rls

backend/src/tenants.rs

@@ -128,13 +128,55 @@ impl TenantService {
 }
 
 pub fn apply_tenant_guc(conn: &mut PgConnection, tenant_id: Uuid) -> AppResult<()> {
-    diesel::sql_query("SELECT set_config('papercrate.tenant_id', $1, true)")
+    diesel::sql_query("SELECT set_config('papercrate.tenant_id', $1, false)")
         .bind::<Text, _>(tenant_id.to_string())
         .execute(conn)
         .map(|_| ())
         .map_err(AppError::from)
 }
 
+pub fn apply_user_guc(conn: &mut PgConnection, user_id: Uuid) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.user_id', $1, false)")
+        .bind::<Text, _>(user_id.to_string())
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+pub fn clear_tenant_context(conn: &mut PgConnection) -> AppResult<()> {
+    diesel::sql_query(
+        "SELECT \
+            set_config('papercrate.tenant_id', '', false), \
+            set_config('papercrate.user_id', '', false), \
+            set_config('papercrate.refresh_token_hash', '', false)"
+    )
+    .execute(conn)
+    .map(|_| ())
+    .map_err(AppError::from)
+}
+
+pub fn clear_user_guc(conn: &mut PgConnection) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.user_id', '', false)")
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+pub fn apply_refresh_token_hash(conn: &mut PgConnection, hash: &str) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.refresh_token_hash', $1, false)")
+        .bind::<Text, _>(hash)
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+pub fn clear_refresh_token_hash(conn: &mut PgConnection) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.refresh_token_hash', '', false)")
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
 fn normalize_storage_root(raw: Option<&str>, tenant_id: Uuid) -> String {
     match raw.map(str::trim) {
         Some(root) if !root.is_empty() => {