109 lines
4.9 KiB
Python
109 lines
4.9 KiB
Python
"""enable_rls_phase1
|
|
|
|
Revision ID: c5f48b9890f9
|
|
Revises: 0b470d9e6cf1
|
|
Create Date: 2026-04-10 04:01:13.043321
|
|
|
|
"""
|
|
from typing import Sequence, Union
|
|
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
|
|
# revision identifiers, used by Alembic.
|
|
revision: str = 'c5f48b9890f9'
|
|
down_revision: Union[str, None] = '0b470d9e6cf1'
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
_NULL_UUID = "00000000-0000-0000-0000-000000000000"
|
|
_PLATFORM_UUID = "00000000-0000-0000-0000-000000000001"
|
|
_CURRENT_ACCOUNT = (
|
|
f"COALESCE(NULLIF(current_setting('app.current_account_id', TRUE), ''), "
|
|
f"'{_NULL_UUID}')::uuid"
|
|
)
|
|
|
|
|
|
def upgrade() -> None:
|
|
# ── trees ───────────────────────────────────────────────────────────────
|
|
# Extended policy mirrors can_access_tree() in app/core/permissions.py.
|
|
# Tenant sees: own rows, platform rows, any default tree, any public tree,
|
|
# any gallery-featured tree.
|
|
# is_gallery_featured = TRUE is included because /public/templates is a
|
|
# no-auth endpoint — no tenant context is set, so gallery trees must pass
|
|
# RLS on their own flag rather than relying on account_id or is_public.
|
|
# Private/team trees from other accounts are hidden.
|
|
op.execute("ALTER TABLE trees ENABLE ROW LEVEL SECURITY")
|
|
op.execute("ALTER TABLE trees FORCE ROW LEVEL SECURITY")
|
|
op.execute(f"""
|
|
CREATE POLICY tenant_isolation ON trees
|
|
USING (
|
|
account_id = {_CURRENT_ACCOUNT}
|
|
OR account_id = '{_PLATFORM_UUID}'::uuid
|
|
OR is_default = TRUE
|
|
OR is_public = TRUE
|
|
OR is_gallery_featured = TRUE
|
|
)
|
|
""")
|
|
|
|
# ── tree_tags ────────────────────────────────────────────────────────────
|
|
# Own account + platform tags (global tags visible to all tenants).
|
|
op.execute("ALTER TABLE tree_tags ENABLE ROW LEVEL SECURITY")
|
|
op.execute("ALTER TABLE tree_tags FORCE ROW LEVEL SECURITY")
|
|
op.execute(f"""
|
|
CREATE POLICY tenant_isolation ON tree_tags
|
|
USING (
|
|
account_id = {_CURRENT_ACCOUNT}
|
|
OR account_id = '{_PLATFORM_UUID}'::uuid
|
|
)
|
|
""")
|
|
|
|
# ── tree_categories ──────────────────────────────────────────────────────
|
|
op.execute("ALTER TABLE tree_categories ENABLE ROW LEVEL SECURITY")
|
|
op.execute("ALTER TABLE tree_categories FORCE ROW LEVEL SECURITY")
|
|
op.execute(f"""
|
|
CREATE POLICY tenant_isolation ON tree_categories
|
|
USING (
|
|
account_id = {_CURRENT_ACCOUNT}
|
|
OR account_id = '{_PLATFORM_UUID}'::uuid
|
|
)
|
|
""")
|
|
|
|
# ── step_categories ──────────────────────────────────────────────────────
|
|
op.execute("ALTER TABLE step_categories ENABLE ROW LEVEL SECURITY")
|
|
op.execute("ALTER TABLE step_categories FORCE ROW LEVEL SECURITY")
|
|
op.execute(f"""
|
|
CREATE POLICY tenant_isolation ON step_categories
|
|
USING (
|
|
account_id = {_CURRENT_ACCOUNT}
|
|
OR account_id = '{_PLATFORM_UUID}'::uuid
|
|
)
|
|
""")
|
|
|
|
# ── psa_connections ──────────────────────────────────────────────────────
|
|
# Tenant-only — PSA credentials must never cross tenant boundaries.
|
|
op.execute("ALTER TABLE psa_connections ENABLE ROW LEVEL SECURITY")
|
|
op.execute("ALTER TABLE psa_connections FORCE ROW LEVEL SECURITY")
|
|
op.execute(f"""
|
|
CREATE POLICY tenant_isolation ON psa_connections
|
|
USING (account_id = {_CURRENT_ACCOUNT})
|
|
""")
|
|
|
|
# ── flow_proposals ────────────────────────────────────────────────────────
|
|
# Tenant-only.
|
|
op.execute("ALTER TABLE flow_proposals ENABLE ROW LEVEL SECURITY")
|
|
op.execute("ALTER TABLE flow_proposals FORCE ROW LEVEL SECURITY")
|
|
op.execute(f"""
|
|
CREATE POLICY tenant_isolation ON flow_proposals
|
|
USING (account_id = {_CURRENT_ACCOUNT})
|
|
""")
|
|
|
|
|
|
def downgrade() -> None:
|
|
for table in ["trees", "tree_tags", "tree_categories", "step_categories",
|
|
"psa_connections", "flow_proposals"]:
|
|
op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table}")
|
|
op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY")
|
|
op.execute(f"ALTER TABLE {table} NO FORCE ROW LEVEL SECURITY")
|