feat: RLS for 8 tables (ai_decision_records, approval_requests, automation_agent_run_steps, roles, sequences, wiki_*) — migration 0129

alembic/versions/0129_rls_for_missing_tables.py

@@ -0,0 +1,42 @@
+"""Enable RLS for 8 tables that need tenant isolation.
+
+Tables excluded (no tenant_id column):
+- outbox_deliveries: linked via event_outbox which has tenant_id
+- marketplace_listings: global plugin marketplace, not tenant-specific
+
+Revision ID: 0129
+Revises: 0128
+"""
+
+from alembic import op
+
+revision = "0129"
+down_revision = "0128"
+branch_labels = None
+depends_on = None
+
+TABLES_NEEDING_RLS = [
+    "ai_decision_records",
+    "approval_requests",
+    "automation_agent_run_steps",
+    "roles",
+    "sequences",
+    "wiki_articles",
+    "wiki_article_versions",
+    "wiki_categories",
+]
+
+
+def upgrade() -> None:
+    for table in TABLES_NEEDING_RLS:
+        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;")
+        op.execute(
+            f"CREATE POLICY tenant_isolation ON {table} "
+            f"FOR ALL USING (tenant_id = current_setting('app.tenant_id')::uuid);"
+        )
+
+
+def downgrade() -> None:
+    for table in TABLES_NEEDING_RLS:
+        op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
+        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY;")