matrix/cygnus-cloud-service/target/classes/db/identity/003_tenant_isolation_constraints.sql

BEGIN;

-- DMLP phase 3: make tenant ownership mandatory and enforce same-tenant
-- relationships without changing any legacy primary keys.

ALTER TABLE identity.company
  ALTER COLUMN tenant_id SET NOT NULL;
ALTER TABLE identity.company_branch
  ALTER COLUMN tenant_id SET NOT NULL;
ALTER TABLE identity.user_group
  ALTER COLUMN tenant_id SET NOT NULL;
ALTER TABLE identity.app_user
  ALTER COLUMN tenant_id SET NOT NULL;
ALTER TABLE identity.permission
  ALTER COLUMN tenant_id SET NOT NULL;
ALTER TABLE identity.denied_pages
  ALTER COLUMN tenant_id SET NOT NULL;
ALTER TABLE identity.user_loginhistory
  ALTER COLUMN tenant_id SET NOT NULL;

CREATE UNIQUE INDEX IF NOT EXISTS uq_identity_company_tenant_id
  ON identity.company (tenant_id, company_id);
CREATE UNIQUE INDEX IF NOT EXISTS uq_identity_branch_tenant_id
  ON identity.company_branch (tenant_id, branch_id, company_id);
CREATE UNIQUE INDEX IF NOT EXISTS uq_identity_group_tenant_id
  ON identity.user_group (tenant_id, group_id);
CREATE UNIQUE INDEX IF NOT EXISTS uq_identity_user_tenant_id
  ON identity.app_user (tenant_id, user_id);

DO $migration$
BEGIN
  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_company_tenant'
         AND conrelid = 'identity.company'::regclass) THEN
    ALTER TABLE identity.company
      ADD CONSTRAINT fk_identity_company_tenant
      FOREIGN KEY (tenant_id)
      REFERENCES identity.client_account (tenant_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_branch_tenant'
         AND conrelid = 'identity.company_branch'::regclass) THEN
    ALTER TABLE identity.company_branch
      ADD CONSTRAINT fk_identity_branch_tenant
      FOREIGN KEY (tenant_id)
      REFERENCES identity.client_account (tenant_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_branch_company_tenant'
         AND conrelid = 'identity.company_branch'::regclass) THEN
    ALTER TABLE identity.company_branch
      ADD CONSTRAINT fk_identity_branch_company_tenant
      FOREIGN KEY (tenant_id, company_id)
      REFERENCES identity.company (tenant_id, company_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_group_tenant'
         AND conrelid = 'identity.user_group'::regclass) THEN
    ALTER TABLE identity.user_group
      ADD CONSTRAINT fk_identity_group_tenant
      FOREIGN KEY (tenant_id)
      REFERENCES identity.client_account (tenant_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_user_tenant'
         AND conrelid = 'identity.app_user'::regclass) THEN
    ALTER TABLE identity.app_user
      ADD CONSTRAINT fk_identity_user_tenant
      FOREIGN KEY (tenant_id)
      REFERENCES identity.client_account (tenant_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_user_group_tenant'
         AND conrelid = 'identity.app_user'::regclass) THEN
    ALTER TABLE identity.app_user
      ADD CONSTRAINT fk_identity_user_group_tenant
      FOREIGN KEY (tenant_id, group_id)
      REFERENCES identity.user_group (tenant_id, group_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_user_company_tenant'
         AND conrelid = 'identity.app_user'::regclass) THEN
    ALTER TABLE identity.app_user
      ADD CONSTRAINT fk_identity_user_company_tenant
      FOREIGN KEY (tenant_id, company_id)
      REFERENCES identity.company (tenant_id, company_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_user_branch_tenant'
         AND conrelid = 'identity.app_user'::regclass) THEN
    ALTER TABLE identity.app_user
      ADD CONSTRAINT fk_identity_user_branch_tenant
      FOREIGN KEY (tenant_id, branch_id, company_id)
      REFERENCES identity.company_branch (tenant_id, branch_id, company_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_permission_tenant'
         AND conrelid = 'identity.permission'::regclass) THEN
    ALTER TABLE identity.permission
      ADD CONSTRAINT fk_identity_permission_tenant
      FOREIGN KEY (tenant_id)
      REFERENCES identity.client_account (tenant_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_permission_group_tenant'
         AND conrelid = 'identity.permission'::regclass) THEN
    ALTER TABLE identity.permission
      ADD CONSTRAINT fk_identity_permission_group_tenant
      FOREIGN KEY (tenant_id, group_id)
      REFERENCES identity.user_group (tenant_id, group_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_permission_page'
         AND conrelid = 'identity.permission'::regclass) THEN
    ALTER TABLE identity.permission
      ADD CONSTRAINT fk_identity_permission_page
      FOREIGN KEY (page_id)
      REFERENCES identity.pages (page_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_denied_tenant'
         AND conrelid = 'identity.denied_pages'::regclass) THEN
    ALTER TABLE identity.denied_pages
      ADD CONSTRAINT fk_identity_denied_tenant
      FOREIGN KEY (tenant_id)
      REFERENCES identity.client_account (tenant_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_denied_user_tenant'
         AND conrelid = 'identity.denied_pages'::regclass) THEN
    ALTER TABLE identity.denied_pages
      ADD CONSTRAINT fk_identity_denied_user_tenant
      FOREIGN KEY (tenant_id, user_id)
      REFERENCES identity.app_user (tenant_id, user_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_denied_page'
         AND conrelid = 'identity.denied_pages'::regclass) THEN
    ALTER TABLE identity.denied_pages
      ADD CONSTRAINT fk_identity_denied_page
      FOREIGN KEY (page_id)
      REFERENCES identity.pages (page_id)
      NOT VALID;
  END IF;

  IF NOT EXISTS (
      SELECT 1 FROM pg_constraint
       WHERE conname = 'fk_identity_login_history_tenant'
         AND conrelid = 'identity.user_loginhistory'::regclass) THEN
    ALTER TABLE identity.user_loginhistory
      ADD CONSTRAINT fk_identity_login_history_tenant
      FOREIGN KEY (tenant_id)
      REFERENCES identity.client_account (tenant_id)
      NOT VALID;
  END IF;

END
$migration$;

ALTER TABLE identity.company
  VALIDATE CONSTRAINT fk_identity_company_tenant;
ALTER TABLE identity.company_branch
  VALIDATE CONSTRAINT fk_identity_branch_tenant;
ALTER TABLE identity.company_branch
  VALIDATE CONSTRAINT fk_identity_branch_company_tenant;
ALTER TABLE identity.user_group
  VALIDATE CONSTRAINT fk_identity_group_tenant;
ALTER TABLE identity.app_user
  VALIDATE CONSTRAINT fk_identity_user_tenant;
ALTER TABLE identity.app_user
  VALIDATE CONSTRAINT fk_identity_user_group_tenant;
ALTER TABLE identity.app_user
  VALIDATE CONSTRAINT fk_identity_user_company_tenant;
ALTER TABLE identity.app_user
  VALIDATE CONSTRAINT fk_identity_user_branch_tenant;
ALTER TABLE identity.permission
  VALIDATE CONSTRAINT fk_identity_permission_tenant;
ALTER TABLE identity.permission
  VALIDATE CONSTRAINT fk_identity_permission_group_tenant;
ALTER TABLE identity.permission
  VALIDATE CONSTRAINT fk_identity_permission_page;
ALTER TABLE identity.denied_pages
  VALIDATE CONSTRAINT fk_identity_denied_tenant;
ALTER TABLE identity.denied_pages
  VALIDATE CONSTRAINT fk_identity_denied_user_tenant;
ALTER TABLE identity.denied_pages
  VALIDATE CONSTRAINT fk_identity_denied_page;
ALTER TABLE identity.user_loginhistory
  VALIDATE CONSTRAINT fk_identity_login_history_tenant;

COMMIT;