archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2025-12-14 08:14:03 +00:00
Code Activity

Move and update force RLS comment

Browse source
This commit is contained in:
lukinovec 2025-01-14 16:16:52 +01:00
parent cf8546fe84
commit 3fabdf8f33
1 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/Commands/CreateUserWithRLSPolicies.php
View file

@ -22,6 +22,14 @@ class CreateUserWithRLSPolicies extends Command
protected $description = "Creates RLS policies for all tables related to the tenant table. Also creates the RLS user if it doesn't exist yet"; protected $description = "Creates RLS policies for all tables related to the tenant table. Also creates the RLS user if it doesn't exist yet";
/**
* Force RLS scoping on the tables, so that the table owner users
* don't bypass the scoping (table owners bypass RLS by default).
*
* E.g. when using a custom implementation where you create tables as the RLS user,
* the queries won't be scoped for the RLS user unless we force the RLS scoping using
* the `ALTER TABLE {$table} FORCE ROW LEVEL SECURITY` query in the `enableRLS` method.
*/
public static bool $forceRls = true; public static bool $forceRls = true;
public function handle(PermissionControlledPostgreSQLSchemaManager $manager): int public function handle(PermissionControlledPostgreSQLSchemaManager $manager): int
@ -52,13 +60,6 @@ class CreateUserWithRLSPolicies extends Command
DB::statement("ALTER TABLE {$table} ENABLE ROW LEVEL SECURITY"); DB::statement("ALTER TABLE {$table} ENABLE ROW LEVEL SECURITY");
if (static::$forceRls) { if (static::$forceRls) {
/**
* Force RLS scoping on the table, so that the table owner users
* don't bypass the scoping – table owners bypass RLS by default.
*
* E.g. when using a custom implementation where you create tables as the RLS user,
* the queries won't be scoped for the RLS user unless we force the RLS scoping using this query.
*/
DB::statement("ALTER TABLE {$table} FORCE ROW LEVEL SECURITY"); DB::statement("ALTER TABLE {$table} FORCE ROW LEVEL SECURITY");
} }
} }