Your First Policy

This example allows administrators to read every orders field while regular users may read selected fields only on their own rows.

const structure = {
  orders: {
    table: orders,
    endpoints: [
      {
        type: "GET",
        admin: ALL,
        user: {
          allowed: {
            field: ["id", "status", "total", "user_id"],
            where: {
              field: "orders.user_id",
              operator: "=",
              value: "$user.id"
            }
          },
          disallowed: []
        },
        guest: NONE
      }
    ]
  }
};

The endpoint selects the operation (GET). The role selects one permission object. allowed.field defines the readable columns, while allowed.where contributes an authorization constraint. NONE rejects the guest role.

const request = {
  table: "orders",
  type: "GET",
  select: ["orders.id", "orders.status", "orders.total"]
};

const plan = await compile(db, request, { id: 42 }, "user", structure);
const result = await plan.execute();

Conceptually, the user context turns the policy into an ownership filter equivalent to orders.user_id = 42. The exact SQL is generated by Drizzle and varies by database driver.

← Explore the Demo · From Request to SQL →