57 lines
1.5 KiB
Python
57 lines
1.5 KiB
Python
|
"""Disable RLS on system identity tables to fix login bootstrap circle.
|
||
|
|
|
||
|
|
Revision ID: 0067
|
||
|
|
Revises: 0066
|
||
|
|
Create Date: 2026-07-29
|
||
|
|
|
||
|
|
Problem: users, user_tenants, groups, roles have RLS enabled. The login
|
||
|
|
process needs to query these tables BEFORE a tenant context is set
|
||
|
|
(bootstrap circle: Login → Membership → Tenant-Context → Login).
|
||
|
|
|
||
|
|
RLS on these tables blocks login because there's no tenant context yet.
|
||
|
|
|
||
|
|
Solution: Disable RLS on system identity tables. Tenant isolation for
|
||
|
|
these tables is enforced at the application level (auth_service always
|
||
|
|
filters by user_id + tenant_id in queries).
|
||
|
|
"""
|
||
|
|
|
||
|
|
from alembic import op
|
||
|
|
|
||
|
|
revision = "0067"
|
||
|
|
down_revision = "0066"
|
||
|
|
branch_labels = None
|
||
|
|
depends_on = None
|
||
|
|
|
||
|
|
# System identity tables — no RLS (needed for login bootstrap)
|
||
|
|
SYSTEM_TABLES = [
|
||
|
|
"users",
|
||
|
|
"user_tenants",
|
||
|
|
"groups",
|
||
|
|
"user_groups",
|
||
|
|
"roles",
|
||
|
|
]
|
||
|
|
|
||
|
|
|
||
|
|
def upgrade() -> None:
|
||
|
|
for table in SYSTEM_TABLES:
|
||
|
|
# Drop any existing policies
|
||
|
|
op.execute(f"""
|
||
|
|
DO $$
|
||
|
|
DECLARE pol RECORD;
|
||
|
|
BEGIN
|
||
|
|
FOR pol IN
|
||
|
|
SELECT polname FROM pg_policy
|
||
|
|
WHERE polrelid = '{table}'::regclass
|
||
|
|
LOOP
|
||
|
|
EXECUTE format('DROP POLICY IF EXISTS %I ON {table}', pol.polname);
|
||
|
|
END LOOP;
|
||
|
|
END $$;
|
||
|
|
""")
|
||
|
|
# Disable RLS
|
||
|
|
op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY")
|
||
|
|
|
||
|
|
|
||
|
|
def downgrade() -> None:
|
||
|
|
for table in SYSTEM_TABLES:
|
||
|
|
op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")
|