Skip to content
MountSQLiMountSQLI

RLS (compilePolicy)

The redesigned @mountsqli/auth no longer includes a general-purpose RLS policy DSL (allowOwner, allowTenant, applyPolicy). Instead, it exports compilePolicy/Policy/PolicyContext as a minimal type bridge used by @mountsqli/storage for object ACL checks.

Non-RLS replacement

Section titled “Non-RLS replacement”

For row-level security at the query level, use MountSQLI’s driver-level RLS enforcement (opt-in enforceRls mode with .unsafe() / withFilters()). See the Raw SQL & RLS Gate page.

compilePolicy (storage ACLs)

Section titled “compilePolicy (storage ACLs)”

compilePolicy is consumed by @mountsqli/storage to check object access:

import { compilePolicy, type Policy, type PolicyContext } from "@mountsqli/auth";


// A policy is a function: (ctx: PolicyContext) => { deny: boolean; filters: FilterNode[] }
const policy: Policy = (ctx) => {
  if (!ctx.userId) return { deny: true, filters: [] };
  return {
    deny: false,
    filters: [{ kind: "filter", column: "ownerId", op: "=", value: ctx.userId }],
  };
};


const { deny, filters } = compilePolicy(policy, { userId: "u1" });
// deny === false
// filters[0] === { kind: "filter", column: "ownerId", op: "=", value: "u1" }

Storage’s canAccess() method calls compilePolicy and checks the object’s stored ACL against the produced filters.

Types

Section titled “Types”
interface PolicyContext {
  userId?: string | number;
  roles?: string[];
  claims?: Record<string, unknown>;
}


interface FilterNode {
  kind: "filter" | string;
  column?: string;
  op?: string;
  value?: unknown;
}


type Policy = (ctx: PolicyContext) => { deny: boolean; filters: FilterNode[] };

Best practices

Section titled “Best practices”
  • Use compilePolicy only for storage ACL checks.
  • For query-level RLS, use MountSQLI’s driver-level enforcement (see link below).
Section titled “Related”