Agent Zero
64 lines
1.8 KiB
Python
64 lines
1.8 KiB
Python
"""Enable RLS for 8 tables that need tenant isolation.
|
|
|
|
Tables excluded (no tenant_id column):
|
|
- outbox_deliveries: linked via event_outbox which has tenant_id
|
|
- marketplace_listings: global plugin marketplace, not tenant-specific
|
|
|
|
Revision ID: 0129
|
|
Revises: 0128
|
|
"""
|
|
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
revision = "0129"
|
|
down_revision = "0128"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
TABLES_NEEDING_RLS = [
|
|
"ai_decision_records",
|
|
"approval_requests",
|
|
"automation_agent_run_steps",
|
|
"roles",
|
|
"sequences",
|
|
"wiki_articles",
|
|
"wiki_article_versions",
|
|
"wiki_categories",
|
|
]
|
|
|
|
|
|
def _table_exists(conn, table_name: str) -> bool:
|
|
"""True when the table exists (dual-path convergence, Gate B).
|
|
|
|
Plugin-owned tables may not exist yet on a fresh install when Alembic
|
|
reaches this revision — skip them instead of failing. The plugin-side
|
|
convergence migrations apply the same RLS policies.
|
|
"""
|
|
row = conn.execute(
|
|
sa.text("SELECT to_regclass(:tname) IS NOT NULL"),
|
|
{"tname": f"public.{table_name}"},
|
|
).scalar()
|
|
return bool(row)
|
|
|
|
|
|
def upgrade() -> None:
|
|
conn = op.get_bind()
|
|
for table in TABLES_NEEDING_RLS:
|
|
if not _table_exists(conn, table):
|
|
continue
|
|
op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;")
|
|
op.execute(
|
|
f"CREATE POLICY tenant_isolation ON {table} "
|
|
f"FOR ALL USING (tenant_id = current_setting('app.tenant_id')::uuid);"
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
conn = op.get_bind()
|
|
for table in TABLES_NEEDING_RLS:
|
|
if not _table_exists(conn, table):
|
|
continue
|
|
op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
|
|
op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY;")
|