Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

gate2: fix migration 0085 — revoke default privileges before dropping crm_runtime, handle dependent_objects_still_exist

Browse Source
This commit is contained in:
Agent Zero
2026-07-31 21:20:59 +02:00
parent 48ddd78e9e
commit 10296137e9
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
alembic/versions/0085_restore_tenant_rls.py
+4 -2
View File
@@ -114,8 +114,10 @@ def upgrade() -> None:
_exec(f"REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM {role}")
_exec(f"REVOKE ALL PRIVILEGES ON SCHEMA public FROM {role}")
# Step 5: Drop crm_runtime role (may fail if permissions insufficient)
_exec("DO $$ BEGIN DROP ROLE IF EXISTS crm_runtime; EXCEPTION WHEN insufficient_privilege THEN NULL; END $$")
# Step 5: Drop crm_runtime role — revoke default privileges first, then drop
_exec("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM crm_runtime")
_exec("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE USAGE, SELECT ON SEQUENCES FROM crm_runtime")
_exec("DO $$ BEGIN DROP ROLE IF EXISTS crm_runtime; EXCEPTION WHEN insufficient_privilege THEN NULL; WHEN dependent_objects_still_exist THEN NULL; END $$")
# Step 6: Grant schema USAGE to runtime roles
_exec("GRANT USAGE ON SCHEMA public TO crm_api")