69 lines
2.5 KiB
Python
69 lines
2.5 KiB
Python
|
"""Disable RLS on all system/auth/config/plugin tables for crm_api startup.
|
||
|
|
|
||
|
|
This migration disables RLS on all tables that are accessed during
|
||
|
|
startup, login, or plugin activation — before a tenant context is set.
|
||
|
|
RLS remains active only on business-data tables (contacts, addresses,
|
||
|
|
attachments, etc.) where tenant context is always set before access.
|
||
|
|
|
||
|
|
Revision ID: 0081
|
||
|
|
Revises: 0080
|
||
|
|
"""
|
||
|
|
from alembic import op
|
||
|
|
from sqlalchemy import text
|
||
|
|
|
||
|
|
revision = "0081"
|
||
|
|
down_revision = "0080"
|
||
|
|
branch_labels = None
|
||
|
|
depends_on = None
|
||
|
|
|
||
|
|
TABLES = [
|
||
|
|
"users", "tenants", "user_tenants", "sessions",
|
||
|
|
"audit_log", "user_groups", "permissions",
|
||
|
|
"password_reset_tokens", "api_tokens",
|
||
|
|
"groups", "roles", "system_settings",
|
||
|
|
"currencies", "tax_rates", "sequences",
|
||
|
|
"saved_filters", "saved_views", "webhooks",
|
||
|
|
"notification_preferences", "tenant_plugin_activation",
|
||
|
|
"workspaces", "workspace_modules", "workspace_users", "workspace_widgets",
|
||
|
|
"automation_cron_jobs", "automation_definitions",
|
||
|
|
"automation_runs", "automation_versions",
|
||
|
|
"automation_agent_definitions", "automation_agent_runs",
|
||
|
|
"automation_agent_versions", "plugins",
|
||
|
|
"user_preferences", "custom_field_definitions",
|
||
|
|
"deletion_log", "backups", "share_links",
|
||
|
|
"unified_search_index_log", "unified_search_providers",
|
||
|
|
"mcp_server_configs", "plugin_test_data",
|
||
|
|
"report_templates", "report_instances",
|
||
|
|
"resource_bookings", "resources",
|
||
|
|
"vacation_sent_log", "pgp_keys",
|
||
|
|
"contact_pgp_keys", "contact_merge_history",
|
||
|
|
"entity_links", "entity_history",
|
||
|
|
"contact_folder_permissions", "contact_folders",
|
||
|
|
"guest_users", "guest_invitations",
|
||
|
|
"permission_delegations", "permission_templates",
|
||
|
|
"consumer_inbox", "outbox_deliveries",
|
||
|
|
"event_outbox", "entity_permissions", "entity_policies",
|
||
|
|
"entity_attachments", "files", "folders",
|
||
|
|
"tags", "tag_assignments", "tasks", "subtasks",
|
||
|
|
]
|
||
|
|
|
||
|
|
def upgrade() -> None:
|
||
|
|
conn = op.get_bind()
|
||
|
|
for table in TABLES:
|
||
|
|
exists = conn.execute(
|
||
|
|
text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
|
||
|
|
).fetchone() is not None
|
||
|
|
if not exists:
|
||
|
|
continue
|
||
|
|
# Drop all RLS policies
|
||
|
|
policies = conn.execute(text(
|
||
|
|
f"SELECT policyname FROM pg_policies WHERE tablename = '{table}'"
|
||
|
|
)).fetchall()
|
||
|
|
for (policyname,) in policies:
|
||
|
|
conn.execute(text(f"DROP POLICY IF EXISTS {policyname} ON {table}"))
|
||
|
|
conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
|
||
|
|
|
||
|
|
|
||
|
|
def downgrade() -> None:
|
||
|
|
pass
|