# Bug 3453: Custom Queries

- Status: closed
- Project: Zero
- Creator: @aboodman
- Labels: zero, zero-cache
- Created: 2025-01-21T00:29:13Z
- Modified: 2025-09-01T09:20:12Z
- Reactions: 👀 ×9 (andreasthoelke, carlosbensant, erlendtryti, franklinjavier, jmcgoldrick, jorroll, mattkinnersley, miguelrk, samohovets) · 👋 ×3 (carlosbensant, franklinjavier, samohovets) · 👍️ ×22 (AdrianoOP, Aexylus, Exerosis, MadeInPierre, SickanK, alamothe, carlosbensant, erlendtryti, fforres, gartz, ictnmd, jakobdybdahl, jmcgoldrick, l0g1x, lukeshay, mattkinnersley, miguelrk, mindreframer, nivekithan, quick007, railaru, samohovets) · 🙏 ×6 (carlosbensant, erlendtryti, gartz, jmcgoldrick, miguelrk, samohovets) · 🥺 ×3 (carlosbensant, erlendtryti, samohovets)
- URL: https://bugs.rocicorp.dev/p/zero/issue/3453

## Description

This would be a dual to [custom mutators](https://bugs.rocicorp.dev/issue/3045).

Custom queries would allow user-provided code to run on the read path server-side to construct a query.  The custom code would return a ZQL expression to zero-cache which would be synced.

This could be useful as an escape hatch when Zero isn't powerful enough to express a query. Custom code could help build the query.

Example:

https://discord.com/channels/830183651022471199/1331027172814491660/1331055669499007007

The real need here is recursive queries. But without recursive queries, if we had subqueries (a simpler and more general feature) then we could use that.

But even without subqueries, if we had "custom" queries then we could figure out all the teams the user is in recursively at request time and generate a simple query that checks just those teams for access.

## Comments (4)

### @railaru — 2025-05-03T10:58:09Z

Great idea! I think this would be super helpful for multi-tenant apps. Personally, I prefer to express permissions in code and custom queries could be a great way to do that.

### @dmsynge — 2025-05-09T05:53:41Z

I like the idea of custom queries, as my use-case involves fairly complex permissions and filtering -- and there have been some queries I think I am unable to express in ZQL for now. I'm working around them, but more powerful query capabilities would be handy and custom queries sounds like a great way to do it. 

I might be alone in this, however, but I quite like the permissions system. It's limited, but getting multi-tenancy security out of the box with a couple of lines of config is pretty awesome. I was able to design parts of my database schema around it, and it's made some fairly complicated features around permissioned access to certain resources absolutely trivial. 

I'm all for the power of custom queries, but I wouldn't want to lose the power of composable permissions filters.

Reactions: 👍️ ×1 (aboodman)

### @aboodman — 2025-05-09T07:24:12Z

The permission system is really just a js library that annotates input queries. You could easily call it to annotate each of your custom queries.

Reactions: 🫡 ×1 (dmsynge)

### @aboodman — 2025-09-01T09:20:12Z

https://zero.rocicorp.dev/docs/synced-queries