Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Fix: Disable RLS on auth tables, correct policy syntax

Browse Source
This commit is contained in:
Agent Zero
2026-08-03 23:06:01 +02:00
parent 4f970a11eb
commit d43407ca77
1 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
alembic/versions/0101_enable_rls_critical_tables.py
+17 -9
View File
@@ -1,9 +1,12 @@
"""Enable RLS on critical tables missing it. """Enable RLS on critical tables missing it.
Tables: api_tokens, sequences, sessions, tenant_plugin_activation, Tables: api_tokens, sequences, tenant_plugin_activation, user_tenants.
user_tenants, password_reset_tokens.
Also adds tenant_id to guest_invitations and enables RLS. Also adds tenant_id to guest_invitations and enables RLS.
NOTE: sessions and password_reset_tokens are EXCLUDED from RLS because
crm_auth accesses them without a tenant context (during login/reset).
Instead, their security is enforced via GRANT restrictions in migration 0100.
Revision ID: 0101 Revision ID: 0101
""" """
@@ -15,25 +18,30 @@ down_revision = "0100"
branch_labels = None branch_labels = None
depends_on = None depends_on = None
# Tables that have tenant_id but no RLS # Tables that have tenant_id and can safely get RLS
# (accessed only by crm_api/crm_worker which always set tenant context)
RLS_TABLES = [ RLS_TABLES = [
"api_tokens", "api_tokens",
"sequences", "sequences",
"sessions",
"tenant_plugin_activation", "tenant_plugin_activation",
"user_tenants", "user_tenants",
"password_reset_tokens",
] ]
def upgrade() -> None: def upgrade() -> None:
# Undo any manual RLS changes on auth tables (safety measure)
op.execute("ALTER TABLE password_reset_tokens DISABLE ROW LEVEL SECURITY;")
op.execute("ALTER TABLE sessions DISABLE ROW LEVEL SECURITY;")
op.execute("DROP POLICY IF EXISTS password_reset_tokens_tenant_isolation ON password_reset_tokens;")
op.execute("DROP POLICY IF EXISTS sessions_tenant_isolation ON sessions;")
# Enable RLS + create tenant isolation policy for each table # Enable RLS + create tenant isolation policy for each table
for table in RLS_TABLES: for table in RLS_TABLES:
op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;") op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;")
op.execute( op.execute(
f"CREATE POLICY {table}_tenant_isolation ON {table} " f"CREATE POLICY {table}_tenant_isolation ON {table} "
f"FOR ALL USING (tenant_id = current_setting('app.current_tenant_id')::uuid) " f"FOR ALL USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid) "
f"WITH CHECK (tenant_id = current_setting('app.current_tenant_id')::uuid);" f"WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid);"
) )
# guest_invitations: add tenant_id + enable RLS # guest_invitations: add tenant_id + enable RLS
@@ -42,8 +50,8 @@ def upgrade() -> None:
op.execute("ALTER TABLE guest_invitations ENABLE ROW LEVEL SECURITY;") op.execute("ALTER TABLE guest_invitations ENABLE ROW LEVEL SECURITY;")
op.execute( op.execute(
"CREATE POLICY guest_invitations_tenant_isolation ON guest_invitations " "CREATE POLICY guest_invitations_tenant_isolation ON guest_invitations "
"FOR ALL USING (tenant_id = current_setting('app.current_tenant_id')::uuid) " "FOR ALL USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid) "
"WITH CHECK (tenant_id = current_setting('app.current_tenant_id')::uuid);" "WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid);"
) )