rls

backend/src/state.rs

@@ -12,7 +12,7 @@ use crate::{
     db::PgPool,
     error::{AppError, AppResult},
     storage::{ObjectStorage, TenantStorage},
-    tenants::{apply_tenant_guc, TenantService},
+    tenants::{apply_tenant_guc, clear_tenant_context, clear_user_guc, TenantService},
 };
 
 pub type PgPooledConnection = PooledConnection<ConnectionManager<PgConnection>>;
@@ -75,14 +75,17 @@ impl AppState {
         debug_assert!(!tenant_id.is_nil(), "nil tenant_id passed to db_for_tenant");
         let mut conn = self.db_unscoped()?;
         apply_tenant_guc(&mut conn, tenant_id)?;
+        clear_user_guc(&mut conn)?;
         Ok(conn)
     }
 
     pub(crate) fn db_unscoped(&self) -> AppResult<PgPooledConnection> {
-        self.pool.get().map_err(|err| {
+        let mut conn = self.pool.get().map_err(|err| {
             tracing::error!(error = ?err, "database pool error");
             AppError::internal("database pool error")
-        })
+        })?;
+        clear_tenant_context(&mut conn)?;
+        Ok(conn)
     }
 
     pub fn storage_for_tenant(&self, tenant_id: Uuid) -> AppResult<TenantStorage> {