79 lines
1.9 KiB
Markdown
79 lines
1.9 KiB
Markdown
# AwoooP RLS Canary Wave 1
|
|
|
|
This wave is a staged apply package only. It enables fail-closed RLS on tables
|
|
that were empty in the latest production preflight.
|
|
|
|
Apply script:
|
|
|
|
```bash
|
|
scripts/ops/awooop-rls-canary-wave1-empty-tables.sql
|
|
```
|
|
|
|
Rollback script:
|
|
|
|
```bash
|
|
scripts/ops/awooop-rls-canary-wave1-empty-tables-rollback.sql
|
|
```
|
|
|
|
## Scope
|
|
|
|
Wave 1 targets only tables that had `total_rows=0` and
|
|
`null_project_id_rows=0` on 2026-05-12:
|
|
|
|
- `awooop_contract_revisions`
|
|
- `awooop_conversation_event`
|
|
- `awooop_mcp_credential_refs`
|
|
- `awooop_mcp_gateway_audit`
|
|
- `awooop_mcp_grants`
|
|
- `budget_ledger`
|
|
|
|
The SQL aborts if any target now has rows, is missing, lacks `project_id`, or
|
|
contains NULL `project_id`.
|
|
|
|
## Pre-Apply Gate
|
|
|
|
Run these before any production apply:
|
|
|
|
```bash
|
|
python3 scripts/ops/awooop-rls-access-audit.py
|
|
python3 scripts/ops/awooop-rls-manual-script-audit.py
|
|
bash scripts/ops/awooop-rls-preflight.sh --exact-counts
|
|
```
|
|
|
|
Expected before wave1 apply:
|
|
|
|
- Runtime access audit: `BLOCKED=0`.
|
|
- Manual script audit: `BLOCKED=0`; review items acknowledged.
|
|
- RLS preflight: still blocked only because policies are not enabled.
|
|
- Exact counts for the six wave1 target tables remain `total_rows=0`.
|
|
|
|
## Apply
|
|
|
|
Run with a migration/operator role in a reviewed maintenance window:
|
|
|
|
```bash
|
|
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 \
|
|
-f scripts/ops/awooop-rls-canary-wave1-empty-tables.sql
|
|
```
|
|
|
|
Then rerun:
|
|
|
|
```bash
|
|
bash scripts/ops/awooop-rls-preflight.sh --exact-counts
|
|
curl -fsS https://awoooi.wooo.work/api/v1/health
|
|
```
|
|
|
|
The global preflight will still be blocked until later waves cover the remaining
|
|
tables. The six wave1 tables should show `rls=true`, `force=true`, and
|
|
`policies=1`, with no fail-open policy expression.
|
|
|
|
## Rollback
|
|
|
|
```bash
|
|
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 \
|
|
-f scripts/ops/awooop-rls-canary-wave1-empty-tables-rollback.sql
|
|
```
|
|
|
|
Rollback disables RLS and removes only the wave1 policies on the six canary
|
|
tables. It does not modify data.
|