fix: WeasyPrint URL fetcher + attachment improvements + webhook error propagation + WebSocket conversation check + RLS disabled on system tables (bootstrap fix)

alembic/versions/0067_disable_rls_system_tables.py

@@ -0,0 +1,56 @@
+"""Disable RLS on system identity tables to fix login bootstrap circle.
+
+Revision ID: 0067
+Revises: 0066
+Create Date: 2026-07-29
+
+Problem: users, user_tenants, groups, roles have RLS enabled. The login
+process needs to query these tables BEFORE a tenant context is set
+(bootstrap circle: Login → Membership → Tenant-Context → Login).
+
+RLS on these tables blocks login because there's no tenant context yet.
+
+Solution: Disable RLS on system identity tables. Tenant isolation for
+these tables is enforced at the application level (auth_service always
+filters by user_id + tenant_id in queries).
+"""
+
+from alembic import op
+
+revision = "0067"
+down_revision = "0066"
+branch_labels = None
+depends_on = None
+
+# System identity tables — no RLS (needed for login bootstrap)
+SYSTEM_TABLES = [
+    "users",
+    "user_tenants",
+    "groups",
+    "user_groups",
+    "roles",
+]
+
+
+def upgrade() -> None:
+    for table in SYSTEM_TABLES:
+        # Drop any existing policies
+        op.execute(f"""
+            DO $$
+            DECLARE pol RECORD;
+            BEGIN
+                FOR pol IN
+                    SELECT polname FROM pg_policy
+                    WHERE polrelid = '{table}'::regclass
+                LOOP
+                    EXECUTE format('DROP POLICY IF EXISTS %I ON {table}', pol.polname);
+                END LOOP;
+            END $$;
+        """)
+        # Disable RLS
+        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY")
+
+
+def downgrade() -> None:
+    for table in SYSTEM_TABLES:
+        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")