sprint1: set_user_context + RLS policies on contacts + folder ACL migration 0051+0052

app/core/db/__init__.py

@@ -106,6 +106,36 @@ async def set_tenant_context(session: AsyncSession, tenant_id: uuid.UUID | str)
     )
 
 
+async def set_user_context(
+    session: AsyncSession,
+    user_id: uuid.UUID | str,
+    group_ids: list[uuid.UUID] | None = None,
+    is_system_admin: bool = False,
+) -> None:
+    """Set PostgreSQL session variables for RLS user context.
+
+    Sets:
+    - app.current_user_id: the user's UUID
+    - app.current_user_groups: comma-separated group UUIDs
+    - app.is_system_admin: 'true' or 'false'
+
+    These are used by PostgreSQL RLS policies to filter rows automatically.
+    """
+    await session.execute(
+        text("SELECT set_config('app.current_user_id', :uid, true)"),
+        {"uid": str(user_id)},
+    )
+    groups_str = ",".join(str(g) for g in group_ids) if group_ids else ""
+    await session.execute(
+        text("SELECT set_config('app.current_user_groups', :groups, true)"),
+        {"groups": groups_str},
+    )
+    await session.execute(
+        text("SELECT set_config('app.is_system_admin', :admin, true)"),
+        {"admin": "true" if is_system_admin else "false"},
+    )
+
+
 @contextlib.asynccontextmanager
 async def create_db_session(
     tenant_id: uuid.UUID | str | None = None,

app/deps.py

@@ -8,11 +8,12 @@ from typing import Any
 
 import redis.asyncio as aioredis
 from fastapi import Depends, HTTPException, Request, status
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import get_settings
 from app.core.auth import get_redis, get_session_data, refresh_session_ttl
-from app.core.db import get_db, set_tenant_context
+from app.core.db import get_db, set_tenant_context, set_user_context
 
 logger = logging.getLogger(__name__)
 
@@ -80,6 +81,18 @@ async def get_current_user(
     tenant_id = uuid.UUID(session_data["tenant_id"])
     await set_tenant_context(db, tenant_id)
 
+    # Set RLS user context for row-level security
+    user_id = uuid.UUID(session_data["user_id"])
+    from app.models.group import UserGroup
+    groups_q = await db.execute(
+        select(UserGroup.group_id)
+        .where(UserGroup.user_id == user_id)
+        .where(UserGroup.tenant_id == tenant_id)
+    )
+    group_ids = [row[0] for row in groups_q]
+    is_admin = session_data.get("is_system_admin", False)
+    await set_user_context(db, user_id, group_ids, is_admin)
+
     # Load resolved permissions from cache (or DB on miss)
     from app.core.permissions import get_cached_permissions