Skip to content

perf(rls): wrap current_setting() in the generated tenant policy for per-statement evaluation #639

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dmitrymaranik wants to merge 2 commits into
base: main
Choose a base branch
from
Open

perf(rls): wrap current_setting() in the generated tenant policy for per-statement evaluation #639

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
44504db
perf(rls): wrap current_setting() in the generated tenant policy for …
dmitrymaranik Jul 4, 2026
1c29a8e
perf(rls): wrap current_setting() in the generated tenant policy for …
dmitrymaranik Jul 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions crates/ruvector-postgres/src/tenancy/isolation.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,8 +139,8 @@ DROP POLICY IF EXISTS ruvector_admin_bypass ON {table};

-- Create tenant isolation policy
CREATE POLICY ruvector_tenant_isolation ON {table}
USING ({column} = current_setting('ruvector.tenant_id', true))
WITH CHECK ({column} = current_setting('ruvector.tenant_id', true));
USING ({column} = (select current_setting('ruvector.tenant_id', true)))
WITH CHECK ({column} = (select current_setting('ruvector.tenant_id', true)));

-- Create admin bypass policy (for ruvector_admin role)
CREATE POLICY ruvector_admin_bypass ON {table}
Expand All @@ -152,7 +152,7 @@ CREATE POLICY ruvector_admin_bypass ON {table}
-- Create wildcard policy for admin queries
CREATE POLICY ruvector_admin_wildcard ON {table}
FOR SELECT
USING (current_setting('ruvector.tenant_id', true) = '*');
USING ((select current_setting('ruvector.tenant_id', true)) = '*');
"#,
table = quoted_table,
column = quoted_column
Expand Down
24 changes: 12 additions & 12 deletions crates/ruvector-postgres/src/tenancy/rls.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,19 +119,19 @@ impl PolicyTemplate {
match self {
Self::Standard => {
format!(
"{} = current_setting('ruvector.tenant_id', true)",
"{} = (select current_setting('ruvector.tenant_id', true))",
tenant_column
)
}
Self::ReadSharedWriteOwn => {
format!(
"{} = current_setting('ruvector.tenant_id', true) OR is_public = true",
"{} = (select current_setting('ruvector.tenant_id', true)) OR is_public = true",
tenant_column
)
}
Self::Hierarchical { path_column } => {
format!(
"{} LIKE current_setting('ruvector.tenant_id', true) || '%'",
"{} LIKE (select current_setting('ruvector.tenant_id', true)) || '%'",
path_column
)
}
Expand All @@ -140,7 +140,7 @@ impl PolicyTemplate {
retention_days,
} => {
format!(
"{} = current_setting('ruvector.tenant_id', true) AND {} > NOW() - INTERVAL '{} days'",
"{} = (select current_setting('ruvector.tenant_id', true)) AND {} > NOW() - INTERVAL '{} days'",
tenant_column, time_column, retention_days
)
}
Expand All @@ -153,13 +153,13 @@ impl PolicyTemplate {
match self {
Self::Standard | Self::ReadSharedWriteOwn => {
format!(
"{} = current_setting('ruvector.tenant_id', true)",
"{} = (select current_setting('ruvector.tenant_id', true))",
tenant_column
)
}
Self::Hierarchical { .. } => {
format!(
"{} = current_setting('ruvector.tenant_id', true)",
"{} = (select current_setting('ruvector.tenant_id', true))",
tenant_column
)
}
Expand All @@ -168,7 +168,7 @@ impl PolicyTemplate {
retention_days: _,
} => {
format!(
"{} = current_setting('ruvector.tenant_id', true)",
"{} = (select current_setting('ruvector.tenant_id', true))",
tenant_column
)
}
Expand Down Expand Up @@ -198,14 +198,14 @@ impl RlsManager {
pub fn generate_enable_rls_sql(&self, config: &RlsPolicyConfig) -> String {
let using_clause = config.custom_using.clone().unwrap_or_else(|| {
format!(
"{} = current_setting('ruvector.tenant_id', true)",
"{} = (select current_setting('ruvector.tenant_id', true))",
config.tenant_column
)
});

let check_clause = config.custom_with_check.clone().unwrap_or_else(|| {
format!(
"{} = current_setting('ruvector.tenant_id', true)",
"{} = (select current_setting('ruvector.tenant_id', true))",
config.tenant_column
)
});
Expand Down Expand Up @@ -258,7 +258,7 @@ CREATE POLICY {policy}_admin ON {table}
-- Only applies when tenant_id is set to '*'
CREATE POLICY {policy}_wildcard ON {table}
FOR SELECT
USING (current_setting('ruvector.tenant_id', true) = '*');
USING ((select current_setting('ruvector.tenant_id', true)) = '*');
"#,
table = config.table_name,
policy = config.policy_name
Expand Down Expand Up @@ -319,7 +319,7 @@ DROP POLICY IF EXISTS ruvector_tenant_isolation_wildcard ON {table};

/// Generate SQL to get current tenant context
pub fn generate_get_tenant_sql() -> String {
"SELECT current_setting('ruvector.tenant_id', true);".to_string()
"SELECT (select current_setting('ruvector.tenant_id', true));".to_string()
}

/// Register a policy configuration
Expand Down Expand Up @@ -437,7 +437,7 @@ DECLARE
v_tenant_id TEXT;
BEGIN
-- Get current tenant context
v_tenant_id := current_setting('ruvector.tenant_id', true);
v_tenant_id := (select current_setting('ruvector.tenant_id', true));

-- Validate context is set
IF v_tenant_id IS NULL OR v_tenant_id = '' THEN
Expand Down