From 93dc1008ee3c9de835819bf0c64ff39703c0cca7 Mon Sep 17 00:00:00 2001
From: Hein <hein.puth@gmail.com>
Date: Mon, 10 Aug 2026 20:34:06 +0200
Subject: [PATCH] fix(security): unwrap userRef for non-DB providers

---
 pkg/security/providers.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkg/security/providers.go b/pkg/security/providers.go
index ca6d20f..62097e5 100644
--- a/pkg/security/providers.go
+++ b/pkg/security/providers.go
@@ -912,6 +912,18 @@ func (p *DatabaseRowSecurityProvider) GetRowSecurity(ctx context.Context, userRe
 		return RowSecurity{}, ErrDirectModeUnsupported
 	}
 
+	// resolvespec_row_security's p_user_id is a scalar integer. GetUserRef() may
+	// hand back the full *UserContext so non-DB providers can inspect claims;
+	// unwrap it here before it reaches the SQL args.
+	switch v := userRef.(type) {
+	case *UserContext:
+		if v != nil {
+			userRef = v.UserID
+		}
+	case UserContext:
+		userRef = v.UserID
+	}
+
 	var template string
 	var hasBlock bool