fix: recreate policy when removing WITH CHECK clause (#551)

internal/diff/policy.go

@@ -254,6 +254,14 @@ func needsRecreate(old, new *ir.RLSPolicy) bool {
 	if old.Permissive != new.Permissive {
 		return true
 	}
+	// PostgreSQL ALTER POLICY cannot clear an existing USING or WITH CHECK
+	// clause, so removing either requires DROP + CREATE.
+	if old.Using != "" && new.Using == "" {
+		return true
+	}
+	if old.WithCheck != "" && new.WithCheck == "" {
+		return true
+	}
 	// All other changes (roles, using, with_check) can use ALTER POLICY
 	return false
 }

internal/diff/table.go

@@ -1661,6 +1661,19 @@ func (td *tableDiff) generateAlterTableStatements(targetSchema string, collector
 				CanRunInTransaction: true,
 			}
 			collector.collect(context, sql)
+
+			if policyDiff.New.Comment != "" {
+				sql = fmt.Sprintf("COMMENT ON POLICY %s ON %s IS %s;",
+					ir.QuoteIdentifier(policyDiff.New.Name), tableName, quoteString(policyDiff.New.Comment))
+				context = &diffContext{
+					Type:                DiffTypeTablePolicy,
+					Operation:           DiffOperationAlter,
+					Path:                fmt.Sprintf("%s.%s.%s", td.Table.Schema, td.Table.Name, policyDiff.New.Name),
+					Source:              policyDiff,
+					CanRunInTransaction: true,
+				}
+				collector.collect(context, sql)
+			}
 		} else {
 			// Use ALTER POLICY for simple changes
 			sql := generateAlterPolicySQL(policyDiff.Old, policyDiff.New, targetSchema)

testdata/diff/create_policy/issue_551_remove_with_check/diff.sql

@@ -0,0 +1,3 @@
+DROP POLICY IF EXISTS agents_app_tenant ON agents;
+
+CREATE POLICY agents_app_tenant ON agents TO PUBLIC USING (organization_id = '00000000-0000-0000-0000-000000000001'::uuid);

testdata/diff/create_policy/issue_551_remove_with_check/new.sql

@@ -0,0 +1,11 @@
+CREATE TABLE public.agents (
+    id integer PRIMARY KEY,
+    organization_id uuid NOT NULL
+);
+
+ALTER TABLE public.agents ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY agents_app_tenant ON public.agents
+    FOR ALL
+    TO PUBLIC
+    USING (organization_id = '00000000-0000-0000-0000-000000000001'::uuid);

testdata/diff/create_policy/issue_551_remove_with_check/old.sql

@@ -0,0 +1,12 @@
+CREATE TABLE public.agents (
+    id integer PRIMARY KEY,
+    organization_id uuid NOT NULL
+);
+
+ALTER TABLE public.agents ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY agents_app_tenant ON public.agents
+    FOR ALL
+    TO PUBLIC
+    USING (organization_id = '00000000-0000-0000-0000-000000000001'::uuid)
+    WITH CHECK (organization_id = '00000000-0000-0000-0000-000000000001'::uuid);

testdata/diff/create_policy/issue_551_remove_with_check/plan.json

@@ -0,0 +1,26 @@
+{
+  "version": "1.0.0",
+  "pgschema_version": "1.12.3",
+  "created_at": "1970-01-01T00:00:00Z",
+  "source_fingerprint": {
+    "hash": "7c89eec1e4bb170bbbca9ed7028bf15211414531ee74b300818acb7766d84b45"
+  },
+  "groups": [
+    {
+      "steps": [
+        {
+          "sql": "DROP POLICY IF EXISTS agents_app_tenant ON agents;",
+          "type": "table.policy",
+          "operation": "drop",
+          "path": "public.agents.agents_app_tenant"
+        },
+        {
+          "sql": "CREATE POLICY agents_app_tenant ON agents TO PUBLIC USING (organization_id = '00000000-0000-0000-0000-000000000001'::uuid);",
+          "type": "table.policy",
+          "operation": "create",
+          "path": "public.agents.agents_app_tenant"
+        }
+      ]
+    }
+  ]
+}

testdata/diff/create_policy/issue_551_remove_with_check/plan.sql

@@ -0,0 +1,3 @@
+DROP POLICY IF EXISTS agents_app_tenant ON agents;
+
+CREATE POLICY agents_app_tenant ON agents TO PUBLIC USING (organization_id = '00000000-0000-0000-0000-000000000001'::uuid);

testdata/diff/create_policy/issue_551_remove_with_check/plan.txt

@@ -0,0 +1,16 @@
+Plan: 1 to modify.
+
+Summary by type:
+  tables: 1 to modify
+
+Tables:
+  ~ agents
+    - agents_app_tenant (policy)
+    + agents_app_tenant (policy)
+
+DDL to be executed:
+--------------------------------------------------
+
+DROP POLICY IF EXISTS agents_app_tenant ON agents;
+
+CREATE POLICY agents_app_tenant ON agents TO PUBLIC USING (organization_id = '00000000-0000-0000-0000-000000000001'::uuid);