P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check

2026-07-29 12:28:08 +02:00
parent 81ae5b7cb6
commit 26bf8d3a31
12 changed files with 423 additions and 39 deletions
@@ -0,0 +1,67 @@
+"""Fix DB roles — add default privileges and grants for all tables.
+
+Revision ID: 0061
+Revises: 0060
+Create Date: 2026-07-29
+
+Problems fixed:
+1. crm_runtime role has no grants on tables created after migration 0044
+2. No ALTER DEFAULT PRIVILEGES for future tables
+3. Auth tables (users, tenants, user_tenants, user_groups) need SELECT grants
+4. New permission/guest/policy tables need grants
+"""
+
+from alembic import op
+
+revision = "0061"
+down_revision = "0060"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Grant privileges on all existing tables to crm_runtime
+    op.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_runtime")
+    
+    # Grant USAGE on sequences
+    op.execute("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_runtime")
+    
+    # Default privileges for future tables created by migration owner
+    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_runtime")
+    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO crm_runtime")
+    
+    # Ensure RLS is enabled on all tenant tables that have tenant_id
+    # (covers tables created after migration 0044 that missed RLS)
+    tenant_tables = [
+        "entity_permissions",
+        "entity_policies",
+        "permission_templates",
+        "permission_delegations",
+        "guest_users",
+        "guest_invitations",
+        "contact_folder_permissions",
+    ]
+    for table in tenant_tables:
+        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")
+        # Create tenant isolation policy if not exists
+        op.execute(f"""
+            DO $$
+            BEGIN
+                IF NOT EXISTS (
+                    SELECT 1 FROM pg_policy 
+                    WHERE polname = '{table}_tenant_isolation' 
+                    AND polrelid = '{table}'::regclass
+                ) THEN
+                    CREATE POLICY {table}_tenant_isolation ON {table}
+                    FOR ALL
+                    USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
+                    WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+                END IF;
+            END $$;
+        """)
+
+
+def downgrade() -> None:
+    # Revoke default privileges
+    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM crm_runtime")
+    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE USAGE, SELECT ON SEQUENCES FROM crm_runtime")