hacklab
0ff1484a6e
Migration 042 enables and forces the tenant_isolation policy on media_assets with an explicit WITH CHECK; media and publishing queries also scope by app.workspace_id.
11 lines
572 B
SQL
11 lines
572 B
SQL
-- 042: media_assets row-level security.
|
|
--
|
|
-- Enable and force the tenant_isolation policy declared in 038, with an
|
|
-- explicit WITH CHECK. All media_assets queries run inside withTenant.
|
|
|
|
ALTER TABLE media_assets ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE media_assets FORCE ROW LEVEL SECURITY;
|
|
DROP POLICY IF EXISTS tenant_isolation ON media_assets;
|
|
CREATE POLICY tenant_isolation ON media_assets
|
|
USING (workspace_id = NULLIF(current_setting('app.workspace_id', true), '')::uuid)
|
|
WITH CHECK (workspace_id = NULLIF(current_setting('app.workspace_id', true), '')::uuid);
|