Agent Zero
70 lines
1.9 KiB
Python
70 lines
1.9 KiB
Python
"""Disable RLS on all system/auth/config tables needed at startup and login.
|
|
|
|
These tables are read before a tenant context is set (startup, login,
|
|
plugin activation). RLS must be disabled on them to allow unprivileged
|
|
(crm_api) access without tenant context.
|
|
|
|
Revision ID: 0079
|
|
Revises: 0078
|
|
"""
|
|
from alembic import op
|
|
from sqlalchemy import text
|
|
|
|
revision = "0079"
|
|
down_revision = "0078"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
# All tables that need to be read WITHOUT tenant context
|
|
SYSTEM_TABLES = [
|
|
# Auth tables
|
|
"user_tenants",
|
|
"sessions",
|
|
"password_reset_tokens",
|
|
"api_tokens",
|
|
"user_groups",
|
|
"user_preferences",
|
|
# RBAC tables
|
|
"roles",
|
|
"groups",
|
|
"permissions",
|
|
# Config tables
|
|
"system_settings",
|
|
"currencies",
|
|
"tax_rates",
|
|
"sequences",
|
|
"saved_filters",
|
|
"saved_views",
|
|
"webhooks",
|
|
"notification_preferences",
|
|
# Plugin tables
|
|
"tenant_plugin_activation",
|
|
# Workspace tables (needed for workspace context before tenant filter)
|
|
"workspaces",
|
|
"workspace_modules",
|
|
"workspace_users",
|
|
"workspace_widgets",
|
|
]
|
|
|
|
def upgrade() -> None:
|
|
conn = op.get_bind()
|
|
for table in SYSTEM_TABLES:
|
|
exists = conn.execute(
|
|
text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
|
|
).fetchone() is not None
|
|
if not exists:
|
|
continue
|
|
# Drop all RLS policies on this table
|
|
policies = conn.execute(text(
|
|
f"SELECT policyname FROM pg_policies WHERE tablename = '{table}'"
|
|
)).fetchall()
|
|
for (policyname,) in policies:
|
|
conn.execute(text(f"DROP POLICY IF EXISTS {policyname} ON {table}"))
|
|
conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
|
|
print(f" Disabled RLS on {table}")
|
|
|
|
def downgrade() -> None:
|
|
# Re-enabling RLS on system tables would break startup with crm_api
|
|
# This is intentionally a no-op
|
|
pass
|