fix(api): update database routing logic in MainRouter

[AdriiiPRodri]

Context

Security Hub exports were failing in production with Cannot assign "<Integration …>" and invalid input syntax for type uuid: "". The first came from reading the integration-provider relationship through the read replica; the second was Row Level Security blocking our integration.save() calls because the tenant context was only being set on the replica connection.

Description

• Allow allow_relation to treat default, admin, and replica as compatible aliases so Django stops rejecting relationships built from replica reads.

• Ensure every Security Hub write (regions update, connection flag) runs inside rls_transaction(..., using=MainRouter.default_db) before saving, so SET CONFIG(api.tenant_id, …) hits the same primary connection that persists the row.

Steps to review

1. Pull the branch and reproduce a Security Hub export against a tenant with the integration enabled.
2. Confirm logs show the integration completing without Cannot assign or invalid input syntax errors.
3. Verify the integration record keeps the new regions map and connected status as expected.

Checklist

• Are there new checks included in this PR? Yes / No
  • If so, do we need to update permissions for the provider? Please review this carefully.
• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the Readme.md
• Ensure new entries are added to CHANGELOG.md, if applicable.

API

• Verify if API specs need to be regenerated.
• Check if version updates are required (e.g., specs, Poetry, etc.).
• Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

✅ All necessary CHANGELOG.md files have been updated.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

[AdriiiPRodri]

Status update - Explanation

When the task blew up with invalid input syntax for type uuid: "", it wasn’t a bad value in our code, it was PostgreSQL’s row-level security telling us we’d lost track of the tenant context. Here’s what was going on:

We iterate findings inside with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS). That context only touches the replica connection, so SET_CONFIG('api.tenant_id', ...) is executed on the replica pool. We do that on purpose to offload read traffic.

The moment we call integration.save(), Django’s router switches to the write alias (the primary). That connection never saw the SET_CONFIG, so current_setting('api.tenant_id') is empty and Postgres rejects the update when the RLS policy checks tenant_id = current_setting('api.tenant_id')::uuid.

Forcing the RLS transaction with using=MainRouter.default_db before each write (saving the regions, toggling connected, etc.) makes sure set_config happens on the same connection that performs the UPDATE. The RLS policy then sees the right tenant and allows the write.

The other piece was in api/db_router.py. Before the change, allow_relation only blessed {default, admin}. When we read IntegrationProviderRelationship from the replica but had the Integration instance from the primary, the router blocked the relationship and Django raised Cannot assign "<Integration ...>". Adding self.replica_db to the allowed set tells Django, "yes, these aliases all point at the same data, it’s fine to relate objects fetched from default/admin/replica even though only default/admin accept writes." That unblocked the lookup so the Security Hub code could actually run.

So the full fix is:

Let the router consider replica a safe partner for relations (reads still stay readonly, writes still go through the primary).
Whenever we mutate the Integration row—like refreshing the regions map or flipping connected, wrap the call in rls_transaction(tenant_id, using=MainRouter.default_db) so we reapply the tenant context on the primary connection before saving.
With those two tweaks the job no longer trips over the router, and RLS works fine

[josema-xyz]

After reading some Django docs... 🚀

[github-actions]

🔒 Container Security Scan

Image: prowler-api:67f926c
Last scan: 2025-10-30 11:24:03 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	4
Total	4

3 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.98%. Comparing base (885ee62) to head (37cdd11).
⚠️ Report is 21 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9080      +/-   ##
==========================================
+ Coverage   88.50%   93.98%   +5.47%     
==========================================
  Files          93      141      +48     
  Lines        3524    16962   +13438     
==========================================
+ Hits         3119    15941   +12822     
- Misses        405     1021     +616     

Flag	Coverage Δ
api	93.98% <83.33%> (?)
prowler-py3.10-m365	?
prowler-py3.11-m365	?
prowler-py3.12-m365	?
prowler-py3.9-m365	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	∅ <ø> (∅)
api	93.98% <84.61%> (∅)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[prowler-bot]

💚 All backports created successfully

Status	Branch	Result
✅	v5.13

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details