test(rls): make tenant-isolation count robust to own-company seed

David commented

2026-06-18 06:11:22 +02:00

Owner

The rls_isolation regression hard-coded count == 1 after seeding its probe company under tenant A. PMS-413 migration 062 backfills a per-tenant internal "own company", so the default tenant A now legitimately owns two companies (own-company + probe) and the matching-GUC read returns 2 rows, failing the assertion. Both rows belong to tenant A, so RLS is not leaking - the hard-coded count was simply stale.

Capture tenant A's owner-visible company count before dropping to the unprivileged role and assert the matching-GUC read equals it. The test still proves the policy is fail-closed (zero rows with no GUC) and exposes exactly tenant A's rows under the matching GUC, but no longer breaks when seed migrations add more tenant-A-owned rows.

#PMS-414

The rls_isolation regression hard-coded count == 1 after seeding its probe company under tenant A. PMS-413 migration 062 backfills a per-tenant internal "own company", so the default tenant A now legitimately owns two companies (own-company + probe) and the matching-GUC read returns 2 rows, failing the assertion. Both rows belong to tenant A, so RLS is not leaking - the hard-coded count was simply stale. Capture tenant A's owner-visible company count before dropping to the unprivileged role and assert the matching-GUC read equals it. The test still proves the policy is fail-closed (zero rows with no GUC) and exposes exactly tenant A's rows under the matching GUC, but no longer breaks when seed migrations add more tenant-A-owned rows. #PMS-414

David added 1 commit

2026-06-18 06:11:22 +02:00

test(rls): make tenant-isolation count robust to own-company seed

E2E / Playwright against staging (pull_request) Successful in 34s

Details

Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m7s

Details

Integration / integration tests (pull_request) Successful in 3m55s

Details

1cce469959

The rls_isolation regression hard-coded count == 1 after seeding its probe company under tenant A. PMS-413 migration 062 backfills a per-tenant internal "own company", so the default tenant A now legitimately owns two companies (own-company + probe) and the matching-GUC read returns 2 rows, failing the assertion. Both rows belong to tenant A, so RLS is not leaking - the hard-coded count was simply stale.

Capture tenant A's owner-visible company count before dropping to the unprivileged role and assert the matching-GUC read equals it. The test still proves the policy is fail-closed (zero rows with no GUC) and exposes exactly tenant A's rows under the matching GUC, but no longer breaks when seed migrations add more tenant-A-owned rows.

#PMS-414

vas2000-work added 1 commit

2026-06-18 06:40:21 +02:00