mirror of
https://origin.cursor.com/mrdevmx/panels.git
synced 2026-10-09 14:33:17 +00:00
b87b0205a8
- Fase 0: scripts de aprovisionamiento (db/provision/) para roles, dos bases de datos separadas (panels_platform / panels_product con esquemas iam+core) y ACLs de Redis por modulo, con verificacion automatizada de aislamiento (verify-isolation.sh) y setup local reproducible (dev-local.sh). - Fase 1: changelogs de Liquibase reescritos para Postgres (db/platform, db/iam, db/core reemplazan db/app + los changesets SQLite de platform). Baseline como estado final (no replay literal), tipos traducidos (IDENTITY, TIMESTAMPTZ/DATE, NUMERIC, BOOLEAN, CITEXT), contexts dev vs. schema/catalogos, RLS por tenant_id como defensa en profundidad, uploaded_by/created_by como snapshot desnormalizado (sin FK hacia iam). - Migraciones ya no corren en el arranque de la API: paso explicito de deploy via db/update.sh con credenciales _owner. Verificado end-to-end contra Postgres 16 + Redis local. Co-authored-by: alberto.martinez <alberto.martinez@mrdev.mx>
71 lines
4.7 KiB
SQL
71 lines
4.7 KiB
SQL
--liquibase formatted sql
|
|
-- PANELS · panels_product.core (Postgres) · Row Level Security (Fase 4b)
|
|
--
|
|
-- Mismo mecanismo que iam (ver db/iam/changesets/002-rls.sql): el rol de
|
|
-- runtime (panels_core_app) no es dueño de las tablas, así que
|
|
-- ENABLE ROW LEVEL SECURITY ya lo restringe sin afectar a panels_core_owner
|
|
-- (que sí necesita ver todos los tenants para migrar/hacer backfills).
|
|
--
|
|
-- Alcance: se aplica a las tablas con columna tenant_id directa --
|
|
-- companies, workers, projects, payroll_weeks, destajo_units/periods/jobs.
|
|
-- Tablas hijas sin tenant_id propio (assignments, documents, budget_items,
|
|
-- loans, attendance, badge_jobs, payroll_week_lines, etc.) dependen del
|
|
-- scoping corregido en la capa de aplicación (Fase 3, cierre del IDOR) via
|
|
-- su FK a projects/workers -- extender RLS a esas tablas con políticas por
|
|
-- subquery es un endurecimiento futuro válido, no bloqueante para esta fase.
|
|
|
|
--changeset panel:core-005a-rls-companies endDelimiter:; splitStatements:true
|
|
--preconditions onFail:MARK_RAN
|
|
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='companies' AND policyname='tenant_isolation'
|
|
ALTER TABLE core.companies ENABLE ROW LEVEL SECURITY;
|
|
CREATE POLICY tenant_isolation ON core.companies
|
|
USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
|
|
WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);
|
|
|
|
--changeset panel:core-005b-rls-workers endDelimiter:; splitStatements:true
|
|
--preconditions onFail:MARK_RAN
|
|
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='workers' AND policyname='tenant_isolation'
|
|
ALTER TABLE core.workers ENABLE ROW LEVEL SECURITY;
|
|
CREATE POLICY tenant_isolation ON core.workers
|
|
USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
|
|
WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);
|
|
|
|
--changeset panel:core-005c-rls-projects endDelimiter:; splitStatements:true
|
|
--preconditions onFail:MARK_RAN
|
|
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='projects' AND policyname='tenant_isolation'
|
|
ALTER TABLE core.projects ENABLE ROW LEVEL SECURITY;
|
|
CREATE POLICY tenant_isolation ON core.projects
|
|
USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
|
|
WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);
|
|
|
|
--changeset panel:core-005d-rls-payroll-weeks endDelimiter:; splitStatements:true
|
|
--preconditions onFail:MARK_RAN
|
|
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='payroll_weeks' AND policyname='tenant_isolation'
|
|
ALTER TABLE core.payroll_weeks ENABLE ROW LEVEL SECURITY;
|
|
CREATE POLICY tenant_isolation ON core.payroll_weeks
|
|
USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
|
|
WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);
|
|
|
|
--changeset panel:core-005e-rls-destajo-units endDelimiter:; splitStatements:true
|
|
--preconditions onFail:MARK_RAN
|
|
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='destajo_units' AND policyname='tenant_isolation'
|
|
ALTER TABLE core.destajo_units ENABLE ROW LEVEL SECURITY;
|
|
CREATE POLICY tenant_isolation ON core.destajo_units
|
|
USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
|
|
WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);
|
|
|
|
--changeset panel:core-005f-rls-destajo-periods endDelimiter:; splitStatements:true
|
|
--preconditions onFail:MARK_RAN
|
|
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='destajo_periods' AND policyname='tenant_isolation'
|
|
ALTER TABLE core.destajo_periods ENABLE ROW LEVEL SECURITY;
|
|
CREATE POLICY tenant_isolation ON core.destajo_periods
|
|
USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
|
|
WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);
|
|
|
|
--changeset panel:core-005g-rls-destajo-jobs endDelimiter:; splitStatements:true
|
|
--preconditions onFail:MARK_RAN
|
|
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='destajo_jobs' AND policyname='tenant_isolation'
|
|
ALTER TABLE core.destajo_jobs ENABLE ROW LEVEL SECURITY;
|
|
CREATE POLICY tenant_isolation ON core.destajo_jobs
|
|
USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
|
|
WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);
|