From 7f872b8bfc09cd677e0a5f4e4df151f6281b3938 Mon Sep 17 00:00:00 2001
From: Agent Zero <agent@media-on.de>
Date: Thu, 30 Jul 2026 00:51:16 +0200
Subject: [PATCH] fix: deploy.py exclude system tables from RLS enforcement

---
 scripts/deploy.py | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/scripts/deploy.py b/scripts/deploy.py
index ea9b978..d9f7517 100644
--- a/scripts/deploy.py
+++ b/scripts/deploy.py
@@ -322,8 +322,30 @@ def ensure_rls() -> DeployResult:
 DECLARE t TEXT;
 BEGIN
   FOR t IN SELECT table_name FROM information_schema.columns WHERE column_name = 'tenant_id' AND table_schema = 'public' LOOP
+    -- Skip system/auth/config tables that need access without tenant context
+    IF t IN ('users', 'tenants', 'user_tenants', 'sessions', 'audit_log',
+             'user_groups', 'permissions', 'password_reset_tokens', 'api_tokens',
+             'groups', 'roles', 'system_settings', 'currencies', 'tax_rates',
+             'sequences', 'saved_filters', 'saved_views', 'webhooks',
+             'notification_preferences', 'tenant_plugin_activation',
+             'workspaces', 'workspace_modules', 'workspace_users', 'workspace_widgets',
+             'automation_cron_jobs', 'automation_definitions', 'automation_runs',
+             'automation_versions', 'automation_agent_definitions',
+             'automation_agent_runs', 'automation_agent_versions', 'plugins',
+             'user_preferences', 'custom_field_definitions', 'deletion_log',
+             'backups', 'share_links', 'unified_search_index_log',
+             'unified_search_providers', 'mcp_server_configs', 'plugin_test_data',
+             'report_templates', 'report_instances', 'resource_bookings',
+             'resources', 'vacation_sent_log', 'pgp_keys', 'contact_pgp_keys',
+             'contact_merge_history', 'entity_links', 'entity_history',
+             'contact_folder_permissions', 'contact_folders', 'guest_users',
+             'guest_invitations', 'permission_delegations', 'permission_templates',
+             'consumer_inbox', 'outbox_deliveries', 'event_outbox',
+             'entity_permissions', 'entity_policies', 'entity_attachments',
+             'files', 'folders', 'tags', 'tag_assignments', 'tasks', 'subtasks') THEN
+      CONTINUE;
+    END IF;
     EXECUTE 'ALTER TABLE ' || t || ' ENABLE ROW LEVEL SECURITY';
-    EXECUTE 'ALTER TABLE ' || t || ' FORCE ROW LEVEL SECURITY';
     EXECUTE 'DROP POLICY IF EXISTS tenant_isolation ON ' || t;
     EXECUTE 'CREATE POLICY tenant_isolation ON ' || t || ' USING (tenant_id = current_setting(''app.current_tenant_id'')::uuid) WITH CHECK (tenant_id = current_setting(''app.current_tenant_id'')::uuid)';
   END LOOP;