fix(rls): 收斂 API DB access context

2026-05-12 19:55:13 +08:00
parent 33c0577e93
commit ff30c61c4c
16 changed files with 327 additions and 55 deletions
--- a/apps/api/src/db/base.py
+++ b/apps/api/src/db/base.py
@@ -106,10 +106,13 @@ async def get_db() -> AsyncGenerator[AsyncSession, None]:
    factory = get_session_factory()
    async with factory() as session:
        try:
+            from src.core.context import get_current_project_id
+
            # AwoooP Phase 2.3 (2026-05-04 ogt): SET LOCAL app.project_id 讓 RLS Policy 生效
-            # 預設 'awoooi'，多租戶路由將在 middleware 注入實際 project_id
+            # 預設 'awoooi'，多租戶路由將透過 contextvar 注入實際 project_id
            await session.execute(
-                text("SELECT set_config('app.project_id', 'awoooi', TRUE)")
+                text("SELECT set_config('app.project_id', :pid, TRUE)"),
+                {"pid": get_current_project_id()},
            )
            yield session
            await session.commit()