ -1567,6 +1805,19 @@ var RLSEditor = ({ apiUrl = "" }) => {
 							children: /* @__PURE__ */ jsxs("div", {
 								className: "max-w-4xl mx-auto flex flex-col gap-6",
 								children: [
+									activeTableData && activeTableManaged && !(activeCollection && hasCodebase) && /* @__PURE__ */ jsx(Alert, {
+										color: "info",
+										children: /* @__PURE__ */ jsxs("div", {
+											className: "flex items-start gap-2",
+											children: [/* @__PURE__ */ jsx(RefreshCwIcon, {
+												size: 16,
+												className: "shrink-0 mt-0.5"
+											}), /* @__PURE__ */ jsx(Typography, {
+												variant: "caption",
+												children: t("studio_rls_reapplied_on_start", { table: activeTableData.tableName })
+											})]
+										})
+									}),
 									activeTableData && activeTableCategory === "internal" && /* @__PURE__ */ jsx(Alert, {
 										color: "info",
 										children: /* @__PURE__ */ jsxs("div", {
@@ -1676,6 +1927,13 @@ var RLSEditor = ({ apiUrl = "" }) => {
 																children: t("studio_rls_unapplied")
 															})
 														}),
+														policy.drift && policy.drift.length > 0 && /* @__PURE__ */ jsx(Tooltip, {
+															title: t("studio_rls_drift_tooltip", { fields: policy.drift.join(", ") }),
+															children: /* @__PURE__ */ jsx("div", {
+																className: "px-1.5 py-0.5 rounded text-[10px] bg-orange-500/10 text-orange-600 border border-orange-500/20 shrink-0",
+																children: `${t("studio_rls_drift")}: ${policy.drift.join(", ")}`
+															})
+														}),
 														policy.status === "live" && hasCodebase && /* @__PURE__ */ jsx(Tooltip, {
 															title: "This policy is live in the database but missing from your codebase schema.",
 															children: /* @__PURE__ */ jsx("div", {
@@ -1696,17 +1954,10 @@ var RLSEditor = ({ apiUrl = "" }) => {
 														variant: "outlined",
 														color: "primary",
 														onClick: async () => {
-															const rule = {
-																name: policy.policyname,
-																operation: policy.cmd?.toLowerCase(),
-																mode: policy.permissive?.toLowerCase(),
-																using: policy.qual || void 0,
-																withCheck: policy.with_check || void 0,
-																roles: policy.roles
-															};
+															const rule = policyToSecurityRule(policy);
 															const newRules = [...(isPostgresCollectionConfig(activeCollection) ? activeCollection.securityRules : void 0) || [], rule];
 															try {
-																await saveSecurityRules(activeCollection.id || activeCollection.path || activeCollection.alias || activeTableData.tableName, newRules);
+																await saveSecurityRules(activeCollection.slug, newRules);
 																snackbarController.open({
 																	type: "success",
 																	message: "Policy imported successfully"
@@ -1729,6 +1980,7 @@ var RLSEditor = ({ apiUrl = "" }) => {
 														title: t("studio_rls_delete"),
 														asChild: true,
 														children: /* @__PURE__ */ jsx(IconButton, {
+															"aria-label": t("studio_rls_delete"),
 															size: "small",
 															onClick: () => setConfirmDropPolicy({
 																policyName: policy.policyname,
@@ -1799,7 +2051,7 @@ var RLSEditor = ({ apiUrl = "" }) => {
 				onAccept: applyToggleRls,
 				onCancel: () => setConfirmToggleRls(null),
 				title: confirmToggleRls?.enabled ? t("studio_rls_disable_confirm_title") : t("studio_rls_enable_confirm_title"),
-				body: confirmToggleRls?.enabled ? t("studio_rls_disable_confirm_body", { table: confirmToggleRls?.table ?? "" }) : t("studio_rls_enable_confirm_body", { table: confirmToggleRls?.table ?? "" })
+				body: confirmToggleRls?.enabled ? [t("studio_rls_disable_confirm_body", { table: confirmToggleRls.table }), confirmToggleRls.managed ? t("studio_rls_disable_reapplied", { table: confirmToggleRls.table }) : ""].filter(Boolean).join(" ") : t("studio_rls_enable_confirm_body", { table: confirmToggleRls?.table ?? "" })
 			}),
 			/* @__PURE__ */ jsx(ConfirmationDialog, {
 				open: confirmDropPolicy !== null,
@@ -1818,4 +2070,4 @@ var RLSEditor = ({ apiUrl = "" }) => {
 //#endregion
 export { RLSEditor };
 
-//# sourceMappingURL=RLSEditor-B-qrgdHy.js.map
+//# sourceMappingURL=RLSEditor-BlLLV6xs.js.map