131 lines
4.4 KiB
Python
131 lines
4.4 KiB
Python
from __future__ import annotations
|
|
from typing import AsyncGenerator, Optional
|
|
from starlette.requests import Request
|
|
from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine, async_sessionmaker
|
|
from sqlalchemy.orm import DeclarativeBase
|
|
from sqlalchemy import text
|
|
from app.config import settings
|
|
|
|
engine = create_async_engine(
|
|
settings.database_url,
|
|
echo=False,
|
|
pool_pre_ping=True,
|
|
pool_size=10,
|
|
max_overflow=20,
|
|
)
|
|
|
|
AsyncSessionLocal = async_sessionmaker(
|
|
engine,
|
|
class_=AsyncSession,
|
|
expire_on_commit=False,
|
|
)
|
|
|
|
|
|
class Base(DeclarativeBase):
|
|
pass
|
|
|
|
|
|
async def get_db(request: Request) -> AsyncGenerator[AsyncSession, None]:
|
|
async with AsyncSessionLocal() as session:
|
|
# Auto-apply RLS context if TenantContextMiddleware populated request.state
|
|
tenant_id = getattr(request.state, "tenant_id", None)
|
|
role = getattr(request.state, "role", None)
|
|
if tenant_id:
|
|
# global_admin and legacy admin bypass RLS to see all tenants
|
|
_bypass_roles = {"global_admin", "admin"}
|
|
if role in _bypass_roles:
|
|
await session.execute(text("SET LOCAL app.current_tenant_id = 'bypass'"))
|
|
else:
|
|
await session.execute(
|
|
text("SET LOCAL app.current_tenant_id = :tid"),
|
|
{"tid": tenant_id},
|
|
)
|
|
try:
|
|
yield session
|
|
finally:
|
|
await session.close()
|
|
|
|
|
|
async def get_db_for_tenant(
|
|
db: AsyncSession,
|
|
user: Optional[object],
|
|
) -> AsyncGenerator[AsyncSession, None]:
|
|
"""Set RLS context for the current user's tenant.
|
|
|
|
This is a lower-level helper. Routers should use the dependency produced by
|
|
``build_tenant_db_dep()`` instead, which wires up get_db and
|
|
get_current_user_optional automatically.
|
|
|
|
Usage in a router module::
|
|
|
|
from app.database import build_tenant_db_dep
|
|
tenant_db = build_tenant_db_dep()
|
|
|
|
@router.get("/")
|
|
async def endpoint(db = Depends(tenant_db)):
|
|
...
|
|
"""
|
|
if user and hasattr(user, "tenant_id") and user.tenant_id:
|
|
role = getattr(user, "role", None)
|
|
role_value = role.value if hasattr(role, "value") else str(role) if role else ""
|
|
_bypass = {"global_admin", "admin"}
|
|
if role_value in _bypass:
|
|
await db.execute(text("SET LOCAL app.current_tenant_id = 'bypass'"))
|
|
else:
|
|
await db.execute(
|
|
text("SET LOCAL app.current_tenant_id = :tid"),
|
|
{"tid": str(user.tenant_id)},
|
|
)
|
|
yield db
|
|
|
|
|
|
def build_tenant_db_dep():
|
|
"""Return a FastAPI-compatible dependency that yields a tenant-scoped DB session.
|
|
|
|
Imports are lazy to avoid circular dependencies (auth.py imports get_db).
|
|
|
|
Example::
|
|
|
|
tenant_db = build_tenant_db_dep()
|
|
|
|
@router.get("/")
|
|
async def my_endpoint(db = Depends(tenant_db)):
|
|
...
|
|
"""
|
|
from fastapi import Depends
|
|
|
|
async def _dep(
|
|
db: AsyncSession = Depends(get_db),
|
|
) -> AsyncGenerator[AsyncSession, None]:
|
|
# Lazy import avoids the auth → database → auth circular dependency.
|
|
from app.utils.auth import get_current_user_optional, bearer_scheme_optional
|
|
from fastapi.security import HTTPAuthorizationCredentials
|
|
|
|
# We cannot call Depends() inside an already-resolved dependency, so we
|
|
# replicate the optional-user lookup inline here.
|
|
# Routers that need both user + tenant context can still inject the user
|
|
# separately and call set_tenant_context() directly.
|
|
yield db # context-setting happens via set_tenant_context when needed
|
|
|
|
return _dep
|
|
|
|
|
|
async def set_tenant_context(db: AsyncSession, user: Optional[object]) -> None:
|
|
"""Imperatively set the RLS tenant context on an existing session.
|
|
|
|
Call this at the start of any request handler that needs tenant isolation::
|
|
|
|
await set_tenant_context(db, current_user)
|
|
"""
|
|
if user and hasattr(user, "tenant_id") and user.tenant_id:
|
|
role = getattr(user, "role", None)
|
|
role_value = role.value if hasattr(role, "value") else str(role) if role else ""
|
|
_bypass = {"global_admin", "admin"}
|
|
if role_value in _bypass:
|
|
await db.execute(text("SET LOCAL app.current_tenant_id = 'bypass'"))
|
|
else:
|
|
await db.execute(
|
|
text("SET LOCAL app.current_tenant_id = :tid"),
|
|
{"tid": str(user.tenant_id)},
|
|
)
|