From 8833444dcbba5ff11a1e17d836186919a30cd0a4 Mon Sep 17 00:00:00 2001
From: Agent Zero <agent@media-on.de>
Date: Thu, 30 Jul 2026 00:20:20 +0200
Subject: [PATCH] phase12: disable RLS on audit_log and sessions (written
 during login)

---
 .../0080_disable_rls_audit_sessions.py        | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 alembic/versions/0080_disable_rls_audit_sessions.py

diff --git a/alembic/versions/0080_disable_rls_audit_sessions.py b/alembic/versions/0080_disable_rls_audit_sessions.py
new file mode 100644
index 0000000..8610ff5
--- /dev/null
+++ b/alembic/versions/0080_disable_rls_audit_sessions.py
@@ -0,0 +1,33 @@
+"""Disable RLS on audit_log and sessions (written during login before tenant context).
+
+Revision ID: 0080
+Revises: 0079
+"""
+from alembic import op
+from sqlalchemy import text
+
+revision = "0080"
+down_revision = "0079"
+branch_labels = None
+depends_on = None
+
+TABLES = ["audit_log", "sessions", "password_reset_tokens", "api_tokens"]
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    for table in TABLES:
+        exists = conn.execute(
+            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
+        ).fetchone() is not None
+        if not exists:
+            continue
+        policies = conn.execute(text(
+            f"SELECT policyname FROM pg_policies WHERE tablename = '{table}'"
+        )).fetchall()
+        for (policyname,) in policies:
+            conn.execute(text(f"DROP POLICY IF EXISTS {policyname} ON {table}"))
+        conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
+        print(f"  Disabled RLS on {table}")
+
+def downgrade() -> None:
+    pass