@supabase/pg-delta 1.0.0-alpha.2 → 1.0.0-alpha.20

package/src/core/objects/rls-policy/changes/rls-policy.create.ts

@@ -0,0 +1,128 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import { stableId } from "../../utils.ts";
+import type { RlsPolicy } from "../rls-policy.model.ts";
+import { CreateRlsPolicyChange } from "./rls-policy.base.ts";
+
+/**
+ * Create an RLS policy.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-createpolicy.html
+ *
+ * Synopsis
+ * ```sql
+ * CREATE POLICY name ON table_name
+ *     [ AS { PERMISSIVE | RESTRICTIVE } ]
+ *     [ FOR { ALL | SELECT | INSERT | UPDATE | DELETE } ]
+ *     [ TO { role_name | PUBLIC | CURRENT_ROLE | CURRENT_USER | SESSION_USER } [, ...] ]
+ *     [ USING ( using_expression ) ]
+ *     [ WITH CHECK ( with_check_expression ) ]
+ * ```
+ */
+export class CreateRlsPolicy extends CreateRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly scope = "object" as const;
+
+  constructor(props: { policy: RlsPolicy }) {
+    super();
+    this.policy = props.policy;
+  }
+
+  get creates() {
+    return [this.policy.stableId];
+  }
+
+  get requires() {
+    const dependencies = new Set<string>();
+
+    // Schema dependency
+    dependencies.add(stableId.schema(this.policy.schema));
+
+    // Table dependency
+    dependencies.add(
+      stableId.table(this.policy.schema, this.policy.table_name),
+    );
+
+    // Owner dependency
+    dependencies.add(stableId.role(this.policy.owner));
+
+    // Relations and functions referenced inside USING / WITH CHECK
+    // expressions must exist before the policy is created. These come from
+    // pg_depend (populated by PostgreSQL's recordDependencyOnExpr at policy
+    // creation), not from re-parsing the expression text.
+    for (const ref of this.policy.referenced_relations) {
+      switch (ref.kind) {
+        case "table":
+          dependencies.add(stableId.table(ref.schema, ref.name));
+          break;
+        case "view":
+          dependencies.add(stableId.view(ref.schema, ref.name));
+          break;
+        case "materialized_view":
+          dependencies.add(stableId.materializedView(ref.schema, ref.name));
+          break;
+        case "foreign_table":
+          dependencies.add(stableId.foreignTable(ref.schema, ref.name));
+          break;
+      }
+    }
+
+    for (const ref of this.policy.referenced_procedures) {
+      dependencies.add(
+        stableId.procedure(ref.schema, ref.name, ref.argument_types.join(",")),
+      );
+    }
+
+    return Array.from(dependencies);
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const parts: string[] = ["CREATE POLICY"];
+
+    // Add policy name
+    parts.push(this.policy.name);
+
+    // Add ON table
+    parts.push("ON", `${this.policy.schema}.${this.policy.table_name}`);
+
+    // Add AS RESTRICTIVE only if false (default is PERMISSIVE)
+    if (!this.policy.permissive) {
+      parts.push("AS RESTRICTIVE");
+    }
+
+    // Add FOR command
+    const commandMap: Record<string, string> = {
+      r: "FOR SELECT",
+      a: "FOR INSERT",
+      w: "FOR UPDATE",
+      d: "FOR DELETE",
+      "*": "FOR ALL",
+    };
+    // Default is FOR ALL; only print when not default
+    if (this.policy.command && this.policy.command !== "*") {
+      parts.push(commandMap[this.policy.command]);
+    }
+
+    // Add TO roles
+    // Default is TO PUBLIC; avoid printing explicit PUBLIC in CREATE
+    if (this.policy.roles && this.policy.roles.length > 0) {
+      const onlyPublic =
+        this.policy.roles.length === 1 &&
+        this.policy.roles[0].toLowerCase() === "public";
+      if (!onlyPublic) {
+        parts.push("TO", this.policy.roles.join(", "));
+      }
+    }
+
+    // Add USING expression
+    if (this.policy.using_expression) {
+      parts.push("USING", `(${this.policy.using_expression})`);
+    }
+
+    // Add WITH CHECK expression
+    if (this.policy.with_check_expression) {
+      parts.push("WITH CHECK", `(${this.policy.with_check_expression})`);
+    }
+
+    return parts.join(" ");
+  }
+}

package/src/core/objects/rls-policy/changes/rls-policy.drop.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { RlsPolicy } from "../rls-policy.model.ts";
+import { DropRlsPolicy } from "./rls-policy.drop.ts";
+
+describe("rls-policy", () => {
+  test("drop", async () => {
+    const policy = new RlsPolicy({
+      schema: "public",
+      name: "test_policy",
+      table_name: "test_table",
+      command: "r",
+      permissive: true,
+      roles: ["public"],
+      using_expression: "user_id = current_user_id()",
+      with_check_expression: null,
+      owner: "test",
+      comment: null,
+      referenced_relations: [],
+      referenced_procedures: [],
+    });
+
+    const change = new DropRlsPolicy({
+      policy,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "DROP POLICY test_policy ON public.test_table",
+    );
+  });
+});

package/src/core/objects/rls-policy/changes/rls-policy.drop.ts

@@ -0,0 +1,40 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import type { RlsPolicy } from "../rls-policy.model.ts";
+import { DropRlsPolicyChange } from "./rls-policy.base.ts";
+
+/**
+ * Drop an RLS policy.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-droppolicy.html
+ *
+ * Synopsis
+ * ```sql
+ * DROP POLICY [ IF EXISTS ] name ON table_name [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class DropRlsPolicy extends DropRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly scope = "object" as const;
+
+  constructor(props: { policy: RlsPolicy }) {
+    super();
+    this.policy = props.policy;
+  }
+
+  get drops() {
+    return [this.policy.stableId];
+  }
+
+  get requires() {
+    return [this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return [
+      "DROP POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+    ].join(" ");
+  }
+}

package/src/core/objects/rls-policy/changes/rls-policy.types.ts

@@ -0,0 +1,11 @@
+import type { AlterRlsPolicy } from "./rls-policy.alter.ts";
+import type { CommentRlsPolicy } from "./rls-policy.comment.ts";
+import type { CreateRlsPolicy } from "./rls-policy.create.ts";
+import type { DropRlsPolicy } from "./rls-policy.drop.ts";
+
+/** Union of all RLS policy-related change variants (`objectType: "rls_policy"`). @category Change Types */
+export type RlsPolicyChange =
+  | AlterRlsPolicy
+  | CommentRlsPolicy
+  | CreateRlsPolicy
+  | DropRlsPolicy;

package/src/core/objects/rls-policy/rls-policy.diff.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, test } from "bun:test";
+import {
+  AlterRlsPolicySetRoles,
+  AlterRlsPolicySetUsingExpression,
+  AlterRlsPolicySetWithCheckExpression,
+} from "./changes/rls-policy.alter.ts";
+import { CreateRlsPolicy } from "./changes/rls-policy.create.ts";
+import { DropRlsPolicy } from "./changes/rls-policy.drop.ts";
+import { diffRlsPolicies } from "./rls-policy.diff.ts";
+import { RlsPolicy, type RlsPolicyProps } from "./rls-policy.model.ts";
+
+const base: RlsPolicyProps = {
+  schema: "public",
+  name: "p1",
+  table_name: "t",
+  command: "r",
+  permissive: true,
+  roles: ["role1"],
+  using_expression: null,
+  with_check_expression: null,
+  owner: "o1",
+  comment: null,
+  referenced_relations: [],
+  referenced_procedures: [],
+};
+
+describe.concurrent("rls-policy.diff", () => {
+  test("create and drop", () => {
+    const p = new RlsPolicy(base);
+    const created = diffRlsPolicies({}, { [p.stableId]: p });
+    expect(created[0]).toBeInstanceOf(CreateRlsPolicy);
+    const dropped = diffRlsPolicies({ [p.stableId]: p }, {});
+    expect(dropped[0]).toBeInstanceOf(DropRlsPolicy);
+  });
+
+  test("alter roles", () => {
+    const main = new RlsPolicy(base);
+    const branch = new RlsPolicy({ ...base, roles: ["r1", "r2"] });
+    const changes = diffRlsPolicies(
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes[0]).toBeInstanceOf(AlterRlsPolicySetRoles);
+  });
+
+  test("alter USING expression", () => {
+    const main = new RlsPolicy({ ...base, using_expression: "old_expr" });
+    const branch = new RlsPolicy({ ...base, using_expression: "new_expr" });
+    const changes = diffRlsPolicies(
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes[0]).toBeInstanceOf(AlterRlsPolicySetUsingExpression);
+  });
+
+  test("alter WITH CHECK expression", () => {
+    const main = new RlsPolicy({ ...base, with_check_expression: "old" });
+    const branch = new RlsPolicy({ ...base, with_check_expression: "new" });
+    const changes = diffRlsPolicies(
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes[0]).toBeInstanceOf(AlterRlsPolicySetWithCheckExpression);
+  });
+
+  test("drop and create when non-alterable property changes", () => {
+    const main = new RlsPolicy(base);
+    const branch = new RlsPolicy({
+      ...base,
+      command: "w",
+      permissive: false,
+    });
+    const changes = diffRlsPolicies(
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes).toHaveLength(2);
+    expect(changes[0]).toBeInstanceOf(DropRlsPolicy);
+    expect(changes[1]).toBeInstanceOf(CreateRlsPolicy);
+  });
+});

package/src/core/objects/rls-policy/rls-policy.diff.ts

@@ -0,0 +1,121 @@
+import { diffObjects } from "../base.diff.ts";
+import { deepEqual, hasNonAlterableChanges } from "../utils.ts";
+import {
+  AlterRlsPolicySetRoles,
+  AlterRlsPolicySetUsingExpression,
+  AlterRlsPolicySetWithCheckExpression,
+} from "./changes/rls-policy.alter.ts";
+import {
+  CreateCommentOnRlsPolicy,
+  DropCommentOnRlsPolicy,
+} from "./changes/rls-policy.comment.ts";
+import { CreateRlsPolicy } from "./changes/rls-policy.create.ts";
+import { DropRlsPolicy } from "./changes/rls-policy.drop.ts";
+import type { RlsPolicyChange } from "./changes/rls-policy.types.ts";
+import type { RlsPolicy } from "./rls-policy.model.ts";
+
+/**
+ * Diff two sets of RLS policies from main and branch catalogs.
+ *
+ * @param main - The RLS policies in the main catalog.
+ * @param branch - The RLS policies in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffRlsPolicies(
+  main: Record<string, RlsPolicy>,
+  branch: Record<string, RlsPolicy>,
+): RlsPolicyChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: RlsPolicyChange[] = [];
+
+  for (const rlsPolicyId of created) {
+    const policy = branch[rlsPolicyId];
+    changes.push(new CreateRlsPolicy({ policy: policy }));
+    if (policy.comment !== null) {
+      changes.push(new CreateCommentOnRlsPolicy({ policy }));
+    }
+  }
+
+  for (const rlsPolicyId of dropped) {
+    changes.push(new DropRlsPolicy({ policy: main[rlsPolicyId] }));
+  }
+
+  for (const rlsPolicyId of altered) {
+    const mainRlsPolicy = main[rlsPolicyId];
+    const branchRlsPolicy = branch[rlsPolicyId];
+
+    // Check if non-alterable properties have changed
+    // These require dropping and recreating the RLS policy
+    // These attributes require drop+create (Postgres has no ALTER for them)
+    const NON_ALTERABLE_FIELDS: Array<keyof RlsPolicy> = [
+      "command",
+      "permissive",
+    ];
+    const nonAlterablePropsChanged = hasNonAlterableChanges(
+      mainRlsPolicy,
+      branchRlsPolicy,
+      NON_ALTERABLE_FIELDS,
+      {},
+    );
+
+    if (nonAlterablePropsChanged) {
+      // Replace the entire RLS policy (drop + create)
+      changes.push(
+        new DropRlsPolicy({ policy: mainRlsPolicy }),
+        new CreateRlsPolicy({ policy: branchRlsPolicy }),
+      );
+    } else {
+      // Only alterable properties changed - check each one
+
+      // ROLES (TO ...)
+      const rolesEqual = deepEqual(mainRlsPolicy.roles, branchRlsPolicy.roles);
+      if (!rolesEqual) {
+        changes.push(
+          new AlterRlsPolicySetRoles({
+            policy: mainRlsPolicy,
+            roles: branchRlsPolicy.roles,
+          }),
+        );
+      }
+
+      // USING expression
+      if (mainRlsPolicy.using_expression !== branchRlsPolicy.using_expression) {
+        changes.push(
+          new AlterRlsPolicySetUsingExpression({
+            policy: mainRlsPolicy,
+            usingExpression: branchRlsPolicy.using_expression,
+          }),
+        );
+      }
+
+      // WITH CHECK expression
+      if (
+        mainRlsPolicy.with_check_expression !==
+        branchRlsPolicy.with_check_expression
+      ) {
+        changes.push(
+          new AlterRlsPolicySetWithCheckExpression({
+            policy: mainRlsPolicy,
+            withCheckExpression: branchRlsPolicy.with_check_expression,
+          }),
+        );
+      }
+
+      // COMMENT
+      if (mainRlsPolicy.comment !== branchRlsPolicy.comment) {
+        if (branchRlsPolicy.comment === null) {
+          changes.push(new DropCommentOnRlsPolicy({ policy: mainRlsPolicy }));
+        } else {
+          changes.push(
+            new CreateCommentOnRlsPolicy({ policy: branchRlsPolicy }),
+          );
+        }
+      }
+
+      // Note: RLS policy renaming would require drop+create due to identity fields
+    }
+  }
+
+  return changes;
+}

package/src/core/objects/rls-policy/rls-policy.model.ts

@@ -0,0 +1,273 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import { BasePgModel } from "../base.model.ts";
+
+const RlsPolicyCommandSchema = z.enum([
+  "r", // SELECT command
+  "a", // INSERT command (add)
+  "w", // UPDATE command (write)
+  "d", // DELETE command
+  "*", // ALL commands
+]);
+
+const RlsPolicyReferencedRelationKindSchema = z.enum([
+  "table",
+  "view",
+  "materialized_view",
+  "foreign_table",
+]);
+
+const rlsPolicyReferencedRelationSchema = z.object({
+  kind: RlsPolicyReferencedRelationKindSchema,
+  schema: z.string(),
+  name: z.string(),
+});
+
+export type RlsPolicyReferencedRelation = z.infer<
+  typeof rlsPolicyReferencedRelationSchema
+>;
+
+const rlsPolicyReferencedProcedureSchema = z.object({
+  schema: z.string(),
+  name: z.string(),
+  argument_types: z.array(z.string()),
+});
+
+export type RlsPolicyReferencedProcedure = z.infer<
+  typeof rlsPolicyReferencedProcedureSchema
+>;
+
+const rlsPolicyPropsSchema = z.object({
+  schema: z.string(),
+  name: z.string(),
+  table_name: z.string(),
+  command: RlsPolicyCommandSchema,
+  permissive: z.boolean(),
+  roles: z.array(z.string()),
+  using_expression: z.string().nullable(),
+  with_check_expression: z.string().nullable(),
+  owner: z.string(),
+  comment: z.string().nullable(),
+  referenced_relations: z.array(rlsPolicyReferencedRelationSchema),
+  referenced_procedures: z.array(rlsPolicyReferencedProcedureSchema),
+});
+
+export type RlsPolicyProps = z.infer<typeof rlsPolicyPropsSchema>;
+
+export class RlsPolicy extends BasePgModel {
+  public readonly schema: RlsPolicyProps["schema"];
+  public readonly name: RlsPolicyProps["name"];
+  public readonly table_name: RlsPolicyProps["table_name"];
+  public readonly command: RlsPolicyProps["command"];
+  public readonly permissive: RlsPolicyProps["permissive"];
+  public readonly roles: RlsPolicyProps["roles"];
+  public readonly using_expression: RlsPolicyProps["using_expression"];
+  public readonly with_check_expression: RlsPolicyProps["with_check_expression"];
+  public readonly owner: RlsPolicyProps["owner"];
+  public readonly comment: RlsPolicyProps["comment"];
+  /**
+   * Tables / views / materialized views / foreign tables that
+   * `using_expression` / `with_check_expression` reference, sourced from
+   * `pg_depend` (`recordDependencyOnExpr` at policy creation). Drives
+   * ordering dependencies in `CreateRlsPolicy.requires`. Intentionally
+   * excluded from `dataFields` — it's derived from the expression text
+   * and changes lockstep with it.
+   */
+  public readonly referenced_relations: RlsPolicyProps["referenced_relations"];
+  /**
+   * Functions / procedures that `using_expression` / `with_check_expression`
+   * reference, sourced from `pg_depend` (refclassid = `pg_proc`). The
+   * argument-type signature comes straight from `pg_proc.proargtypes` via
+   * `format_type`, so it matches the signature the procedure extractor
+   * embeds in `stableId.procedure(...)`. Not part of `dataFields`.
+   */
+  public readonly referenced_procedures: RlsPolicyProps["referenced_procedures"];
+
+  constructor(props: RlsPolicyProps) {
+    super();
+
+    // Identity fields
+    this.schema = props.schema;
+    this.name = props.name;
+    this.table_name = props.table_name;
+
+    // Data fields
+    this.command = props.command;
+    this.permissive = props.permissive;
+    this.roles = props.roles;
+    this.using_expression = props.using_expression;
+    this.with_check_expression = props.with_check_expression;
+    this.owner = props.owner;
+    this.comment = props.comment;
+
+    // Derived metadata (not part of equality)
+    this.referenced_relations = props.referenced_relations;
+    this.referenced_procedures = props.referenced_procedures;
+  }
+
+  get stableId(): `rlsPolicy:${string}` {
+    return `rlsPolicy:${this.schema}.${this.table_name}.${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      schema: this.schema,
+      table_name: this.table_name,
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    return {
+      command: this.command,
+      permissive: this.permissive,
+      roles: this.roles,
+      using_expression: this.using_expression,
+      with_check_expression: this.with_check_expression,
+      owner: this.owner,
+      comment: this.comment,
+    };
+  }
+}
+
+export async function extractRlsPolicies(pool: Pool): Promise<RlsPolicy[]> {
+  const { rows: policyRows } = await pool.query<RlsPolicyProps>(sql`
+with extension_policy_oids as (
+  select
+    objid
+  from
+    pg_depend d
+  where
+    d.refclassid = 'pg_extension'::regclass
+    and d.classid = 'pg_policy'::regclass
+),
+extension_table_oids as (
+  select
+    objid
+  from
+    pg_depend d
+  where
+    d.refclassid = 'pg_extension'::regclass
+    and d.classid = 'pg_class'::regclass
+    and d.deptype = 'e'
+),
+policy_relation_deps as (
+  -- Relations referenced inside polqual / polwithcheck. PostgreSQL records
+  -- these via recordDependencyOnExpr(..., DEPENDENCY_NORMAL = 'n') at
+  -- CREATE POLICY time, so pg_depend is authoritative and we don't need to
+  -- re-parse the expression text. Covers regular tables, partitioned
+  -- tables, views, materialized views, and foreign tables — any relation
+  -- kind the policy can reference in a subquery.
+  select distinct
+    d.objid                 as policy_oid,
+    case ref_c.relkind
+      when 'r' then 'table'
+      when 'p' then 'table'
+      when 'v' then 'view'
+      when 'm' then 'materialized_view'
+      when 'f' then 'foreign_table'
+    end                     as ref_kind,
+    ref_ns.nspname          as ref_schema,
+    ref_c.relname           as ref_name
+  from
+    pg_depend d
+    join pg_policy p on p.oid = d.objid
+    join pg_class ref_c on ref_c.oid = d.refobjid
+    join pg_namespace ref_ns on ref_ns.oid = ref_c.relnamespace
+  where
+    d.classid = 'pg_policy'::regclass
+    and d.refclassid = 'pg_class'::regclass
+    and d.deptype = 'n'
+    and ref_c.relkind in ('r', 'p', 'v', 'm', 'f')
+    and d.refobjid <> p.polrelid
+),
+policy_procedure_deps as (
+  -- Functions / procedures referenced inside polqual / polwithcheck. Same
+  -- pg_depend mechanism as above, just refclassid = pg_proc. proargtypes
+  -- formatted via format_type(oid, null) matches the signature produced by
+  -- the procedure extractor (see procedure.model.ts), so stableId.procedure
+  -- on both sides of the diff lines up exactly.
+  select distinct
+    d.objid            as policy_oid,
+    ref_ns.nspname     as ref_schema,
+    ref_p.proname      as ref_name,
+    array(
+      select format_type(oid, null)
+      from unnest(ref_p.proargtypes) as oid
+    )                  as ref_argument_types
+  from
+    pg_depend d
+    join pg_proc ref_p on ref_p.oid = d.refobjid
+    join pg_namespace ref_ns on ref_ns.oid = ref_p.pronamespace
+  where
+    d.classid = 'pg_policy'::regclass
+    and d.refclassid = 'pg_proc'::regclass
+    and d.deptype = 'n'
+)
+select
+  tc.relnamespace::regnamespace::text as schema,
+  quote_ident(p.polname) as name,
+  quote_ident(tc.relname) as table_name,
+  p.polcmd as command,
+  p.polpermissive as permissive,
+  case
+    when p.polroles = '{0}' then array['public']::text[]
+    else array(
+      select quote_ident(rolname)
+      from pg_catalog.pg_roles
+      where oid = any(p.polroles)
+      order by rolname
+    )
+  end as roles,
+  pg_get_expr(p.polqual, p.polrelid) as using_expression,
+  pg_get_expr(p.polwithcheck, p.polrelid) as with_check_expression,
+  tc.relowner::regrole::text as owner,
+  obj_description(p.oid, 'pg_policy') as comment,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object(
+          'kind', prd.ref_kind,
+          'schema', prd.ref_schema,
+          'name', prd.ref_name
+        )
+        order by prd.ref_schema, prd.ref_name
+      )
+      from policy_relation_deps prd
+      where prd.policy_oid = p.oid
+    ),
+    '[]'
+  ) as referenced_relations,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object(
+          'schema', ppd.ref_schema,
+          'name', ppd.ref_name,
+          'argument_types', ppd.ref_argument_types
+        )
+        order by ppd.ref_schema, ppd.ref_name, ppd.ref_argument_types
+      )
+      from policy_procedure_deps ppd
+      where ppd.policy_oid = p.oid
+    ),
+    '[]'
+  ) as referenced_procedures
+from
+  pg_catalog.pg_policy p
+  inner join pg_catalog.pg_class tc on tc.oid = p.polrelid
+  left outer join extension_policy_oids e_policy on p.oid = e_policy.objid
+  left outer join extension_table_oids e_table on tc.oid = e_table.objid
+  where not tc.relnamespace::regnamespace::text like any(array['pg\\_%', 'information\\_schema'])
+  and e_policy.objid is null
+  and e_table.objid is null
+order by
+  1, 2
+  `);
+  // Validate and parse each row using the Zod schema
+  const validatedRows = policyRows.map((row: unknown) =>
+    rlsPolicyPropsSchema.parse(row),
+  );
+  return validatedRows.map((row: RlsPolicyProps) => new RlsPolicy(row));
+}