50 lines
1.5 KiB
Python
50 lines
1.5 KiB
Python
|
"""Fix RLS policies — app.tenant_id → app.current_tenant_id.
|
||
|
|
|
||
|
|
8 RLS policies in production reference 'app.tenant_id' which doesn't exist
|
||
|
|
as a PostgreSQL parameter. The code uses 'app.current_tenant_id'.
|
||
|
|
This causes 500 errors on roles, sequences, wiki, approval_requests,
|
||
|
|
ai_decision_records, and automation_agent_run_steps.
|
||
|
|
|
||
|
|
Revision ID: 0136
|
||
|
|
Revises: 0135
|
||
|
|
Create Date: 2026-08-21
|
||
|
|
"""
|
||
|
|
from alembic import op
|
||
|
|
|
||
|
|
revision = "0136"
|
||
|
|
down_revision = "0135"
|
||
|
|
branch_labels = None
|
||
|
|
depends_on = None
|
||
|
|
|
||
|
|
# All 8 tables with broken RLS policies referencing app.tenant_id
|
||
|
|
TABLES_WITH_BAD_RLS = [
|
||
|
|
"ai_decision_records",
|
||
|
|
"approval_requests",
|
||
|
|
"automation_agent_run_steps",
|
||
|
|
"roles",
|
||
|
|
"sequences",
|
||
|
|
"wiki_articles",
|
||
|
|
"wiki_article_versions",
|
||
|
|
"wiki_categories",
|
||
|
|
]
|
||
|
|
|
||
|
|
|
||
|
|
def upgrade() -> None:
|
||
|
|
for table in TABLES_WITH_BAD_RLS:
|
||
|
|
# Drop old policy with app.tenant_id
|
||
|
|
op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
|
||
|
|
# Create new policy with app.current_tenant_id
|
||
|
|
op.execute(
|
||
|
|
f"CREATE POLICY tenant_isolation ON {table} "
|
||
|
|
f"USING (tenant_id::text = current_setting('app.current_tenant_id', true));"
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def downgrade() -> None:
|
||
|
|
for table in TABLES_WITH_BAD_RLS:
|
||
|
|
op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
|
||
|
|
op.execute(
|
||
|
|
f"CREATE POLICY tenant_isolation ON {table} "
|
||
|
|
f"USING (tenant_id::text = current_setting('app.tenant_id', true));"
|
||
|
|
)
|