orchid-orm 1.68.4 → 1.68.6

package/dist/migrations/index.js

@@ -1318,6 +1318,44 @@ const dropCheck = ({ changeTableAst: { drop }, changingColumns }, dbCheck, name)
 		check: sql
 	});
 };
+const defaultRlsState = {
+	enable: false,
+	force: false
+};
+const normalizeRlsFlag = (value, defaultValue) => {
+	if (value === void 0) return defaultValue;
+	return value === true || value === "true" || value === "t";
+};
+const processTableRls = (ast, dbStructure, tables, currentSchema) => {
+	const projectRlsDefaults = tables[0]?.internal.rls?.tableRlsDefaults;
+	for (const table of tables) {
+		const tableRls = table.internal.tableRls;
+		if (!tableRls) continue;
+		const schemaName = table.q.schema ?? currentSchema;
+		const dbTable = dbStructure.tables.find((item) => item.schemaName === schemaName && item.name === table.table);
+		if (!dbTable) continue;
+		const codeRls = {
+			enable: normalizeRlsFlag(tableRls.enable ?? projectRlsDefaults?.enable, defaultRlsState.enable),
+			force: normalizeRlsFlag(tableRls.force ?? projectRlsDefaults?.force, defaultRlsState.force)
+		};
+		const dbRls = {
+			enable: normalizeRlsFlag(dbTable.rls?.enable, defaultRlsState.enable),
+			force: normalizeRlsFlag(dbTable.rls?.force, defaultRlsState.force)
+		};
+		if (codeRls.enable !== dbRls.enable) ast.push({
+			type: "tableRls",
+			action: codeRls.enable ? "enable" : "disable",
+			schema: schemaName,
+			table: table.table
+		});
+		if (codeRls.force !== dbRls.force) ast.push({
+			type: "tableRls",
+			action: codeRls.force ? "force" : "noForce",
+			schema: schemaName,
+			table: table.table
+		});
+	}
+};
 const processTables = async (ast, domainsMap, adapter, dbStructure, config, { structureToAstCtx, codeItems: { tables }, currentSchema, internal: { generatorIgnore }, verifying }, pendingDbTypes) => {
 	const createTables = collectCreateTables(tables, dbStructure, currentSchema);
 	const compareSql = {
@@ -1331,6 +1369,7 @@ const processTables = async (ast, domainsMap, adapter, dbStructure, config, { st
 	await applyChangeTables(adapter, changeTables, structureToAstCtx, dbStructure, domainsMap, ast, currentSchema, config, compareSql, tableExpressions, verifying, pendingDbTypes);
 	processForeignKeys(config, ast, changeTables, currentSchema, tableShapes);
 	await Promise.all([applyCompareSql(compareSql, adapter), compareSqlExpressions(tableExpressions, adapter)]);
+	processTableRls(ast, dbStructure, tables, currentSchema);
 	for (const dbTable of dropTables) ast.push((0, rake_db.tableToAst)(structureToAstCtx, dbStructure, dbTable, "drop", domainsMap));
 };
 const collectCreateTables = (tables, dbStructure, currentSchema) => {
@@ -1879,6 +1918,7 @@ const verifyMigration = async (adapter, config, migrationCode, generateMigration
 			config.log = log;
 			for (const changeFn of changeFns) await changeFn(db, true);
 			const dbStructure = await (0, rake_db.introspectDbSchema)(trx, {
+				rls: generateMigrationParams.codeItems.tables.some((table) => !!table.internal.tableRls),
 				roles,
 				loadDefaultPrivileges: defaultPrivileges?.loadDefaultPrivileges
 			});
@@ -2066,6 +2106,15 @@ const report = (ast, config, currentSchema) => {
 			if (parts.length) code.push(parts.join("\n"));
 			break;
 		}
+		case "tableRls": {
+			const table = dbItemName({
+				schema: a.schema,
+				name: a.table
+			}, currentSchema);
+			const message = a.action === "enable" ? `${green("+ enable rls")} ${table}` : a.action === "disable" ? `${red("- enable rls")} ${table}` : a.action === "force" ? `${green("+ force rls")} ${table}` : `${red("- force rls")} ${table}`;
+			code.push(message);
+			break;
+		}
 		default: (0, pqb_internal.exhaustive)(a);
 	}
 	const result = (0, pqb_internal.codeToString)(code, "", "  ");
@@ -2090,7 +2139,7 @@ const generate = async (adapters, config, args, afterPull) => {
 	const db = await getDbFromConfig(config, dbPath);
 	const { columnTypes, internal } = db.$qb;
 	const rolesDbStructureParam = internal.roles ? internal.managedRolesSql ? { whereSql: internal.managedRolesSql } : pqb_internal.emptyObject : void 0;
-	const { dbStructure } = await migrateAndPullStructures(adapters, config, rolesDbStructureParam, internal.roles ? { loadDefaultPrivileges: true } : void 0, afterPull);
+	const { dbStructure } = await migrateAndPullStructures(adapters, config, db, rolesDbStructureParam, internal.roles ? { loadDefaultPrivileges: true } : void 0, afterPull);
 	const [adapter] = adapters;
 	const adapterSchema = adapter.getSchema();
 	const currentSchema = (typeof adapterSchema === "function" ? adapterSchema() : adapterSchema) ?? "public";
@@ -2142,7 +2191,7 @@ const getDbFromConfig = async (config, dbPath) => {
 	if (!db?.$qb) throw new Error(`Unable to import OrchidORM instance as ${config.dbExportedAs ?? "db"} from ${config.dbPath}`);
 	return db;
 };
-const migrateAndPullStructures = async (adapters, config, roles, defaultPrivileges, afterPull) => {
+const migrateAndPullStructures = async (adapters, config, db, roles, defaultPrivileges, afterPull) => {
 	if (afterPull) return { dbStructure: {
 		version: await (0, rake_db.getDbVersion)(adapters[0]),
 		schemas: [],
@@ -2159,6 +2208,7 @@ const migrateAndPullStructures = async (adapters, config, roles, defaultPrivileg
 	} };
 	for (const adapter of adapters) await (0, rake_db.migrate)(adapter, config);
 	const dbStructures = await Promise.all(adapters.map((adapter) => (0, rake_db.introspectDbSchema)(adapter, {
+		rls: hasCodeTablesWithRls(db),
 		roles,
 		loadDefaultPrivileges: defaultPrivileges?.loadDefaultPrivileges
 	})));
@@ -2166,6 +2216,13 @@ const migrateAndPullStructures = async (adapters, config, roles, defaultPrivileg
 	for (let i = 1; i < dbStructures.length; i++) compareDbStructures(dbStructure, dbStructures[i], i);
 	return { dbStructure };
 };
+const hasCodeTablesWithRls = (db) => {
+	for (const key in db) {
+		if (key[0] === "$") continue;
+		if (db[key].internal.tableRls) return true;
+	}
+	return false;
+};
 const compareDbStructures = (a, b, i, path) => {
 	let err;
 	if (typeof a !== typeof b) err = true;