cat/Kanban
Private
Public Access
1
0
Fork 0
Code Activity

Phase 2: Enforce Row-Level Security at the PostgreSQL level

Browse Source 
- Rewrite rls.ts with withTenant()/withBypassRLS() using parameterized
  set_config() in interactive Prisma transactions (no SQL injection)
- Add FORCE ROW LEVEL SECURITY on all 15 tenant-scoped tables
- Add __bypass__ sentinel and WITH CHECK clauses to every RLS policy
- Explicitly DISABLE RLS on tenants, tenant_hostnames, sessions
- Wrap all API route and page loader queries in withTenant()
- Wrap validateSession() in withBypassRLS() (joins RLS-protected users)
- Keep existing tenantId where-clause filters as optimization layer
- Add postgresql-client to Dockerfile and auto-apply RLS via entrypoint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Catherine Renelle
2026-02-25 22:54:26 -05:00
parent f6ddfcfc62
commit bd12160ebb
15 changed files with 625 additions and 424 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+2
View File
@@ -29,7 +29,9 @@ RUN npx prisma generate
COPY --from=builder /app/build ./build
COPY --from=builder /app/server.js ./server.js
COPY scripts ./scripts
RUN apk add --no-cache postgresql-client
RUN apk del python3 make g++ && rm -rf /var/cache/apk/*
RUN mkdir -p /app/uploads
docker-entrypoint.sh
+7
View File
@@ -20,5 +20,12 @@ if [ $RETRY -ge $MAX_RETRIES ]; then
exit 1
fi
echo "Applying RLS policies..."
if psql "$DATABASE_URL" -f ./scripts/setup-rls.sql; then
echo "RLS policies applied successfully."
else
echo "WARNING: Failed to apply RLS policies. Continuing anyway..."
fi
echo "Starting server..."
exec node server.js
scripts/setup-rls.sql
+210 -40
View File
@@ -1,65 +1,144 @@
-- Row-Level Security (RLS) Policies
-- Run this after migrations to enable tenant isolation at the DB level.
-- Idempotent: safe to re-run on every deploy.
-- Helper: current tenant context (set via SET LOCAL in Prisma extension)
-- Usage: SET LOCAL app.current_tenant_id = '<uuid>';
-- Helper: current tenant context (set via set_config() in Prisma transaction)
-- Usage: SELECT set_config('app.current_tenant_id', '<uuid>', true);
-- ─── Enable RLS ──────────────────────────────────────────
-- ─── Tables WITHOUT RLS (cross-tenant by design) ──────
ALTER TABLE tenants DISABLE ROW LEVEL SECURITY;
ALTER TABLE tenant_hostnames DISABLE ROW LEVEL SECURITY;
ALTER TABLE sessions DISABLE ROW LEVEL SECURITY;
-- ─── Enable + Force RLS ────────────────────────────────
ALTER TABLE users ENABLE ROW LEVEL SECURITY;
ALTER TABLE boards ENABLE ROW LEVEL SECURITY;
ALTER TABLE board_members ENABLE ROW LEVEL SECURITY;
ALTER TABLE columns ENABLE ROW LEVEL SECURITY;
ALTER TABLE cards ENABLE ROW LEVEL SECURITY;
ALTER TABLE card_assignees ENABLE ROW LEVEL SECURITY;
ALTER TABLE tags ENABLE ROW LEVEL SECURITY;
ALTER TABLE card_labels ENABLE ROW LEVEL SECURITY;
ALTER TABLE categories ENABLE ROW LEVEL SECURITY;
ALTER TABLE checklists ENABLE ROW LEVEL SECURITY;
ALTER TABLE checklist_items ENABLE ROW LEVEL SECURITY;
ALTER TABLE comments ENABLE ROW LEVEL SECURITY;
ALTER TABLE attachments ENABLE ROW LEVEL SECURITY;
ALTER TABLE activities ENABLE ROW LEVEL SECURITY;
ALTER TABLE notifications ENABLE ROW LEVEL SECURITY;
ALTER TABLE board_templates ENABLE ROW LEVEL SECURITY;
ALTER TABLE users FORCE ROW LEVEL SECURITY;
-- ─── Tenant-scoped tables (direct tenant_id) ────────────
ALTER TABLE boards ENABLE ROW LEVEL SECURITY;
ALTER TABLE boards FORCE ROW LEVEL SECURITY;
ALTER TABLE board_members ENABLE ROW LEVEL SECURITY;
ALTER TABLE board_members FORCE ROW LEVEL SECURITY;
ALTER TABLE columns ENABLE ROW LEVEL SECURITY;
ALTER TABLE columns FORCE ROW LEVEL SECURITY;
ALTER TABLE cards ENABLE ROW LEVEL SECURITY;
ALTER TABLE cards FORCE ROW LEVEL SECURITY;
ALTER TABLE card_assignees ENABLE ROW LEVEL SECURITY;
ALTER TABLE card_assignees FORCE ROW LEVEL SECURITY;
ALTER TABLE tags ENABLE ROW LEVEL SECURITY;
ALTER TABLE tags FORCE ROW LEVEL SECURITY;
ALTER TABLE card_labels ENABLE ROW LEVEL SECURITY;
ALTER TABLE card_labels FORCE ROW LEVEL SECURITY;
ALTER TABLE categories ENABLE ROW LEVEL SECURITY;
ALTER TABLE categories FORCE ROW LEVEL SECURITY;
ALTER TABLE checklists ENABLE ROW LEVEL SECURITY;
ALTER TABLE checklists FORCE ROW LEVEL SECURITY;
ALTER TABLE checklist_items ENABLE ROW LEVEL SECURITY;
ALTER TABLE checklist_items FORCE ROW LEVEL SECURITY;
ALTER TABLE comments ENABLE ROW LEVEL SECURITY;
ALTER TABLE comments FORCE ROW LEVEL SECURITY;
ALTER TABLE attachments ENABLE ROW LEVEL SECURITY;
ALTER TABLE attachments FORCE ROW LEVEL SECURITY;
ALTER TABLE activities ENABLE ROW LEVEL SECURITY;
ALTER TABLE activities FORCE ROW LEVEL SECURITY;
ALTER TABLE notifications ENABLE ROW LEVEL SECURITY;
ALTER TABLE notifications FORCE ROW LEVEL SECURITY;
ALTER TABLE board_templates ENABLE ROW LEVEL SECURITY;
ALTER TABLE board_templates FORCE ROW LEVEL SECURITY;
-- ─── Tenant-scoped tables (direct tenant_id) ──────────
-- Users
DROP POLICY IF EXISTS users_tenant_isolation ON users;
CREATE POLICY users_tenant_isolation ON users
USING (tenant_id::text = current_setting('app.current_tenant_id', true));
USING (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id::text = current_setting('app.current_tenant_id', true)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id::text = current_setting('app.current_tenant_id', true)
);
-- Boards
DROP POLICY IF EXISTS boards_tenant_isolation ON boards;
CREATE POLICY boards_tenant_isolation ON boards
USING (tenant_id::text = current_setting('app.current_tenant_id', true));
USING (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id::text = current_setting('app.current_tenant_id', true)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id::text = current_setting('app.current_tenant_id', true)
);
-- Tags
DROP POLICY IF EXISTS tags_tenant_isolation ON tags;
CREATE POLICY tags_tenant_isolation ON tags
USING (tenant_id::text = current_setting('app.current_tenant_id', true));
USING (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id::text = current_setting('app.current_tenant_id', true)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id::text = current_setting('app.current_tenant_id', true)
);
-- Categories
DROP POLICY IF EXISTS categories_tenant_isolation ON categories;
CREATE POLICY categories_tenant_isolation ON categories
USING (tenant_id::text = current_setting('app.current_tenant_id', true));
USING (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id::text = current_setting('app.current_tenant_id', true)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id::text = current_setting('app.current_tenant_id', true)
);
-- Board Templates (null tenant_id = system template, visible to all)
DROP POLICY IF EXISTS board_templates_tenant_isolation ON board_templates;
CREATE POLICY board_templates_tenant_isolation ON board_templates
USING (
tenant_id IS NULL
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id IS NULL
OR tenant_id::text = current_setting('app.current_tenant_id', true)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR tenant_id IS NULL
OR tenant_id::text = current_setting('app.current_tenant_id', true)
);
-- ─── Board-scoped tables (via join to boards) ───────────
-- ─── Board-scoped tables (via join to boards) ─────────
-- Board Members
DROP POLICY IF EXISTS board_members_tenant_isolation ON board_members;
CREATE POLICY board_members_tenant_isolation ON board_members
USING (
board_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR board_id IN (
SELECT id FROM boards
WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR board_id IN (
SELECT id FROM boards
WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
)
@@ -69,7 +148,15 @@ CREATE POLICY board_members_tenant_isolation ON board_members
DROP POLICY IF EXISTS columns_tenant_isolation ON columns;
CREATE POLICY columns_tenant_isolation ON columns
USING (
board_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR board_id IN (
SELECT id FROM boards
WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR board_id IN (
SELECT id FROM boards
WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
)
@@ -79,7 +166,15 @@ CREATE POLICY columns_tenant_isolation ON columns
DROP POLICY IF EXISTS activities_tenant_isolation ON activities;
CREATE POLICY activities_tenant_isolation ON activities
USING (
board_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR board_id IN (
SELECT id FROM boards
WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR board_id IN (
SELECT id FROM boards
WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
)
@@ -91,7 +186,16 @@ CREATE POLICY activities_tenant_isolation ON activities
DROP POLICY IF EXISTS cards_tenant_isolation ON cards;
CREATE POLICY cards_tenant_isolation ON cards
USING (
column_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR column_id IN (
SELECT c.id FROM columns c
JOIN boards b ON c.board_id = b.id
WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR column_id IN (
SELECT c.id FROM columns c
JOIN boards b ON c.board_id = b.id
WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
@@ -102,7 +206,17 @@ CREATE POLICY cards_tenant_isolation ON cards
DROP POLICY IF EXISTS card_assignees_tenant_isolation ON card_assignees;
CREATE POLICY card_assignees_tenant_isolation ON card_assignees
USING (
card_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
@@ -114,7 +228,17 @@ CREATE POLICY card_assignees_tenant_isolation ON card_assignees
DROP POLICY IF EXISTS card_labels_tenant_isolation ON card_labels;
CREATE POLICY card_labels_tenant_isolation ON card_labels
USING (
card_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
@@ -126,7 +250,17 @@ CREATE POLICY card_labels_tenant_isolation ON card_labels
DROP POLICY IF EXISTS checklists_tenant_isolation ON checklists;
CREATE POLICY checklists_tenant_isolation ON checklists
USING (
card_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
@@ -138,7 +272,18 @@ CREATE POLICY checklists_tenant_isolation ON checklists
DROP POLICY IF EXISTS checklist_items_tenant_isolation ON checklist_items;
CREATE POLICY checklist_items_tenant_isolation ON checklist_items
USING (
checklist_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR checklist_id IN (
SELECT ch.id FROM checklists ch
JOIN cards ca ON ch.card_id = ca.id
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR checklist_id IN (
SELECT ch.id FROM checklists ch
JOIN cards ca ON ch.card_id = ca.id
JOIN columns c ON ca.column_id = c.id
@@ -151,7 +296,17 @@ CREATE POLICY checklist_items_tenant_isolation ON checklist_items
DROP POLICY IF EXISTS comments_tenant_isolation ON comments;
CREATE POLICY comments_tenant_isolation ON comments
USING (
card_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
@@ -163,7 +318,17 @@ CREATE POLICY comments_tenant_isolation ON comments
DROP POLICY IF EXISTS attachments_tenant_isolation ON attachments;
CREATE POLICY attachments_tenant_isolation ON attachments
USING (
card_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
WHERE b.tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR card_id IN (
SELECT ca.id FROM cards ca
JOIN columns c ON ca.column_id = c.id
JOIN boards b ON c.board_id = b.id
@@ -171,17 +336,22 @@ CREATE POLICY attachments_tenant_isolation ON attachments
)
);
-- ─── User-scoped tables ─────────────────────────────────
-- ─── User-scoped tables ───────────────────────────────
-- Notifications
DROP POLICY IF EXISTS notifications_tenant_isolation ON notifications;
CREATE POLICY notifications_tenant_isolation ON notifications
USING (
user_id IN (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR user_id IN (
SELECT id FROM users
WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
)
)
WITH CHECK (
current_setting('app.current_tenant_id', true) = '__bypass__'
OR user_id IN (
SELECT id FROM users
WHERE tenant_id::text = current_setting('app.current_tenant_id', true)
)
);
-- Sessions (no RLS - cross-tenant by design for session validation)
-- Sessions are validated in application code with tenant check
src/lib/server/auth.ts
+7 -2
View File
@@ -1,5 +1,6 @@
import bcrypt from 'bcrypt';
import { prisma } from './db.js';
import { withBypassRLS } from './rls.js';
const SALT_ROUNDS = 12;
const SESSION_DURATION_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
@@ -21,7 +22,10 @@ export async function createSession(userId: string): Promise<{ id: string; expir
}
export async function validateSession(sessionId: string) {
const session = await prisma.session.findUnique({
// Uses withBypassRLS because this joins to the users table (RLS-protected)
// and runs before tenant context is established in hooks.server.ts.
return withBypassRLS(async (tx) => {
const session = await tx.session.findUnique({
where: { id: sessionId },
include: {
user: {
@@ -40,11 +44,12 @@ export async function validateSession(sessionId: string) {
if (!session) return null;
if (session.expiresAt < new Date()) {
await prisma.session.delete({ where: { id: sessionId } });
await tx.session.delete({ where: { id: sessionId } });
return null;
}
return session;
});
}
export async function deleteSession(sessionId: string) {
src/lib/server/rls.ts
+25 -45
View File
@@ -1,56 +1,36 @@
import { PrismaClient } from '@prisma/client';
import type { Prisma } from '@prisma/client';
import { prisma } from './db.js';
type TxClient = Prisma.TransactionClient;
/**
* Prisma client extension for Row-Level Security.
* Executes a callback within an interactive Prisma transaction
* with the RLS tenant context set to the given tenantId.
*
* Usage:
* const db = forTenant(tenantId);
* const boards = await db.board.findMany(); // automatically filtered
*
* const db = bypassRLS();
* const allBoards = await db.board.findMany(); // no RLS
* All queries inside the callback are scoped to that tenant
* by PostgreSQL RLS policies.
*/
const basePrisma = new PrismaClient();
/**
* Returns a Prisma client that sets the tenant context for RLS policies.
* All queries through this client will be filtered to the specified tenant.
*/
export function forTenant(tenantId: string): PrismaClient {
return basePrisma.$extends({
query: {
$allOperations({ args, query }) {
return basePrisma.$transaction(async (tx) => {
await tx.$executeRawUnsafe(
`SET LOCAL app.current_tenant_id = '${tenantId}'`
);
return query(args);
export async function withTenant<T>(
tenantId: string,
callback: (tx: TxClient) => Promise<T>
): Promise<T> {
return prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_tenant_id', ${tenantId}, true)`;
return callback(tx);
});
}
}
}) as unknown as PrismaClient;
}
/**
* Returns a Prisma client that bypasses RLS.
* Use for Site Admin operations that need cross-tenant access.
* Executes a callback that bypasses RLS.
* Uses the '__bypass__' sentinel recognized by RLS policies.
*
* Use for cross-tenant operations like session validation.
*/
export function bypassRLS(): PrismaClient {
return basePrisma.$extends({
query: {
$allOperations({ args, query }) {
return basePrisma.$transaction(async (tx) => {
await tx.$executeRawUnsafe(
`SET LOCAL app.current_tenant_id = ''`
);
// With RLS, setting an empty tenant_id effectively shows nothing.
// For bypass, we need to use a superuser or disable RLS.
// In practice, the app Prisma client (db.ts) doesn't enable RLS
// on the connection, so this is used when RLS is fully enabled.
return query(args);
export async function withBypassRLS<T>(
callback: (tx: TxClient) => Promise<T>
): Promise<T> {
return prisma.$transaction(async (tx) => {
await tx.$executeRaw`SELECT set_config('app.current_tenant_id', ${'__bypass__'}, true)`;
return callback(tx);
});
}
}
}) as unknown as PrismaClient;
}
src/routes/api/auth/login/+server.ts
+6 -2
View File
@@ -1,8 +1,8 @@
import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { verifyPassword, createSession, sessionCookieName, sessionCookieOptions } from '$lib/server/auth.js';
import { loginSchema } from '$lib/server/validation.js';
import { withTenant } from '$lib/server/rls.js';
export const POST: RequestHandler = async ({ request, locals, cookies }) => {
const tenant = locals.tenant;
@@ -16,13 +16,17 @@ export const POST: RequestHandler = async ({ request, locals, cookies }) => {
const { email, password } = result.data;
const user = await prisma.user.findUnique({
const user = await withTenant(tenant.id, async (tx) => {
return tx.user.findUnique({
where: { tenantId_email: { tenantId: tenant.id, email } }
});
});
if (!user) {
return json({ error: 'Invalid email or password' }, { status: 401 });
}
// Verify password outside transaction
const valid = await verifyPassword(password, user.passwordHash);
if (!valid) {
return json({ error: 'Invalid email or password' }, { status: 401 });
src/routes/api/auth/register/+server.ts
+13 -5
View File
@@ -1,8 +1,8 @@
import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { hashPassword, createSession, sessionCookieName, sessionCookieOptions } from '$lib/server/auth.js';
import { registerSchema } from '$lib/server/validation.js';
import { withTenant } from '$lib/server/rls.js';
export const POST: RequestHandler = async ({ request, locals, cookies }) => {
const tenant = locals.tenant;
@@ -16,16 +16,19 @@ export const POST: RequestHandler = async ({ request, locals, cookies }) => {
const { email, name, password } = result.data;
// Hash password outside transaction to avoid holding DB connection during bcrypt
const passwordHash = await hashPassword(password);
const user = await withTenant(tenant.id, async (tx) => {
// Check if user already exists in this tenant
const existing = await prisma.user.findUnique({
const existing = await tx.user.findUnique({
where: { tenantId_email: { tenantId: tenant.id, email } }
});
if (existing) {
return json({ error: 'An account with this email already exists' }, { status: 409 });
return null;
}
const passwordHash = await hashPassword(password);
const user = await prisma.user.create({
return tx.user.create({
data: {
tenantId: tenant.id,
email,
@@ -33,6 +36,11 @@ export const POST: RequestHandler = async ({ request, locals, cookies }) => {
passwordHash
}
});
});
if (!user) {
return json({ error: 'An account with this email already exists' }, { status: 409 });
}
const session = await createSession(user.id);
cookies.set(sessionCookieName(), session.id, sessionCookieOptions(session.expiresAt));
src/routes/api/boards/+server.ts
+8 -5
View File
@@ -1,13 +1,14 @@
import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { boardSchema } from '$lib/server/validation.js';
import { withTenant } from '$lib/server/rls.js';
// List boards for current tenant
export const GET: RequestHandler = async ({ locals }) => {
const tenant = locals.tenant;
if (!tenant) throw error(400, 'Unknown tenant');
const boards = await withTenant(tenant.id, async (tx) => {
const where: Record<string, unknown> = { tenantId: tenant.id, archived: false };
// If not logged in, only show public boards
@@ -19,10 +20,9 @@ export const GET: RequestHandler = async ({ locals }) => {
{ visibility: 'PUBLIC' },
{ members: { some: { userId: locals.user.id } } }
];
delete where.visibility;
}
const boards = await prisma.board.findMany({
return tx.board.findMany({
where,
include: {
members: {
@@ -32,6 +32,7 @@ export const GET: RequestHandler = async ({ locals }) => {
},
orderBy: { updatedAt: 'desc' }
});
});
return json({ boards });
};
@@ -50,7 +51,8 @@ export const POST: RequestHandler = async ({ request, locals }) => {
const { title, description, visibility } = result.data;
const board = await prisma.board.create({
const board = await withTenant(tenant.id, async (tx) => {
return tx.board.create({
data: {
tenantId: tenant.id,
title,
@@ -58,7 +60,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
visibility,
members: {
create: {
userId: locals.user.id,
userId: locals.user!.id,
role: 'OWNER'
}
}
@@ -69,6 +71,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
}
}
});
});
return json({ board }, { status: 201 });
};
src/routes/api/boards/[boardId]/+server.ts
+20 -14
View File
@@ -1,14 +1,15 @@
import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { boardSchema } from '$lib/server/validation.js';
import { withTenant } from '$lib/server/rls.js';
// Get single board with all columns and cards
export const GET: RequestHandler = async ({ params, locals }) => {
const tenant = locals.tenant;
if (!tenant) throw error(400, 'Unknown tenant');
const board = await prisma.board.findFirst({
const board = await withTenant(tenant.id, async (tx) => {
return tx.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: {
columns: {
@@ -32,6 +33,7 @@ export const GET: RequestHandler = async ({ params, locals }) => {
}
}
});
});
if (!board) throw error(404, 'Board not found');
@@ -53,7 +55,14 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const board = await prisma.board.findFirst({
const body = await request.json();
const result = boardSchema.partial().safeParse(body);
if (!result.success) {
return json({ error: result.error.issues[0].message }, { status: 400 });
}
const updated = await withTenant(tenant.id, async (tx) => {
const board = await tx.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: { members: true }
});
@@ -61,20 +70,15 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
const member = board.members.find((m) => m.userId === locals.user!.id);
const isAdmin =
locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot edit boards');
const body = await request.json();
const result = boardSchema.partial().safeParse(body);
if (!result.success) {
return json({ error: result.error.issues[0].message }, { status: 400 });
}
const updated = await prisma.board.update({
return tx.board.update({
where: { id: params.boardId },
data: result.data
});
});
return json({ board: updated });
};
@@ -85,7 +89,8 @@ export const DELETE: RequestHandler = async ({ params, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const board = await prisma.board.findFirst({
await withTenant(tenant.id, async (tx) => {
const board = await tx.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: { members: true }
});
@@ -93,10 +98,11 @@ export const DELETE: RequestHandler = async ({ params, locals }) => {
const member = board.members.find((m) => m.userId === locals.user!.id);
const isAdmin =
locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (member?.role !== 'OWNER' && !isAdmin) throw error(403, 'Only owners can delete boards');
await prisma.board.delete({ where: { id: params.boardId } });
await tx.board.delete({ where: { id: params.boardId } });
});
return json({ ok: true });
};
src/routes/api/boards/[boardId]/columns/+server.ts
+16 -14
View File
@@ -1,8 +1,8 @@
import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { columnSchema } from '$lib/server/validation.js';
import { generatePosition } from '$lib/utils/fractional-index.js';
import { withTenant } from '$lib/server/rls.js';
// Create column
export const POST: RequestHandler = async ({ params, request, locals }) => {
@@ -10,32 +10,33 @@ export const POST: RequestHandler = async ({ params, request, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const board = await prisma.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: { members: true }
});
if (!board) throw error(404, 'Board not found');
const member = board.members.find((m) => m.userId === locals.user!.id);
const isAdmin = locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot add columns');
const body = await request.json();
const result = columnSchema.safeParse(body);
if (!result.success) {
return json({ error: result.error.issues[0].message }, { status: 400 });
}
const column = await withTenant(tenant.id, async (tx) => {
const board = await tx.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: { members: true }
});
if (!board) throw error(404, 'Board not found');
const member = board.members.find((m) => m.userId === locals.user!.id);
const isAdmin = locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot add columns');
// Get the last column position
const lastColumn = await prisma.column.findFirst({
const lastColumn = await tx.column.findFirst({
where: { boardId: params.boardId },
orderBy: { position: 'desc' }
});
const position = generatePosition(lastColumn?.position, null);
const column = await prisma.column.create({
return tx.column.create({
data: {
boardId: params.boardId,
title: result.data.title,
@@ -45,6 +46,7 @@ export const POST: RequestHandler = async ({ params, request, locals }) => {
cards: true
}
});
});
return json({ column }, { status: 201 });
};
src/routes/api/boards/[boardId]/columns/[columnId]/+server.ts
+16 -13
View File
@@ -1,7 +1,7 @@
import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { columnSchema, moveColumnSchema } from '$lib/server/validation.js';
import { withTenant } from '$lib/server/rls.js';
// Update column title
export const PATCH: RequestHandler = async ({ params, request, locals }) => {
@@ -9,41 +9,42 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const column = await prisma.column.findFirst({
const body = await request.json();
const updated = await withTenant(tenant.id, async (tx) => {
const column = await tx.column.findFirst({
where: { id: params.columnId, board: { id: params.boardId, tenantId: tenant.id } },
include: { board: { include: { members: true } } }
});
if (!column) throw error(404, 'Column not found');
const member = column.board.members.find((m) => m.userId === locals.user!.id);
const isAdmin = locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
const isAdmin = locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot edit columns');
const body = await request.json();
// Allow both title update and position update
if (body.position !== undefined) {
const result = moveColumnSchema.safeParse(body);
if (!result.success) {
return json({ error: result.error.issues[0].message }, { status: 400 });
throw error(400, result.error.issues[0].message);
}
const updated = await prisma.column.update({
return tx.column.update({
where: { id: params.columnId },
data: { position: result.data.position }
});
return json({ column: updated });
}
const result = columnSchema.safeParse(body);
if (!result.success) {
return json({ error: result.error.issues[0].message }, { status: 400 });
throw error(400, result.error.issues[0].message);
}
const updated = await prisma.column.update({
return tx.column.update({
where: { id: params.columnId },
data: { title: result.data.title }
});
});
return json({ column: updated });
};
@@ -54,18 +55,20 @@ export const DELETE: RequestHandler = async ({ params, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const column = await prisma.column.findFirst({
await withTenant(tenant.id, async (tx) => {
const column = await tx.column.findFirst({
where: { id: params.columnId, board: { id: params.boardId, tenantId: tenant.id } },
include: { board: { include: { members: true } } }
});
if (!column) throw error(404, 'Column not found');
const member = column.board.members.find((m) => m.userId === locals.user!.id);
const isAdmin = locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
const isAdmin = locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (member?.role === 'VIEWER' && !isAdmin) throw error(403, 'Viewers cannot delete columns');
if (!member && !isAdmin) throw error(403, 'Access denied');
await prisma.column.delete({ where: { id: params.columnId } });
await tx.column.delete({ where: { id: params.columnId } });
});
return json({ ok: true });
};
src/routes/api/boards/[boardId]/columns/[columnId]/cards/+server.ts
+16 -14
View File
@@ -1,8 +1,8 @@
import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { cardSchema } from '$lib/server/validation.js';
import { generatePosition } from '$lib/utils/fractional-index.js';
import { withTenant } from '$lib/server/rls.js';
// Create card in column
export const POST: RequestHandler = async ({ params, request, locals }) => {
@@ -10,32 +10,33 @@ export const POST: RequestHandler = async ({ params, request, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const column = await prisma.column.findFirst({
where: { id: params.columnId, board: { id: params.boardId, tenantId: tenant.id } },
include: { board: { include: { members: true } } }
});
if (!column) throw error(404, 'Column not found');
const member = column.board.members.find((m) => m.userId === locals.user!.id);
const isAdmin = locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot add cards');
const body = await request.json();
const result = cardSchema.safeParse(body);
if (!result.success) {
return json({ error: result.error.issues[0].message }, { status: 400 });
}
const card = await withTenant(tenant.id, async (tx) => {
const column = await tx.column.findFirst({
where: { id: params.columnId, board: { id: params.boardId, tenantId: tenant.id } },
include: { board: { include: { members: true } } }
});
if (!column) throw error(404, 'Column not found');
const member = column.board.members.find((m) => m.userId === locals.user!.id);
const isAdmin = locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot add cards');
// Get the last card position in this column
const lastCard = await prisma.card.findFirst({
const lastCard = await tx.card.findFirst({
where: { columnId: params.columnId },
orderBy: { position: 'desc' }
});
const position = generatePosition(lastCard?.position, null);
const card = await prisma.card.create({
return tx.card.create({
data: {
columnId: params.columnId,
title: result.data.title,
@@ -50,6 +51,7 @@ export const POST: RequestHandler = async ({ params, request, locals }) => {
_count: { select: { comments: true, checklists: true, attachments: true } }
}
});
});
return json({ card }, { status: 201 });
};
src/routes/api/boards/[boardId]/columns/[columnId]/cards/[cardId]/+server.ts
+18 -13
View File
@@ -1,14 +1,15 @@
import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { cardSchema, moveCardSchema } from '$lib/server/validation.js';
import { withTenant } from '$lib/server/rls.js';
// Get single card with full details
export const GET: RequestHandler = async ({ params, locals }) => {
const tenant = locals.tenant;
if (!tenant) throw error(400, 'Unknown tenant');
const card = await prisma.card.findFirst({
const card = await withTenant(tenant.id, async (tx) => {
return tx.card.findFirst({
where: {
id: params.cardId,
column: { id: params.columnId, board: { id: params.boardId, tenantId: tenant.id } }
@@ -30,6 +31,7 @@ export const GET: RequestHandler = async ({ params, locals }) => {
column: { select: { id: true, title: true } }
}
});
});
if (!card) throw error(404, 'Card not found');
@@ -42,7 +44,10 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const card = await prisma.card.findFirst({
const body = await request.json();
const updated = await withTenant(tenant.id, async (tx) => {
const card = await tx.card.findFirst({
where: {
id: params.cardId,
column: { board: { id: params.boardId, tenantId: tenant.id } }
@@ -52,19 +57,17 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
if (!card) throw error(404, 'Card not found');
const member = card.column.board.members.find((m) => m.userId === locals.user!.id);
const isAdmin = locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
const isAdmin = locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot edit cards');
const body = await request.json();
// Handle move (column change + position)
if (body.columnId !== undefined || body.position !== undefined) {
const data: Record<string, unknown> = {};
if (body.columnId) data.columnId = body.columnId;
if (body.position) data.position = body.position;
const updated = await prisma.card.update({
return tx.card.update({
where: { id: params.cardId },
data,
include: {
@@ -75,20 +78,19 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
_count: { select: { comments: true, checklists: true, attachments: true } }
}
});
return json({ card: updated });
}
// Handle content update
const result = cardSchema.partial().safeParse(body);
if (!result.success) {
return json({ error: result.error.issues[0].message }, { status: 400 });
throw error(400, result.error.issues[0].message);
}
const updateData: Record<string, unknown> = { ...result.data };
if (body.dueDate !== undefined) updateData.dueDate = body.dueDate ? new Date(body.dueDate) : null;
if (body.archived !== undefined) updateData.archived = body.archived;
const updated = await prisma.card.update({
return tx.card.update({
where: { id: params.cardId },
data: updateData,
include: {
@@ -99,6 +101,7 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
_count: { select: { comments: true, checklists: true, attachments: true } }
}
});
});
return json({ card: updated });
};
@@ -109,7 +112,8 @@ export const DELETE: RequestHandler = async ({ params, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const card = await prisma.card.findFirst({
await withTenant(tenant.id, async (tx) => {
const card = await tx.card.findFirst({
where: {
id: params.cardId,
column: { board: { id: params.boardId, tenantId: tenant.id } }
@@ -119,11 +123,12 @@ export const DELETE: RequestHandler = async ({ params, locals }) => {
if (!card) throw error(404, 'Card not found');
const member = card.column.board.members.find((m) => m.userId === locals.user!.id);
const isAdmin = locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
const isAdmin = locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot delete cards');
await prisma.card.delete({ where: { id: params.cardId } });
await tx.card.delete({ where: { id: params.cardId } });
});
return json({ ok: true });
};
src/routes/boards/+page.server.ts
+4 -2
View File
@@ -1,10 +1,11 @@
import type { PageServerLoad } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { withTenant } from '$lib/server/rls.js';
export const load: PageServerLoad = async ({ locals }) => {
const tenant = locals.tenant;
if (!tenant) return { boards: [] };
const boards = await withTenant(tenant.id, async (tx) => {
const where: any = { tenantId: tenant.id, archived: false };
if (!locals.user) {
@@ -16,7 +17,7 @@ export const load: PageServerLoad = async ({ locals }) => {
];
}
const boards = await prisma.board.findMany({
return tx.board.findMany({
where,
include: {
members: {
@@ -26,6 +27,7 @@ export const load: PageServerLoad = async ({ locals }) => {
},
orderBy: { updatedAt: 'desc' }
});
});
return { boards };
};
src/routes/boards/[boardId]/+page.server.ts
+4 -2
View File
@@ -1,12 +1,13 @@
import { error } from '@sveltejs/kit';
import type { PageServerLoad } from './$types.js';
import { prisma } from '$lib/server/db.js';
import { withTenant } from '$lib/server/rls.js';
export const load: PageServerLoad = async ({ params, locals }) => {
const tenant = locals.tenant;
if (!tenant) throw error(400, 'Unknown tenant');
const board = await prisma.board.findFirst({
const board = await withTenant(tenant.id, async (tx) => {
return tx.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: {
columns: {
@@ -30,6 +31,7 @@ export const load: PageServerLoad = async ({ params, locals }) => {
}
}
});
});
if (!board) throw error(404, 'Board not found');