rake-db 2.33.4 → 2.33.5

package/dist/index.mjs

@@ -1203,6 +1203,22 @@ const buildQuery = (ast, objectType, privileges, grantable, action) => {
 	} else parts.push(`REVOKE ${privilegeList} ON ${objectTypeToSql[objectType]} FROM "${ast.grantee}"`);
 	return parts.join(" ");
 };
+const actionToSql = {
+	enable: "ENABLE ROW LEVEL SECURITY",
+	disable: "DISABLE ROW LEVEL SECURITY",
+	force: "FORCE ROW LEVEL SECURITY",
+	noForce: "NO FORCE ROW LEVEL SECURITY"
+};
+const setRls = async (migration, tableName, action) => {
+	const [schema, table] = getSchemaAndTableFromName(migration.adapter.getSchema(), tableName);
+	await migration.adapter.arrays(`ALTER TABLE ${quoteTable(schema, table)} ${actionToSql[action]}`);
+};
+const enableOrDisableRls = (migration, up, tableName) => {
+	return setRls(migration, tableName, up ? "enable" : "disable");
+};
+const forceOrNoForceRls = (migration, up, tableName) => {
+	return setRls(migration, tableName, up ? "force" : "noForce");
+};
 /**
 * Creates a new `db` instance that is an instance of `pqb` with mixed in migration methods from the `Migration` class.
 * It overrides `query` and `array` db adapter methods to intercept SQL for the logging.
@@ -2064,6 +2080,18 @@ var Migration = class {
 	changeDefaultPrivileges(params) {
 		return changeDefaultPrivileges(this, this.up, params);
 	}
+	enableRls(tableName) {
+		return enableOrDisableRls(this, this.up, tableName);
+	}
+	disableRls(tableName) {
+		return enableOrDisableRls(this, !this.up, tableName);
+	}
+	forceRls(tableName) {
+		return forceOrNoForceRls(this, this.up, tableName);
+	}
+	noForceRls(tableName) {
+		return forceOrNoForceRls(this, !this.up, tableName);
+	}
 };
 const wrapWithEnhancingError = async (text, values, promise) => {
 	try {
@@ -3408,6 +3436,11 @@ const astToGenerateItem = (config, ast, currentSchema) => {
 			if (ast.owner) deps.push(`role:${ast.owner}`);
 			deps.push(`role:${ast.grantee}`);
 			break;
+		case "tableRls": {
+			const { schema = currentSchema } = ast;
+			deps.push(schema, `${schema}.${ast.table}`);
+			break;
+		}
 		default: exhaustive(ast);
 	}
 	return {
@@ -3873,6 +3906,13 @@ const astEncoders = {
 		code.push(props);
 		addCode(code, "});");
 		return code;
+	},
+	tableRls(ast, _config, currentSchema) {
+		const table = quoteSchemaTable({
+			schema: ast.schema,
+			name: ast.table
+		}, currentSchema);
+		return `await db.${ast.action === "enable" ? "enableRls" : ast.action === "disable" ? "disableRls" : ast.action === "force" ? "forceRls" : "noForceRls"}(${table});`;
 	}
 };
 const roleParams = (name, ast, compare, to) => {
@@ -4005,10 +4045,18 @@ ORDER BY a.attnum`;
 const schemasSql = `SELECT coalesce(json_agg(nspname ORDER BY nspname), '[]')
 FROM pg_catalog.pg_namespace n
 WHERE ${filterSchema("nspname")}`;
-const tablesSql = `SELECT
+const tablesSql = (rls) => `SELECT
   nspname AS "schemaName",
   relname AS "name",
   obj_description(c.oid) AS comment,
+  ${rls ? `(SELECT json_build_object(
+        'enable', rc.relrowsecurity,
+        'force', rc.relforcerowsecurity
+      )
+      FROM pg_class rc
+      JOIN pg_namespace nr ON nr.oid = rc.relnamespace
+      WHERE rc.relname = c.relname
+        AND nr.nspname = n.nspname) AS "rls",` : ""}
   (SELECT coalesce(json_agg(t), '[]') FROM (${columnsSql({
 	schema: "n",
 	table: "c",
@@ -4328,7 +4376,7 @@ const defaultPrivilegesSql = `SELECT COALESCE(json_agg(t.*), '[]') FROM (
   JOIN LATERAL aclexplode(d.defaclacl) ae ON true
   GROUP BY "grantor", "grantee", "schema", "object"
 ) t`;
-const sql = (version, params) => `SELECT (${schemasSql}) AS "schemas", ${jsonAgg(tablesSql, "tables")}, ${jsonAgg(viewsSql, "views")}, ${jsonAgg(indexesSql, "indexes")}, ${jsonAgg(constraintsSql, "constraints")}, ${jsonAgg(triggersSql, "triggers")}, ${jsonAgg(extensionsSql, "extensions")}, ${jsonAgg(enumsSql, "enums")}, ${jsonAgg(domainsSql, "domains")}, ${jsonAgg(collationsSql(version), "collations")}${params?.roles ? `, (${roleSql(params.roles)}) AS "roles"` : ""}${params?.loadDefaultPrivileges ? `, (${defaultPrivilegesSql}) AS "defaultPrivileges"` : ""}`;
+const sql = (version, params) => `SELECT (${schemasSql}) AS "schemas", ${jsonAgg(tablesSql(params?.rls), "tables")}, ${jsonAgg(viewsSql, "views")}, ${jsonAgg(indexesSql, "indexes")}, ${jsonAgg(constraintsSql, "constraints")}, ${jsonAgg(triggersSql, "triggers")}, ${jsonAgg(extensionsSql, "extensions")}, ${jsonAgg(enumsSql, "enums")}, ${jsonAgg(domainsSql, "domains")}, ${jsonAgg(collationsSql(version), "collations")}${params?.roles ? `, (${roleSql(params.roles)}) AS "roles"` : ""}${params?.loadDefaultPrivileges ? `, (${defaultPrivilegesSql}) AS "defaultPrivileges"` : ""}`;
 async function getDbVersion(db) {
 	const { rows: [{ version: versionString }] } = await db.query("SELECT version()");
 	return +versionString.match(/\d+/)[0];
@@ -4475,6 +4523,18 @@ const structureToAst = async (ctx, adapter, config) => {
 	for (const table of data.tables) {
 		if (table.name === migrationsTable && table.schemaName === migrationsSchema) continue;
 		ast.push(tableToAst(ctx, data, table, "create", domains));
+		if (table.rls?.enable) ast.push({
+			type: "tableRls",
+			action: "enable",
+			schema: table.schemaName === ctx.currentSchema ? void 0 : table.schemaName,
+			table: table.name
+		});
+		if (table.rls?.force) ast.push({
+			type: "tableRls",
+			action: "force",
+			schema: table.schemaName === ctx.currentSchema ? void 0 : table.schemaName,
+			table: table.name
+		});
 	}
 	for (const it of data.extensions) ast.push({
 		type: "extension",