Skip to content

Table of Contents

django_rls

django_rls.resolvers

default_request_user_resolver

def default_request_user_resolver(request: Any) -> Dict[str, RLSValue]

Default RLS resolver for standard Django requests in REQUEST_RESOLVER.

Dynamically builds a dict based on the fields in RLS_FIELDS. Extracts the value directly from request.user.{field} - fields must map exactly.

If user is not authenticated or a field doesn't exist, returns RlsWildcard.NONE for that field.

default_rls_bypass_check

def default_rls_bypass_check(request: Any) -> bool

Returns True if the current request's user is a superuser. Default for BYPASS_CHECK_RESOLVER.

strawberry_context_user_resolver

def strawberry_context_user_resolver(info: Any) -> Dict[str, RLSValue]

Strawberry GraphQL version of the default resolver.

Reads info.context.user and resolves all RLS_FIELDS dynamically. Fields must map exactly to user attributes - no fallback logic.

strawberry_rls_bypass_check

def strawberry_rls_bypass_check(info: Any) -> bool

Returns True if the info.context.user is a superuser. Intended for use as a BYPASS_CHECK_RESOLVER.

django_rls.utils

get_field_sql_type

def get_field_sql_type(model: models.Model, field_name: str) -> str

Maps Django field types to PostgreSQL SQL types for RLS policy generation.

Arguments:

  • model - The Django model instance
  • field_name - Name of the field to get the SQL type for

Returns:

PostgreSQL SQL type string (e.g., 'int', 'uuid', 'text')

Raises:

  • FieldDoesNotExist - If the field does not exist on the model

build_rls_using_clause

def build_rls_using_clause(fields: List[str], field_types: Dict[str, str],
                           session_prefix: str) -> str

Constructs the RLS USING clause with wildcard and null handling for each field.

Each field is wrapped in a CASE statement that handles: - NULL session variables (returns FALSE) - Empty strings (returns FALSE) - RlsWildcard.NONE (returns FALSE) - RlsWildcard.ALL (returns TRUE - bypasses RLS) - Normal values (compares field to session variable)

Arguments:

  • fields - List of field names to include in the RLS policy
  • field_types - Dictionary mapping field names to their PostgreSQL SQL types
  • session_prefix - Prefix for session variables (typically "rls")

Returns:

SQL string containing the USING clause for the RLS policy

django_rls.settings

django_rls.constants

django_rls.apps

django_rls.middleware

RLSMiddleware Objects

class RLSMiddleware(MiddlewareMixin)

Middleware that sets PostgreSQL session variables based on RLS context.

  • If BYPASS_CHECK_RESOLVER returns True, sets all session vars to RlsWildcard.ALL.
  • Otherwise uses VALUE_RESOLVER to fetch per-field RLS values.
  • Only sets session vars for fields in RLS_FIELDS.

These variables are used in PostgreSQL RLS policies with current_setting().

django_rls.exceptions

django_rls.admin

django_rls.settings_type

DjangoRLSSettings Objects

@dataclass
class DjangoRLSSettings()

DjangoRLSSettings

Configuration for enabling PostgreSQL Row-Level Security (RLS) across selected Django models, with enforcement scoped by model fields and session variables.

This includes dynamic policy generation, session binding, and model auto-filling.

RLS_FIELDS

A list of field names to be set as PostgreSQL session variables. These fields are extracted from the user/context by REQUEST_RESOLVER and set as rls.field_name in the database session.

Example:

RLS_FIELDS = ["tenant_id", "user_id"]

TENANT_APPS

List of app labels where all models should be treated as tenant-specific. When using add_rls, models in these apps will automatically default to using tenant_id for RLS if the field exists.

REQUEST_RESOLVER

A function that returns the current RLS context to set into PostgreSQL session variables.

Example return: { "user_id": 1, "tenant_id": 4, "public":true, }

This value is used for: - Setting session variables like SET rls.tenant_id = 123 - Auto-filling fields on models if AUTO_SET_FIELDS = True

You can plug in a Django request-based or Strawberry GraphQL resolver here.

BYPASS_CHECK_RESOLVER

Optional function to determine if RLS should be bypassed entirely for a request or context.

If this returns True, all fields in RLS_FIELDS will be set to RlsWildcard.ALL.

Example use case: - Allow superusers to bypass RLS enforcement - Allow specific IPs or roles to see all data

AUTO_SET_FIELDS

If True, models in TENANT_APPS will have their RLS fields automatically set on creation/save based on the current session context (as resolved by REQUEST_RESOLVER).

For example, if a model requires tenant_id and user_id, and the current session provides:

Then calling model.save() will auto-fill these fields before validation (unless explicitly set). This helps prevent accidental leaks or incomplete data in a multi-tenant system.

SKIP_MODELS

Optional list of model paths (e.g., "app.Model") to explicitly exclude from AUTO_SET_FIELDS even if they are in TENANT_APPS.

Example:

SKIP_MODELS = [ "core.AuditLog", "sessions.Session" ]

SESSION_NAMESPACE_PREFIX

Prefix for PostgreSQL session variables used in current_setting().

Changing this will break existing RLS policies unless manually updated.

USE_DB_MIGRATION_USER

If True, migrations (and potentially startup checks) that apply RLS policies will explicitly use the MIGRATION_USER and MIGRATION_PASSWORD credentials.

This ensures that runtime roles (used by the app) are properly enforced by RLS as they are not the owner of the RLS policy.

MIGRATION_USER

Username of the dedicated RLS-safe migration user.

This user must: - Have sufficient privileges to create policies - Be separate from the app's runtime role

MIGRATION_PASSWORD

Password for the MIGRATION_USER.

django_rls.migration_hook

django_rls.migrations

RunDynamicSQL Objects

class RunDynamicSQL(Operation)

A custom migration operation that generates SQL at runtime.

This operation is used to create and drop RLS policies dynamically. The SQL is generated by the provided functions at migration time, allowing for dynamic table and policy name resolution.

Arguments:

  • create_func - A callable that takes a schema_editor and returns SQL string to create the RLS policy.
  • drop_func - A callable that takes a schema_editor and returns SQL string to drop the RLS policy.

django_rls.management.commands.add_rls

django_rls.management.commands.makemigrations

django_rls.management.commands

django_rls.management