35 lines
1.8 KiB
SQL
35 lines
1.8 KiB
SQL
-- R-P11a Global Search isolation rollout artifact.
|
|
-- Companion to prisma/rls/tenant-isolation.sql. These tables are tenant-scoped
|
|
-- metadata around Meilisearch documents and recent searches. Activate only once
|
|
-- every runtime access uses withTenantRLS() and therefore sets app.tenant_id.
|
|
--
|
|
-- Verification:
|
|
-- psql "$DIRECT_URL" -f prisma/rls/search-isolation.sql
|
|
|
|
ALTER TABLE "SearchIndexEntry" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "SearchIndexEntry" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_search_index_entry" ON "SearchIndexEntry";
|
|
CREATE POLICY "tenant_isolation_search_index_entry" ON "SearchIndexEntry"
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
ALTER TABLE "RecentSearch" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "RecentSearch" FORCE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS "tenant_isolation_recent_search" ON "RecentSearch";
|
|
CREATE POLICY "tenant_isolation_recent_search" ON "RecentSearch"
|
|
USING ("tenantId" = current_setting('app.tenant_id', true))
|
|
WITH CHECK ("tenantId" = current_setting('app.tenant_id', true));
|
|
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON "SearchIndexEntry", "RecentSearch" TO hivegrid_app;
|
|
|
|
-- Inverse SQL (coordinated rollback):
|
|
-- REVOKE SELECT, INSERT, UPDATE, DELETE ON "SearchIndexEntry", "RecentSearch" FROM hivegrid_app;
|
|
-- DROP POLICY IF EXISTS "tenant_isolation_search_index_entry" ON "SearchIndexEntry";
|
|
-- ALTER TABLE "SearchIndexEntry" NO FORCE ROW LEVEL SECURITY;
|
|
-- ALTER TABLE "SearchIndexEntry" DISABLE ROW LEVEL SECURITY;
|
|
-- DROP POLICY IF EXISTS "tenant_isolation_recent_search" ON "RecentSearch";
|
|
-- ALTER TABLE "RecentSearch" NO FORCE ROW LEVEL SECURITY;
|
|
-- ALTER TABLE "RecentSearch" DISABLE ROW LEVEL SECURITY;
|