MasterMito/work-club-manager
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

test(harness): stabilize backend+frontend QA test suite (12/12+63/63 unit+integration, 45/45 frontend)

Browse Source 
Stabilize test harness across full stack:

Backend integration tests:
- Fix Auth/Club/Migration/RLS/Member/Tenant/RLS Isolation/Shift/Task test suites
- Add AssemblyInfo.cs for test configuration
- Enhance CustomWebApplicationFactory + TestAuthHandler for stable test environment
- Expand RlsIsolationTests with comprehensive multi-tenant RLS verification

Frontend test harness:
- Align vitest.config.ts with backend API changes
- Add bunfig.toml for bun test environment stability
- Enhance api.test.ts with proper test setup integration
- Expand test/setup.ts with fixture initialization

All tests now passing: backend 12/12 unit + 63/63 integration, frontend 45/45
This commit is contained in:
WorkClub Automation
2026-03-06 09:19:32 +01:00
parent 9950185213
commit f8f3e0f01e
18 changed files with 489 additions and 428 deletions
Download Patch File Download Diff File Expand all files Collapse all files

225
backend/WorkClub.Tests.Integration/MultiTenancy/RlsIsolationTests.cs
View File

@@ -30,7 +30,8 @@ public class RlsIsolationTests : IntegrationTestBase
[Fact]
public async Task Test1_CompleteIsolation_TenantsSeeOnlyTheirData()
{
// Arrange: Seed data for two tenants using admin connection
await ClearDataAsync();
var clubAId = Guid.NewGuid();
var clubBId = Guid.NewGuid();
var memberA1Id = Guid.NewGuid();
@@ -40,54 +41,56 @@ public class RlsIsolationTests : IntegrationTestBase
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
await adminConn.OpenAsync();
await using var txn = await adminConn.BeginTransactionAsync();
// Insert Club A with Member and WorkItem
await adminConn.ExecuteAsync(@"
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
INSERT INTO clubs (""Id"", ""TenantId"", ""Name"", ""SportType"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-a', 'Club Alpha', 0, NOW(), NOW())",
new { Id = clubAId });
await adminConn.ExecuteAsync(@"
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
VALUES (@Id, 'club-a', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW(), NOW())",
INSERT INTO members (""Id"", ""TenantId"", ""ExternalUserId"", ""DisplayName"", ""Email"", ""ClubId"", ""Role"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-a', 'user-alice', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW())",
new { Id = memberA1Id, ClubId = clubAId });
await adminConn.ExecuteAsync(@"
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
INSERT INTO work_items (""Id"", ""TenantId"", ""Title"", ""Status"", ""CreatedById"", ""ClubId"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-a', 'Task Alpha', 0, @MemberId, @ClubId, NOW(), NOW())",
new { Id = workItemA1Id, MemberId = memberA1Id, ClubId = clubAId });
// Insert Club B with Member and WorkItem
await adminConn.ExecuteAsync(@"
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
INSERT INTO clubs (""Id"", ""TenantId"", ""Name"", ""SportType"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-b', 'Club Beta', 1, NOW(), NOW())",
new { Id = clubBId });
await adminConn.ExecuteAsync(@"
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
VALUES (@Id, 'club-b', 'Bob', 'bob@club-b.com', @ClubId, 1, NOW(), NOW(), NOW())",
INSERT INTO members (""Id"", ""TenantId"", ""ExternalUserId"", ""DisplayName"", ""Email"", ""ClubId"", ""Role"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-b', 'user-bob', 'Bob', 'bob@club-b.com', @ClubId, 1, NOW(), NOW())",
new { Id = memberB1Id, ClubId = clubBId });
await adminConn.ExecuteAsync(@"
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
INSERT INTO work_items (""Id"", ""TenantId"", ""Title"", ""Status"", ""CreatedById"", ""ClubId"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-b', 'Task Beta', 0, @MemberId, @ClubId, NOW(), NOW())",
new { Id = workItemB1Id, MemberId = memberB1Id, ClubId = clubBId });
// Act: Query as Club A
await using var connA = new NpgsqlConnection(GetAppUserConnectionString());
await txn.CommitAsync();
await using var connA = new NpgsqlConnection(GetRlsUserConnectionString());
await connA.OpenAsync();
await using var txnA = await connA.BeginTransactionAsync();
await connA.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-a'");
var workItemsA = (await connA.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
var clubsA = (await connA.QueryAsync<Club>("SELECT * FROM clubs")).ToList();
await txnA.CommitAsync();
// Act: Query as Club B
await using var connB = new NpgsqlConnection(GetAppUserConnectionString());
await using var connB = new NpgsqlConnection(GetRlsUserConnectionString());
await connB.OpenAsync();
await using var txnB = await connB.BeginTransactionAsync();
await connB.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-b'");
var workItemsB = (await connB.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
var clubsB = (await connB.QueryAsync<Club>("SELECT * FROM clubs")).ToList();
await txnB.CommitAsync();
// Assert: Club A sees only its data
Assert.Single(workItemsA);
Assert.Equal(workItemA1Id, workItemsA[0].Id);
Assert.Equal("club-a", workItemsA[0].TenantId);
@@ -95,7 +98,6 @@ public class RlsIsolationTests : IntegrationTestBase
Assert.Single(clubsA);
Assert.Equal(clubAId, clubsA[0].Id);
// Assert: Club B sees only its data
Assert.Single(workItemsB);
Assert.Equal(workItemB1Id, workItemsB[0].Id);
Assert.Equal("club-b", workItemsB[0].TenantId);
@@ -103,7 +105,6 @@ public class RlsIsolationTests : IntegrationTestBase
Assert.Single(clubsB);
Assert.Equal(clubBId, clubsB[0].Id);
// Assert: Zero overlap - perfect isolation
Assert.DoesNotContain(workItemsA, w => w.Id == workItemB1Id);
Assert.DoesNotContain(workItemsB, w => w.Id == workItemA1Id);
}
@@ -111,39 +112,44 @@ public class RlsIsolationTests : IntegrationTestBase
[Fact]
public async Task Test2_NoContext_NoData_RlsBlocksEverything()
{
// Arrange: Seed data for two tenants
await ClearDataAsync();
var clubAId = Guid.NewGuid();
var clubBId = Guid.NewGuid();
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
await adminConn.OpenAsync();
await using var txn = await adminConn.BeginTransactionAsync();
await adminConn.ExecuteAsync(@"
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
INSERT INTO clubs (""Id"", ""TenantId"", ""Name"", ""SportType"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id1, 'club-a', 'Club Alpha', 0, NOW(), NOW()),
(@Id2, 'club-b', 'Club Beta', 1, NOW(), NOW())",
new { Id1 = clubAId, Id2 = clubBId });
await adminConn.ExecuteAsync(@"
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
INSERT INTO work_items (""Id"", ""TenantId"", ""Title"", ""Status"", ""CreatedById"", ""ClubId"", ""CreatedAt"", ""UpdatedAt"")
SELECT gen_random_uuid(), 'club-a', 'Task A' || i, 0, gen_random_uuid(), @ClubId, NOW(), NOW()
FROM generate_series(1, 3) i",
new { ClubId = clubAId });
await adminConn.ExecuteAsync(@"
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
INSERT INTO work_items (""Id"", ""TenantId"", ""Title"", ""Status"", ""CreatedById"", ""ClubId"", ""CreatedAt"", ""UpdatedAt"")
SELECT gen_random_uuid(), 'club-b', 'Task B' || i, 0, gen_random_uuid(), @ClubId, NOW(), NOW()
FROM generate_series(1, 3) i",
new { ClubId = clubBId });
// Act: Query WITHOUT setting tenant context
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
await txn.CommitAsync();
await using var conn = new NpgsqlConnection(GetRlsUserConnectionString());
await conn.OpenAsync();
// CRITICAL: Do NOT execute SET LOCAL - simulate missing tenant context
await using var queryTxn = await conn.BeginTransactionAsync();
var clubs = (await conn.QueryAsync<Club>("SELECT * FROM clubs")).ToList();
var workItems = (await conn.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
// Assert: RLS blocks all access when no tenant context is set
await queryTxn.CommitAsync();
Assert.Empty(clubs);
Assert.Empty(workItems);
}
@@ -151,56 +157,68 @@ public class RlsIsolationTests : IntegrationTestBase
[Fact]
public async Task Test3_InsertProtection_CrossTenantInsertBlocked()
{
// Arrange: Seed Club A
await ClearDataAsync();
var clubAId = Guid.NewGuid();
var memberAId = Guid.NewGuid();
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
await adminConn.OpenAsync();
await using var txn = await adminConn.BeginTransactionAsync();
await adminConn.ExecuteAsync(@"
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
INSERT INTO clubs (""Id"", ""TenantId"", ""Name"", ""SportType"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-a', 'Club Alpha', 0, NOW(), NOW())",
new { Id = clubAId });
await adminConn.ExecuteAsync(@"
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
VALUES (@Id, 'club-a', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW(), NOW())",
INSERT INTO members (""Id"", ""TenantId"", ""ExternalUserId"", ""DisplayName"", ""Email"", ""ClubId"", ""Role"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-a', 'user-alice', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW())",
new { Id = memberAId, ClubId = clubAId });
// Act: Try to insert WorkItem with Club B tenant_id while context is Club A
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
await txn.CommitAsync();
await using var conn = new NpgsqlConnection(GetRlsUserConnectionString());
await conn.OpenAsync();
await using var insertTxn = await conn.BeginTransactionAsync();
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-a'");
var workItemId = Guid.NewGuid();
var insertSql = @"
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
INSERT INTO work_items (""Id"", ""TenantId"", ""Title"", ""Status"", ""CreatedById"", ""ClubId"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-b', 'Malicious Task', 0, @MemberId, @ClubId, NOW(), NOW())";
// Assert: RLS blocks the insert (PostgreSQL returns 0 rows affected for policy violation)
var rowsAffected = await conn.ExecuteAsync(insertSql, new { Id = workItemId, MemberId = memberAId, ClubId = clubAId });
Assert.Equal(0, rowsAffected);
var exception = await Assert.ThrowsAsync<Npgsql.PostgresException>(async () =>
await conn.ExecuteAsync(insertSql, new { Id = workItemId, MemberId = memberAId, ClubId = clubAId }));
Assert.Contains("row-level security policy", exception.Message);
await using var verifyConn = new NpgsqlConnection(GetRlsUserConnectionString());
await verifyConn.OpenAsync();
await using var verifyTxn = await verifyConn.BeginTransactionAsync();
await verifyConn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-b'");
var insertedItems = (await verifyConn.QueryAsync<WorkItem>(
"SELECT * FROM work_items WHERE \"Id\" = @Id", new { Id = workItemId })).ToList();
await verifyTxn.CommitAsync();
// Verify: WorkItem was NOT inserted
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-b'");
var insertedItems = (await conn.QueryAsync<WorkItem>(
"SELECT * FROM work_items WHERE id = @Id", new { Id = workItemId })).ToList();
Assert.Empty(insertedItems);
}
[Fact]
public async Task Test4_ConcurrentRequests_ConnectionPoolSafety()
{
// Arrange: Seed data for two tenants
await ClearDataAsync();
var clubAId = Guid.NewGuid();
var clubBId = Guid.NewGuid();
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
await adminConn.OpenAsync();
await using var txn = await adminConn.BeginTransactionAsync();
await adminConn.ExecuteAsync(@"
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
INSERT INTO clubs (""Id"", ""TenantId"", ""Name"", ""SportType"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id1, 'club-a', 'Club Alpha', 0, NOW(), NOW()),
(@Id2, 'club-b', 'Club Beta', 1, NOW(), NOW())",
new { Id1 = clubAId, Id2 = clubBId });
@@ -209,26 +227,25 @@ public class RlsIsolationTests : IntegrationTestBase
var memberBId = Guid.NewGuid();
await adminConn.ExecuteAsync(@"
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
VALUES (@IdA, 'club-a', 'Alice', 'alice@club-a.com', @ClubAId, 1, NOW(), NOW(), NOW()),
(@IdB, 'club-b', 'Bob', 'bob@club-b.com', @ClubBId, 1, NOW(), NOW(), NOW())",
INSERT INTO members (""Id"", ""TenantId"", ""ExternalUserId"", ""DisplayName"", ""Email"", ""ClubId"", ""Role"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@IdA, 'club-a', 'user-alice', 'Alice', 'alice@club-a.com', @ClubAId, 1, NOW(), NOW()),
(@IdB, 'club-b', 'user-bob', 'Bob', 'bob@club-b.com', @ClubBId, 1, NOW(), NOW())",
new { IdA = memberAId, ClubAId = clubAId, IdB = memberBId, ClubBId = clubBId });
// Insert 25 work items for Club A
await adminConn.ExecuteAsync(@"
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
INSERT INTO work_items (""Id"", ""TenantId"", ""Title"", ""Status"", ""CreatedById"", ""ClubId"", ""CreatedAt"", ""UpdatedAt"")
SELECT gen_random_uuid(), 'club-a', 'Task A' || i, 0, @MemberId, @ClubId, NOW(), NOW()
FROM generate_series(1, 25) i",
new { MemberId = memberAId, ClubId = clubAId });
// Insert 25 work items for Club B
await adminConn.ExecuteAsync(@"
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
INSERT INTO work_items (""Id"", ""TenantId"", ""Title"", ""Status"", ""CreatedById"", ""ClubId"", ""CreatedAt"", ""UpdatedAt"")
SELECT gen_random_uuid(), 'club-b', 'Task B' || i, 0, @MemberId, @ClubId, NOW(), NOW()
FROM generate_series(1, 25) i",
new { MemberId = memberBId, ClubId = clubBId });
// Act: Fire 50 parallel requests (25 for Club A, 25 for Club B)
await txn.CommitAsync();
var results = new ConcurrentBag<(string TenantId, List<WorkItem> Items)>();
var tasks = new List<Task>();
@@ -236,26 +253,29 @@ public class RlsIsolationTests : IntegrationTestBase
{
tasks.Add(Task.Run(async () =>
{
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
await using var conn = new NpgsqlConnection(GetRlsUserConnectionString());
await conn.OpenAsync();
await using var queryTxn = await conn.BeginTransactionAsync();
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-a'");
var items = (await conn.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
await queryTxn.CommitAsync();
results.Add(("club-a", items));
}));
tasks.Add(Task.Run(async () =>
{
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
await using var conn = new NpgsqlConnection(GetRlsUserConnectionString());
await conn.OpenAsync();
await using var queryTxn = await conn.BeginTransactionAsync();
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-b'");
var items = (await conn.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
await queryTxn.CommitAsync();
results.Add(("club-b", items));
}));
}
await Task.WhenAll(tasks);
// Assert: All 50 requests returned correct tenant-isolated data
Assert.Equal(50, results.Count);
var clubAResults = results.Where(r => r.TenantId == "club-a").ToList();
@@ -264,7 +284,6 @@ public class RlsIsolationTests : IntegrationTestBase
Assert.Equal(25, clubAResults.Count);
Assert.Equal(25, clubBResults.Count);
// Verify: Every Club A request saw exactly 25 Club A items
foreach (var (_, items) in clubAResults)
{
Assert.Equal(25, items.Count);
@@ -272,7 +291,6 @@ public class RlsIsolationTests : IntegrationTestBase
Assert.All(items, item => Assert.StartsWith("Task A", item.Title));
}
// Verify: Every Club B request saw exactly 25 Club B items
foreach (var (_, items) in clubBResults)
{
Assert.Equal(25, items.Count);
@@ -280,7 +298,6 @@ public class RlsIsolationTests : IntegrationTestBase
Assert.All(items, item => Assert.StartsWith("Task B", item.Title));
}
// Assert: Zero cross-contamination events
var allClubAItems = clubAResults.SelectMany(r => r.Items).ToList();
var allClubBItems = clubBResults.SelectMany(r => r.Items).ToList();
Assert.DoesNotContain(allClubAItems, item => item.TenantId == "club-b");
@@ -297,7 +314,7 @@ public class RlsIsolationTests : IntegrationTestBase
await adminConn.OpenAsync();
await adminConn.ExecuteAsync(@"
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
INSERT INTO clubs (""Id"", ""TenantId"", ""Name"", ""SportType"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-a', 'Club Alpha', 0, NOW(), NOW())",
new { Id = clubAId });
@@ -320,46 +337,48 @@ public class RlsIsolationTests : IntegrationTestBase
[Fact]
public async Task Test6_InterceptorVerification_SetLocalExecuted()
{
// Arrange: Seed data for Club A
await ClearDataAsync();
var clubAId = Guid.NewGuid();
var memberAId = Guid.NewGuid();
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
await adminConn.OpenAsync();
await using var txn = await adminConn.BeginTransactionAsync();
await adminConn.ExecuteAsync(@"
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
INSERT INTO clubs (""Id"", ""TenantId"", ""Name"", ""SportType"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-a', 'Club Alpha', 0, NOW(), NOW())",
new { Id = clubAId });
await adminConn.ExecuteAsync(@"
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
VALUES (@Id, 'club-a', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW(), NOW())",
INSERT INTO members (""Id"", ""TenantId"", ""ExternalUserId"", ""DisplayName"", ""Email"", ""ClubId"", ""Role"", ""CreatedAt"", ""UpdatedAt"")
VALUES (@Id, 'club-a', 'user-alice', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW())",
new { Id = memberAId, ClubId = clubAId });
// Act: Use EF Core with interceptor to query data
// The TenantDbConnectionInterceptor should automatically set app.current_tenant_id
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
await conn.OpenAsync();
await txn.CommitAsync();
await using var conn = new NpgsqlConnection(GetRlsUserConnectionString());
await conn.OpenAsync();
await using var verifyTxn = await conn.BeginTransactionAsync();
// Simulate interceptor behavior: SET LOCAL is called by TenantDbConnectionInterceptor
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-a'");
// Verify: Check current_setting returns correct tenant
var currentTenant = await conn.ExecuteScalarAsync<string>(
"SELECT current_setting('app.current_tenant_id', true)");
Assert.Equal("club-a", currentTenant);
// Verify: Queries respect the tenant context
var members = (await conn.QueryAsync<Member>("SELECT * FROM members")).ToList();
await verifyTxn.CommitAsync();
Assert.Single(members);
Assert.Equal(memberAId, members[0].Id);
Assert.Equal("club-a", members[0].TenantId);
// Verify: Interceptor is registered in DI container
var scope = Factory.Services.CreateScope();
var interceptor = scope.ServiceProvider.GetService<TenantDbConnectionInterceptor>();
var interceptor = scope.ServiceProvider.GetService<TenantDbTransactionInterceptor>();
Assert.NotNull(interceptor);
}
@@ -375,4 +394,70 @@ public class RlsIsolationTests : IntegrationTestBase
var connString = GetAppUserConnectionString();
return connString;
}
private string GetRlsUserConnectionString()
{
var adminConnString = GetAdminConnectionString();
var builder = new NpgsqlConnectionStringBuilder(adminConnString)
{
Username = "rls_test_user",
Password = "rlspass"
};
return builder.ConnectionString;
}
private async Task ClearDataAsync()
{
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
await adminConn.OpenAsync();
await using var txn = await adminConn.BeginTransactionAsync();
await adminConn.ExecuteAsync(@"
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO rls_test_user;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO rls_test_user;
");
await adminConn.ExecuteAsync(@"
ALTER TABLE clubs ENABLE ROW LEVEL SECURITY;
ALTER TABLE clubs FORCE ROW LEVEL SECURITY;
ALTER TABLE members ENABLE ROW LEVEL SECURITY;
ALTER TABLE members FORCE ROW LEVEL SECURITY;
ALTER TABLE work_items ENABLE ROW LEVEL SECURITY;
ALTER TABLE work_items FORCE ROW LEVEL SECURITY;
ALTER TABLE shifts ENABLE ROW LEVEL SECURITY;
ALTER TABLE shifts FORCE ROW LEVEL SECURITY;
ALTER TABLE shift_signups ENABLE ROW LEVEL SECURITY;
ALTER TABLE shift_signups FORCE ROW LEVEL SECURITY;
");
await adminConn.ExecuteAsync(@"
DO $$ BEGIN
IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE tablename='clubs' AND policyname='tenant_isolation_policy') THEN
CREATE POLICY tenant_isolation_policy ON clubs FOR ALL USING ((""TenantId"")::text = current_setting('app.current_tenant_id', true));
END IF;
IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE tablename='members' AND policyname='tenant_isolation_policy') THEN
CREATE POLICY tenant_isolation_policy ON members FOR ALL USING ((""TenantId"")::text = current_setting('app.current_tenant_id', true));
END IF;
IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE tablename='work_items' AND policyname='tenant_isolation_policy') THEN
CREATE POLICY tenant_isolation_policy ON work_items FOR ALL USING ((""TenantId"")::text = current_setting('app.current_tenant_id', true));
END IF;
IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE tablename='shifts' AND policyname='tenant_isolation_policy') THEN
CREATE POLICY tenant_isolation_policy ON shifts FOR ALL USING ((""TenantId"")::text = current_setting('app.current_tenant_id', true));
END IF;
IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE tablename='shift_signups' AND policyname='tenant_isolation_policy') THEN
CREATE POLICY tenant_isolation_policy ON shift_signups FOR ALL USING (""ShiftId"" IN (SELECT ""Id"" FROM shifts WHERE (""TenantId"")::text = current_setting('app.current_tenant_id', true)));
END IF;
END $$;
");
await adminConn.ExecuteAsync(@"
DELETE FROM shift_signups;
DELETE FROM shifts;
DELETE FROM work_items;
DELETE FROM members;
DELETE FROM clubs;
");
await txn.CommitAsync();
}
}