feat(tables): enforce RLS on dynamic workspace schemas#2212
feat(tables): enforce RLS on dynamic workspace schemas#2212daryllimyt merged 28 commits intomainfrom
Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 4 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="tracecat/tables/service.py">
<violation number="1" location="tracecat/tables/service.py:727">
P1: Security: `EditorService.insert_row` and `update_row` don't reject writes to internal `__tc_*` columns. Since `get_columns()` reflects all physical columns (including `__tc_workspace_id`), a caller could set/override the tenant column in their payload. While RLS `WITH CHECK` may block cross-workspace writes when active, this should be filtered at the application layer for defense-in-depth — matching the approach in `custom_fields/service.py` which blocks operations targeting internal column names. Consider filtering `params.data` (or `row_data`) to reject keys where `is_internal_column_name(key)` is true, similar to how output is already stripped.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 91943620a4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This stack of pull requests is managed by Graphite. Learn more about stacking. |
daryllimyt
force-pushed
the
feat/rls-dynamic-schema-model-a
branch
from
9194362 to
b9cdd2e
Compare
daryllimyt
force-pushed
the
feat/rls-dynamic-schema-model-a
branch
from
b9cdd2e to
ed6b32a
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ed6b32a54a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
daryllimyt
force-pushed
the
feat/rls-dynamic-schema-model-a
branch
2 times, most recently
from
571c254 to
37f760c
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d526d9861f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7884ab64dd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
alembic/versions/b5fc4168fe22_apply_model_a_rls_to_dynamic_workspace_.py
Show resolved
Hide resolved
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5a594d6062
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
daryllimyt
force-pushed
the
feat/rls-dynamic-schema-model-a
branch
from
5a594d6 to
bc5f6b6
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 485fd501fe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
2 issues found across 5 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="tests/unit/test_tables_service.py">
<violation number="1" location="tests/unit/test_tables_service.py:158">
P2: This test encodes the wrong contract for the `__tc_*` internal namespace; allowing `__tc_shadow` means internal-prefixed columns will bypass both the write guard and the visibility filter.</violation>
</file>
<file name="tests/unit/test_case_fields_service.py">
<violation number="1" location="tests/unit/test_case_fields_service.py:183">
P2: Don't codify `__tc_*` as a user-available namespace; reserve it for internal columns.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38342762f6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
alembic/versions/b5fc4168fe22_apply_model_a_rls_to_dynamic_workspace_.py
Show resolved
Hide resolved
daryllimyt
force-pushed
the
feat/rls-dynamic-schema-model-a
branch
2 times, most recently
from
4937fa5 to
ac4cbe2
Compare
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="tests/unit/test_dynamic_workspace_service_rls.py">
<violation number="1" location="tests/unit/test_dynamic_workspace_service_rls.py:26">
P2: Shadow the autouse `workflow_bucket` fixture here so this unit suite does not fail on missing MinIO.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
daryllimyt
force-pushed
the
feat/rls-dynamic-schema-model-a
branch
from
e45808b to
2eb724c
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2eb724cc9a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
alembic/versions/cd84c08340a5_add_cascade_delete_to_membership_.py
Outdated
Show resolved
Hide resolved
daryllimyt
had a problem deploying
to
internal-registry-ci
GitHub Actions
Failure
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f0e4784e52
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 47c14a3a76
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
|
✅ No security or compliance issues detected. Reviewed everything up to 6a05cb0. Security Overview
Detected Code ChangesThe diff is too large to display a summary of code changes. |
There was a problem hiding this comment.
1 issue found across 6 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="tracecat/tables/service.py">
<violation number="1" location="tracecat/tables/service.py:618">
P2: Explicit `name: null` rename payloads are silently ignored instead of being rejected, so invalid update requests can succeed unexpectedly.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
daryllimyt
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0aabc8bad4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
alembic/versions/b5fc4168fe22_apply_model_a_rls_to_dynamic_workspace_.py
Outdated
Show resolved
Hide resolved
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
daryllimyt
temporarily deployed
to
internal-registry-ci
GitHub Actions
Inactive
2 participants
Summary
tables_<ws_short>,custom_fields_<ws_short>) by introducing an internal tenant column (__tc_workspace_id)__tc_workspace_idand enable RLS policy (rls_policy_dynamic_workspace)__tc_*columns from API-facing row payloads and field listingsChanges
tracecat/tables/service.pytracecat/custom_fields/service.pytracecat/cases/service.py__tc_workspace_idto workspacecase_fieldsphysical table definition__tc_workspace_idas reservedalembic/versions/b5fc4168fe22_apply_model_a_rls_to_dynamic_workspace_.py__tc_workspace_idacross dynamic workspace schemasValidation
uv run ruff check tracecat/tables/service.py tracecat/custom_fields/service.py tracecat/cases/service.py alembic/versions/b5fc4168fe22_apply_model_a_rls_to_dynamic_workspace_.pyuv run basedpyright tracecat/tables/service.py tracecat/custom_fields/service.py tracecat/cases/service.py alembic/versions/b5fc4168fe22_apply_model_a_rls_to_dynamic_workspace_.pyuv run pytest tests/unit/test_tables_service.py tests/unit/test_case_fields_service.py(fails in this worktree due missing MinIO onlocalhost:9000)QA
3athttp://localhost:280and signed in to the UI as seeded usertest@tracecat.comevidence_note(Text, defaultseeded note) andtriage_score(Integer, default7) in the UICASE-0001, updated custom field values in the UI, and verified viadocker exec ... psqlthatcustom_fields_ws_1KyvEJCxa6QPAj3FTDFnfB.case_fieldsstored the row with the expected values and the correct__tc_workspace_idinventory_checkswith columnshostnameandrisk_score, inserted rowshost-a/10andhost-b/25in the UI, and verified viadocker exec ... psqlthattables_ws_1KyvEJCxa6QPAj3FTDFnfB.inventory_checksstored both rows with the correct__tc_workspace_id__tc_workspace_idSummary by cubic
Enforces Model A RLS on dynamic workspace schemas using a hidden
__tc_workspace_idand a reserved__tc_namespace. Table/editor APIs now return only user-visible columns in a stable order; invalid case-field inputs return HTTP 400.New Features
app.current_workspace_idwith bypass viaapp.rls_bypass='on'; auto-enablerls_policy_dynamic_workspacefor newtables_<ws>andcustom_fields_<ws>.case_fields.__tc_workspace_idto alltables_<ws>tables andcase_fields; reserve the__tc_prefix (case-insensitive) across table/editor metadata and custom-field ops; treat null column-rename payloads as no-ops.get_row/list_rows/lookup_rows/insert/update) andlist_fields/get_columns(system fields first); hide internal columns; quote"schema"."table"identifiers.Migration
__tc_workspace_idand enable the workspace RLS policy across existingtables_*andcustom_fields_*; handle legacy table metadata aliases; migration chain linearized after mergingmain.__tc_workspace_idtomigrated_tc_workspace_id(with numeric suffix if needed) and update metadata; preserve existing user-defined__tc_*columns and comments.Written for commit 6a05cb0. Summary will update on new commits.