From 667df8325a78aedebb0ffefefe7dcc63c1fb6691 Mon Sep 17 00:00:00 2001 From: Marc Villain Date: Tue, 3 Nov 2026 11:36:23 +0100 Subject: [PATCH] docs: which databases run procedures and row security --- docs/security.md | 2 +- docs/writes.md | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/security.md b/docs/security.md index deceef5..d902caf 100644 --- a/docs/security.md +++ b/docs/security.md @@ -87,7 +87,7 @@ createREST({ ## Row security -With Postgres, row security is the strongest perimeter: the database itself hides the rows a session may not see. Connect as a role without `BYPASSRLS`, and set what your policies read in the `transaction` hook: +Row security needs PostgreSQL, or SQL Server with security policies (see [Dialects](./dialects.md#sql-server)). With Postgres, it is the strongest perimeter: the database itself hides the rows a session may not see. Connect as a role without `BYPASSRLS`, and set what your policies read in the `transaction` hook: ```ts async transaction(tx, context) { diff --git a/docs/writes.md b/docs/writes.md index 4285b8c..87f6169 100644 --- a/docs/writes.md +++ b/docs/writes.md @@ -194,6 +194,8 @@ Answer: 409 ## Procedures +PostgreSQL, MySQL and SQL Server run procedures; SQLite has no functions to call. A MySQL function returns a single value, and a SQL Server function cannot change data. + A procedure calls a database function at a path you choose. A `{name}` in the path passes that segment as the argument of the same name; the body's keys pass the others. Arguments are checked by name and type, and one with a default may be left out. A procedure is a POST unless declared `method: 'GET'`. A GET procedure takes its arguments from the query string (`/search?q=milk&limit=10`), each once, and runs in a read-only transaction: use it for a function without side effects.