Leopoldadmin/leocrm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: 0015 RLS migration idempotent — DROP POLICY IF EXISTS before CREATE POLICY

Browse Source
This commit is contained in:
Leopoldadmin
2026-07-04 08:12:39 +00:00
parent 7a42cf3457
commit 1c059369fc
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
alembic/versions/0015_rls_policies.py
+6 -4
View File
@@ -1,5 +1,7 @@
"""Enable Row Level Security with tenant isolation policies on core tables. """Enable Row Level Security with tenant isolation policies on core tables.
Idempotent: drops existing policies before creating them.
Revision ID: 0015_rls_policies Revision ID: 0015_rls_policies
Revises: 0014_currency_unique_fix Revises: 0014_currency_unique_fix
Create Date: 2026-07-04 Create Date: 2026-07-04
@@ -41,15 +43,15 @@ RLS_TABLES = [
"password_reset_tokens", "password_reset_tokens",
] ]
# Tables without tenant_id — no RLS (plugins, plugin_migrations are global)
NO_RLS_TABLES = ["plugins", "plugin_migrations"]
def upgrade() -> None: def upgrade() -> None:
for table_name in RLS_TABLES: for table_name in RLS_TABLES:
# Enable RLS on the table # Enable RLS on the table (idempotent — ENABLE is safe to repeat)
op.execute(f"ALTER TABLE {table_name} ENABLE ROW LEVEL SECURITY") op.execute(f"ALTER TABLE {table_name} ENABLE ROW LEVEL SECURITY")
# Drop existing policy if it exists (idempotent — prevents DuplicateObjectError on restart)
op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table_name}")
# Create tenant isolation policy # Create tenant isolation policy
# USING clause: tenant_id must match the session variable set by the app # USING clause: tenant_id must match the session variable set by the app
op.execute( op.execute(