Basis: Certvia dev@a48c5fb als Fundament für Craftvia
Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -0,0 +1,391 @@
|
||||
-- ============================================================================
|
||||
-- F-04: Row Level Security scharfschalten (FORCE + WITH CHECK + Kontext)
|
||||
-- ============================================================================
|
||||
-- Diese Migration enthält NUR SQL (keine Schemaänderung) und ist idempotent.
|
||||
--
|
||||
-- Ziel: Die in den bisherigen Migrationen definierten `tenant_isolation`-Policies
|
||||
-- werden für die eingeschränkte App-Rolle `isms_app` (NOBYPASSRLS) wirksam.
|
||||
--
|
||||
-- Warum FORCE für den Owner UNSCHÄDLICH ist:
|
||||
-- PostgreSQL wendet RLS auf einen Superuser bzw. eine Rolle mit BYPASSRLS NIE
|
||||
-- an — auch nicht unter FORCE ROW LEVEL SECURITY. Die Owner-/Migrations-Rolle
|
||||
-- `isms` ist Superuser + BYPASSRLS, sieht also weiterhin ALLE Zeilen. Deshalb
|
||||
-- bleiben Migrationen, Seed und der mandantenübergreifende Login-Lookup (die
|
||||
-- über `DATABASE_URL` = Owner laufen) voll funktionsfähig. FORCE greift nur für
|
||||
-- `isms_app`. WICHTIG für Prod: Die Owner-/Migrate-Rolle MUSS BYPASSRLS bzw.
|
||||
-- Superuser sein, sonst sähe der Login keine Nutzer (null Zeilen).
|
||||
--
|
||||
-- Warum WITH CHECK zwingend nötig ist (INSERT-Falle):
|
||||
-- Unter FORCE ROW LEVEL SECURITY lehnt Postgres jeden INSERT/UPDATE ab, dessen
|
||||
-- Zielzeile keine WITH-CHECK-Policy erfüllt. Die bisherigen Policies hatten nur
|
||||
-- USING (Lesefilter), KEIN WITH CHECK → damit würde `isms_app` KEINE Zeile mehr
|
||||
-- anlegen können. Jede Policy erhält deshalb hier zusätzlich
|
||||
-- `WITH CHECK (tenant_id = current_setting('app.tenant_id', true))`, sodass nur
|
||||
-- Zeilen des aktiven Mandanten geschrieben werden dürfen (verhindert auch das
|
||||
-- „Umschreiben" einer Zeile auf einen fremden Mandanten).
|
||||
--
|
||||
-- Wie der Kontext gesetzt wird:
|
||||
-- `current_setting('app.tenant_id', true)` liest den GUC-Parameter (2. Arg true
|
||||
-- = kein Fehler, wenn ungesetzt → NULL). Die App setzt ihn TRANSAKTIONSLOKAL via
|
||||
-- `SELECT set_config('app.tenant_id', <tenantId>, true)` in derselben Transaktion
|
||||
-- wie die eigentliche Operation (siehe src/server/db.ts, dbForTenant, RLS-Pfad).
|
||||
-- Ist der Kontext NICHT gesetzt, ergibt `tenant_id = NULL` → NULL (nicht TRUE):
|
||||
-- `isms_app` sieht dann 0 Zeilen (fail-closed). Genau deshalb MUSS das
|
||||
-- Scharfschalten zusammen mit der Kontextsetzung (RLS_ENFORCED=true) erfolgen.
|
||||
--
|
||||
-- App-Rolle / Secret (NICHT in dieser Migration):
|
||||
-- `isms_app` existiert bereits (NOLOGIN, NOBYPASSRLS, mit GRANTs). Für den
|
||||
-- scharfen Betrieb braucht sie LOGIN + starkes Passwort — das ist ein SECRET und
|
||||
-- gehört NICHT in versioniertes SQL. Setze es operativ (einmalig), z. B.:
|
||||
-- ALTER ROLE isms_app WITH LOGIN PASSWORD '<stark>';
|
||||
-- und verbinde die App über RLS_DATABASE_URL als isms_app (RLS_ENFORCED=true).
|
||||
-- Siehe docs/DEPLOY-PROD-CONTABO.md und .env.prod.example.
|
||||
--
|
||||
-- Idempotenz: ENABLE/FORCE sind idempotent; die Policy wird vor CREATE via
|
||||
-- DROP POLICY IF EXISTS entfernt (deckt Gruppe A = 12 bestehende USING-only-
|
||||
-- Policies und Gruppe B = 37 ohne Policy einheitlich ab).
|
||||
-- ============================================================================
|
||||
|
||||
ALTER TABLE "asset_relations" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "asset_relations";
|
||||
CREATE POLICY tenant_isolation ON "asset_relations"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "asset_relations" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "assets" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "assets";
|
||||
CREATE POLICY tenant_isolation ON "assets"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "assets" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "audit_logs" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "audit_logs";
|
||||
CREATE POLICY tenant_isolation ON "audit_logs"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "audit_logs" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "bia_entries" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "bia_entries";
|
||||
CREATE POLICY tenant_isolation ON "bia_entries"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "bia_entries" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "measures" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "measures";
|
||||
CREATE POLICY tenant_isolation ON "measures"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "measures" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "process_assets" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "process_assets";
|
||||
CREATE POLICY tenant_isolation ON "process_assets"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "process_assets" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "processes" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "processes";
|
||||
CREATE POLICY tenant_isolation ON "processes"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "processes" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "risk_assets" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "risk_assets";
|
||||
CREATE POLICY tenant_isolation ON "risk_assets"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "risk_assets" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "risk_measures" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "risk_measures";
|
||||
CREATE POLICY tenant_isolation ON "risk_measures"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "risk_measures" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "risks" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "risks";
|
||||
CREATE POLICY tenant_isolation ON "risks"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "risks" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "roles" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "roles";
|
||||
CREATE POLICY tenant_isolation ON "roles"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "roles" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "users" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "users";
|
||||
CREATE POLICY tenant_isolation ON "users"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "users" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "tasks" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "tasks";
|
||||
CREATE POLICY tenant_isolation ON "tasks"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "tasks" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "task_comments" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "task_comments";
|
||||
CREATE POLICY tenant_isolation ON "task_comments"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "task_comments" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "managed_registers" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "managed_registers";
|
||||
CREATE POLICY tenant_isolation ON "managed_registers"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "managed_registers" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "register_rows" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "register_rows";
|
||||
CREATE POLICY tenant_isolation ON "register_rows"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "register_rows" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "onboarding_progress" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "onboarding_progress";
|
||||
CREATE POLICY tenant_isolation ON "onboarding_progress"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "onboarding_progress" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "wizard_facts" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "wizard_facts";
|
||||
CREATE POLICY tenant_isolation ON "wizard_facts"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "wizard_facts" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "wizard_scopes" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "wizard_scopes";
|
||||
CREATE POLICY tenant_isolation ON "wizard_scopes"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "wizard_scopes" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "policy_package_states" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "policy_package_states";
|
||||
CREATE POLICY tenant_isolation ON "policy_package_states"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "policy_package_states" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "tenant_settings" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "tenant_settings";
|
||||
CREATE POLICY tenant_isolation ON "tenant_settings"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "tenant_settings" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "tenant_modules" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "tenant_modules";
|
||||
CREATE POLICY tenant_isolation ON "tenant_modules"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "tenant_modules" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "supplier_profiles" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "supplier_profiles";
|
||||
CREATE POLICY tenant_isolation ON "supplier_profiles"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "supplier_profiles" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "it_service_profiles" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "it_service_profiles";
|
||||
CREATE POLICY tenant_isolation ON "it_service_profiles"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "it_service_profiles" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "software_profiles" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "software_profiles";
|
||||
CREATE POLICY tenant_isolation ON "software_profiles"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "software_profiles" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "project_profiles" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "project_profiles";
|
||||
CREATE POLICY tenant_isolation ON "project_profiles"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "project_profiles" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "supplier_assessments" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "supplier_assessments";
|
||||
CREATE POLICY tenant_isolation ON "supplier_assessments"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "supplier_assessments" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "contracts" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "contracts";
|
||||
CREATE POLICY tenant_isolation ON "contracts"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "contracts" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "ndas" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "ndas";
|
||||
CREATE POLICY tenant_isolation ON "ndas"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "ndas" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "supplier_evidence" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "supplier_evidence";
|
||||
CREATE POLICY tenant_isolation ON "supplier_evidence"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "supplier_evidence" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "service_control_responsibilities" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "service_control_responsibilities";
|
||||
CREATE POLICY tenant_isolation ON "service_control_responsibilities"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "service_control_responsibilities" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "subcontractors" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "subcontractors";
|
||||
CREATE POLICY tenant_isolation ON "subcontractors"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "subcontractors" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "management_decisions" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "management_decisions";
|
||||
CREATE POLICY tenant_isolation ON "management_decisions"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "management_decisions" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "maturity_assessments" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "maturity_assessments";
|
||||
CREATE POLICY tenant_isolation ON "maturity_assessments"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "maturity_assessments" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "control_assessments" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "control_assessments";
|
||||
CREATE POLICY tenant_isolation ON "control_assessments"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "control_assessments" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "control_implementations" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "control_implementations";
|
||||
CREATE POLICY tenant_isolation ON "control_implementations"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "control_implementations" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "policy_documents" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "policy_documents";
|
||||
CREATE POLICY tenant_isolation ON "policy_documents"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "policy_documents" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "policy_requirements" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "policy_requirements";
|
||||
CREATE POLICY tenant_isolation ON "policy_requirements"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "policy_requirements" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "policy_variables" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "policy_variables";
|
||||
CREATE POLICY tenant_isolation ON "policy_variables"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "policy_variables" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "policy_baseline_params" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "policy_baseline_params";
|
||||
CREATE POLICY tenant_isolation ON "policy_baseline_params"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "policy_baseline_params" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "policy_evidence" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "policy_evidence";
|
||||
CREATE POLICY tenant_isolation ON "policy_evidence"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "policy_evidence" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "crypto_entries" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "crypto_entries";
|
||||
CREATE POLICY tenant_isolation ON "crypto_entries"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "crypto_entries" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "classification_classes" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "classification_classes";
|
||||
CREATE POLICY tenant_isolation ON "classification_classes"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "classification_classes" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "handling_aspects" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "handling_aspects";
|
||||
CREATE POLICY tenant_isolation ON "handling_aspects"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "handling_aspects" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "handling_rules" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "handling_rules";
|
||||
CREATE POLICY tenant_isolation ON "handling_rules"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "handling_rules" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "risk_matrix_classes" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "risk_matrix_classes";
|
||||
CREATE POLICY tenant_isolation ON "risk_matrix_classes"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "risk_matrix_classes" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "risk_ew_levels" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "risk_ew_levels";
|
||||
CREATE POLICY tenant_isolation ON "risk_ew_levels"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "risk_ew_levels" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "risk_damage_dimensions" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "risk_damage_dimensions";
|
||||
CREATE POLICY tenant_isolation ON "risk_damage_dimensions"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "risk_damage_dimensions" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
ALTER TABLE "handbook_topics" ENABLE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS tenant_isolation ON "handbook_topics";
|
||||
CREATE POLICY tenant_isolation ON "handbook_topics"
|
||||
USING ("tenant_id" = current_setting('app.tenant_id', true))
|
||||
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
|
||||
ALTER TABLE "handbook_topics" FORCE ROW LEVEL SECURITY;
|
||||
|
||||
Reference in New Issue
Block a user