RLS DSL - v0.1.0
    Preparing search index...

    Class PolicyBuilder

    Policy builder class implementing fluent API

    Index

    Constructors

    constructor

    Methods

    on for read write update delete all to when withCheck allow restrictive permissive requireAll allowAny description toDefinition toSQL

    Constructors

    Methods

    • Set the USING clause (read filter)

      Determines which existing rows can be seen/modified by the current user.

      Parameters

      Returns this

      // Users can only see their own documents
      policy('view_own_docs')
        .on('documents')
        .read()
        .when(column('user_id').isOwner());

      // Complex condition with OR
      policy('view_docs')
        .on('documents')
        .read()
        .when(
          column('user_id').isOwner()
            .or(column('is_public').eq(true))
        );

    • Set the WITH CHECK clause (write validation)

      Validates that new/modified rows meet the specified condition.

      Parameters

      Returns this

      // Prevent users from creating documents for other users
      policy('create_docs')
        .on('documents')
        .write()
        .withCheck(column('user_id').isOwner());

      // For UPDATE, use both when() and withCheck()
      policy('update_docs')
        .on('documents')
        .update()
        .when(column('user_id').isOwner())  // Can only update own docs
        .withCheck(column('user_id').isOwner());  // Can't change ownership

    • Type-safe method to set the appropriate clause(s) based on the operation.

      • SELECT/DELETE: sets USING clause (read filter)
      • INSERT: sets WITH CHECK clause (write validation)
      • UPDATE/ALL: sets both USING and WITH CHECK clauses (same condition)

      Parameters

      Returns this

      // For SELECT - sets USING only
      policy('read_docs')
        .on('documents')
        .read()
        .allow(column('user_id').isOwner());

      // For INSERT - sets WITH CHECK only
      policy('create_docs')
        .on('documents')
        .write()
        .allow(column('user_id').isOwner());

      // For UPDATE - sets both USING and WITH CHECK
      policy('update_docs')
        .on('documents')
        .update()
        .allow(column('user_id').isOwner());

    • User-focused alias for .restrictive() - all policies must pass

      Makes this policy RESTRICTIVE, meaning it must pass in addition to other policies. Useful for adding constraints that apply to all operations (e.g., tenant isolation).

      Returns this

      // Tenant isolation that restricts all other policies
      policy('tenant_isolation')
        .on('documents')
        .all()
        .requireAll()  // This policy AND other policies must pass
        .when(column('tenant_id').belongsToTenant());

      // Now add a permissive policy for user access
      policy('user_access')
        .on('documents')
        .read()
        .when(column('user_id').isOwner());
      // Users can only see their own docs within their tenant

    • User-focused alias for .permissive() - any policy can grant access

      Makes this policy PERMISSIVE (default), meaning if this policy passes, access is granted (unless blocked by a RESTRICTIVE policy).

      Returns this

      // Multiple ways to access documents
      policy('owner_access')
        .on('documents')
        .read()
        .allowAny()  // Explicit, but this is the default
        .when(column('user_id').isOwner());

      policy('public_access')
        .on('documents')
        .read()
        .when(column('is_public').eq(true));
      // User can see a document if EITHER policy passes

    Settings

    Member Visibility

    On This Page

    Constructors
    Methods