Agent Zero
66 lines
1.9 KiB
Python
66 lines
1.9 KiB
Python
"""Disable RLS on startup/system tables that are read without tenant context.
|
|
|
|
These tables are accessed during app startup or login before a tenant context
|
|
is set. RLS would block these queries and prevent the app from starting.
|
|
|
|
Security: These tables are either system-wide (currencies, taxes, sequences,
|
|
system_settings) or user-specific (saved_filters, saved_views, webhooks) and
|
|
are protected by application-level authorization.
|
|
|
|
Revision ID: 0076
|
|
Revises: 0075
|
|
"""
|
|
|
|
from alembic import op
|
|
from sqlalchemy import text
|
|
|
|
revision = "0076"
|
|
down_revision = "0075"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
TABLES = [
|
|
"system_settings",
|
|
"currencies",
|
|
"taxes",
|
|
"sequences",
|
|
"saved_filters",
|
|
"saved_views",
|
|
"webhooks",
|
|
]
|
|
|
|
|
|
def upgrade() -> None:
|
|
conn = op.get_bind()
|
|
for table in TABLES:
|
|
# Check if table exists
|
|
exists = conn.execute(
|
|
text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
|
|
).fetchone() is not None
|
|
if not exists:
|
|
continue
|
|
|
|
# Drop RLS policy if exists
|
|
conn.execute(text(f"DROP POLICY IF EXISTS {table}_tenant_isolation ON {table}"))
|
|
# Disable RLS
|
|
conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
|
|
|
|
|
|
def downgrade() -> None:
|
|
conn = op.get_bind()
|
|
for table in TABLES:
|
|
exists = conn.execute(
|
|
text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
|
|
).fetchone() is not None
|
|
if not exists:
|
|
continue
|
|
conn.execute(text(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY"))
|
|
conn.execute(
|
|
text(
|
|
f"CREATE POLICY {table}_tenant_isolation ON {table} "
|
|
"FOR ALL "
|
|
"USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
|
|
"WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
|
|
)
|
|
)
|