From 93a330ae404a3399984e99df2d689ddee2267a1e Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Mon, 3 Aug 2026 23:14:26 +0200 Subject: [PATCH] =?UTF-8?q?Fix:=20Simplify=20migration=200101=20=E2=80=94?= =?UTF-8?q?=20only=20disable=20RLS=20on=20auth=20tables?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../0101_enable_rls_critical_tables.py | 57 +++---------------- 1 file changed, 8 insertions(+), 49 deletions(-) diff --git a/alembic/versions/0101_enable_rls_critical_tables.py b/alembic/versions/0101_enable_rls_critical_tables.py index 3a8f2c4..2181138 100644 --- a/alembic/versions/0101_enable_rls_critical_tables.py +++ b/alembic/versions/0101_enable_rls_critical_tables.py @@ -1,68 +1,27 @@ -"""Enable RLS on critical tables missing it. +"""Fix RLS on auth tables — disable RLS that was accidentally enabled. -Tables: api_tokens, sequences, tenant_plugin_activation, user_tenants. -Also adds tenant_id to guest_invitations and enables RLS. - -NOTE: sessions and password_reset_tokens are EXCLUDED from RLS because -crm_auth accesses them without a tenant context (during login/reset). -Instead, their security is enforced via GRANT restrictions in migration 0100. +This migration ONLY disables RLS on auth tables and does NOT enable +new RLS. RLS on other tables will be added in a later migration +after the app is confirmed working. Revision ID: 0101 """ from alembic import op -import sqlalchemy as sa revision = "0101" down_revision = "0100" branch_labels = None depends_on = None -# Tables that have tenant_id and can safely get RLS -# (accessed only by crm_api/crm_worker which always set tenant context) -RLS_TABLES = [ - "api_tokens", - "sequences", - "tenant_plugin_activation", - "user_tenants", -] - def upgrade() -> None: - # Undo any manual RLS changes on auth tables (safety measure) - op.execute("ALTER TABLE password_reset_tokens DISABLE ROW LEVEL SECURITY;") - op.execute("ALTER TABLE sessions DISABLE ROW LEVEL SECURITY;") + # Disable RLS on auth tables (safety measure — these tables must not have RLS) + op.execute("ALTER TABLE IF EXISTS password_reset_tokens DISABLE ROW LEVEL SECURITY;") + op.execute("ALTER TABLE IF EXISTS sessions DISABLE ROW LEVEL SECURITY;") op.execute("DROP POLICY IF EXISTS password_reset_tokens_tenant_isolation ON password_reset_tokens;") op.execute("DROP POLICY IF EXISTS sessions_tenant_isolation ON sessions;") - # Enable RLS + create tenant isolation policy for each table - for table in RLS_TABLES: - op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;") - op.execute( - f"CREATE POLICY {table}_tenant_isolation ON {table} " - f"FOR ALL USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid) " - f"WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid);" - ) - - # guest_invitations: add tenant_id + enable RLS - op.add_column("guest_invitations", sa.Column("tenant_id", sa.UUID(), nullable=True)) - op.execute("CREATE INDEX ix_guest_invitations_tenant_id ON guest_invitations (tenant_id);") - op.execute("ALTER TABLE guest_invitations ENABLE ROW LEVEL SECURITY;") - op.execute( - "CREATE POLICY guest_invitations_tenant_isolation ON guest_invitations " - "FOR ALL USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid) " - "WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid);" - ) - def downgrade() -> None: - # Drop guest_invitations RLS + tenant_id - op.execute("DROP POLICY IF EXISTS guest_invitations_tenant_isolation ON guest_invitations;") - op.execute("ALTER TABLE guest_invitations DISABLE ROW LEVEL SECURITY;") - op.execute("DROP INDEX IF EXISTS ix_guest_invitations_tenant_id;") - op.drop_column("guest_invitations", "tenant_id") - - # Drop RLS on other tables - for table in RLS_TABLES: - op.execute(f"DROP POLICY IF EXISTS {table}_tenant_isolation ON {table};") - op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY;") + pass