fix(db): add missing RLS policy + app-role grant to PartnerProgram - #62
Open
keithfawcett wants to merge 1 commit into
Open
fix(db): add missing RLS policy + app-role grant to PartnerProgram#62keithfawcett wants to merge 1 commit into
keithfawcett wants to merge 1 commit into
Conversation
PartnerProgram (formerly PartnerCampaign) was created after the global RLS/grant migrations and never got its own tenant_isolation policy or openpartner_app DML grant — every other tenant table created since (PartnerPostback, etc.) does. The rename migration only assumed a policy existed. Prod runs the app role (DATABASE_URL_APP + OPENPARTNER_APP_DB_PASSWORD set, OPENPARTNER_TENANCY=multi), so PartnerProgram queries would fail permission-denied when the partner↔program feature is exercised; on a privileged-pool deploy the absent policy means no tenant filter. Adds enable/force RLS + tenant_isolation policy + idempotent app-role grant, mirroring 20260613000000_partner_postback.ts. Verified locally: relrowsecurity + relforcerowsecurity = t, policy present (ALL, USING+WITH CHECK), grant present. NOTE: prod migrations are manual — run `pnpm migrate` against prod after merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
keithfawcett
added a commit
that referenced
this pull request
Aug 9, 2026
Turns the handoff brief into a status record: what each item was, what actually shipped, and — the part that is still open — the staging exercises that have to pass before either money path is trusted. Item A (#10, PR #73): planner/executor split with a durable payout intent and a frozen commission set. Item B (#12, PR #75): the three funding races plus a live-Stripe backstop for missed refund/reversal webhooks. Item C (#8, PR #74): the three missing tables, per-table primary keys, a portable SQL dump, and two array round-trip bugs the test found. No code left on any of the three; the remaining work is the staging checklists in docs/direct-connect-payouts.md and section H of the funding staging runbook, plus the two post-merge prod actions for #62 and #63. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
PartnerProgram(formerlyPartnerCampaign) is the only tenant-scoped table with notenant_isolationRLS policy and noopenpartner_appgrant. Its create migration (20260511) ran after the global RLS/grant migrations (20260507*) and never added them; the rename migration's comment claims a policy "already existed" — it never did.Prod is confirmed on the app role (
DATABASE_URL_APP+OPENPARTNER_APP_DB_PASSWORDpopulated,OPENPARTNER_TENANCY=multi), so:PartnerProgramfailpermission deniedwhenever the partner↔program feature is used (latent until that route is hit — not yet observed in logs).partner-campaigns.tsleans on RLS, not an explicittenantIdcolumn filter).Found via an unsteered Codex review.
Fix
One migration mirroring the canonical pattern in
20260613000000_partner_postback.ts: enable + force RLS, add thetenant_isolationpolicy (USING + WITH CHECK onapp.tenant_id/app.platform_admin), and an idempotentopenpartner_appgrant guarded on the role existing.Verified locally after
pnpm migrate:relrowsecurity/relforcerowsecurity=t, policy present (ALL), grant present (SELECT/INSERT/UPDATE/DELETE).Deploy
Migrations don't auto-run on deploy here — run
pnpm migrateagainst prod after merge (same as prior migration PRs).🤖 Generated with Claude Code