39 lines
1.2 KiB
SQL
39 lines
1.2 KiB
SQL
-- Idempotent: enable RLS + tenant policies on agent_runs
|
|
-- Safe to re-run.
|
|
|
|
alter table public.agent_runs enable row level security;
|
|
|
|
drop policy if exists agent_runs_tenant_select on public.agent_runs;
|
|
drop policy if exists agent_runs_tenant_insert on public.agent_runs;
|
|
drop policy if exists agent_runs_tenant_update on public.agent_runs;
|
|
|
|
create policy agent_runs_tenant_select on public.agent_runs
|
|
for select using (
|
|
tenant_id::text = coalesce(
|
|
auth.jwt() -> 'app_metadata' ->> 'tenant_id',
|
|
auth.jwt() -> 'user_metadata' ->> 'tenant_id'
|
|
)
|
|
);
|
|
|
|
create policy agent_runs_tenant_insert on public.agent_runs
|
|
for insert with check (
|
|
tenant_id::text = coalesce(
|
|
auth.jwt() -> 'app_metadata' ->> 'tenant_id',
|
|
auth.jwt() -> 'user_metadata' ->> 'tenant_id'
|
|
)
|
|
);
|
|
|
|
create policy agent_runs_tenant_update on public.agent_runs
|
|
for update using (
|
|
tenant_id::text = coalesce(
|
|
auth.jwt() -> 'app_metadata' ->> 'tenant_id',
|
|
auth.jwt() -> 'user_metadata' ->> 'tenant_id'
|
|
)
|
|
);
|
|
|
|
-- Verify
|
|
select c.relname, c.relrowsecurity
|
|
from pg_class c
|
|
join pg_namespace n on n.oid = c.relnamespace
|
|
where n.nspname = 'public' and c.relname = 'agent_runs';
|