rls

2025-10-31 19:13:11 +01:00
parent 2d8a4432cc
commit 175387f0d3
19 changed files with 463 additions and 107 deletions
@@ -15,6 +15,16 @@ This creates windows for the compose stack, frontend dev server, backend API, an
 background worker using the repository-relative paths defined in the tmux file.
 Detach with `Ctrl+b d` and reattach later with the same command.

+The development Postgres container now seeds two database roles:
+
+- `papercrate_app_login` (password `papercrate_app`) is used by the backend and
+  is subject to row-level security policies.
+- `papercrate` remains the owner role for running Diesel migrations or other
+  maintenance tasks.
+
+When connecting manually to inspect RLS behaviour, switch to the application
+role with `SET ROLE papercrate_app_login;` before querying tenant tables.
+
 ## Backend Integration Tests

 Integration tests require a running Postgres instance (and, optionally, Quickwit