c539e6fd83
- Base platform from base.git (ERP base: auth, core, config, message, workflow, plugin) - Created erp-diary module skeleton (lib.rs, dto.rs, error.rs, event.rs, state.rs) - Integrated erp-diary into workspace and erp-server - Added DiaryModule registration in main.rs - Added DiaryState FromRef in state.rs - Diary routes mounted (empty routes, ready for implementation) - Product design spec v1.2 preserved in docs/ - Implementation plan preserved in plans/ Cargo check: OK Cargo test: OK (78+ base tests passing)
83 lines
2.9 KiB
Rust
83 lines
2.9 KiB
Rust
use sea_orm_migration::prelude::*;
|
||
|
||
#[derive(DeriveMigrationName)]
|
||
pub struct Migration;
|
||
|
||
#[async_trait::async_trait]
|
||
impl MigrationTrait for Migration {
|
||
async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
|
||
let conn = manager.get_connection();
|
||
|
||
// 替换所有表的 RLS 策略：移除空字符串绕过条件
|
||
// 原策略允许 current_setting(...) = '' 时通过（绕过 RLS），现在要求变量已设置且匹配
|
||
conn.execute_unprepared(
|
||
r#"
|
||
DO $$
|
||
DECLARE
|
||
tbl TEXT;
|
||
BEGIN
|
||
FOR tbl IN
|
||
SELECT c.table_name FROM information_schema.columns c
|
||
JOIN information_schema.tables t
|
||
ON c.table_name = t.table_name AND c.table_schema = t.table_schema
|
||
WHERE c.column_name = 'tenant_id'
|
||
AND c.table_schema = 'public'
|
||
AND t.table_type = 'BASE TABLE'
|
||
ORDER BY c.table_name
|
||
LOOP
|
||
EXECUTE format('DROP POLICY IF EXISTS tenant_isolation ON %I', tbl);
|
||
EXECUTE format(
|
||
'CREATE POLICY tenant_isolation ON %I USING (
|
||
current_setting(''app.current_tenant_id'', true) != ''''
|
||
AND tenant_id = current_setting(''app.current_tenant_id'', true)::uuid
|
||
)',
|
||
tbl
|
||
);
|
||
END LOOP;
|
||
END;
|
||
$$;
|
||
"#,
|
||
)
|
||
.await?;
|
||
|
||
Ok(())
|
||
}
|
||
|
||
async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
|
||
let conn = manager.get_connection();
|
||
|
||
// 回滚：恢复允许空字符串绕过的原策略
|
||
conn.execute_unprepared(
|
||
r#"
|
||
DO $$
|
||
DECLARE
|
||
tbl TEXT;
|
||
BEGIN
|
||
FOR tbl IN
|
||
SELECT c.table_name FROM information_schema.columns c
|
||
JOIN information_schema.tables t
|
||
ON c.table_name = t.table_name AND c.table_schema = t.table_schema
|
||
WHERE c.column_name = 'tenant_id'
|
||
AND c.table_schema = 'public'
|
||
AND t.table_type = 'BASE TABLE'
|
||
ORDER BY c.table_name
|
||
LOOP
|
||
EXECUTE format('DROP POLICY IF EXISTS tenant_isolation ON %I', tbl);
|
||
EXECUTE format(
|
||
'CREATE POLICY tenant_isolation ON %I USING (
|
||
current_setting(''app.current_tenant_id'', true) = ''''
|
||
OR tenant_id = current_setting(''app.current_tenant_id'', true)::uuid
|
||
)',
|
||
tbl
|
||
);
|
||
END LOOP;
|
||
END;
|
||
$$;
|
||
"#,
|
||
)
|
||
.await?;
|
||
|
||
Ok(())
|
||
}
|
||
}
|