drizzle-queries

Drizzle Query Patterns

Guidelines for writing consistent and secure Drizzle ORM queries with RLS.

Overview

This rule defines patterns for writing Drizzle ORM queries and mutations that respect Row Level Security (RLS) policies.

actions:

• type: suggest message: | When writing Drizzle queries:

  1. Query Structure:

  // ✅ DO: Use simple, direct queries with RLS
  export async function getItems() {
    const db = await createDrizzleSupabaseClient()
    const result = await db.rls(async (tx) => {
      return await tx.select().from(items)
    })
    return result
  }
  
  // ❌ DON'T: Add unnecessary complexity or manual auth checks
  export async function getItems() {
    const supabase = await createClient() // ❌ Don't use Supabase client directly
    const { data: { user } } = await supabase.auth.getUser()
    if (!user) throw new Error('Not authenticated')
    // ... more unnecessary checks
  }
  

  1. Mutations:

  // ✅ DO: Return the mutated record when possible
  export async function createItem(data: NewItem) {
    const db = await createDrizzleSupabaseClient()
    const result = await db.rls(async (tx) => {
      const [item] = await tx.insert(items)
        .values(data)
        .returning()
      return item
    })
    return result
  }
  
  // ❌ DON'T: Return void or boolean when you can return the record
  export async function createItem(data: NewItem) {
    const db = await createDrizzleSupabaseClient()
    await db.rls(async (tx) => {
      await tx.insert(items).values(data)
    })
    return true // ❌ Less useful than returning the record
  }