69eac9ffaa
- Create src/lib/prisma-tenant.ts:
- withTenantContext(tenantId) / createTenantPrisma — Prisma $extends client
- Intercepts findMany, findFirst, findUnique, create, createMany, update,
updateMany, delete, deleteMany, upsert, count, aggregate, groupBy on User
- Auto-injects tenantId filter on all reads, writes, and deletes
- setTenantRLS() helper for explicit RLS enforcement in transactions
- TENANT_SCOPED_MODELS constant for future extensibility
- Create prisma/migrations/20260304104214_initial_schema — baseline migration
capturing schema created by initial db push
- Create prisma/migrations/20260304104245_add_rls_policies:
- ALTER TABLE User ENABLE ROW LEVEL SECURITY
- CREATE POLICY tenant_isolation_user USING app.current_tenant_id session var
- Defense-in-depth architecture comments explaining primary vs secondary enforcement
- Create src/lib/__tests__/tenant-isolation.test.ts (6 tests, all passing):
- Test 1: Tenant A context returns only Tenant A's users (zero from B)
- Test 2: Tenant B context returns only Tenant B's users (zero from A)
- Test 3: create() auto-sets tenantId, invisible to other tenant
- Test 4: findUnique by Tenant B's ID under Tenant A context returns null
- Additional: findFirst cross-tenant blocked, count() is tenant-scoped
41 lines
2.0 KiB
SQL
41 lines
2.0 KiB
SQL
-- =============================================================================
|
|
-- PostgreSQL Row-Level Security (RLS) Policies
|
|
-- Defense-in-depth tenant isolation for NetForge
|
|
-- =============================================================================
|
|
--
|
|
-- ARCHITECTURE NOTE:
|
|
-- The primary multi-tenancy enforcement is at the application layer via
|
|
-- Prisma query extensions in src/lib/prisma-tenant.ts (withTenantContext).
|
|
--
|
|
-- RLS policies here serve as DEFENSE-IN-DEPTH:
|
|
-- - They catch bugs where application code bypasses the Prisma middleware
|
|
-- - They provide an independent enforcement layer at the database level
|
|
-- - They document data isolation intent in the database schema itself
|
|
--
|
|
-- IMPORTANT: The Prisma client connects as the database OWNER, which by
|
|
-- default bypasses RLS (PostgreSQL superusers and table owners bypass RLS
|
|
-- unless FORCE ROW LEVEL SECURITY is set on the table). This means these
|
|
-- policies will NOT block queries from the standard Prisma client unless
|
|
-- FORCE ROW LEVEL SECURITY is enabled, or a non-owner role is used.
|
|
--
|
|
-- To enforce RLS for a query, use setTenantRLS() from src/lib/prisma-tenant.ts
|
|
-- within a transaction before executing queries. This sets the session variable
|
|
-- app.current_tenant_id which the policy USING clause reads.
|
|
-- =============================================================================
|
|
|
|
-- Enable RLS on the User table
|
|
ALTER TABLE "User" ENABLE ROW LEVEL SECURITY;
|
|
|
|
-- Policy: tenant_isolation_user
|
|
-- Restricts access to rows matching the current tenant context.
|
|
-- The app.current_tenant_id session variable is set by setTenantRLS().
|
|
-- When no tenant context is set (super-admin operations), all rows are visible.
|
|
CREATE POLICY tenant_isolation_user ON "User"
|
|
USING (
|
|
"tenantId" = current_setting('app.current_tenant_id', true)::text
|
|
OR current_setting('app.current_tenant_id', true) IS NULL
|
|
OR current_setting('app.current_tenant_id', true) = ''
|
|
)
|
|
WITH CHECK (
|
|
"tenantId" = current_setting('app.current_tenant_id', true)::text
|
|
); |