Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

phase1: separate DB roles, RLS restoration, login on crm_auth
Check Cross-Plugin Imports / check (push) Has been cancelled
Details

Browse Source 
- config.py: add auth_database_url, worker_database_url, migration_database_url
- db/__init__.py: separate engines for auth/worker/migration + get_auth_db/get_worker_db
- auth.py: all auth endpoints use get_auth_db (crm_auth role)
- auth_service.py: remove login fallback, require active membership, check status
- auth_service.py: switch_tenant checks active membership status
- alembic/env.py: use migration_database_url for Alembic
- docker-compose.yml: add AUTH_DATABASE_URL, WORKER_DATABASE_URL
- .env.example: add all 4 DB URLs with separate roles
- migration 0085: transfer ownership to crm_migration, fix BYPASSRLS,
  enable RLS+FORCE on all tenant tables, drop old policies, create new
  fail-closed policies scoped to crm_api+crm_worker, revoke excessive grants,
  grant minimal crm_auth access, drop crm_runtime, set default privileges
- tests/test_rls_coverage.py: automated RLS coverage check (13 tests)
- tests/test_cross_tenant_security_v2.py: RLS tests with unprivileged role
This commit is contained in:
Agent Zero
2026-07-31 02:05:16 +02:00
parent cdbbc1b6f0
commit 100b9f705c
9 changed files with 705 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.yml
+8 -5
View File
@@ -81,9 +81,11 @@ services:
redis:
condition: service_healthy
environment:
# App/worker uses crm_api (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
# API uses crm_api (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
# Migration/DDL uses crm_migration (owner, can bypass RLS for DDL)
# Auth uses crm_auth (NOSUPERUSER, NOBYPASSRLS) — identity tables only
AUTH_DATABASE_URL: ${AUTH_DATABASE_URL:-postgresql+asyncpg://crm_auth:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
# Migration/DDL uses crm_migration (owner, NOBYPASSRLS)
MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://crm_migration:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD}@redis:6379/0}
SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
@@ -152,9 +154,10 @@ services:
memory: 512M
cpus: "1.0"
environment:
# Worker uses crm_runtime too — RLS enforced
DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://${POSTGRES_USER:-crm_user}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
# Worker uses crm_worker (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
DATABASE_URL: ${WORKER_DATABASE_URL:-${DATABASE_URL:?DATABASE_URL is required}}
WORKER_DATABASE_URL: ${WORKER_DATABASE_URL:-postgresql+asyncpg://crm_worker:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://crm_migration:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD}@redis:6379/0}
SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
FRONTEND_URL: ${FRONTEND_URL:-http://localhost:8000}