Agent Zero
43 lines
1.1 KiB
Python
43 lines
1.1 KiB
Python
"""Enable RLS for 8 tables that need tenant isolation.
|
|
|
|
Tables excluded (no tenant_id column):
|
|
- outbox_deliveries: linked via event_outbox which has tenant_id
|
|
- marketplace_listings: global plugin marketplace, not tenant-specific
|
|
|
|
Revision ID: 0129
|
|
Revises: 0128
|
|
"""
|
|
|
|
from alembic import op
|
|
|
|
revision = "0129"
|
|
down_revision = "0128"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
TABLES_NEEDING_RLS = [
|
|
"ai_decision_records",
|
|
"approval_requests",
|
|
"automation_agent_run_steps",
|
|
"roles",
|
|
"sequences",
|
|
"wiki_articles",
|
|
"wiki_article_versions",
|
|
"wiki_categories",
|
|
]
|
|
|
|
|
|
def upgrade() -> None:
|
|
for table in TABLES_NEEDING_RLS:
|
|
op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;")
|
|
op.execute(
|
|
f"CREATE POLICY tenant_isolation ON {table} "
|
|
f"FOR ALL USING (tenant_id = current_setting('app.tenant_id')::uuid);"
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
for table in TABLES_NEEDING_RLS:
|
|
op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
|
|
op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY;")
|