Row Level Security

[jasonmacdonald]

Is it currently possible to implement RLS with Zenstack? I noticed there's a warning about not supporting sequential transactions, but with Prisma, the only way right now to properly implement RLS is using the Array syntax and not the interactive one. It seems that right now using the interactive approach causes other requests to happen outside of the transaction. prisma/prisma#12735 (comment)

This is currently holding me back from looking deeper into Zen as this is a requirement for us. :(

[jiashengguo]

@jasonmacdonald, ZenStack does not use RLS at all. Instead, we use the injected SQL filter to achieve the same authorization ability that RLS could provide. Therefore, for the part you mentioned, it should have the same behavior as Prisma.

[jasonmacdonald]

@jiashengguo So I would have to leave that extension and other code as part of Prisma and not migrate it to Zen as a plugin?

I guess my concern was, if I try to then use transactions in Zen, where I can't use the Array syntax and should use interactive instead, my extension would fail to apply the RLS in the correct transaction. This is due to the bug I linked where Prisma currently requires you to use the Array syntax in order for it to run all "child calls" (those run in query()) in the same transaction.

I hope I'm making sense as it's a little confusing to try and explain.