leocrm/alembic/versions/0101_enable_rls_critical_tables.py

"""Fix RLS on auth tables — disable RLS that was accidentally enabled.

This migration ONLY disables RLS on auth tables and does NOT enable
new RLS. RLS on other tables will be added in a later migration
after the app is confirmed working.

Revision ID: 0101
"""

from alembic import op

revision = "0101"
down_revision = "0100"
branch_labels = None
depends_on = None


def upgrade() -> None:
    # Disable RLS on auth tables (safety measure — these tables must not have RLS)
    op.execute("ALTER TABLE IF EXISTS password_reset_tokens DISABLE ROW LEVEL SECURITY;")
    op.execute("ALTER TABLE IF EXISTS sessions DISABLE ROW LEVEL SECURITY;")
    op.execute("DROP POLICY IF EXISTS password_reset_tokens_tenant_isolation ON password_reset_tokens;")
    op.execute("DROP POLICY IF EXISTS sessions_tenant_isolation ON sessions;")


def downgrade() -> None:
    pass