Matheus
d66170c795
- users + tenant_memberships tables (tenant-scoped)
- RLS policy on tenant_memberships using set_config('app.current_tenant_id', ...)
- withTenantContext() helper for transaction-scoped tenant context
- separate non-superuser app role (b2bcall_app): the default Docker postgres
user is SUPERUSER and always bypasses RLS even with FORCE, so the app must
never connect through the migration/owner role. Documented in
docs/TENANT_ISOLATION.md.
- automated isolation test proving tenant A never sees tenant B's data
6 lines
216 B
Plaintext
6 lines
216 B
Plaintext
FREESWITCH_PAT=
|
|
DATABASE_URL=postgresql://user:password@localhost:5432/b2bcall?schema=public
|
|
POSTGRES_APP_USER=
|
|
POSTGRES_APP_PASSWORD=
|
|
APP_DATABASE_URL=postgresql://user:password@localhost:5432/b2bcall?schema=public
|