sprint1: set_user_context + RLS policies on contacts + folder ACL migration 0051+0052

app/core/db/__init__.py

@@ -106,6 +106,36 @@ async def set_tenant_context(session: AsyncSession, tenant_id: uuid.UUID | str)
     )
 
 
+async def set_user_context(
+    session: AsyncSession,
+    user_id: uuid.UUID | str,
+    group_ids: list[uuid.UUID] | None = None,
+    is_system_admin: bool = False,
+) -> None:
+    """Set PostgreSQL session variables for RLS user context.
+
+    Sets:
+    - app.current_user_id: the user's UUID
+    - app.current_user_groups: comma-separated group UUIDs
+    - app.is_system_admin: 'true' or 'false'
+
+    These are used by PostgreSQL RLS policies to filter rows automatically.
+    """
+    await session.execute(
+        text("SELECT set_config('app.current_user_id', :uid, true)"),
+        {"uid": str(user_id)},
+    )
+    groups_str = ",".join(str(g) for g in group_ids) if group_ids else ""
+    await session.execute(
+        text("SELECT set_config('app.current_user_groups', :groups, true)"),
+        {"groups": groups_str},
+    )
+    await session.execute(
+        text("SELECT set_config('app.is_system_admin', :admin, true)"),
+        {"admin": "true" if is_system_admin else "false"},
+    )
+
+
 @contextlib.asynccontextmanager
 async def create_db_session(
     tenant_id: uuid.UUID | str | None = None,