feat(02-01): Prisma schema expansion, RLS migration, and PrismaModule

- Add User, Role enum, PasswordResetToken, LdapConfig, LdapFieldMapping models - Expand Tenant model with isActive, users relation, ldapConfig relation - Create RLS migration with tenant isolation policies on all tenant-scoped tables - Create PrismaModule (global), PrismaService, and forTenant extension - Add JWT_SECRET, TESSERA_ADMIN_*, TESSERA_FORCE_CHANGE env vars to docker-compose - Install @nestjs/jwt, @nestjs/passport, passport, argon2, class-validator deps
2026-06-18 13:22:38 +02:00
parent dddc39f570
commit d0b36c8f22
11 changed files with 651 additions and 21 deletions
@@ -0,0 +1,114 @@
+-- CreateEnum
+CREATE TYPE "Role" AS ENUM ('SUPER_ADMIN', 'ADMIN', 'USER');
+
+-- CreateTable
+CREATE TABLE "Tenant" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Tenant_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "User" (
+    "id" TEXT NOT NULL,
+    "username" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "passwordHash" TEXT,
+    "displayName" TEXT,
+    "role" "Role" NOT NULL DEFAULT 'USER',
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "mustChangePassword" BOOLEAN NOT NULL DEFAULT false,
+    "ldapDn" TEXT,
+    "tenantId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "lastLoginAt" TIMESTAMP(3),
+
+    CONSTRAINT "User_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "PasswordResetToken" (
+    "id" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "usedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "PasswordResetToken_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "LdapConfig" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "serverUrl" TEXT NOT NULL,
+    "baseDn" TEXT NOT NULL,
+    "bindDn" TEXT NOT NULL,
+    "bindPassword" TEXT NOT NULL,
+    "searchFilter" TEXT NOT NULL DEFAULT '(objectClass=person)',
+    "syncIntervalMin" INTEGER NOT NULL DEFAULT 60,
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "lastSyncAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "LdapConfig_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "LdapFieldMapping" (
+    "id" TEXT NOT NULL,
+    "ldapConfigId" TEXT NOT NULL,
+    "ldapField" TEXT NOT NULL,
+    "tesseraField" TEXT NOT NULL,
+    "isDefault" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "LdapFieldMapping_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Tenant_slug_key" ON "Tenant"("slug");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "User_username_key" ON "User"("username");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
+
+-- CreateIndex
+CREATE INDEX "User_tenantId_idx" ON "User"("tenantId");
+
+-- CreateIndex
+CREATE INDEX "User_username_idx" ON "User"("username");
+
+-- CreateIndex
+CREATE INDEX "User_email_idx" ON "User"("email");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "PasswordResetToken_token_key" ON "PasswordResetToken"("token");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "LdapConfig_tenantId_key" ON "LdapConfig"("tenantId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "LdapFieldMapping_ldapConfigId_ldapField_key" ON "LdapFieldMapping"("ldapConfigId", "ldapField");
+
+-- AddForeignKey
+ALTER TABLE "User" ADD CONSTRAINT "User_tenantId_fkey" FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "PasswordResetToken" ADD CONSTRAINT "PasswordResetToken_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "LdapConfig" ADD CONSTRAINT "LdapConfig_tenantId_fkey" FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "LdapFieldMapping" ADD CONSTRAINT "LdapFieldMapping_ldapConfigId_fkey" FOREIGN KEY ("ldapConfigId") REFERENCES "LdapConfig"("id") ON DELETE CASCADE ON UPDATE CASCADE;
@@ -0,0 +1,37 @@
+-- Create function to get current tenant from session variable
+CREATE OR REPLACE FUNCTION current_tenant_id() RETURNS TEXT AS $$
+  SELECT current_setting('app.current_tenant', true);
+$$ LANGUAGE sql STABLE;
+
+-- Enable RLS on User table
+ALTER TABLE "User" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "User" FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY tenant_isolation_policy ON "User"
+  USING ("tenantId" = current_tenant_id());
+
+-- Enable RLS on PasswordResetToken table (via userId -> User -> tenantId)
+-- PasswordResetToken does not have a direct tenantId column, so we join through User
+ALTER TABLE "PasswordResetToken" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "PasswordResetToken" FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY tenant_isolation_policy ON "PasswordResetToken"
+  USING ("userId" IN (
+    SELECT "id" FROM "User" WHERE "tenantId" = current_tenant_id()
+  ));
+
+-- Enable RLS on LdapConfig table
+ALTER TABLE "LdapConfig" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "LdapConfig" FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY tenant_isolation_policy ON "LdapConfig"
+  USING ("tenantId" = current_tenant_id());
+
+-- Enable RLS on LdapFieldMapping table (via ldapConfigId -> LdapConfig -> tenantId)
+ALTER TABLE "LdapFieldMapping" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "LdapFieldMapping" FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY tenant_isolation_policy ON "LdapFieldMapping"
+  USING ("ldapConfigId" IN (
+    SELECT "id" FROM "LdapConfig" WHERE "tenantId" = current_tenant_id()
+  ));
@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (e.g., Git)
+provider = "postgresql"