feat(db): activate Todo row-level security#598
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
life-ustc | 60c85c4 | Commit Preview URL Branch Preview URL |
Jul 22 2026, 10:05 AM |
There was a problem hiding this comment.
Pull request overview
This PR activates PostgreSQL row-level security (RLS) for the Todo table and adds a dedicated CI job to validate default-deny behavior and per-user isolation using a non-owner, NOBYPASSRLS runtime role—aligning with the staged rollout plan in #550 / #596.
Changes:
- Enable and force RLS on
Todo, adding an owner-isolation policy that ties row access toapp.user_id. - Add an integration test that exercises default-deny, concurrent user isolation, forged-owner rejection, and runtime role attributes.
- Introduce a dedicated
ci:rlsworkflow phase/job that runs the test suite under a locked-down runtime role with only table-level grants.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
prisma/migrations/20260722163000_todo_owner_rls/migration.sql |
Enables + forces RLS on Todo and adds a strict owner-matching USING/WITH CHECK policy keyed on app.user_id. |
tests/integration/todo-rls.test.ts |
Adds a DB-backed integration test proving default-deny, isolation between two seeded users, and forged ownership rejection. |
.github/workflows/db-backed-bun-job.yml |
Adds a new ci:rls phase that creates a non-owner NOINHERIT NOBYPASSRLS runtime role, grants minimal schema/table access, and runs only the RLS test under that role. |
.github/workflows/ci.yml |
Wires a new “PostgreSQL RLS Isolation Test” CI job that runs the ci:rls phase. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
E2E HTML report is ready: https://life-ustc.github.io/e2e-snapshot-artifacts/reports/29910519914/index.html |
# [1.76.0](v1.75.0...v1.76.0) (2026-07-22) ### Features * **db:** activate Todo row-level security ([#598](#598)) ([5b16b66](5b16b66))
|
🎉 This PR is included in version 1.76.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Part of #550
Summary
Todowith matchingUSINGandWITH CHECKowner policyNOINHERIT NOBYPASSRLSruntime role and grants only runtime table accessDeployment order
This follows the already-merged inactive context plumbing in #596. It deliberately remains separate so the application context is deployed before policy activation. It does not close #550; the remaining table families need their own policy matrices.
Verification
bunx vitest run tests/unit/rls-context.test.ts tests/unit/todo-service-delete.test.ts: 8/8