Agent Zero
47 lines
1.2 KiB
Python
47 lines
1.2 KiB
Python
"""Restrict DELETE grants on sensitive tables.
|
|
|
|
Removes DELETE privilege from crm_api and crm_worker on:
|
|
api_tokens, audit_log, notification_types, password_reset_tokens,
|
|
plugin_allowlist, plugin_migrations, plugins, sessions,
|
|
tenant_plugin_activation, tenants, user_tenants, users.
|
|
|
|
crm_auth keeps DELETE on sessions + password_reset_tokens (for logout/reset).
|
|
|
|
Revision ID: 0100
|
|
"""
|
|
|
|
from alembic import op
|
|
|
|
revision = "0100"
|
|
down_revision = "0099"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
# Tables where DELETE must be removed from crm_api and crm_worker
|
|
SENSITIVE_TABLES = [
|
|
"api_tokens",
|
|
"audit_log",
|
|
"notification_types",
|
|
"password_reset_tokens",
|
|
"plugin_allowlist",
|
|
"plugin_migrations",
|
|
"plugins",
|
|
"sessions",
|
|
"tenant_plugin_activation",
|
|
"tenants",
|
|
"user_tenants",
|
|
"users",
|
|
]
|
|
|
|
|
|
def upgrade() -> None:
|
|
for table in SENSITIVE_TABLES:
|
|
op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_api;")
|
|
op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_worker;")
|
|
|
|
|
|
def downgrade() -> None:
|
|
for table in SENSITIVE_TABLES:
|
|
op.execute(f"GRANT DELETE ON TABLE {table} TO crm_api;")
|
|
op.execute(f"GRANT DELETE ON TABLE {table} TO crm_worker;")
|