fix(security): change types for template and hasBlock

fix(security): unwrap userRef for non-DB providers
2026-08-13 21:06:07 +00:00 · 2026-08-10 20:46:40 +02:00 · 2026-08-10 20:34:06 +02:00
1 changed files with 16 additions and 4 deletions
@@ -912,8 +912,20 @@ func (p *DatabaseRowSecurityProvider) GetRowSecurity(ctx context.Context, userRe
 		return RowSecurity{}, ErrDirectModeUnsupported
 	}

-	var template string
-	var hasBlock bool
+	// resolvespec_row_security's p_user_id is a scalar integer. GetUserRef() may
+	// hand back the full *UserContext so non-DB providers can inspect claims;
+	// unwrap it here before it reaches the SQL args.
+	switch v := userRef.(type) {
+	case *UserContext:
+		if v != nil {
+			userRef = v.UserID
+		}
+	case UserContext:
+		userRef = v.UserID
+	}
+
+	var template sql.NullString
+	var hasBlock sql.NullBool

 	runQuery := func() error {
 		query := fmt.Sprintf(`SELECT p_template, p_block FROM %s($1, $2, $3)`, p.sqlNames.RowSecurity)
@@ -933,8 +945,8 @@ func (p *DatabaseRowSecurityProvider) GetRowSecurity(ctx context.Context, userRe
 		Schema:    schema,
 		Tablename: table,
 		UserID:    userRef,
-		Template:  template,
-		HasBlock:  hasBlock,
+		Template:  template.String,
+		HasBlock:  hasBlock.Bool,
 	}, nil
 }
Author	SHA1	Message	Date
warkanum	0261f121e8	fix(security): change types for template and hasBlock Tests / Unit Tests (push) Failing after 19s Details Tests / Integration Tests (push) Failing after 30s Details Build , Vet Test, and Lint / Run Vet Tests (1.23.x) (push) Failing after 39s Details Build , Vet Test, and Lint / Lint Code (push) Successful in 3m45s Details Build , Vet Test, and Lint / Run Vet Tests (1.24.x) (push) Successful in 3m47s Details Build , Vet Test, and Lint / Build (push) Successful in 3m47s Details	2026-08-10 20:46:40 +02:00
warkanum	93dc1008ee	fix(security): unwrap userRef for non-DB providers	2026-08-10 20:34:06 +02:00