admin/0pt
5
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Enforce tenant isolation for document credit storage #422

Merged
admin merged 1 commits from codex/credit-ledger-tenant-rls into main 2026-11-02 06:41:37 +00:00
Conversation 0 Commits 1 Files Changed 5
+138 -37
admin commented 2026-11-02 06:39:48 +00:00
Owner
Copy Link
Copy Source

Credit ledger and purchase tables lacked database tenant isolation. Add forced RLS, transaction-local tenant scoping, and fail closed when the role bypasses RLS or the expected migration is not active. The scoped tenant must still come from independently authenticated and authorized application context. Global payment-reference uniqueness is preserved.

Validation: nine tests with a real isolated PostgreSQL non-superuser role, including cross-tenant reads/writes, concurrency, duplicate payments and disabled-RLS rejection; typecheck, targeted lint, full suite (1285 passed / 197 skipped), Next build. Additionally restored the current 0pt database dump into a network-isolated disposable Postgres, applied 017/018/019 with the 0pt application role, and observed five forced-RLS tables plus tenant A visible / tenant B hidden within a rolled-back transaction. This is a test restore, not a production migration or proof of offsite backup.

No customer billing route is enabled; payment, refund handling, project authorization and deployment still require independent verification.

Credit ledger and purchase tables lacked database tenant isolation. Add forced RLS, transaction-local tenant scoping, and fail closed when the role bypasses RLS or the expected migration is not active. The scoped tenant must still come from independently authenticated and authorized application context. Global payment-reference uniqueness is preserved. Validation: nine tests with a real isolated PostgreSQL non-superuser role, including cross-tenant reads/writes, concurrency, duplicate payments and disabled-RLS rejection; typecheck, targeted lint, full suite (1285 passed / 197 skipped), Next build. Additionally restored the current 0pt database dump into a network-isolated disposable Postgres, applied 017/018/019 with the 0pt application role, and observed five forced-RLS tables plus tenant A visible / tenant B hidden within a rolled-back transaction. This is a test restore, not a production migration or proof of offsite backup. No customer billing route is enabled; payment, refund handling, project authorization and deployment still require independent verification.
admin added 1 commit 2026-11-02 06:39:49 +00:00
fix: enforce tenant isolation on credit storage
CI (SIAX Cloud) / integration (push) Skipped
Details
CI (SIAX Cloud) / sonar (push) Skipped
Details
masterplan-lock / check (push) Successful in 5s
Details
CI (SIAX Cloud) / sonar (pull_request) Skipped
Details
masterplan-lock / check (pull_request) Successful in 6s
Details
CI (SIAX Cloud) / security (push) Successful in 20s
Details
Security Scan (SIAX Cloud) / security (push) Successful in 19s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 16s
Details
Security Scan (SIAX Cloud) / security (pull_request) Successful in 16s
Details
CI (SIAX Cloud) / quality (push) Successful in 52s
Details
CI (SIAX Cloud) / integration (pull_request) Successful in 51s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 1m9s
Details
0f734297ce
CODEOWNERS rules requested review from sax3l 2026-11-02 06:39:49 +00:00
admin merged commit 243c45c0f2 into main 2026-11-02 06:41:37 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
sax3l
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: admin/0pt#422