66 lines
1.8 KiB
Markdown
66 lines
1.8 KiB
Markdown
# AwoooP RLS Canary Wave 1.2
|
|
|
|
This wave targets:
|
|
|
|
- `awooop_projects`
|
|
|
|
Status: staged, apply pending.
|
|
|
|
## Safety Model
|
|
|
|
`awooop_projects` is special. Runtime checks such as MCP Gate 1 and budget
|
|
lookup should be tenant-scoped, but Operator Console needs a cross-tenant
|
|
project list.
|
|
|
|
Wave 1.2 keeps normal table access tenant-scoped and adds an explicit platform
|
|
read function:
|
|
|
|
```sql
|
|
public.awooop_operator_list_projects()
|
|
```
|
|
|
|
The function is `SECURITY DEFINER`, has a fixed `search_path`, returns only the
|
|
Operator Console project-list columns, and grants execute only to `awooop_app`.
|
|
|
|
## App Changes
|
|
|
|
- `platform_operator_service.list_tenants()` reads from
|
|
`awooop_operator_list_projects()`.
|
|
- `budget_service._get_tenant_budget_limit(project_id)` now opens
|
|
`get_db_context(project_id)`, so tenant budget reads match RLS context.
|
|
|
|
## Apply
|
|
|
|
```bash
|
|
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 \
|
|
-f scripts/ops/awooop-rls-canary-wave1-2-projects.sql
|
|
```
|
|
|
|
The SQL aborts if:
|
|
|
|
- table is missing,
|
|
- `project_id` is missing,
|
|
- any `project_id` is NULL,
|
|
- row count exceeds the reviewed canary cap of 20 rows.
|
|
|
|
## Verification
|
|
|
|
Expected after apply:
|
|
|
|
- `app.project_id='awoooi'`: direct table read sees only `awoooi`.
|
|
- `app.project_id='ewoooc'`: direct table read sees only `ewoooc`.
|
|
- `awooop_operator_list_projects()`: returns both projects for Operator Console.
|
|
- tenant budget lookup can read the matching tenant row.
|
|
- global RLS preflight remains blocked only by later-wave tables.
|
|
|
|
## Rollback
|
|
|
|
```bash
|
|
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 \
|
|
-f scripts/ops/awooop-rls-canary-wave1-2-projects-rollback.sql
|
|
```
|
|
|
|
Rollback disables RLS and removes the Wave1.2 policies on `awooop_projects`.
|
|
It intentionally keeps `awooop_operator_list_projects()` for deployed API
|
|
compatibility.
|