Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

fix: deploy.py exclude system tables from RLS enforcement

Browse Source
This commit is contained in:
Agent Zero
2026-07-30 00:51:16 +02:00
parent d4ffbeca50
commit 7f872b8bfc
1 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/deploy.py
+23 -1
View File
@@ -322,8 +322,30 @@ def ensure_rls() -> DeployResult:
DECLARE t TEXT;
BEGIN
FOR t IN SELECT table_name FROM information_schema.columns WHERE column_name = 'tenant_id' AND table_schema = 'public' LOOP
-- Skip system/auth/config tables that need access without tenant context
IF t IN ('users', 'tenants', 'user_tenants', 'sessions', 'audit_log',
'user_groups', 'permissions', 'password_reset_tokens', 'api_tokens',
'groups', 'roles', 'system_settings', 'currencies', 'tax_rates',
'sequences', 'saved_filters', 'saved_views', 'webhooks',
'notification_preferences', 'tenant_plugin_activation',
'workspaces', 'workspace_modules', 'workspace_users', 'workspace_widgets',
'automation_cron_jobs', 'automation_definitions', 'automation_runs',
'automation_versions', 'automation_agent_definitions',
'automation_agent_runs', 'automation_agent_versions', 'plugins',
'user_preferences', 'custom_field_definitions', 'deletion_log',
'backups', 'share_links', 'unified_search_index_log',
'unified_search_providers', 'mcp_server_configs', 'plugin_test_data',
'report_templates', 'report_instances', 'resource_bookings',
'resources', 'vacation_sent_log', 'pgp_keys', 'contact_pgp_keys',
'contact_merge_history', 'entity_links', 'entity_history',
'contact_folder_permissions', 'contact_folders', 'guest_users',
'guest_invitations', 'permission_delegations', 'permission_templates',
'consumer_inbox', 'outbox_deliveries', 'event_outbox',
'entity_permissions', 'entity_policies', 'entity_attachments',
'files', 'folders', 'tags', 'tag_assignments', 'tasks', 'subtasks') THEN
CONTINUE;
END IF;
EXECUTE 'ALTER TABLE ' || t || ' ENABLE ROW LEVEL SECURITY';
EXECUTE 'ALTER TABLE ' || t || ' FORCE ROW LEVEL SECURITY';
EXECUTE 'DROP POLICY IF EXISTS tenant_isolation ON ' || t;
EXECUTE 'CREATE POLICY tenant_isolation ON ' || t || ' USING (tenant_id = current_setting(''app.current_tenant_id'')::uuid) WITH CHECK (tenant_id = current_setting(''app.current_tenant_id'')::uuid)';
END LOOP;