ref: refactor forced db connections to use replica when needed

api/src/backend/api/rbac/permissions.py

@@ -30,7 +30,9 @@ class HasPermissions(BasePermission):
             return True
 
         user_roles = (
-            User.objects.using(MainRouter.admin_db).get(id=request.user.id).roles.all()
+            User.objects.using(MainRouter.admin_read)
+            .get(id=request.user.id)
+            .roles.all()
         )
         if not user_roles:
             return False

api/src/backend/api/utils.py

@@ -175,7 +175,7 @@ def validate_invitation(
     try:
         # Admin DB connector is used to bypass RLS protection since the invitation belongs to a tenant the user
         # is not a member of yet
-        invitation = Invitation.objects.using(MainRouter.admin_db).get(
+        invitation = Invitation.objects.using(MainRouter.admin_read).get(
             token=invitation_token, email=email
         )
     except Invitation.DoesNotExist:

api/src/backend/api/v1/views.py

@@ -1836,7 +1836,7 @@ class InvitationAcceptViewSet(BaseRLSViewSet):
         )
 
         # Proceed with accepting the invitation
-        user = User.objects.using(MainRouter.admin_db).get(email=user_email)
+        user = User.objects.using(MainRouter.admin_read).get(email=user_email)
         membership = Membership.objects.using(MainRouter.admin_db).create(
             user=user,
             tenant=invitation.tenant,

api/src/backend/tasks/jobs/deletion.py

@@ -65,7 +65,7 @@ def delete_tenant(pk: str):
     """
     deletion_summary = {}
 
-    for provider in Provider.objects.using(MainRouter.admin_db).filter(tenant_id=pk):
+    for provider in Provider.objects.using(MainRouter.admin_read).filter(tenant_id=pk):
         with rls_transaction(pk):
             summary = delete_provider(provider.id)
             deletion_summary.update(summary)