Why does DEFINE SCOPE fail on SurrealDB 3?

DEFINE SCOPE or DEFINE TOKEN

Critical: SurrealDB refuses the migration, loses data, or leaks a credential.

What happens

Observed on SurrealDB 3.0.2: DEFINE SCOPE and DEFINE TOKEN are parse errors ("expected a define statement keyword"), so the whole file fails before any statement runs.

Why it is dangerous on a populated table

Table size does not change this one: on SurrealDB 3 the file does not parse, so nothing in it runs, in any environment.

Fires on

DEFINE SCOPE account SESSION 24h SIGNIN (SELECT * FROM user WHERE email = $email);

The safe pattern

DEFINE ACCESS account ON DATABASE TYPE RECORD SIGNIN (SELECT * FROM user WHERE email = $email AND crypto::argon2::compare(pass, $pass)) DURATION FOR SESSION 24h;

Fixtures

The rule ships with these files and the test suite runs them on every change: the first set must fire, the second must stay silent.

DEFINE SCOPE account SESSION 24h SIGNIN (SELECT * FROM user WHERE email = $email);

DEFINE TOKEN legacy ON DATABASE TYPE RS256 VALUE '-----BEGIN PUBLIC KEY-----MIIBIjAN';

DEFINE ACCESS api ON DATABASE TYPE JWT URL 'https://auth.example.com/.well-known/jwks.json';

DEFINE ACCESS account ON DATABASE TYPE RECORD SIGNIN (SELECT * FROM user WHERE email = $email AND crypto::argon2::compare(pass, $pass)) DURATION FOR SESSION 24h;

How to check locally

npx bolvrk check migration.surql --engine=surrealdb