hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

chore(db): force row-level security on media_assets

Browse source 
Migration 042 enables and forces the tenant_isolation policy on
media_assets with an explicit WITH CHECK; media and publishing queries
also scope by app.workspace_id.
This commit is contained in:
hacklab 2026-10-15 14:15:03 +02:00
parent ad0f1be6cf
commit fb81fab7bb
3 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
apps/api/migrations/042_media_assets_rls.sql Normal file
View file

@ -0,0 +1,11 @@
-- 042: media_assets row-level security.
--
-- Enable and force the tenant_isolation policy declared in 038, with an
-- explicit WITH CHECK. All media_assets queries run inside withTenant.
ALTER TABLE media_assets ENABLE ROW LEVEL SECURITY;
ALTER TABLE media_assets FORCE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON media_assets;
CREATE POLICY tenant_isolation ON media_assets
USING (workspace_id = NULLIF(current_setting('app.workspace_id', true), '')::uuid)
WITH CHECK (workspace_id = NULLIF(current_setting('app.workspace_id', true), '')::uuid);