From 501442e5f0c19f0a4ded7e35cef787ff362438aa Mon Sep 17 00:00:00 2001 From: chihlasm Date: Sun, 12 Apr 2026 03:12:46 +0000 Subject: [PATCH] fix: seed_test_users must use ADMIN_DATABASE_URL after Phase 4 RLS on users MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RLS is now enabled on the users table. The seed script was using the app-role connection (DATABASE_URL) which has no tenant context at seed time — all SELECTs return 0 rows and INSERTs are blocked by FORCE RLS. Falls back to DATABASE_URL if ADMIN_DATABASE_URL is not set (local dev without roles configured). Co-Authored-By: Claude Sonnet 4.6 --- backend/scripts/seed_test_users.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/backend/scripts/seed_test_users.py b/backend/scripts/seed_test_users.py index f8348d97..8526fea1 100644 --- a/backend/scripts/seed_test_users.py +++ b/backend/scripts/seed_test_users.py @@ -80,7 +80,10 @@ def _display_code() -> str: async def main() -> None: - engine = create_async_engine(settings.DATABASE_URL, echo=False) + # Must use ADMIN_DATABASE_URL (BYPASSRLS) — Phase 4 enabled RLS on users. + # The app-role connection has no tenant context at seed time and would see 0 rows. + admin_url = getattr(settings, "ADMIN_DATABASE_URL", None) or settings.DATABASE_URL + engine = create_async_engine(admin_url, echo=False) password_hash = get_password_hash(SHARED_PASSWORD) now = datetime.now(timezone.utc) team_account_id: uuid.UUID | None = None