81 lines
2.7 KiB
Python
81 lines
2.7 KiB
Python
|
"""Converged DELETE grants (F20/Astra).
|
||
|
|
|
||
|
|
Removes the effect of the blanket ``GRANT DELETE ON ALL TABLES`` that
|
||
|
|
prestart.sh applied on every boot — which silently undid migration
|
||
|
|
0100's protections on every container start.
|
||
|
|
|
||
|
|
Documented target state:
|
||
|
|
|
||
|
|
Runtime-legitimate DELETEs (crm_api only):
|
||
|
|
- users, user_tenants (user deletion on last membership, BUG-030)
|
||
|
|
- sessions (logout session invalidation)
|
||
|
|
- plugins, notification_types (plugin uninstall + registry sync)
|
||
|
|
|
||
|
|
Protected — DELETE stays REVOKED from crm_api AND crm_worker:
|
||
|
|
- audit_log (Astra acceptance: API/Worker write, never delete)
|
||
|
|
- api_tokens (revoke is an UPDATE on revoked_at)
|
||
|
|
- password_reset_tokens (consumption is an UPDATE on used_at)
|
||
|
|
- plugin_allowlist, plugin_migrations (install/migration path only —
|
||
|
|
plugin_migrations rows are deleted via the migration factory)
|
||
|
|
- tenants (never deleted at runtime)
|
||
|
|
- tenant_plugin_activation (deactivation is an UPDATE)
|
||
|
|
|
||
|
|
crm_worker receives no DELETE on any protected table (workers never
|
||
|
|
delete users, sessions or plugin rows).
|
||
|
|
|
||
|
|
Revision ID: 0145
|
||
|
|
Revises: 0144
|
||
|
|
"""
|
||
|
|
|
||
|
|
from alembic import op
|
||
|
|
|
||
|
|
revision = "0145"
|
||
|
|
down_revision = "0144"
|
||
|
|
branch_labels = None
|
||
|
|
depends_on = None
|
||
|
|
|
||
|
|
# Tables where runtime DELETE is a documented, legitimate operation (crm_api)
|
||
|
|
RUNTIME_DELETE_TABLES = [
|
||
|
|
"users",
|
||
|
|
"user_tenants",
|
||
|
|
"sessions",
|
||
|
|
"plugins",
|
||
|
|
"notification_types",
|
||
|
|
]
|
||
|
|
|
||
|
|
# Tables where DELETE must stay revoked from BOTH runtime roles (0100 + F20)
|
||
|
|
PROTECTED_TABLES = [
|
||
|
|
"audit_log",
|
||
|
|
"api_tokens",
|
||
|
|
"password_reset_tokens",
|
||
|
|
"plugin_allowlist",
|
||
|
|
"plugin_migrations",
|
||
|
|
"tenants",
|
||
|
|
"tenant_plugin_activation",
|
||
|
|
]
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
def upgrade() -> None:
|
||
|
|
# 1. Re-assert 0100's revocations — production DBs have lived with the
|
||
|
|
# blanket boot grant, so revoke first for a deterministic baseline.
|
||
|
|
for table in PROTECTED_TABLES:
|
||
|
|
op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_api;")
|
||
|
|
op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_worker;")
|
||
|
|
|
||
|
|
# 2. Grant the runtime-legitimate DELETEs to crm_api (BUG-030 stays
|
||
|
|
# fixed, logout keeps working, plugin management keeps working).
|
||
|
|
for table in RUNTIME_DELETE_TABLES:
|
||
|
|
op.execute(f"GRANT DELETE ON TABLE {table} TO crm_api;")
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
def downgrade() -> None:
|
||
|
|
# Best-effort inverse: revoke the runtime grants, re-grant the
|
||
|
|
# protected tables (matching the pre-F20 blanket state).
|
||
|
|
for table in RUNTIME_DELETE_TABLES:
|
||
|
|
op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_api;")
|
||
|
|
for table in PROTECTED_TABLES:
|
||
|
|
op.execute(f"GRANT DELETE ON TABLE {table} TO crm_api;")
|
||
|
|
op.execute(f"GRANT DELETE ON TABLE {table} TO crm_worker;")
|