@rebasepro/studio 0.6.0 → 0.7.0

package/dist/{RLSEditor-CTxYbBdW.js → RLSEditor-BM64laoW.js}

@@ -1,9 +1,10 @@
 import { t as MonacoEditor } from "./MonacoEditor-COZqrIJ1.js";
 import { ErrorView, useRebaseContext, useSnackbarController, useStudioCollectionRegistry, useTranslation } from "@rebasepro/core";
 import { useCallback, useEffect, useMemo, useState } from "react";
-import { Alert, AlertTriangleIcon, Button, Chip, CircularProgress, Dialog, DialogActions, DialogContent, DialogTitle, HelpCircleIcon, IconButton, KeyIcon, MultiSelect, MultiSelectItem, Paper, RefreshCwIcon, ResizablePanels, Select, SelectItem, ShieldIcon, Tab, Tabs, TextField, Tooltip, Trash2Icon, Typography, cls, defaultBorderMixin, iconSize } from "@rebasepro/ui";
+import { Alert, AlertTriangleIcon, Button, Chip, CircularProgress, DatabaseIcon, Dialog, DialogActions, DialogContent, DialogTitle, HelpCircleIcon, IconButton, KeyIcon, Link2Icon, LockIcon, MultiSelect, MultiSelectItem, Paper, RefreshCwIcon, ResizablePanels, Select, SelectItem, ShieldIcon, Tab, Tabs, TextField, Tooltip, Trash2Icon, Typography, cls, defaultBorderMixin, iconSize } from "@rebasepro/ui";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { isPostgresCollection } from "@rebasepro/types";
+import { JUNCTION_TABLES_SQL, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS } from "@rebasepro/common";
 //#region src/components/RLSEditor/PolicyEditor.tsx
 var COMMAND_OPTIONS = [
 	"ALL",
@@ -373,199 +374,212 @@ var PolicyEditor = ({ policy, schema, table, onSave, onCancel }) => {
 			open: helpOpen,
 			onOpenChange: setHelpOpen,
 			maxWidth: "3xl",
-			children: [/* @__PURE__ */ jsxs(DialogContent, {
-				className: "p-4 sm:p-6 lg:p-8 flex flex-col gap-6",
-				children: [
-					/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
-						variant: "h5",
-						className: "mb-2",
-						children: t("studio_policy_help_title")
-					}), /* @__PURE__ */ jsx(Typography, {
-						className: "text-text-secondary dark:text-text-secondary-dark",
-						children: t("studio_policy_help_intro")
-					})] }),
-					/* @__PURE__ */ jsxs("div", {
-						className: "flex flex-col gap-4",
-						children: [
-							/* @__PURE__ */ jsxs(Paper, {
-								className: cls("p-4 sm:p-5 flex flex-col gap-1", defaultBorderMixin),
-								children: [/* @__PURE__ */ jsx(Typography, {
-									variant: "subtitle2",
-									className: "text-primary dark:text-primary-light font-medium",
-									children: t("studio_policy_help_step1_title")
-								}), /* @__PURE__ */ jsx(Typography, {
-									variant: "body2",
-									className: "text-text-secondary dark:text-text-secondary-dark",
-									children: t("studio_policy_help_step1_desc")
-								})]
-							}),
-							/* @__PURE__ */ jsxs(Paper, {
-								className: cls("p-4 sm:p-5 flex flex-col gap-1", defaultBorderMixin),
-								children: [
-									/* @__PURE__ */ jsx(Typography, {
-										variant: "subtitle2",
-										className: "text-primary dark:text-primary-light font-medium",
-										children: t("studio_policy_help_step2_title")
-									}),
-									/* @__PURE__ */ jsx(Typography, {
-										variant: "body2",
-										className: "text-text-secondary dark:text-text-secondary-dark mb-1",
-										children: t("studio_policy_help_step2_desc")
-									}),
-									/* @__PURE__ */ jsxs("ul", {
-										className: "list-disc pl-5 space-y-1 text-sm text-text-secondary dark:text-text-secondary-dark",
-										children: [
-											/* @__PURE__ */ jsxs("li", { children: [
-												/* @__PURE__ */ jsx("strong", { children: "public" }),
-												": ",
-												t("studio_policy_help_role_public")
-											] }),
-											/* @__PURE__ */ jsxs("li", { children: [
-												/* @__PURE__ */ jsx("strong", { children: "authenticated" }),
-												": ",
-												t("studio_policy_help_role_authenticated")
-											] }),
-											/* @__PURE__ */ jsxs("li", { children: [
-												/* @__PURE__ */ jsx("strong", { children: "anon" }),
-												": ",
-												t("studio_policy_help_role_anon")
-											] })
-										]
-									})
-								]
-							}),
-							/* @__PURE__ */ jsxs(Paper, {
-								className: cls("p-4 sm:p-5 flex flex-col gap-1", defaultBorderMixin),
-								children: [
-									/* @__PURE__ */ jsx(Typography, {
-										variant: "subtitle2",
-										className: "text-primary dark:text-primary-light font-medium",
-										children: t("studio_policy_help_step3_title")
-									}),
-									/* @__PURE__ */ jsx(Typography, {
-										variant: "body2",
-										className: "text-text-secondary dark:text-text-secondary-dark mb-1",
-										children: t("studio_policy_help_step3_desc")
-									}),
-									/* @__PURE__ */ jsx("div", {
-										className: cls("bg-surface-100 dark:bg-surface-950 px-3 py-2 rounded-md font-mono text-sm my-2", defaultBorderMixin),
-										children: "Example: auth.uid() = user_id"
-									}),
-									/* @__PURE__ */ jsx(Typography, {
-										variant: "caption",
-										className: "text-text-secondary dark:text-text-secondary-dark",
-										children: t("studio_policy_help_step3_example")
-									})
-								]
-							}),
-							/* @__PURE__ */ jsxs(Paper, {
-								className: cls("p-4 sm:p-5 flex flex-col gap-1", defaultBorderMixin),
-								children: [
-									/* @__PURE__ */ jsx(Typography, {
-										variant: "subtitle2",
-										className: "text-primary dark:text-primary-light font-medium",
-										children: t("studio_policy_help_step4_title")
-									}),
-									/* @__PURE__ */ jsx(Typography, {
-										variant: "body2",
-										className: "text-text-secondary dark:text-text-secondary-dark mb-1",
-										children: t("studio_policy_help_step4_desc")
-									}),
-									/* @__PURE__ */ jsx("div", {
-										className: cls("bg-surface-100 dark:bg-surface-950 px-3 py-2 rounded-md font-mono text-sm my-2", defaultBorderMixin),
-										children: "Example: auth.uid() = user_id"
-									}),
-									/* @__PURE__ */ jsx(Typography, {
-										variant: "caption",
-										className: "text-text-secondary dark:text-text-secondary-dark",
-										children: t("studio_policy_help_step4_example")
-									})
-								]
-							}),
-							/* @__PURE__ */ jsxs(Paper, {
-								className: cls("p-4 sm:p-5 flex flex-col gap-2 bg-primary/5 dark:bg-primary-bg-dark/10", defaultBorderMixin),
-								children: [
-									/* @__PURE__ */ jsx(Typography, {
+			children: [
+				/* @__PURE__ */ jsx(DialogTitle, {
+					hidden: true,
+					children: "Row-Level Security Help"
+				}),
+				/* @__PURE__ */ jsxs(DialogContent, {
+					className: "p-4 sm:p-6 lg:p-8 flex flex-col gap-6",
+					children: [
+						/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
+							variant: "h5",
+							className: "mb-2",
+							children: t("studio_policy_help_title")
+						}), /* @__PURE__ */ jsx(Typography, {
+							className: "text-text-secondary dark:text-text-secondary-dark",
+							children: t("studio_policy_help_intro")
+						})] }),
+						/* @__PURE__ */ jsxs("div", {
+							className: "flex flex-col gap-4",
+							children: [
+								/* @__PURE__ */ jsxs(Paper, {
+									className: cls("p-4 sm:p-5 flex flex-col gap-1", defaultBorderMixin),
+									children: [/* @__PURE__ */ jsx(Typography, {
 										variant: "subtitle2",
 										className: "text-primary dark:text-primary-light font-medium",
-										children: t("studio_policy_help_auth_vars_title")
-									}),
-									/* @__PURE__ */ jsx(Typography, {
+										children: t("studio_policy_help_step1_title")
+									}), /* @__PURE__ */ jsx(Typography, {
 										variant: "body2",
 										className: "text-text-secondary dark:text-text-secondary-dark",
-										children: t("studio_policy_help_auth_vars_desc")
-									}),
-									/* @__PURE__ */ jsxs("ul", {
-										className: "list-disc pl-5 space-y-2 text-sm text-text-secondary dark:text-text-secondary-dark font-normal",
-										children: [
-											/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("code", {
-												className: "bg-surface-100 dark:bg-surface-950 px-1.5 py-0.5 rounded mr-1 whitespace-nowrap",
-												children: "auth.uid()"
-											}), /* @__PURE__ */ jsxs("span", {
-												className: "block mt-0.5",
-												children: ["Returns the current user's ID as text. Example: ", /* @__PURE__ */ jsx("code", {
-													className: "bg-surface-100 dark:bg-surface-950 px-1 py-0.5 rounded text-[11px]",
-													children: "auth.uid() = user_id"
-												})]
-											})] }),
-											/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("code", {
-												className: "bg-surface-100 dark:bg-surface-950 px-1.5 py-0.5 rounded mr-1 whitespace-nowrap",
-												children: "auth.jwt()"
-											}), /* @__PURE__ */ jsxs("span", {
-												className: "block mt-0.5",
-												children: ["Returns the full JWT payload as JSONB so you can check custom claims. Example: ", /* @__PURE__ */ jsx("code", {
-													className: "bg-surface-100 dark:bg-surface-950 px-1 py-0.5 rounded text-[11px]",
-													children: "auth.jwt() ->> 'email' = 'admin@example.com'"
-												})]
-											})] }),
-											/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("code", {
-												className: "bg-surface-100 dark:bg-surface-950 px-1.5 py-0.5 rounded mr-1 whitespace-nowrap",
-												children: "auth.roles()"
-											}), /* @__PURE__ */ jsxs("span", {
-												className: "block mt-0.5",
-												children: ["Returns the user's role IDs as a comma-separated string. Best used with: ", /* @__PURE__ */ jsx("code", {
-													className: "bg-surface-100 dark:bg-surface-950 px-1 py-0.5 rounded text-[11px]",
-													children: "string_to_array(auth.roles(), ',') @> ARRAY['admin']"
-												})]
-											})] })
-										]
-									})
-								]
-							})
-						]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: cls("mt-2 flex flex-col sm:flex-row justify-between items-start sm:items-center bg-primary/5 dark:bg-primary-bg-dark/10 p-4 rounded-xl border border-primary/10 dark:border-primary/20", defaultBorderMixin),
-						children: [/* @__PURE__ */ jsx(Typography, {
-							variant: "body2",
-							className: "text-primary dark:text-primary-light mb-4 sm:mb-0 max-w-md",
-							children: t("studio_policy_help_docs_cta")
-						}), /* @__PURE__ */ jsx(Button, {
-							component: "a",
-							href: "https://www.postgresql.org/docs/current/sql-createpolicy.html",
-							target: "_blank",
-							variant: "outlined",
-							color: "primary",
-							size: "small",
-							className: "whitespace-nowrap flex-shrink-0",
-							children: t("studio_policy_help_read_docs")
-						})]
+										children: t("studio_policy_help_step1_desc")
+									})]
+								}),
+								/* @__PURE__ */ jsxs(Paper, {
+									className: cls("p-4 sm:p-5 flex flex-col gap-1", defaultBorderMixin),
+									children: [
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "subtitle2",
+											className: "text-primary dark:text-primary-light font-medium",
+											children: t("studio_policy_help_step2_title")
+										}),
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "text-text-secondary dark:text-text-secondary-dark mb-1",
+											children: t("studio_policy_help_step2_desc")
+										}),
+										/* @__PURE__ */ jsxs("ul", {
+											className: "list-disc pl-5 space-y-1 text-sm text-text-secondary dark:text-text-secondary-dark",
+											children: [
+												/* @__PURE__ */ jsxs("li", { children: [
+													/* @__PURE__ */ jsx("strong", { children: "public" }),
+													": ",
+													t("studio_policy_help_role_public")
+												] }),
+												/* @__PURE__ */ jsxs("li", { children: [
+													/* @__PURE__ */ jsx("strong", { children: "authenticated" }),
+													": ",
+													t("studio_policy_help_role_authenticated")
+												] }),
+												/* @__PURE__ */ jsxs("li", { children: [
+													/* @__PURE__ */ jsx("strong", { children: "anon" }),
+													": ",
+													t("studio_policy_help_role_anon")
+												] })
+											]
+										})
+									]
+								}),
+								/* @__PURE__ */ jsxs(Paper, {
+									className: cls("p-4 sm:p-5 flex flex-col gap-1", defaultBorderMixin),
+									children: [
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "subtitle2",
+											className: "text-primary dark:text-primary-light font-medium",
+											children: t("studio_policy_help_step3_title")
+										}),
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "text-text-secondary dark:text-text-secondary-dark mb-1",
+											children: t("studio_policy_help_step3_desc")
+										}),
+										/* @__PURE__ */ jsx("div", {
+											className: cls("bg-surface-100 dark:bg-surface-950 px-3 py-2 rounded-md font-mono text-sm my-2", defaultBorderMixin),
+											children: "Example: auth.uid() = user_id"
+										}),
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											className: "text-text-secondary dark:text-text-secondary-dark",
+											children: t("studio_policy_help_step3_example")
+										})
+									]
+								}),
+								/* @__PURE__ */ jsxs(Paper, {
+									className: cls("p-4 sm:p-5 flex flex-col gap-1", defaultBorderMixin),
+									children: [
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "subtitle2",
+											className: "text-primary dark:text-primary-light font-medium",
+											children: t("studio_policy_help_step4_title")
+										}),
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "text-text-secondary dark:text-text-secondary-dark mb-1",
+											children: t("studio_policy_help_step4_desc")
+										}),
+										/* @__PURE__ */ jsx("div", {
+											className: cls("bg-surface-100 dark:bg-surface-950 px-3 py-2 rounded-md font-mono text-sm my-2", defaultBorderMixin),
+											children: "Example: auth.uid() = user_id"
+										}),
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											className: "text-text-secondary dark:text-text-secondary-dark",
+											children: t("studio_policy_help_step4_example")
+										})
+									]
+								}),
+								/* @__PURE__ */ jsxs(Paper, {
+									className: cls("p-4 sm:p-5 flex flex-col gap-2 bg-primary/5 dark:bg-primary-bg-dark/10", defaultBorderMixin),
+									children: [
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "subtitle2",
+											className: "text-primary dark:text-primary-light font-medium",
+											children: t("studio_policy_help_auth_vars_title")
+										}),
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "text-text-secondary dark:text-text-secondary-dark",
+											children: t("studio_policy_help_auth_vars_desc")
+										}),
+										/* @__PURE__ */ jsxs("ul", {
+											className: "list-disc pl-5 space-y-2 text-sm text-text-secondary dark:text-text-secondary-dark font-normal",
+											children: [
+												/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("code", {
+													className: "bg-surface-100 dark:bg-surface-950 px-1.5 py-0.5 rounded mr-1 whitespace-nowrap",
+													children: "auth.uid()"
+												}), /* @__PURE__ */ jsxs("span", {
+													className: "block mt-0.5",
+													children: ["Returns the current user's ID as text. Example: ", /* @__PURE__ */ jsx("code", {
+														className: "bg-surface-100 dark:bg-surface-950 px-1 py-0.5 rounded text-[11px]",
+														children: "auth.uid() = user_id"
+													})]
+												})] }),
+												/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("code", {
+													className: "bg-surface-100 dark:bg-surface-950 px-1.5 py-0.5 rounded mr-1 whitespace-nowrap",
+													children: "auth.jwt()"
+												}), /* @__PURE__ */ jsxs("span", {
+													className: "block mt-0.5",
+													children: ["Returns the full JWT payload as JSONB so you can check custom claims. Example: ", /* @__PURE__ */ jsx("code", {
+														className: "bg-surface-100 dark:bg-surface-950 px-1 py-0.5 rounded text-[11px]",
+														children: "auth.jwt() ->> 'email' = 'admin@example.com'"
+													})]
+												})] }),
+												/* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsx("code", {
+													className: "bg-surface-100 dark:bg-surface-950 px-1.5 py-0.5 rounded mr-1 whitespace-nowrap",
+													children: "auth.roles()"
+												}), /* @__PURE__ */ jsxs("span", {
+													className: "block mt-0.5",
+													children: ["Returns the user's role IDs as a comma-separated string. Best used with: ", /* @__PURE__ */ jsx("code", {
+														className: "bg-surface-100 dark:bg-surface-950 px-1 py-0.5 rounded text-[11px]",
+														children: "string_to_array(auth.roles(), ',') @> ARRAY['admin']"
+													})]
+												})] })
+											]
+										})
+									]
+								})
+							]
+						}),
+						/* @__PURE__ */ jsxs("div", {
+							className: cls("mt-2 flex flex-col sm:flex-row justify-between items-start sm:items-center bg-primary/5 dark:bg-primary-bg-dark/10 p-4 rounded-xl border border-primary/10 dark:border-primary/20", defaultBorderMixin),
+							children: [/* @__PURE__ */ jsx(Typography, {
+								variant: "body2",
+								className: "text-primary dark:text-primary-light mb-4 sm:mb-0 max-w-md",
+								children: t("studio_policy_help_docs_cta")
+							}), /* @__PURE__ */ jsx(Button, {
+								component: "a",
+								href: "https://www.postgresql.org/docs/current/sql-createpolicy.html",
+								target: "_blank",
+								variant: "outlined",
+								color: "primary",
+								size: "small",
+								className: "whitespace-nowrap flex-shrink-0",
+								children: t("studio_policy_help_read_docs")
+							})]
+						})
+					]
+				}),
+				/* @__PURE__ */ jsx(DialogActions, {
+					className: "p-4 sm:px-6 sm:pb-6 pt-0 border-t-0",
+					children: /* @__PURE__ */ jsx(Button, {
+						onClick: () => setHelpOpen(false),
+						variant: "filled",
+						color: "primary",
+						children: t("studio_policy_help_got_it")
 					})
-				]
-			}), /* @__PURE__ */ jsx(DialogActions, {
-				className: "p-4 sm:px-6 sm:pb-6 pt-0 border-t-0",
-				children: /* @__PURE__ */ jsx(Button, {
-					onClick: () => setHelpOpen(false),
-					variant: "filled",
-					color: "primary",
-					children: t("studio_policy_help_got_it")
 				})
-			})]
+			]
 		})
 	] });
 };
 //#endregion
 //#region src/components/RLSEditor/RLSEditor.tsx
+function classifyTableClient(tableName, schemaName, junctionTableNames, isMappedToCollection) {
+	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "internal";
+	if (isMappedToCollection) return "collection";
+	if (junctionTableNames.has(tableName)) return "junction";
+	return "other";
+}
 /**
 * Validates and double-quotes a SQL identifier to prevent injection.
 * Only allows safe Postgres identifiers (letters, digits, underscores).
@@ -575,6 +589,81 @@ function sanitizeSqlIdentifier(name) {
 	if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) throw new Error(`Invalid SQL identifier: "${name}". Only letters, digits, and underscores are allowed.`);
 	return `"${name}"`;
 }
+function SidebarSection({ title, icon, expanded, onToggle, count, children }) {
+	return /* @__PURE__ */ jsxs("div", {
+		className: "mb-2",
+		children: [/* @__PURE__ */ jsxs("div", {
+			className: "flex items-center p-1.5 cursor-pointer hover:bg-surface-100 dark:hover:bg-surface-900 rounded transition-colors",
+			onClick: onToggle,
+			children: [
+				/* @__PURE__ */ jsx("svg", {
+					className: cls("w-3 h-3 mr-1.5 transition-transform text-text-disabled dark:text-text-disabled-dark", expanded ? "rotate-90" : ""),
+					fill: "currentColor",
+					viewBox: "0 0 20 20",
+					children: /* @__PURE__ */ jsx("path", { d: "M7.293 14.707a1 1 0 010-1.414L10.586 10 7.293 6.707a1 1 0 011.414-1.414l4 4a1 1 0 010 1.414l-4 4a1 1 0 01-1.414 0z" })
+				}),
+				icon,
+				/* @__PURE__ */ jsx(Typography, {
+					variant: "body2",
+					className: "text-text-primary dark:text-text-primary-dark font-medium text-xs truncate flex-grow ml-1.5",
+					children: title
+				}),
+				count !== void 0 && /* @__PURE__ */ jsx("span", {
+					className: "text-[10px] text-text-disabled dark:text-text-disabled-dark font-medium tabular-nums mr-1",
+					children: count
+				})
+			]
+		}), expanded && /* @__PURE__ */ jsx("div", {
+			className: "ml-3 mt-0.5 space-y-0.5",
+			children
+		})]
+	});
+}
+function SidebarTableRow({ table, isSelected, onSelect, badge, dimmed, t }) {
+	return /* @__PURE__ */ jsxs("div", {
+		onClick: onSelect,
+		className: cls("flex items-center p-1 cursor-pointer rounded transition-colors group relative", isSelected ? "bg-primary/10 text-primary dark:bg-primary/20 dark:text-primary-light" : "hover:bg-surface-100 dark:hover:bg-surface-900 text-text-secondary dark:text-text-secondary-dark", dimmed && !isSelected && "opacity-60"),
+		children: [
+			/* @__PURE__ */ jsx("svg", {
+				className: "w-3.5 h-3.5 mr-1 shrink-0 text-text-disabled dark:text-text-disabled-dark",
+				fill: "none",
+				stroke: "currentColor",
+				viewBox: "0 0 24 24",
+				children: /* @__PURE__ */ jsx("path", {
+					strokeLinecap: "round",
+					strokeLinejoin: "round",
+					strokeWidth: 2,
+					d: "M3 10h18M3 14h18m-9-4v8m-7 0h14a2 2 0 002-2V8a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z"
+				})
+			}),
+			/* @__PURE__ */ jsx(Typography, {
+				variant: "body2",
+				className: "text-xs truncate flex-1 min-w-0",
+				children: table.tableName
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "flex items-center gap-1.5 shrink-0 ml-2",
+				children: [
+					badge && /* @__PURE__ */ jsx("span", {
+						className: "text-[9px] uppercase tracking-wider font-semibold text-text-disabled dark:text-text-disabled-dark bg-surface-200 dark:bg-surface-800 rounded px-1 py-px",
+						children: badge
+					}),
+					table.rlsEnabled ? /* @__PURE__ */ jsx(Tooltip, {
+						title: t("studio_rls_enabled"),
+						children: /* @__PURE__ */ jsx("div", { className: "w-1.5 h-1.5 rounded-full bg-green-500" })
+					}) : /* @__PURE__ */ jsx(Tooltip, {
+						title: t("studio_rls_disabled"),
+						children: /* @__PURE__ */ jsx("div", { className: "w-1.5 h-1.5 rounded-full bg-orange-400 opacity-50" })
+					}),
+					/* @__PURE__ */ jsx("span", {
+						className: "text-[10px] opacity-40 group-hover:opacity-100 min-w-[1.2rem] text-right font-medium",
+						children: table.policies.length
+					})
+				]
+			})
+		]
+	});
+}
 var RLSEditor = ({ apiUrl = "" }) => {
 	const { databaseAdmin } = useRebaseContext();
 	const snackbarController = useSnackbarController();
@@ -585,6 +674,7 @@ var RLSEditor = ({ apiUrl = "" }) => {
 	const [tables, setTables] = useState([]);
 	const [selectedTable, setSelectedTable] = useState(null);
 	const [activeTab, setActiveTab] = useState(0);
+	const [junctionTableNames, setJunctionTableNames] = useState(/* @__PURE__ */ new Set());
 	const [editingPolicy, setEditingPolicy] = useState(null);
 	const [sidebarSize, setSidebarSize] = useState(() => {
 		try {
@@ -594,7 +684,11 @@ var RLSEditor = ({ apiUrl = "" }) => {
 			return 20;
 		}
 	});
-	const [expandedSchemas, setExpandedSchemas] = useState({ public: true });
+	const [expandedSections, setExpandedSections] = useState({
+		collection: true,
+		other: true,
+		internal: false
+	});
 	const [sidebarTab, setSidebarTab] = useState("tables");
 	useEffect(() => {
 		try {
@@ -676,7 +770,15 @@ var RLSEditor = ({ apiUrl = "" }) => {
 			});
 			const sortedTables = Object.values(tableMap).sort((a, b) => a.tableName.localeCompare(b.tableName));
 			setTables(sortedTables);
-			if (sortedTables.length > 0 && !selectedTable) setSelectedTable(`${sortedTables[0].schemaName}.${sortedTables[0].tableName}`);
+			try {
+				const jRows = extractRows(await databaseAdmin.executeSql(JUNCTION_TABLES_SQL));
+				setJunctionTableNames(new Set(jRows.map((r) => r.table_name).filter(Boolean)));
+			} catch {}
+			if (sortedTables.length > 0 && !selectedTable) {
+				const firstUserTable = sortedTables.find((t) => !REBASE_INTERNAL_SCHEMAS.includes(t.schemaName));
+				if (firstUserTable) setSelectedTable(`${firstUserTable.schemaName}.${firstUserTable.tableName}`);
+				else setSelectedTable(`${sortedTables[0].schemaName}.${sortedTables[0].tableName}`);
+			}
 		} catch (e) {
 			console.error("RLS fetch error:", e);
 			setError("Failed to fetch RLS policies: " + (e instanceof Error ? e.message : String(e)));
@@ -694,18 +796,38 @@ var RLSEditor = ({ apiUrl = "" }) => {
 		if (!selectedTable) return null;
 		return tables.find((t) => `${t.schemaName}.${t.tableName}` === selectedTable) || null;
 	}, [selectedTable, tables]);
-	const groupedTables = useMemo(() => {
-		const groups = {};
+	/** Categorize tables into 4 buckets for the sidebar. */
+	const categorizedTables = useMemo(() => {
+		const groups = {
+			collection: [],
+			junction: [],
+			internal: [],
+			other: []
+		};
 		tables.forEach((table) => {
-			if (!groups[table.schemaName]) groups[table.schemaName] = [];
-			groups[table.schemaName].push(table);
+			const isMapped = !!collectionRegistry.collections?.find((c) => c.id === table.tableName || c.path === table.tableName || c.table === table.tableName || c.slug === table.tableName || c.collectionId === table.tableName);
+			groups[classifyTableClient(table.tableName, table.schemaName, junctionTableNames, isMapped)].push(table);
 		});
 		return groups;
-	}, [tables]);
+	}, [
+		tables,
+		junctionTableNames,
+		collectionRegistry.collections
+	]);
 	const activeCollection = useMemo(() => {
 		if (!activeTableData) return null;
 		return collectionRegistry.collections?.find((c) => c.id === activeTableData.tableName || c.path === activeTableData.tableName || c.table === activeTableData.tableName || c.slug === activeTableData.tableName || c.collectionId === activeTableData.tableName) || null;
 	}, [activeTableData, collectionRegistry.collections]);
+	/** The category of the currently selected table. */
+	const activeTableCategory = useMemo(() => {
+		if (!activeTableData) return null;
+		const isMapped = !!activeCollection;
+		return classifyTableClient(activeTableData.tableName, activeTableData.schemaName, junctionTableNames, isMapped);
+	}, [
+		activeTableData,
+		activeCollection,
+		junctionTableNames
+	]);
 	const mergedPolicies = useMemo(() => {
 		if (!activeTableData) return [];
 		const policiesMap = {};
@@ -803,74 +925,78 @@ var RLSEditor = ({ apiUrl = "" }) => {
 							children: isLoading && tables.length === 0 ? /* @__PURE__ */ jsx("div", {
 								className: "flex justify-center p-4",
 								children: /* @__PURE__ */ jsx(CircularProgress, { size: "small" })
-							}) : Object.keys(groupedTables).length === 0 ? /* @__PURE__ */ jsx("div", {
+							}) : tables.length === 0 ? /* @__PURE__ */ jsx("div", {
 								className: "p-4 text-center",
 								children: /* @__PURE__ */ jsx(Typography, {
 									variant: "caption",
 									className: "text-text-disabled dark:text-text-disabled-dark italic",
 									children: t("studio_rls_no_tables")
 								})
-							}) : Object.entries(groupedTables).map(([schemaName, schemaTables]) => /* @__PURE__ */ jsxs("div", {
-								className: "mb-2",
-								children: [/* @__PURE__ */ jsxs("div", {
-									className: "flex items-center p-1 cursor-pointer hover:bg-surface-100 dark:hover:bg-surface-950 rounded transition-colors",
-									onClick: () => setExpandedSchemas((prev) => ({
+							}) : /* @__PURE__ */ jsxs(Fragment, { children: [
+								categorizedTables.collection.length > 0 && /* @__PURE__ */ jsx(SidebarSection, {
+									title: "Schema Collections",
+									icon: /* @__PURE__ */ jsx(DatabaseIcon, {
+										size: 12,
+										className: "text-primary dark:text-primary-light"
+									}),
+									expanded: expandedSections.collection ?? true,
+									onToggle: () => setExpandedSections((prev) => ({
 										...prev,
-										[schemaName]: !prev[schemaName]
+										collection: !(prev.collection ?? true)
 									})),
-									children: [/* @__PURE__ */ jsx("svg", {
-										className: cls("w-3 h-3 mr-1 transition-transform", expandedSchemas[schemaName] ? "rotate-90" : ""),
-										fill: "currentColor",
-										viewBox: "0 0 20 20",
-										children: /* @__PURE__ */ jsx("path", { d: "M7.293 14.707a1 1 0 010-1.414L10.586 10 7.293 6.707a1 1 0 011.414-1.414l4 4a1 1 0 010 1.414l-4 4a1 1 0 01-1.414 0z" })
-									}), /* @__PURE__ */ jsx(Typography, {
-										variant: "body2",
-										className: "text-text-primary dark:text-text-primary-dark font-medium text-xs truncate flex-grow",
-										children: schemaName
-									})]
-								}), expandedSchemas[schemaName] && /* @__PURE__ */ jsx("div", {
-									className: "ml-3 mt-1 space-y-0.5",
-									children: schemaTables.map((table) => {
-										const key = `${table.schemaName}.${table.tableName}`;
-										return /* @__PURE__ */ jsxs("div", {
-											onClick: () => setSelectedTable(key),
-											className: cls("flex items-center p-1 cursor-pointer rounded transition-colors group relative", selectedTable === key ? "bg-primary/10 text-primary dark:bg-primary/20 dark:text-primary-light" : "hover:bg-surface-100 dark:hover:bg-surface-950 text-text-secondary dark:text-text-secondary-dark"),
-											children: [
-												/* @__PURE__ */ jsx("svg", {
-													className: "w-3.5 h-3.5 mr-1 shrink-0 text-text-disabled dark:text-text-disabled-dark",
-													fill: "none",
-													stroke: "currentColor",
-													viewBox: "0 0 24 24",
-													children: /* @__PURE__ */ jsx("path", {
-														strokeLinecap: "round",
-														strokeLinejoin: "round",
-														strokeWidth: 2,
-														d: "M3 10h18M3 14h18m-9-4v8m-7 0h14a2 2 0 002-2V8a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z"
-													})
-												}),
-												/* @__PURE__ */ jsx(Typography, {
-													variant: "body2",
-													className: "text-xs truncate flex-1 min-w-0",
-													children: table.tableName
-												}),
-												/* @__PURE__ */ jsxs("div", {
-													className: "flex items-center gap-1.5 shrink-0 ml-2",
-													children: [table.rlsEnabled ? /* @__PURE__ */ jsx(Tooltip, {
-														title: t("studio_rls_enabled"),
-														children: /* @__PURE__ */ jsx("div", { className: "w-1.5 h-1.5 rounded-full bg-green-500" })
-													}) : /* @__PURE__ */ jsx(Tooltip, {
-														title: t("studio_rls_disabled"),
-														children: /* @__PURE__ */ jsx("div", { className: "w-1.5 h-1.5 rounded-full bg-orange-400 opacity-50" })
-													}), /* @__PURE__ */ jsx("span", {
-														className: "text-[10px] opacity-40 group-hover:opacity-100 min-w-[1.2rem] text-right font-medium",
-														children: table.policies.length
-													})]
-												})
-											]
-										}, key);
-									})
-								})]
-							}, schemaName))
+									children: categorizedTables.collection.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
+										table,
+										isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
+										onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
+										t
+									}, `${table.schemaName}.${table.tableName}`))
+								}),
+								(categorizedTables.other.length > 0 || categorizedTables.junction.length > 0) && /* @__PURE__ */ jsxs(SidebarSection, {
+									title: "Other Tables",
+									icon: /* @__PURE__ */ jsx(AlertTriangleIcon, {
+										size: 12,
+										className: "text-yellow-500 dark:text-yellow-400"
+									}),
+									expanded: expandedSections.other ?? true,
+									onToggle: () => setExpandedSections((prev) => ({
+										...prev,
+										other: !(prev.other ?? true)
+									})),
+									children: [categorizedTables.other.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
+										table,
+										isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
+										onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
+										t
+									}, `${table.schemaName}.${table.tableName}`)), categorizedTables.junction.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
+										table,
+										isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
+										onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
+										badge: "Junction",
+										dimmed: true,
+										t
+									}, `${table.schemaName}.${table.tableName}`))]
+								}),
+								categorizedTables.internal.length > 0 && /* @__PURE__ */ jsx(SidebarSection, {
+									title: "Rebase Internal",
+									icon: /* @__PURE__ */ jsx(LockIcon, {
+										size: 12,
+										className: "text-text-disabled dark:text-text-disabled-dark"
+									}),
+									expanded: expandedSections.internal ?? false,
+									onToggle: () => setExpandedSections((prev) => ({
+										...prev,
+										internal: !(prev.internal ?? false)
+									})),
+									count: categorizedTables.internal.length,
+									children: categorizedTables.internal.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
+										table,
+										isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
+										onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
+										dimmed: true,
+										t
+									}, `${table.schemaName}.${table.tableName}`))
+								})
+							] })
 						})]
 					}), sidebarTab === "info" && /* @__PURE__ */ jsxs("div", {
 						className: "flex flex-col h-full",
@@ -1033,10 +1159,11 @@ var RLSEditor = ({ apiUrl = "" }) => {
 								size: "small",
 								onClick: async () => {
 									const table = activeTableData.tableName;
+									const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(table)}`;
 									const action = activeTableData.rlsEnabled ? "DISABLE" : "ENABLE";
 									if (!confirm(`Are you sure you want to ${action.toLowerCase()} Row Level Security on "${table}"?`)) return;
 									try {
-										await databaseAdmin.executeSql(`ALTER TABLE ${sanitizeSqlIdentifier(table)} ${action} ROW LEVEL SECURITY`);
+										await databaseAdmin.executeSql(`ALTER TABLE ${qualifiedTable} ${action} ROW LEVEL SECURITY`);
 										snackbarController.open({
 											type: "success",
 											message: `RLS ${action.toLowerCase()}d on ${table}`
@@ -1063,7 +1190,6 @@ var RLSEditor = ({ apiUrl = "" }) => {
 							/* @__PURE__ */ jsx(Button, {
 								size: "small",
 								color: "primary",
-								disabled: !activeCollection,
 								onClick: () => setEditingPolicy("new"),
 								children: t("studio_rls_create_policy")
 							})
@@ -1104,31 +1230,57 @@ var RLSEditor = ({ apiUrl = "" }) => {
 					schema: activeTableData.schemaName,
 					table: activeTableData.tableName,
 					onSave: async (newPolicy) => {
-						if (!activeCollection) return;
-						const rule = {
-							name: newPolicy.policyname,
-							operation: newPolicy.cmd?.toLowerCase(),
-							mode: newPolicy.permissive?.toLowerCase(),
-							using: newPolicy.qual || void 0,
-							withCheck: newPolicy.with_check || void 0,
-							roles: newPolicy.roles
-						};
-						const existingRules = (isPostgresCollection(activeCollection) ? activeCollection.securityRules : void 0) || [];
-						let newRules;
-						if (editingPolicy === "new") newRules = [...existingRules, rule];
-						else newRules = existingRules.map((r) => r.name === editingPolicy.policyname ? rule : r);
-						try {
-							if (!(await fetch(`${apiUrl}/api/schema-editor/collection/save`, {
-								method: "POST",
-								headers: { "Content-Type": "application/json" },
-								body: JSON.stringify({
-									collectionId: activeCollection.id || activeCollection.path || activeCollection.alias || activeTableData.tableName,
-									collectionData: { securityRules: newRules }
-								})
-							})).ok) throw new Error("Failed to save policy");
+						if (activeCollection) {
+							const rule = {
+								name: newPolicy.policyname,
+								operation: newPolicy.cmd?.toLowerCase(),
+								mode: newPolicy.permissive?.toLowerCase(),
+								using: newPolicy.qual || void 0,
+								withCheck: newPolicy.with_check || void 0,
+								roles: newPolicy.roles
+							};
+							const existingRules = (isPostgresCollection(activeCollection) ? activeCollection.securityRules : void 0) || [];
+							let newRules;
+							if (editingPolicy === "new") newRules = [...existingRules, rule];
+							else newRules = existingRules.map((r) => r.name === editingPolicy.policyname ? rule : r);
+							try {
+								if (!(await fetch(`${apiUrl}/api/schema-editor/collection/save`, {
+									method: "POST",
+									headers: { "Content-Type": "application/json" },
+									body: JSON.stringify({
+										collectionId: activeCollection.id || activeCollection.path || activeCollection.alias || activeTableData.tableName,
+										collectionData: { securityRules: newRules }
+									})
+								})).ok) throw new Error("Failed to save policy");
+								snackbarController.open({
+									type: "success",
+									message: "Policy saved successfully"
+								});
+								setEditingPolicy(null);
+								fetchRLSData();
+							} catch (e) {
+								snackbarController.open({
+									type: "error",
+									message: e instanceof Error ? e.message : String(e)
+								});
+							}
+						} else try {
+							const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(activeTableData.tableName)}`;
+							const policyName = sanitizeSqlIdentifier(newPolicy.policyname || "unnamed_policy");
+							const cmd = newPolicy.cmd || "ALL";
+							const permissive = (newPolicy.permissive || "PERMISSIVE") === "PERMISSIVE" ? "PERMISSIVE" : "RESTRICTIVE";
+							const roles = newPolicy.roles && newPolicy.roles.length > 0 ? newPolicy.roles.map((r) => sanitizeSqlIdentifier(r)).join(", ") : "public";
+							if (editingPolicy !== "new") await databaseAdmin.executeSql(`DROP POLICY IF EXISTS ${policyName} ON ${qualifiedTable}`);
+							let sql = `CREATE POLICY ${policyName} ON ${qualifiedTable}`;
+							sql += ` AS ${permissive}`;
+							sql += ` FOR ${cmd}`;
+							sql += ` TO ${roles}`;
+							if (newPolicy.qual) sql += ` USING (${newPolicy.qual})`;
+							if (newPolicy.with_check) sql += ` WITH CHECK (${newPolicy.with_check})`;
+							await databaseAdmin.executeSql(sql);
 							snackbarController.open({
 								type: "success",
-								message: "Policy saved successfully"
+								message: `Policy "${newPolicy.policyname}" applied directly via SQL`
 							});
 							setEditingPolicy(null);
 							fetchRLSData();
@@ -1147,17 +1299,59 @@ var RLSEditor = ({ apiUrl = "" }) => {
 						children: /* @__PURE__ */ jsxs("div", {
 							className: "max-w-4xl mx-auto flex flex-col gap-6",
 							children: [
-								activeTableData && !activeCollection && /* @__PURE__ */ jsxs(Alert, {
+								activeTableData && activeTableCategory === "internal" && /* @__PURE__ */ jsx(Alert, {
+									color: "info",
+									children: /* @__PURE__ */ jsxs("div", {
+										className: "flex items-start gap-2",
+										children: [/* @__PURE__ */ jsx(LockIcon, {
+											size: 16,
+											className: "shrink-0 mt-0.5"
+										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "mb-1 font-semibold",
+											children: "Rebase System Table"
+										}), /* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											className: "opacity-80",
+											children: "This table is managed internally by Rebase. Its security policies are configured automatically. Editing policies on system tables is an advanced operation."
+										})] })]
+									})
+								}),
+								activeTableData && activeTableCategory === "junction" && /* @__PURE__ */ jsx(Alert, {
+									color: "info",
+									children: /* @__PURE__ */ jsxs("div", {
+										className: "flex items-start gap-2",
+										children: [/* @__PURE__ */ jsx(Link2Icon, {
+											size: 16,
+											className: "shrink-0 mt-0.5"
+										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "mb-1 font-semibold",
+											children: "Junction Table"
+										}), /* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											className: "opacity-80",
+											children: "This is an auto-generated junction table for a many-to-many relation. Its access is typically managed through the related collections' policies. You can still add RLS policies directly if needed."
+										})] })]
+									})
+								}),
+								activeTableData && activeTableCategory === "other" && /* @__PURE__ */ jsx(Alert, {
 									color: "warning",
-									children: [/* @__PURE__ */ jsx(Typography, {
-										variant: "body2",
-										className: "mb-1",
-										children: "Table not managed by Rebase"
-									}), /* @__PURE__ */ jsx(Typography, {
-										variant: "caption",
-										className: "opacity-80",
-										children: "This table is not mapped to a Rebase Schema via code. To edit security policies visually, you must first import this table into a Schema configuration file."
-									})]
+									children: /* @__PURE__ */ jsxs("div", {
+										className: "flex items-start gap-2",
+										children: [/* @__PURE__ */ jsx(AlertTriangleIcon, {
+											size: 16,
+											className: "shrink-0 mt-0.5"
+										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "mb-1 font-semibold",
+											children: "Unmapped Table"
+										}), /* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											className: "opacity-80",
+											children: "This table exists in the database but isn't mapped to a collection definition. Import it into a Schema configuration file to manage security policies visually."
+										})] })]
+									})
 								}),
 								activeTableData && !activeTableData.rlsEnabled && /* @__PURE__ */ jsxs("div", {
 									className: cls("p-4 sm:p-5 bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-900/50 rounded-lg flex flex-col sm:flex-row gap-4 items-start sm:items-center justify-between", defaultBorderMixin),
@@ -1271,7 +1465,6 @@ var RLSEditor = ({ apiUrl = "" }) => {
 													variant: "text",
 													color: "primary",
 													onClick: () => setEditingPolicy(policy),
-													disabled: !activeCollection,
 													children: t("studio_rls_edit")
 												}),
 												policy.status !== "code_only" && /* @__PURE__ */ jsx(Tooltip, {
@@ -1281,9 +1474,10 @@ var RLSEditor = ({ apiUrl = "" }) => {
 														size: "small",
 														onClick: async () => {
 															const table = activeTableData.tableName;
+															const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(table)}`;
 															if (!confirm(`Drop policy "${policy.policyname}" from table "${table}"?`)) return;
 															try {
-																await databaseAdmin.executeSql(`DROP POLICY ${sanitizeSqlIdentifier(policy.policyname)} ON ${sanitizeSqlIdentifier(table)}`);
+																await databaseAdmin.executeSql(`DROP POLICY ${sanitizeSqlIdentifier(policy.policyname)} ON ${qualifiedTable}`);
 																snackbarController.open({
 																	type: "success",
 																	message: `Policy "${policy.policyname}" dropped`
@@ -1320,7 +1514,7 @@ var RLSEditor = ({ apiUrl = "" }) => {
 											className: "text-text-disabled dark:text-text-disabled-dark max-w-sm mb-4",
 											children: "RLS is enabled on this table but no policies exist. All access is denied by default (Postgres deny-all). Create a policy to allow specific access."
 										}),
-										activeCollection && /* @__PURE__ */ jsx(Button, {
+										/* @__PURE__ */ jsx(Button, {
 											size: "small",
 											variant: "filled",
 											color: "primary",
@@ -1359,4 +1553,4 @@ var RLSEditor = ({ apiUrl = "" }) => {
 //#endregion
 export { RLSEditor };
 
-//# sourceMappingURL=RLSEditor-CTxYbBdW.js.map
+//# sourceMappingURL=RLSEditor-BM64laoW.js.map