From 945c582b179bc0cb4b7a95a134526eb4fb8c792d Mon Sep 17 00:00:00 2001
From: Dmitry Maranik <40249835+dmitrymaranik@users.noreply.github.com>
Date: Fri, 3 Jul 2026 19:36:10 -0700
Subject: [PATCH 1/4] perf(rls): wrap current_setting() in the generated tenant
 policy for per-statement eval

---
 src/RLS/PolicyManagers/TraitRLSManager.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/RLS/PolicyManagers/TraitRLSManager.php b/src/RLS/PolicyManagers/TraitRLSManager.php
index 52ed15ea..f6cb5060 100644
--- a/src/RLS/PolicyManagers/TraitRLSManager.php
+++ b/src/RLS/PolicyManagers/TraitRLSManager.php
@@ -67,7 +67,7 @@ class TraitRLSManager implements RLSPolicyManager
 
         return <<<SQL
         CREATE POLICY {$table}_rls_policy ON {$table} USING (
-            {$tenantKeyColumn}::text = current_setting('{$sessionTenantKey}')
+            {$tenantKeyColumn}::text = (select current_setting('{$sessionTenantKey}'))
         );
         SQL;
     }
@@ -87,7 +87,7 @@ class TraitRLSManager implements RLSPolicyManager
             {$parentRelationship->getForeignKeyName()} IN (
                 SELECT {$parent->getKeyName()}
                 FROM {$parent->getTable()}
-                WHERE {$tenantKeyColumn}::text = current_setting('{$sessionTenantKey}')
+                WHERE {$tenantKeyColumn}::text = (select current_setting('{$sessionTenantKey}'))
             )
         );
         SQL;

From 7a1a2162ac8a5f48baf92d2cdb155d924ba803ca Mon Sep 17 00:00:00 2001
From: Dmitry Maranik <40249835+dmitrymaranik@users.noreply.github.com>
Date: Fri, 3 Jul 2026 19:36:11 -0700
Subject: [PATCH 2/4] perf(rls): wrap current_setting() in the generated tenant
 policy for per-statement eval

---
 src/RLS/PolicyManagers/TableRLSManager.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/RLS/PolicyManagers/TableRLSManager.php b/src/RLS/PolicyManagers/TableRLSManager.php
index 3f87bf3e..64b0334c 100644
--- a/src/RLS/PolicyManagers/TableRLSManager.php
+++ b/src/RLS/PolicyManagers/TableRLSManager.php
@@ -528,7 +528,7 @@ class TableRLSManager implements RLSPolicyManager
 
             if ($table === tenancy()->model()->getTable()) {
                 // Convert tenant key to text to match the session variable type
-                $query .= "{$column}::text = current_setting('{$sessionTenantKey}')\n";
+                $query .= "{$column}::text = (select current_setting('{$sessionTenantKey}'))\n";
                 continue;
             }
 

From a09ea639671f44a264c67a797f067e85bdbef451 Mon Sep 17 00:00:00 2001
From: Dmitry Maranik <40249835+dmitrymaranik@users.noreply.github.com>
Date: Fri, 3 Jul 2026 19:36:12 -0700
Subject: [PATCH 3/4] perf(rls): wrap current_setting() in the generated tenant
 policy for per-statement eval

---
 tests/RLS/TraitManagerTest.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/RLS/TraitManagerTest.php b/tests/RLS/TraitManagerTest.php
index b88b147b..23835194 100644
--- a/tests/RLS/TraitManagerTest.php
+++ b/tests/RLS/TraitManagerTest.php
@@ -279,7 +279,7 @@ test('trait rls manager generates queries correctly', function() {
     expect($manager->generateQueries())->toContain(
         <<<SQL
         CREATE POLICY posts_rls_policy ON posts USING (
-            tenant_id::text = current_setting('my.current_tenant')
+            tenant_id::text = (select current_setting('my.current_tenant'))
         );
         SQL,
         <<<SQL
@@ -287,7 +287,7 @@ test('trait rls manager generates queries correctly', function() {
             post_id IN (
                 SELECT id
                 FROM posts
-                WHERE tenant_id::text = current_setting('my.current_tenant')
+                WHERE tenant_id::text = (select current_setting('my.current_tenant'))
             )
         );
         SQL,

From 61410b52d44e4b3e2a1872d431b41bc86b6d5450 Mon Sep 17 00:00:00 2001
From: Dmitry Maranik <40249835+dmitrymaranik@users.noreply.github.com>
Date: Fri, 3 Jul 2026 19:36:14 -0700
Subject: [PATCH 4/4] perf(rls): wrap current_setting() in the generated tenant
 policy for per-statement eval

---
 tests/RLS/TableManagerTest.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/RLS/TableManagerTest.php b/tests/RLS/TableManagerTest.php
index c5c8d254..a1592f6f 100644
--- a/tests/RLS/TableManagerTest.php
+++ b/tests/RLS/TableManagerTest.php
@@ -582,7 +582,7 @@ test('table rls manager generates queries correctly', function() {
     expect(array_values(app(TableRLSManager::class)->generateQueries()))->toEqualCanonicalizing([
         <<<SQL
         CREATE POLICY authors_rls_policy ON authors USING (
-            tenant_id::text = current_setting('my.current_tenant')
+            tenant_id::text = (select current_setting('my.current_tenant'))
         );
         SQL,
         <<<SQL
@@ -590,7 +590,7 @@ test('table rls manager generates queries correctly', function() {
             author_id IN (
                 SELECT id
                 FROM authors
-                WHERE tenant_id::text = current_setting('my.current_tenant')
+                WHERE tenant_id::text = (select current_setting('my.current_tenant'))
             )
         );
         SQL,
@@ -602,7 +602,7 @@ test('table rls manager generates queries correctly', function() {
                 WHERE author_id IN (
                     SELECT id
                     FROM authors
-                    WHERE tenant_id::text = current_setting('my.current_tenant')
+                    WHERE tenant_id::text = (select current_setting('my.current_tenant'))
                 )
             )
         );
@@ -652,7 +652,7 @@ test('table rls manager generates queries correctly', function() {
     expect(app(TableRLSManager::class)->generateQueries($paths))->toContain(
         <<<SQL
         CREATE POLICY primaries_rls_policy ON primaries USING (
-            tenant_id::text = current_setting('my.current_tenant')
+            tenant_id::text = (select current_setting('my.current_tenant'))
         );
         SQL,
         <<<SQL
@@ -660,7 +660,7 @@ test('table rls manager generates queries correctly', function() {
             primary_id IN (
                 SELECT id
                 FROM primaries
-                WHERE tenant_id::text = current_setting('my.current_tenant')
+                WHERE tenant_id::text = (select current_setting('my.current_tenant'))
             )
         );
         SQL,
@@ -672,7 +672,7 @@ test('table rls manager generates queries correctly', function() {
                 WHERE primary_id IN (
                     SELECT id
                     FROM primaries
-                    WHERE tenant_id::text = current_setting('my.current_tenant')
+                    WHERE tenant_id::text = (select current_setting('my.current_tenant'))
                 )
             )
         );