69eac9ffaa
- Create src/lib/prisma-tenant.ts:
- withTenantContext(tenantId) / createTenantPrisma — Prisma $extends client
- Intercepts findMany, findFirst, findUnique, create, createMany, update,
updateMany, delete, deleteMany, upsert, count, aggregate, groupBy on User
- Auto-injects tenantId filter on all reads, writes, and deletes
- setTenantRLS() helper for explicit RLS enforcement in transactions
- TENANT_SCOPED_MODELS constant for future extensibility
- Create prisma/migrations/20260304104214_initial_schema — baseline migration
capturing schema created by initial db push
- Create prisma/migrations/20260304104245_add_rls_policies:
- ALTER TABLE User ENABLE ROW LEVEL SECURITY
- CREATE POLICY tenant_isolation_user USING app.current_tenant_id session var
- Defense-in-depth architecture comments explaining primary vs secondary enforcement
- Create src/lib/__tests__/tenant-isolation.test.ts (6 tests, all passing):
- Test 1: Tenant A context returns only Tenant A's users (zero from B)
- Test 2: Tenant B context returns only Tenant B's users (zero from A)
- Test 3: create() auto-sets tenantId, invisible to other tenant
- Test 4: findUnique by Tenant B's ID under Tenant A context returns null
- Additional: findFirst cross-tenant blocked, count() is tenant-scoped
61 lines
2.0 KiB
SQL
61 lines
2.0 KiB
SQL
-- =============================================================================
|
|
-- Initial Schema Migration
|
|
-- Created as a baseline to capture the state created by `prisma db push`
|
|
-- during project initialization (01-01-PLAN.md).
|
|
--
|
|
-- This migration is marked as applied without running it (baseline approach)
|
|
-- since the schema already exists in the database from the initial db push.
|
|
-- =============================================================================
|
|
|
|
-- CreateEnum
|
|
CREATE TYPE "TenantStatus" AS ENUM ('ACTIVE', 'PENDING_SUSPENSION', 'SUSPENDED');
|
|
|
|
-- CreateEnum
|
|
CREATE TYPE "Role" AS ENUM ('ADMIN', 'OFFICE_STAFF', 'COLLECTOR', 'TECHNICIAN', 'CLIENT');
|
|
|
|
-- CreateTable
|
|
CREATE TABLE "Tenant" (
|
|
"id" TEXT NOT NULL,
|
|
"name" TEXT NOT NULL,
|
|
"slug" TEXT NOT NULL,
|
|
"ownerEmail" TEXT NOT NULL,
|
|
"businessAddress" TEXT,
|
|
"contactPhone" TEXT,
|
|
"status" "TenantStatus" NOT NULL DEFAULT 'ACTIVE',
|
|
"suspendedAt" TIMESTAMP(3),
|
|
"gracePeriodEndsAt" TIMESTAMP(3),
|
|
"createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
"updatedAt" TIMESTAMP(3) NOT NULL,
|
|
|
|
CONSTRAINT "Tenant_pkey" PRIMARY KEY ("id")
|
|
);
|
|
|
|
-- CreateTable
|
|
CREATE TABLE "User" (
|
|
"id" TEXT NOT NULL,
|
|
"email" TEXT NOT NULL,
|
|
"passwordHash" TEXT NOT NULL,
|
|
"firstName" TEXT NOT NULL,
|
|
"lastName" TEXT NOT NULL,
|
|
"tenantId" TEXT,
|
|
"roles" "Role"[],
|
|
"isActive" BOOLEAN NOT NULL DEFAULT true,
|
|
"isSuperAdmin" BOOLEAN NOT NULL DEFAULT false,
|
|
"createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
"updatedAt" TIMESTAMP(3) NOT NULL,
|
|
|
|
CONSTRAINT "User_pkey" PRIMARY KEY ("id")
|
|
);
|
|
|
|
-- CreateIndex
|
|
CREATE UNIQUE INDEX "Tenant_slug_key" ON "Tenant"("slug");
|
|
|
|
-- CreateIndex
|
|
CREATE INDEX "User_tenantId_idx" ON "User"("tenantId");
|
|
|
|
-- CreateIndex
|
|
CREATE UNIQUE INDEX "User_email_tenantId_key" ON "User"("email", "tenantId");
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "User" ADD CONSTRAINT "User_tenantId_fkey" FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|