msolarczek/craftvia
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
9ec7fa53565b3e72fb13eaa6093ccd8fd4f5be1b
craftvia/prisma/migrations/20260730160000_rls_enforce/migration.sql
T
msolarczekandClaude Opus 5 c8e6f30a27
CI / build-and-check (push) Canceled after 0s
Details
CI / audit (push) Canceled after 0s
Details
CI / sbom (push) Canceled after 0s
Details
Basis: Certvia dev@a48c5fb als Fundament für Craftvia 
Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation
und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 11:05:39 +02:00

392 lines
20 KiB
SQL
Raw Blame History

-- ============================================================================
-- F-04: Row Level Security scharfschalten (FORCE + WITH CHECK + Kontext)
-- ============================================================================
-- Diese Migration enthält NUR SQL (keine Schemaänderung) und ist idempotent.
--
-- Ziel: Die in den bisherigen Migrationen definierten `tenant_isolation`-Policies
-- werden für die eingeschränkte App-Rolle `isms_app` (NOBYPASSRLS) wirksam.
--
-- Warum FORCE für den Owner UNSCHÄDLICH ist:
-- PostgreSQL wendet RLS auf einen Superuser bzw. eine Rolle mit BYPASSRLS NIE
-- an — auch nicht unter FORCE ROW LEVEL SECURITY. Die Owner-/Migrations-Rolle
-- `isms` ist Superuser + BYPASSRLS, sieht also weiterhin ALLE Zeilen. Deshalb
-- bleiben Migrationen, Seed und der mandantenübergreifende Login-Lookup (die
-- über `DATABASE_URL` = Owner laufen) voll funktionsfähig. FORCE greift nur für
-- `isms_app`. WICHTIG für Prod: Die Owner-/Migrate-Rolle MUSS BYPASSRLS bzw.
-- Superuser sein, sonst sähe der Login keine Nutzer (null Zeilen).
--
-- Warum WITH CHECK zwingend nötig ist (INSERT-Falle):
-- Unter FORCE ROW LEVEL SECURITY lehnt Postgres jeden INSERT/UPDATE ab, dessen
-- Zielzeile keine WITH-CHECK-Policy erfüllt. Die bisherigen Policies hatten nur
-- USING (Lesefilter), KEIN WITH CHECK → damit würde `isms_app` KEINE Zeile mehr
-- anlegen können. Jede Policy erhält deshalb hier zusätzlich
-- `WITH CHECK (tenant_id = current_setting('app.tenant_id', true))`, sodass nur
-- Zeilen des aktiven Mandanten geschrieben werden dürfen (verhindert auch das
-- „Umschreiben" einer Zeile auf einen fremden Mandanten).
--
-- Wie der Kontext gesetzt wird:
-- `current_setting('app.tenant_id', true)` liest den GUC-Parameter (2. Arg true
-- = kein Fehler, wenn ungesetzt → NULL). Die App setzt ihn TRANSAKTIONSLOKAL via
-- `SELECT set_config('app.tenant_id', <tenantId>, true)` in derselben Transaktion
-- wie die eigentliche Operation (siehe src/server/db.ts, dbForTenant, RLS-Pfad).
-- Ist der Kontext NICHT gesetzt, ergibt `tenant_id = NULL` → NULL (nicht TRUE):
-- `isms_app` sieht dann 0 Zeilen (fail-closed). Genau deshalb MUSS das
-- Scharfschalten zusammen mit der Kontextsetzung (RLS_ENFORCED=true) erfolgen.
--
-- App-Rolle / Secret (NICHT in dieser Migration):
-- `isms_app` existiert bereits (NOLOGIN, NOBYPASSRLS, mit GRANTs). Für den
-- scharfen Betrieb braucht sie LOGIN + starkes Passwort — das ist ein SECRET und
-- gehört NICHT in versioniertes SQL. Setze es operativ (einmalig), z. B.:
-- ALTER ROLE isms_app WITH LOGIN PASSWORD '<stark>';
-- und verbinde die App über RLS_DATABASE_URL als isms_app (RLS_ENFORCED=true).
-- Siehe docs/DEPLOY-PROD-CONTABO.md und .env.prod.example.
--
-- Idempotenz: ENABLE/FORCE sind idempotent; die Policy wird vor CREATE via
-- DROP POLICY IF EXISTS entfernt (deckt Gruppe A = 12 bestehende USING-only-
-- Policies und Gruppe B = 37 ohne Policy einheitlich ab).
-- ============================================================================
ALTER TABLE "asset_relations" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "asset_relations";
CREATE POLICY tenant_isolation ON "asset_relations"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "asset_relations" FORCE ROW LEVEL SECURITY;
ALTER TABLE "assets" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "assets";
CREATE POLICY tenant_isolation ON "assets"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "assets" FORCE ROW LEVEL SECURITY;
ALTER TABLE "audit_logs" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "audit_logs";
CREATE POLICY tenant_isolation ON "audit_logs"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "audit_logs" FORCE ROW LEVEL SECURITY;
ALTER TABLE "bia_entries" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "bia_entries";
CREATE POLICY tenant_isolation ON "bia_entries"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "bia_entries" FORCE ROW LEVEL SECURITY;
ALTER TABLE "measures" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "measures";
CREATE POLICY tenant_isolation ON "measures"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "measures" FORCE ROW LEVEL SECURITY;
ALTER TABLE "process_assets" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "process_assets";
CREATE POLICY tenant_isolation ON "process_assets"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "process_assets" FORCE ROW LEVEL SECURITY;
ALTER TABLE "processes" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "processes";
CREATE POLICY tenant_isolation ON "processes"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "processes" FORCE ROW LEVEL SECURITY;
ALTER TABLE "risk_assets" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_assets";
CREATE POLICY tenant_isolation ON "risk_assets"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_assets" FORCE ROW LEVEL SECURITY;
ALTER TABLE "risk_measures" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_measures";
CREATE POLICY tenant_isolation ON "risk_measures"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_measures" FORCE ROW LEVEL SECURITY;
ALTER TABLE "risks" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risks";
CREATE POLICY tenant_isolation ON "risks"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risks" FORCE ROW LEVEL SECURITY;
ALTER TABLE "roles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "roles";
CREATE POLICY tenant_isolation ON "roles"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "roles" FORCE ROW LEVEL SECURITY;
ALTER TABLE "users" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "users";
CREATE POLICY tenant_isolation ON "users"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "users" FORCE ROW LEVEL SECURITY;
ALTER TABLE "tasks" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "tasks";
CREATE POLICY tenant_isolation ON "tasks"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "tasks" FORCE ROW LEVEL SECURITY;
ALTER TABLE "task_comments" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "task_comments";
CREATE POLICY tenant_isolation ON "task_comments"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "task_comments" FORCE ROW LEVEL SECURITY;
ALTER TABLE "managed_registers" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "managed_registers";
CREATE POLICY tenant_isolation ON "managed_registers"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "managed_registers" FORCE ROW LEVEL SECURITY;
ALTER TABLE "register_rows" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "register_rows";
CREATE POLICY tenant_isolation ON "register_rows"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "register_rows" FORCE ROW LEVEL SECURITY;
ALTER TABLE "onboarding_progress" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "onboarding_progress";
CREATE POLICY tenant_isolation ON "onboarding_progress"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "onboarding_progress" FORCE ROW LEVEL SECURITY;
ALTER TABLE "wizard_facts" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "wizard_facts";
CREATE POLICY tenant_isolation ON "wizard_facts"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "wizard_facts" FORCE ROW LEVEL SECURITY;
ALTER TABLE "wizard_scopes" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "wizard_scopes";
CREATE POLICY tenant_isolation ON "wizard_scopes"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "wizard_scopes" FORCE ROW LEVEL SECURITY;
ALTER TABLE "policy_package_states" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_package_states";
CREATE POLICY tenant_isolation ON "policy_package_states"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_package_states" FORCE ROW LEVEL SECURITY;
ALTER TABLE "tenant_settings" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "tenant_settings";
CREATE POLICY tenant_isolation ON "tenant_settings"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "tenant_settings" FORCE ROW LEVEL SECURITY;
ALTER TABLE "tenant_modules" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "tenant_modules";
CREATE POLICY tenant_isolation ON "tenant_modules"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "tenant_modules" FORCE ROW LEVEL SECURITY;
ALTER TABLE "supplier_profiles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "supplier_profiles";
CREATE POLICY tenant_isolation ON "supplier_profiles"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "supplier_profiles" FORCE ROW LEVEL SECURITY;
ALTER TABLE "it_service_profiles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "it_service_profiles";
CREATE POLICY tenant_isolation ON "it_service_profiles"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "it_service_profiles" FORCE ROW LEVEL SECURITY;
ALTER TABLE "software_profiles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "software_profiles";
CREATE POLICY tenant_isolation ON "software_profiles"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "software_profiles" FORCE ROW LEVEL SECURITY;
ALTER TABLE "project_profiles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "project_profiles";
CREATE POLICY tenant_isolation ON "project_profiles"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "project_profiles" FORCE ROW LEVEL SECURITY;
ALTER TABLE "supplier_assessments" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "supplier_assessments";
CREATE POLICY tenant_isolation ON "supplier_assessments"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "supplier_assessments" FORCE ROW LEVEL SECURITY;
ALTER TABLE "contracts" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "contracts";
CREATE POLICY tenant_isolation ON "contracts"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "contracts" FORCE ROW LEVEL SECURITY;
ALTER TABLE "ndas" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "ndas";
CREATE POLICY tenant_isolation ON "ndas"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "ndas" FORCE ROW LEVEL SECURITY;
ALTER TABLE "supplier_evidence" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "supplier_evidence";
CREATE POLICY tenant_isolation ON "supplier_evidence"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "supplier_evidence" FORCE ROW LEVEL SECURITY;
ALTER TABLE "service_control_responsibilities" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "service_control_responsibilities";
CREATE POLICY tenant_isolation ON "service_control_responsibilities"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "service_control_responsibilities" FORCE ROW LEVEL SECURITY;
ALTER TABLE "subcontractors" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "subcontractors";
CREATE POLICY tenant_isolation ON "subcontractors"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "subcontractors" FORCE ROW LEVEL SECURITY;
ALTER TABLE "management_decisions" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "management_decisions";
CREATE POLICY tenant_isolation ON "management_decisions"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "management_decisions" FORCE ROW LEVEL SECURITY;
ALTER TABLE "maturity_assessments" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "maturity_assessments";
CREATE POLICY tenant_isolation ON "maturity_assessments"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "maturity_assessments" FORCE ROW LEVEL SECURITY;
ALTER TABLE "control_assessments" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "control_assessments";
CREATE POLICY tenant_isolation ON "control_assessments"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "control_assessments" FORCE ROW LEVEL SECURITY;
ALTER TABLE "control_implementations" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "control_implementations";
CREATE POLICY tenant_isolation ON "control_implementations"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "control_implementations" FORCE ROW LEVEL SECURITY;
ALTER TABLE "policy_documents" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_documents";
CREATE POLICY tenant_isolation ON "policy_documents"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_documents" FORCE ROW LEVEL SECURITY;
ALTER TABLE "policy_requirements" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_requirements";
CREATE POLICY tenant_isolation ON "policy_requirements"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_requirements" FORCE ROW LEVEL SECURITY;
ALTER TABLE "policy_variables" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_variables";
CREATE POLICY tenant_isolation ON "policy_variables"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_variables" FORCE ROW LEVEL SECURITY;
ALTER TABLE "policy_baseline_params" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_baseline_params";
CREATE POLICY tenant_isolation ON "policy_baseline_params"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_baseline_params" FORCE ROW LEVEL SECURITY;
ALTER TABLE "policy_evidence" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_evidence";
CREATE POLICY tenant_isolation ON "policy_evidence"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_evidence" FORCE ROW LEVEL SECURITY;
ALTER TABLE "crypto_entries" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "crypto_entries";
CREATE POLICY tenant_isolation ON "crypto_entries"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "crypto_entries" FORCE ROW LEVEL SECURITY;
ALTER TABLE "classification_classes" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "classification_classes";
CREATE POLICY tenant_isolation ON "classification_classes"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "classification_classes" FORCE ROW LEVEL SECURITY;
ALTER TABLE "handling_aspects" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "handling_aspects";
CREATE POLICY tenant_isolation ON "handling_aspects"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "handling_aspects" FORCE ROW LEVEL SECURITY;
ALTER TABLE "handling_rules" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "handling_rules";
CREATE POLICY tenant_isolation ON "handling_rules"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "handling_rules" FORCE ROW LEVEL SECURITY;
ALTER TABLE "risk_matrix_classes" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_matrix_classes";
CREATE POLICY tenant_isolation ON "risk_matrix_classes"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_matrix_classes" FORCE ROW LEVEL SECURITY;
ALTER TABLE "risk_ew_levels" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_ew_levels";
CREATE POLICY tenant_isolation ON "risk_ew_levels"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_ew_levels" FORCE ROW LEVEL SECURITY;
ALTER TABLE "risk_damage_dimensions" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_damage_dimensions";
CREATE POLICY tenant_isolation ON "risk_damage_dimensions"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_damage_dimensions" FORCE ROW LEVEL SECURITY;
ALTER TABLE "handbook_topics" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "handbook_topics";
CREATE POLICY tenant_isolation ON "handbook_topics"
USING ("tenant_id" = current_setting('app.tenant_id', true))
WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "handbook_topics" FORCE ROW LEVEL SECURITY;
Reference in New Issue View Git Blame Copy Permalink