scripte/timemaster
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(security/dsgvo): RLS für hours_payouts nachgezogen (Mandantentrennung)

Browse Source 
hours_payouts war die einzige firmenbezogene Tabelle ohne Row-Level-Security
(Migration 0030 hatte keinen RLS-Block). Die Endpunkte filtern zwar applikativ
nach company_id (kein akutes Leck), aber das DB-seitige Schutznetz – das im
ganzen System (FORCE RLS, 0024/0034) die Mandantentrennung garantiert – fehlte.

Migration 0039 aktiviert ENABLE+FORCE RLS + company_id-Policies (analog 0024).
conftest.py-RLS-Replik + neuer Cross-Tenant-Test test_rls_hours_payouts_tenant_isolation.
Verifiziert auf 137+164 (rls=True, force=True, 4 Policies). 191/191 Tests grün.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
patrick
2026-06-23 14:06:19 +02:00
co-authored by Claude Opus 4.8
parent 2b74f95e68
commit 3034c6c55a
3 changed files with 72 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/conftest.py
+1 -1
View File
@@ -34,7 +34,7 @@ def _rls_using_join(): return (
_COMPANY_COL_TABLES = [
"absence_comments", "absence_types", "audit_logs", "caldav_company_configs", "departments",
"kiosk_devices", "ldap_configs", "overtime_balances", "smtp_configs",
"hours_payouts", "kiosk_devices", "ldap_configs", "overtime_balances", "smtp_configs",
"special_assignments", "users", "work_schedules",
]
_USER_JOIN_TABLES = [