FEAT: add postgres rls for tenant isolation

Author: sru-thy

src/authentication/authentication.guard.ts

@@ -1,7 +1,6 @@
 import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
 import { GqlExecutionContext } from '@nestjs/graphql';
 import { AuthenticationHelper } from './authentication.helper';
-import { ExecutionManager } from '../util/execution.manager';
 
 @Injectable()
 export class AuthGuard implements CanActivate {
@@ -14,7 +13,6 @@ export class AuthGuard implements CanActivate {
       if (token) {
         const reqAuthToken = token.split(' ')[1];
         ctx.user = this.authenticationHelper.validateAuthToken(reqAuthToken);
-        ExecutionManager.setTenantId(ctx.user.tenantId);
         return true;
       }
     }

src/authorization/entity/abstract.tenant.entity.ts

@@ -2,7 +2,10 @@ import { Column } from 'typeorm';
 import BaseEntity from './base.entity';
 
 class AbstractTenantEntity extends BaseEntity {
-  @Column({ type: 'uuid' })
+  @Column({
+    type: 'uuid',
+    default: () => "current_setting('app.current_tenant')",
+  })
   public tenantId!: string;
 }
 

src/database/database.module.ts

@@ -2,6 +2,7 @@ import { Module } from '@nestjs/common';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { SnakeNamingStrategy } from 'typeorm-naming-strategies';
+import { ExecutionManager } from '../util/execution.manager';
 
 @Module({
   imports: [
@@ -22,6 +23,18 @@ import { SnakeNamingStrategy } from 'typeorm-naming-strategies';
         namingStrategy: new SnakeNamingStrategy(),
         synchronize: false,
         logging: true,
+        extra: {
+          poolMiddleware: async (query: string, params: any[]) => {
+            const tenantId = ExecutionManager.getTenantId();
+            if (tenantId) {
+              return [
+                `SELECT set_config('app.tenant_id', ${tenantId}, false) ${query}`,
+                params,
+              ];
+            }
+            return [query, params];
+          },
+        },
       }),
     }),
   ],

src/middleware/executionId.middleware.ts

@@ -2,9 +2,18 @@ import { NestMiddleware } from '@nestjs/common';
 import { NextFunction, Request, Response } from 'express';
 
 import { ExecutionManager } from '../util/execution.manager';
+import { AuthenticationHelper } from '../authentication/authentication.helper';
 
 export class ExecutionContextBinder implements NestMiddleware {
+  constructor(private readonly auth: AuthenticationHelper) {}
   async use(req: Request, res: Response, next: NextFunction) {
-    ExecutionManager.runWithContext(next);
+    ExecutionManager.runWithContext(async () => {
+      const token = req.headers.authorization?.split(' ')[1];
+      if (token) {
+        const user = this.auth.validateAuthToken(token);
+        ExecutionManager.setTenantId(user.tenantId);
+      }
+      next();
+    });
   }
 }

src/migrations/1733833844028-MultiTenantFeature.ts

@@ -71,9 +71,64 @@ export class MultiTenantFeature1733833844028 implements MigrationInterface {
     await queryRunner.query(
       `ALTER TABLE "user_permission" ALTER COLUMN "tenant_id" DROP DEFAULT`,
     );
+    await queryRunner.query(`
+      ALTER TABLE "user" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "role" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "group" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "entity_model" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "user_group" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "user_permission" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "group_role" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "group_permission" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "role_permission" ENABLE ROW LEVEL SECURITY;
+      ALTER TABLE "entity_permission" ENABLE ROW LEVEL SECURITY;
+ 
+      CREATE POLICY tenant_isolation_policy ON "user" 
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "role"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "group"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "entity_model"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "user_group"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "user_permission"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "group_role"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "group_permission"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "role_permission"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      CREATE POLICY tenant_isolation_policy ON "entity_permission"
+        USING (tenant_id = current_setting('app.tenant_id')::uuid);
+      `);
   }
 
   public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      DROP POLICY tenant_isolation_policy ON "user";
+      DROP POLICY tenant_isolation_policy ON "role";
+      DROP POLICY tenant_isolation_policy ON "group";
+      DROP POLICY tenant_isolation_policy ON "entity_model";
+      DROP POLICY tenant_isolation_policy ON "user_group";
+      DROP POLICY tenant_isolation_policy ON "user_permission";
+      DROP POLICY tenant_isolation_policy ON "group_role";
+      DROP POLICY tenant_isolation_policy ON "group_permission";
+      DROP POLICY tenant_isolation_policy ON "role_permission";
+      DROP POLICY tenant_isolation_policy ON "entity_permission";
+      ALTER TABLE "user" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "role" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "group" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "entity_model" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "user_group" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "user_permission" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "group_role" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "group_permission" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "role_permission" DISABLE ROW LEVEL SECURITY;
+      ALTER TABLE "entity_permission" DISABLE ROW LEVEL SECURITY;
+    `);
     await queryRunner.query(
       `ALTER TABLE "user_permission" DROP COLUMN "tenant_id"`,
     );