Building Composable RLS: Enterprise Data Security on Autopilot

The RLS Contract: IProtected

This article details an approach to automatically enforcing Row-Level Security (RLS) in enterprise applications, building upon a composable Data Access Layer (DAL). The system ensures that queries return only records accessible to the authenticated user, even with complex joins, by introducing the IProtected interface.

Why This Matters

Manually implementing RLS is complex and prone to errors, potentially exposing sensitive data and violating compliance requirements; security breaches can cost organizations millions in fines and reputational damage. This approach shifts the security burden from application code to a robust DAL framework, reducing risk and development time.

Key Insights

• Ulid? UserId in IDbCtx: Represents the authenticated user’s identifier, central to the RLS implementation.
• IProtected interface: Defines the contract for entities requiring RLS, simplifying security logic.
• Projected Permissions: Enables hierarchical security, allowing entities to inherit permissions from parent entities.

Working Example

[EntityFilter<IProtected>(nameof(Filter))]
public interface IProtected
{
    // The entity must expose the ID used for the permission check.
    Ulid GetPermissionObjectId();
    // Filter method dynamically applies an INNER JOIN to permissions table.
}

public partial class Comment : IProtected
{
    // Tells the RLS filter to use the Post ID for the security check.
    [ExpressionMethod(nameof(GetPermissionObjectIdExpression))]
    public Ulid GetPermissionObjectId() => Post.Id;
    private static Expression<Func<Comment, Ulid>> GetPermissionObjectIdExpression()
        => x => x.Post.Id;
}

Practical Applications

• Multi-tenant SaaS: Automatically isolates data between tenants, ensuring each customer only accesses their own records.
• Healthcare Data: Enforces HIPAA compliance by restricting access to patient records based on user roles and permissions.

References:

• https://dev.to/gigaherz/building-composable-rls-enterprise-data-security-on-autopilot-abj