chihlasm/resolutionflow
1
0
Fork 0
Code Issues 23 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: remove platform_steps and template_trees from Phase 4 RLS

Browse Source 
Both tables have no account_id column — they are globally readable
by all authenticated users and must not have RLS policies.

Also removes the corresponding test cases that assumed these tables
had account_id-based policies.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
chihlasm
2026-04-12 01:48:50 +00:00
parent c6da4ebee5
commit f9248aeaa8
2 changed files with 7 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
backend/tests/test_rls_isolation.py
View File

@@ -958,8 +958,10 @@ async def test_tree_shares_account_a_cannot_see_account_b(admin_conn, conn_a):
# ===========================================================================
# Phase 4 RLS isolation tests
# Tables: users, script_builder_sessions, ai_session_steps,
# notifications, platform_steps, template_trees
# Tables: users, script_builder_sessions, ai_session_steps, notifications
#
# Note: platform_steps and template_trees have no account_id column and no RLS —
# they are globally readable by all authenticated users.
# ===========================================================================
# ---------------------------------------------------------------------------
@@ -1083,58 +1085,3 @@ async def test_notifications_account_a_cannot_see_account_b(admin_conn, conn_a):
finally:
await admin_conn.execute(f"DELETE FROM notifications WHERE id = '{notif_id}'")
# ---------------------------------------------------------------------------
# platform_steps — platform content visible to all tenants
# ---------------------------------------------------------------------------
@pytest.mark.asyncio
async def test_platform_steps_visible_to_all_tenants(admin_conn, conn_a):
"""Platform steps (PLATFORM_ACCOUNT_ID) must be visible to any tenant."""
step_id = str(uuid.uuid4())
await admin_conn.execute(f"""
INSERT INTO platform_steps (
id, account_id, title, step_type, content,
is_active, created_at, updated_at
) VALUES (
'{step_id}', '{PLATFORM_ACCOUNT_ID}', 'Phase4 RLS Platform Step',
'action', '{{}}'::jsonb, TRUE, NOW(), NOW()
)
""")
try:
rows = await conn_a.fetch(
f"SELECT id FROM platform_steps WHERE id = '{step_id}'"
)
assert len(rows) == 1, (
"Platform steps (PLATFORM_ACCOUNT_ID) must be visible to all tenants"
)
finally:
await admin_conn.execute(f"DELETE FROM platform_steps WHERE id = '{step_id}'")
# ---------------------------------------------------------------------------
# template_trees — platform content visible to all tenants
# ---------------------------------------------------------------------------
@pytest.mark.asyncio
async def test_template_trees_visible_to_all_tenants(admin_conn, conn_a):
"""Template trees (PLATFORM_ACCOUNT_ID) must be visible to any tenant."""
tmpl_id = str(uuid.uuid4())
await admin_conn.execute(f"""
INSERT INTO template_trees (
id, account_id, name, tree_structure, is_active,
created_at, updated_at
) VALUES (
'{tmpl_id}', '{PLATFORM_ACCOUNT_ID}', 'Phase4 RLS Template',
'{{}}'::jsonb, TRUE, NOW(), NOW()
)
""")
try:
rows = await conn_a.fetch(
f"SELECT id FROM template_trees WHERE id = '{tmpl_id}'"
)
assert len(rows) == 1, (
"Template trees (PLATFORM_ACCOUNT_ID) must be visible to all tenants"
)
finally:
await admin_conn.execute(f"DELETE FROM template_trees WHERE id = '{tmpl_id}'")