98 lines
5.0 KiB
SQL
98 lines
5.0 KiB
SQL
-- R-P12a Automation isolation artifact.
|
|
-- Companion to prisma/rls/tenant-isolation.sql. Enable during the merge
|
|
-- migration once the schema lands and the automation service has shipped.
|
|
-- Global template catalog writes must run through a separately privileged
|
|
-- deploy/seed path. The tenant runtime may read global templates, but may only
|
|
-- create, update, or delete rows belonging to its active tenant.
|
|
--
|
|
-- Verification:
|
|
-- psql "$DIRECT_URL" -f prisma/rls/automation-isolation.sql
|
|
|
|
ALTER TABLE "AutomationRule" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "AutomationRule" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_rule" ON "AutomationRule";
|
|
CREATE POLICY "tenant_isolation_automation_rule" ON "AutomationRule"
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
ALTER TABLE "AutomationRuleStep" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "AutomationRuleStep" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_rule_step" ON "AutomationRuleStep";
|
|
CREATE POLICY "tenant_isolation_automation_rule_step" ON "AutomationRuleStep"
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
ALTER TABLE "AutomationExecution" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "AutomationExecution" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_execution" ON "AutomationExecution";
|
|
CREATE POLICY "tenant_isolation_automation_execution" ON "AutomationExecution"
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
ALTER TABLE "AutomationStepExecution" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "AutomationStepExecution" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_step_execution" ON "AutomationStepExecution";
|
|
CREATE POLICY "tenant_isolation_automation_step_execution" ON "AutomationStepExecution"
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
ALTER TABLE "AutomationCredential" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "AutomationCredential" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_credential" ON "AutomationCredential";
|
|
CREATE POLICY "tenant_isolation_automation_credential" ON "AutomationCredential"
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
ALTER TABLE "AutomationTemplate" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "AutomationTemplate" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_template" ON "AutomationTemplate";
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_template_select" ON "AutomationTemplate";
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_template_insert" ON "AutomationTemplate";
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_template_update" ON "AutomationTemplate";
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_template_delete" ON "AutomationTemplate";
|
|
|
|
CREATE POLICY "tenant_isolation_automation_template_select" ON "AutomationTemplate"
|
|
FOR SELECT
|
|
USING ("tenantId" IS NULL OR "tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
CREATE POLICY "tenant_isolation_automation_template_insert" ON "AutomationTemplate"
|
|
FOR INSERT
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
CREATE POLICY "tenant_isolation_automation_template_update" ON "AutomationTemplate"
|
|
FOR UPDATE
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
CREATE POLICY "tenant_isolation_automation_template_delete" ON "AutomationTemplate"
|
|
FOR DELETE
|
|
USING ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
ALTER TABLE "AutomationTriggerMeter" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "AutomationTriggerMeter" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_automation_trigger_meter" ON "AutomationTriggerMeter";
|
|
CREATE POLICY "tenant_isolation_automation_trigger_meter" ON "AutomationTriggerMeter"
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON "AutomationRule" TO hivegrid_app;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON "AutomationRuleStep" TO hivegrid_app;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON "AutomationExecution" TO hivegrid_app;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON "AutomationStepExecution" TO hivegrid_app;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON "AutomationCredential" TO hivegrid_app;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON "AutomationTemplate" TO hivegrid_app;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON "AutomationTriggerMeter" TO hivegrid_app;
|
|
|
|
-- Inverse per table:
|
|
-- REVOKE SELECT, INSERT, UPDATE, DELETE ON "<table>" FROM hivegrid_app;
|
|
-- DROP POLICY IF EXISTS "<policy>" ON "<table>";
|
|
-- ALTER TABLE "<table>" NO FORCE ROW LEVEL SECURITY;
|
|
-- ALTER TABLE "<table>" DISABLE ROW LEVEL SECURITY;
|