From 0d7602db3aaa9cf9cabeba28d182a9cae84f4ac1 Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Wed, 29 Jul 2026 23:42:25 +0200 Subject: [PATCH] phase12: disable RLS on tax_rates (startup table) --- .../versions/0077_disable_rls_tax_rates.py | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 alembic/versions/0077_disable_rls_tax_rates.py diff --git a/alembic/versions/0077_disable_rls_tax_rates.py b/alembic/versions/0077_disable_rls_tax_rates.py new file mode 100644 index 0000000..01aaf3c --- /dev/null +++ b/alembic/versions/0077_disable_rls_tax_rates.py @@ -0,0 +1,25 @@ +"""Disable RLS on tax_rates table (read at startup without tenant context). + +Revision ID: 0077 +Revises: 0076 +""" +from alembic import op +from sqlalchemy import text + +revision = "0077" +down_revision = "0076" +branch_labels = None +depends_on = None + +def upgrade() -> None: + op.execute("DROP POLICY IF EXISTS tax_rates_tenant_isolation ON tax_rates") + op.execute("ALTER TABLE tax_rates DISABLE ROW LEVEL SECURITY") + +def downgrade() -> None: + op.execute("ALTER TABLE tax_rates ENABLE ROW LEVEL SECURITY") + op.execute( + "CREATE POLICY tax_rates_tenant_isolation ON tax_rates " + "FOR ALL " + "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) " + "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)" + )