Agent Zero
108 lines
3.9 KiB
Python
108 lines
3.9 KiB
Python
"""Create 4 separate DB roles for strict separation.
|
|
|
|
crm_migration: Schema owner, runs Alembic, BypassRLS
|
|
- Owns all tables, sequences, functions
|
|
- Can bypass RLS for migrations
|
|
- Never used by the API
|
|
|
|
crm_auth: Login bootstrap only
|
|
- Reads users, user_tenants, tenants, roles, groups
|
|
- NO RLS on system tables (already disabled)
|
|
- No general CRM data access
|
|
|
|
crm_api: Application runtime
|
|
- NOBYPASSRLS, NOSUPERUSER
|
|
- SELECT, INSERT, UPDATE, DELETE on all tables
|
|
- Tenant context is mandatory (RLS enforces it)
|
|
|
|
crm_worker: Background jobs
|
|
- NOBYPASSRLS, NOSUPERUSER
|
|
- Same data access as crm_api
|
|
- Tenant context set per job
|
|
|
|
Revision ID: 0070
|
|
Revises: 0069
|
|
"""
|
|
|
|
from alembic import op
|
|
from sqlalchemy import text
|
|
|
|
revision = "0070"
|
|
down_revision = "0069"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
conn = op.get_bind()
|
|
|
|
# 1. Create crm_migration role (schema owner, bypass RLS)
|
|
conn.execute(text("""
|
|
DO $$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_migration') THEN
|
|
CREATE ROLE crm_migration WITH LOGIN NOINHERIT;
|
|
END IF;
|
|
END $$;
|
|
"""))
|
|
conn.execute(text("ALTER ROLE crm_migration WITH BYPASSRLS"))
|
|
|
|
# 2. Create crm_auth role (login bootstrap, no RLS on system tables)
|
|
conn.execute(text("""
|
|
DO $$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_auth') THEN
|
|
CREATE ROLE crm_auth WITH LOGIN NOINHERIT;
|
|
END IF;
|
|
END $$;
|
|
"""))
|
|
conn.execute(text("ALTER ROLE crm_auth WITH NOBYPASSRLS"))
|
|
# Grant read access to system tables only
|
|
conn.execute(text("GRANT SELECT ON users, user_tenants, tenants, roles, user_groups, groups TO crm_auth"))
|
|
|
|
# 3. Create crm_api role (application runtime, NOBYPASSRLS)
|
|
conn.execute(text("""
|
|
DO $$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_api') THEN
|
|
CREATE ROLE crm_api WITH LOGIN NOINHERIT;
|
|
END IF;
|
|
END $$;
|
|
"""))
|
|
conn.execute(text("ALTER ROLE crm_api WITH NOBYPASSRLS NOSUPERUSER"))
|
|
# Grant data access on all existing tables
|
|
conn.execute(text("GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_api"))
|
|
conn.execute(text("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_api"))
|
|
# Default privileges for future tables
|
|
conn.execute(text("ALTER DEFAULT PRIVILEGES GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_api"))
|
|
conn.execute(text("ALTER DEFAULT PRIVILEGES GRANT USAGE, SELECT ON SEQUENCES TO crm_api"))
|
|
|
|
# 4. Create crm_worker role (background jobs, NOBYPASSRLS)
|
|
conn.execute(text("""
|
|
DO $$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_worker') THEN
|
|
CREATE ROLE crm_worker WITH LOGIN NOINHERIT;
|
|
END IF;
|
|
END $$;
|
|
"""))
|
|
conn.execute(text("ALTER ROLE crm_worker WITH NOBYPASSRLS NOSUPERUSER"))
|
|
conn.execute(text("GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_worker"))
|
|
conn.execute(text("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_worker"))
|
|
conn.execute(text("ALTER DEFAULT PRIVILEGES GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_worker"))
|
|
conn.execute(text("ALTER DEFAULT PRIVILEGES GRANT USAGE, SELECT ON SEQUENCES TO crm_worker"))
|
|
|
|
# 5. Grant USAGE on schema to all roles
|
|
conn.execute(text("GRANT USAGE ON SCHEMA public TO crm_api, crm_worker, crm_auth, crm_migration"))
|
|
|
|
# 6. Set passwords (same as crm_user for now — will be changed in docker-compose)
|
|
# Passwords are set via environment variables in prestart.sh
|
|
|
|
|
|
def downgrade() -> None:
|
|
conn = op.get_bind()
|
|
conn.execute(text("DROP ROLE IF EXISTS crm_worker"))
|
|
conn.execute(text("DROP ROLE IF EXISTS crm_api"))
|
|
conn.execute(text("DROP ROLE IF EXISTS crm_auth"))
|
|
conn.execute(text("DROP ROLE IF EXISTS crm_migration"))
|