{"id":43119656,"url":"https://github.com/s1owjke/prisma-rls","last_synced_at":"2026-01-31T19:11:21.210Z","repository":{"id":255441800,"uuid":"805892495","full_name":"s1owjke/prisma-rls","owner":"s1owjke","description":"Prisma client extension for row-level security on any database","archived":false,"fork":false,"pushed_at":"2025-10-15T12:20:47.000Z","size":113,"stargazers_count":9,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-10-16T15:57:12.371Z","etag":null,"topics":["database","prisma","prisma-client","prisma-extension","rls","row-level-security"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/s1owjke.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-05-25T19:06:59.000Z","updated_at":"2025-10-15T12:19:12.000Z","dependencies_parsed_at":"2025-09-09T22:24:03.654Z","dependency_job_id":"26ff96fc-fd2d-4cae-94b6-7110f9ae5867","html_url":"https://github.com/s1owjke/prisma-rls","commit_stats":null,"previous_names":["s1owjke/prisma-extension-rls"],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/s1owjke/prisma-rls","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1owjke%2Fprisma-rls","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1owjke%2Fprisma-rls/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1owjke%2Fprisma-rls/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1owjke%2Fprisma-rls/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/s1owjke","download_url":"https://codeload.github.com/s1owjke/prisma-rls/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1owjke%2Fprisma-rls/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28950631,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-31T18:30:42.805Z","status":"ssl_error","status_checked_at":"2026-01-31T18:30:19.593Z","response_time":128,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["database","prisma","prisma-client","prisma-extension","rls","row-level-security"],"created_at":"2026-01-31T19:11:20.800Z","updated_at":"2026-01-31T19:11:21.204Z","avatar_url":"https://github.com/s1owjke.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Prisma RLS\n\n[![Published on npm](https://img.shields.io/npm/v/prisma-rls?color=brightgreen)](https://www.npmjs.com/package/prisma-rls) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)\n\nRow-Level Security (RLS) traditionally requires databases with native support and custom security policies for each table.\n\nThis library provides an alternative: a Prisma client extension that automatically adds \"where\" clauses to all model queries. This method works without database-side RLS support (e.g., in MySQL).\n\nNote that this extension doesn't apply to raw queries. For those, you must handle them manually or choose database with built-in support.\n\n## Quick start\n\nDefine shared types:\n\n```typescript\nimport { Prisma, User } from \"@prisma/client\";\nimport { PermissionsConfig } from \"prisma-rls\";\n\nexport type Role = \"User\" | \"Guest\";\nexport type PermissionsContext = { user: User | null };\nexport type RolePermissions = PermissionsConfig\u003cPrisma.TypeMap, PermissionsContext\u003e;\nexport type PermissionsRegistry = Record\u003cRole, RolePermissions\u003e;\n```\n\nDefine permissions for each model in your schema, they also can be a function:\n\n```typescript\nimport { RolePermissions } from \"./types\";\n\nexport const User: RolePermissions = {\n  Post: {\n    read: { published: { equals: true } },\n    create: true,\n    update: (permissionContext) =\u003e ({\n      author: {\n        id: { equals: permissionContext.user.id },\n      },\n    }),\n    delete: (permissionContext) =\u003e ({\n      author: {\n        id: { equals: permissionContext.user.id },\n      },\n    }),\n  },\n  User: {\n    read: (permissionContext) =\u003e ({\n      id: { equals: permissionContext.user.id },\n    }),\n    create: false,\n    update: (permissionContext) =\u003e ({\n      id: { equals: permissionContext.user.id },\n    }),\n    delete: false,\n  },\n}\n```\n\nIn most cases, you will have multiple roles. To define them in a type-safe manner, follow this pattern:\n\n```typescript\nimport { guest } from \"./guest\";\nimport { user } from \"./user\";\nimport { PermissionsRegistry } from \"./types\";\n\nexport const permissionsRegistry = {\n  User: user,\n  Guest: guest,\n} satisfies PermissionsRegistry;\n```\n\nPrisma extensions don't support dynamic contexts, so create an extension per context:\n\n```typescript\nimport { Prisma, PrismaClient } from \"@prisma/client\";\nimport Fastify, { FastifyRequest } from \"fastify\";\nimport { createRlsExtension } from \"prisma-rls\";\n\nimport { permissionsRegistry, PermissionsContext } from \"./permissions\";\n\n(async () =\u003e {\n  const prisma = new PrismaClient();\n  const server = Fastify();\n\n  const resolveRequestConext = async (request: FastifyRequest) =\u003e {\n    const user = await resolveUser(request.headers.authorization);\n    const userRole = user ? user.role : \"Guest\";\n    \n    const permissionsContext: PermissionsContext = { user };\n\n    const rlsExtension = createRlsExtension({\n      dmmf: Prisma.dmmf,\n      permissionsConfig: permissionsRegistry[userRole],\n      context: permissionsContext,\n    });\n\n    return { db: prisma.$extends(rlsExtension) };\n  };\n\n  server.get(\"/user/list\", async function handler(request, reply) {\n    const { db } = resolveRequestConext(request);\n    return await db.user.findMany();\n  });\n\n  await server.listen({ port: 8080, host: \"0.0.0.0\" });\n})();\n```\n\nAfter that, all non-raw queries will be executed according to the defined permissions.\n\n## Edge cases\n\nAt the moment there is only a known edge case.\n\n### Required belongs-to\n\nAn edge case affects all mandatory belongs-to relations on the owner side (the entity owns the foreign key). \n\nIn these cases, Prisma does not generate filters due to potential referential integrity violations. For performance reasons, no additional checks are applied by default. However, you can change this behavior by enabling the `checkRequiredBelongsTo` flag:\n\n```typescript\nconst rlsExtension = createRlsExtension({\n  dmmf: Prisma.dmmf,\n  permissionsConfig: permissionsRegistry[userRole],\n  context: permissionsContext,\n  checkRequiredBelongsTo: true,\n});\n```\n\nWhen `checkRequiredBelongsTo` is set to true, the library performs an additional query for each required belongs-to relation (it makes one batched request per relation, not per record) to verify that all data complies with the current permissions.\n\nIf the policy restricts data access, an error will be thrown, this error should be handled at the application level:\n\n```typescript\nimport { ReferentialIntegrityError } from \"prisma-rls\";\n\ntry {\n  return await db.post.findMany({ \n    select: { id: true, category: { select: { id: true } } }\n  });\n} catch (error) {\n  if (error instanceof ReferentialIntegrityError) {\n    return [];\n  }\n  \n  throw error;\n}\n```\n\nAlternatively, you can consider the following options:\n\n- Make them optional - keep the foreign keys required but define the relationships as optional\n- Handle at the policy level - apply consistent policy filters to restrict access to both sides of relation\n\n### Edge runtime\n\nWhen prisma is built for edge runtimes such as cloudflare workers, it no longer exposes the `dmmf` property. To work around this, you can use the [Pothos generator](https://pothos-graphql.dev/docs/plugins/prisma/setup#edge-run-times) to generate a compatible datamodel.\n\n```prisma\ngenerator pothos {\n  provider          = \"prisma-pothos-types\"\n  clientOutput      = \"@prisma/client\"\n  output            = \"./pothos-types.ts\"\n  generateDatamodel = true\n}\n```\n\nThe only change you need to make is replacing the `dmmf` property source, everything else remains the same:\n\n```typescript\nimport { getDatamodel } from \"@pothos/plugin-prisma/generated\";\n\nconst rlsExtension = createRlsExtension({\n  dmmf: {\n    datamodel: {\n      models: Object.entries(getDatamodel()[\"datamodel\"][\"models\"]).map(([name, model]) =\u003e ({ ...model, name })),\n    },\n  },\n});\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fs1owjke%2Fprisma-rls","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fs1owjke%2Fprisma-rls","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fs1owjke%2Fprisma-rls/lists"}