From 9bf8157667275bf239a4e9ef0c9974a0f3a9cabd Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Thu, 20 Aug 2026 11:25:42 +0200 Subject: [PATCH] =?UTF-8?q?feat:=20RLS=20for=208=20tables=20(ai=5Fdecision?= =?UTF-8?q?=5Frecords,=20approval=5Frequests,=20automation=5Fagent=5Frun?= =?UTF-8?q?=5Fsteps,=20roles,=20sequences,=20wiki=5F*)=20=E2=80=94=20migra?= =?UTF-8?q?tion=200129?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../versions/0129_rls_for_missing_tables.py | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 alembic/versions/0129_rls_for_missing_tables.py diff --git a/alembic/versions/0129_rls_for_missing_tables.py b/alembic/versions/0129_rls_for_missing_tables.py new file mode 100644 index 0000000..71c1ab4 --- /dev/null +++ b/alembic/versions/0129_rls_for_missing_tables.py @@ -0,0 +1,42 @@ +"""Enable RLS for 8 tables that need tenant isolation. + +Tables excluded (no tenant_id column): +- outbox_deliveries: linked via event_outbox which has tenant_id +- marketplace_listings: global plugin marketplace, not tenant-specific + +Revision ID: 0129 +Revises: 0128 +""" + +from alembic import op + +revision = "0129" +down_revision = "0128" +branch_labels = None +depends_on = None + +TABLES_NEEDING_RLS = [ + "ai_decision_records", + "approval_requests", + "automation_agent_run_steps", + "roles", + "sequences", + "wiki_articles", + "wiki_article_versions", + "wiki_categories", +] + + +def upgrade() -> None: + for table in TABLES_NEEDING_RLS: + op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;") + op.execute( + f"CREATE POLICY tenant_isolation ON {table} " + f"FOR ALL USING (tenant_id = current_setting('app.tenant_id')::uuid);" + ) + + +def downgrade() -> None: + for table in TABLES_NEEDING_RLS: + op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};") + op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY;")