schalli
92e8eaffa5
- Second, deliberately separate migration (pure hand-SQL, no Prisma- generated DDL): ENABLE/FORCE ROW LEVEL SECURITY plus a tenant_isolation_policy for each of the three new tables, following the pattern of 20260618112133_rls_policies (Auth-Kerntabellen) rather than the RLS-exempt Tender* app-layer tables - Group/ModuleGrant compare tenantId directly against current_tenant_id(); GroupMembership has no own tenantId and follows the PasswordResetToken join pattern (groupId IN (SELECT id FROM Group WHERE tenantId = ...)) - migration-sql.spec.ts extended with a second describe block covering both migration files (6x ROW LEVEL SECURITY, 3x CREATE POLICY, the join vs. direct-comparison shape) - Re-ran the Task-2 end-to-end proof after applying this migration: identical result (USER without grant 403 + empty list, USER with direct grant 200 + slug present, ADMIN 200) — the app's DB role (tessera) is a Postgres superuser with rolbypassrls=true, so it bypasses RLS as documented as an acceptable outcome by the plan; RLS remains the defense-in-depth net for any future non-superuser connection