coreci/coreci-chat
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

fix(test): seed tenant_memberships in the tenant scope - the M1 migration forces RLS on that table
ci / test-pglite (PGlite, default) (push) Failing after 1m47s
Details
ci / test-postgres (Postgres 16, G-022 RLS) (push) Failing after 1m21s
Details
ci / test-pglite (PGlite, default) (pull_request) Failing after 1m47s
Details
ci / test-postgres (Postgres 16, G-022 RLS) (pull_request) Failing after 1m25s
Details

Browse Source
This commit is contained in:
Isabella Ferreira — PO coreci-chat
2026-10-27 05:08:45 +00:00
parent a7d55b9ec9
commit 585f15f5de
1 changed files with 23 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/db/tests/pen/cross-tenant.test.ts
+23 -7
View File
@@ -65,9 +65,10 @@ describe("cross-tenant isolation (REQ-039 pen test)", () => {
// outside a tenant scope — RLS WITH CHECK rejects it).
}
// Seed two tenants + users + memberships + one target each.
// In PG mode (coreci_app role), the tenants/users/memberships tables are
// NOT tenant-scoped (they're the bootstrap tables), so direct inserts
// work. The targets table IS tenant-scoped — seed via withTenant so the
// In PG mode (coreci_app role) the tenants and users tables are the
// bootstrap tables and are not tenant-scoped, so direct inserts work.
// tenant_memberships IS tenant-scoped (the M1 migration enables AND forces
// RLS on it) and so is targets — both are seeded via withTenant so the
// RLS WITH CHECK passes.
await db.query(
`INSERT INTO tenants (id, name) VALUES ($1,'T1'), ($2,'T2') ON CONFLICT DO NOTHING`,
@@ -77,10 +78,25 @@ describe("cross-tenant isolation (REQ-039 pen test)", () => {
`INSERT INTO users (id, email) VALUES ($1,'u1@t1.test'), ($2,'u2@t2.test') ON CONFLICT DO NOTHING`,
[U1, U2],
);
await db.query(
`INSERT INTO tenant_memberships (tenant_id, user_id, role) VALUES ($1,$2,'admin'), ($3,$4,'admin') ON CONFLICT DO NOTHING`,
[T1, U1, T2, U2],
);
if (isPgMode) {
await withTenant(T1, async (c) => {
await c.query(
`INSERT INTO tenant_memberships (tenant_id, user_id, role) VALUES ($1,$2,'admin') ON CONFLICT DO NOTHING`,
[T1, U1],
);
});
await withTenant(T2, async (c) => {
await c.query(
`INSERT INTO tenant_memberships (tenant_id, user_id, role) VALUES ($1,$2,'admin') ON CONFLICT DO NOTHING`,
[T2, U2],
);
});
} else {
await db.query(
`INSERT INTO tenant_memberships (tenant_id, user_id, role) VALUES ($1,$2,'admin'), ($3,$4,'admin') ON CONFLICT DO NOTHING`,
[T1, U1, T2, U2],
);
}
// Seed targets via withTenant (RLS WITH CHECK requires the row's
// tenant_id to match the current app.tenant_id).
await withTenant(T1, async (c) => {