root
8fc88ffc14
Build & Push / Pipeline Tests (push) Failing after 59s
Build & Push / Build & Push Docker Image (push) Has been skipped
Test / Type Check (all packages) (push) Failing after 51s
Test / API Unit Tests (push) Has been skipped
Test / Homepage Unit Tests (push) Has been skipped
Test / Carplace Unit Tests (push) Has been skipped
Test / Admin Unit Tests (push) Has been skipped
Test / Dashboard Unit Tests (push) Has been skipped
Test / API Integration Tests (push) Has been skipped
25 lines
1.2 KiB
Markdown
25 lines
1.2 KiB
Markdown
# ADR-002 — Defer Postgres RLS until app-level isolation is proven
|
|
|
|
## Status
|
|
|
|
Accepted (Phase 3) — **RLS not enabled yet**
|
|
|
|
## Context
|
|
|
|
Phase 3 lists optional Postgres row-level security after app-level cross-tenant tests. The API already scopes queries with `companyId` from the authenticated session. Enabling RLS without a complete policy matrix and migration path risks breaking admin, workers, migrations, and reporting jobs that use elevated DB roles.
|
|
|
|
## Decision
|
|
|
|
1. Land and keep expanding the app-level suite (`apps/api/src/tests/integration/cross-tenant-isolation.test.ts`).
|
|
2. Do **not** enable `FORCE ROW LEVEL SECURITY` in production until:
|
|
- Cross-tenant suite covers vehicles, customers, reservations, payments, team, billing reads
|
|
- Worker and migration DB roles are designed (`BYPASSRLS` or dedicated policies)
|
|
- A staging soak proves no latent `findMany` without tenant predicates
|
|
3. Revisit RLS as a defense-in-depth layer in a dedicated change set — not as a gate to start Phase 3 assurance work.
|
|
|
|
## Consequences
|
|
|
|
- Tenant safety remains an application responsibility in the near term.
|
|
- Pen-testers should still treat missing `companyId` filters as Critical.
|
|
- Future RLS work tracks under Phase 3 optional / post-GA hardening.
|