crudPolicy() — drizzle-orm Function Reference

Architecture documentation for the crudPolicy() function in rls.ts from the drizzle-orm codebase.

Function typescript DrizzleORM RelationalQuery

Entity Profile

DrizzleORM→ RelationalQuery→ crudPolicy() — drizzle-orm Function Reference

Dependency Diagram

graph TD
  1c48d132_326d_cce7_e938_3a0ebec4f655["crudPolicy()"]
  5fa43d48_28a9_faeb_d727_27d04b78971a["rls.ts"]
  1c48d132_326d_cce7_e938_3a0ebec4f655 -->|defined in| 5fa43d48_28a9_faeb_d727_27d04b78971a
  style 1c48d132_326d_cce7_e938_3a0ebec4f655 fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

drizzle-orm/src/neon/rls.ts lines 15–87

export const crudPolicy = (options: {
	role: PgPolicyToOption;
	read: SQL | boolean | null;
	modify: SQL | boolean | null;
}) => {
	if (options.read === undefined) {
		throw new Error('crudPolicy requires a read policy');
	}

	if (options.modify === undefined) {
		throw new Error('crudPolicy requires a modify policy');
	}

	let read: SQL | undefined;
	if (options.read === true) {
		read = sql`true`;
	} else if (options.read === false) {
		read = sql`false`;
	} else if (options.read !== null) {
		read = options.read;
	}

	let modify: SQL | undefined;
	if (options.modify === true) {
		modify = sql`true`;
	} else if (options.modify === false) {
		modify = sql`false`;
	} else if (options.modify !== null) {
		modify = options.modify;
	}

	let rolesName = '';
	if (Array.isArray(options.role)) {
		rolesName = options.role
			.map((it) => {
				return is(it, PgRole) ? it.name : (it as string);
			})
			.join('-');
	} else {
		rolesName = is(options.role, PgRole)
			? options.role.name
			: (options.role as string);
	}

	return [
		read
		&& pgPolicy(`crud-${rolesName}-policy-select`, {
			for: 'select',
			to: options.role,
			using: read,
		}),

		modify
		&& pgPolicy(`crud-${rolesName}-policy-insert`, {
			for: 'insert',
			to: options.role,
			withCheck: modify,
		}),
		modify
		&& pgPolicy(`crud-${rolesName}-policy-update`, {
			for: 'update',
			to: options.role,
			using: modify,
			withCheck: modify,
		}),
		modify
		&& pgPolicy(`crud-${rolesName}-policy-delete`, {
			for: 'delete',
			to: options.role,
			using: modify,
		}),
	].filter(Boolean);
};