@sladkoff/kysely-access-control 0.0.6 → 0.0.8

package/README.md

@@ -196,6 +196,25 @@ Unfortunately, even those you provide the column list to Kysely as a type, that
 system (or at all by the runtime), and as a result we cannot do the sensible thing of replacing a `.selectAll()` with a
 select of all columns.
 
+## Table Aliases in Subqueries
+
+Table aliases in subqueries (e.g., `selectFrom('table as t')`) are not currently supported. When using table aliases
+in subqueries, the library may fail to properly enforce permissions or throw errors.
+
+For example, the following pattern will not work:
+```typescript
+.select((qb) => {
+  const rsvps = qb
+    .selectFrom("rsvp as r")
+    .innerJoin("person", "person.id", "r.person_id")
+    .select("r.id");
+  
+  return [jsonArrayFrom(rsvps).as("rsvps")];
+})
+```
+
+Use the full table name without aliases in subqueries to ensure proper permission enforcement.
+
 # Features
 
 ## Table/Column Statement Type + Context Controls

package/dist/src/kyselyAccessControl.js

@@ -78,8 +78,9 @@ const createAccessControlPlugin = (guard) => {
                     }
                 }
             }
-            // Must be allow
-            return super.transformUpdateQuery(node);
+            // Apply RLS filter from grants to WHERE clause
+            const newNode = Object.assign(Object.assign({}, node), { where: this._transformWhere(guardResult, node.where) });
+            return super.transformUpdateQuery(newNode);
         }
         /**
          * Enforce insert on a table
@@ -229,7 +230,7 @@ const createAccessControlPlugin = (guard) => {
                     // the internal SelectQueryNode
                     return from;
                 }
-                const guardResult = fullGuard.table(from.table, StatementType.Update, TableUsageContext.TableInJoin);
+                const guardResult = fullGuard.table(from.table, StatementType.Select, TableUsageContext.TableInJoin);
                 (0, exports.throwIfDenyWithReason)(guardResult, `JOIN denied on table ${((_a = from.table.schema) === null || _a === void 0 ? void 0 : _a.name) ? `${from.table.schema.name}.` : ""}${from.table.identifier.name}`);
                 if (guardResult === exports.Allow) {
                     return from;

package/package.json

@@ -3,7 +3,7 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "module": "index.ts",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "scripts": {
     "compile": "tsc -p tsconfig.build.json"
   },