@accounter/server
Version:
Accounter GraphQL server
26 lines (25 loc) • 1.04 kB
TypeScript
import { sql } from 'slonik';
/**
* Multi-business read scope for RLS.
*
* Adds `get_current_business_scope()` (the request's authorized read scope as a
* UUID array) and switches every tenant_isolation read predicate (USING) to
* `owner_id = ANY (get_current_business_scope())`, while writes (WITH CHECK)
* stay pinned to the single `get_current_business_id()` target.
*
* The scope helper falls back to `ARRAY[get_current_business_id()]` when
* `app.current_business_scope` is unset, so this migration is backward
* compatible: until the tenant DB client sets the scope (a later step), reads
* behave exactly as before.
*
* The separate `allow_bootstrap_root` (businesses / financial_entities) and
* `super_admins_select` policies are intentionally left untouched.
*/
declare const _default: {
name: string;
run: ({ connection }: {
sql: typeof sql.unsafe;
connection: import("slonik").DatabaseTransactionConnection | import("slonik").DatabasePool;
}) => Promise<void>;
};
export default _default;