From 1c059369fc974cbe2f377674e981dc4065867daf Mon Sep 17 00:00:00 2001 From: Leopoldadmin Date: Sat, 4 Jul 2026 08:12:39 +0000 Subject: [PATCH] =?UTF-8?q?Fix:=200015=20RLS=20migration=20idempotent=20?= =?UTF-8?q?=E2=80=94=20DROP=20POLICY=20IF=20EXISTS=20before=20CREATE=20POL?= =?UTF-8?q?ICY?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- alembic/versions/0015_rls_policies.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/alembic/versions/0015_rls_policies.py b/alembic/versions/0015_rls_policies.py index d83335b..98be3b9 100644 --- a/alembic/versions/0015_rls_policies.py +++ b/alembic/versions/0015_rls_policies.py @@ -1,5 +1,7 @@ """Enable Row Level Security with tenant isolation policies on core tables. +Idempotent: drops existing policies before creating them. + Revision ID: 0015_rls_policies Revises: 0014_currency_unique_fix Create Date: 2026-07-04 @@ -41,15 +43,15 @@ RLS_TABLES = [ "password_reset_tokens", ] -# Tables without tenant_id — no RLS (plugins, plugin_migrations are global) -NO_RLS_TABLES = ["plugins", "plugin_migrations"] - def upgrade() -> None: for table_name in RLS_TABLES: - # Enable RLS on the table + # Enable RLS on the table (idempotent — ENABLE is safe to repeat) op.execute(f"ALTER TABLE {table_name} ENABLE ROW LEVEL SECURITY") + # Drop existing policy if it exists (idempotent — prevents DuplicateObjectError on restart) + op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table_name}") + # Create tenant isolation policy # USING clause: tenant_id must match the session variable set by the app op.execute(