diff --git a/api/src/backend/api/rbac/permissions.py b/api/src/backend/api/rbac/permissions.py index 6a95e82932..79f44f7ee8 100644 --- a/api/src/backend/api/rbac/permissions.py +++ b/api/src/backend/api/rbac/permissions.py @@ -30,7 +30,9 @@ class HasPermissions(BasePermission): return True user_roles = ( - User.objects.using(MainRouter.admin_db).get(id=request.user.id).roles.all() + User.objects.using(MainRouter.admin_read) + .get(id=request.user.id) + .roles.all() ) if not user_roles: return False diff --git a/api/src/backend/api/utils.py b/api/src/backend/api/utils.py index 9dd86daeaf..1dec5b8c9e 100644 --- a/api/src/backend/api/utils.py +++ b/api/src/backend/api/utils.py @@ -175,7 +175,7 @@ def validate_invitation( try: # Admin DB connector is used to bypass RLS protection since the invitation belongs to a tenant the user # is not a member of yet - invitation = Invitation.objects.using(MainRouter.admin_db).get( + invitation = Invitation.objects.using(MainRouter.admin_read).get( token=invitation_token, email=email ) except Invitation.DoesNotExist: diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py index 70c2c2cb38..615fc08c08 100644 --- a/api/src/backend/api/v1/views.py +++ b/api/src/backend/api/v1/views.py @@ -1836,7 +1836,7 @@ class InvitationAcceptViewSet(BaseRLSViewSet): ) # Proceed with accepting the invitation - user = User.objects.using(MainRouter.admin_db).get(email=user_email) + user = User.objects.using(MainRouter.admin_read).get(email=user_email) membership = Membership.objects.using(MainRouter.admin_db).create( user=user, tenant=invitation.tenant, diff --git a/api/src/backend/tasks/jobs/deletion.py b/api/src/backend/tasks/jobs/deletion.py index 5ca08e70bb..74485c8765 100644 --- a/api/src/backend/tasks/jobs/deletion.py +++ b/api/src/backend/tasks/jobs/deletion.py @@ -65,7 +65,7 @@ def delete_tenant(pk: str): """ deletion_summary = {} - for provider in Provider.objects.using(MainRouter.admin_db).filter(tenant_id=pk): + for provider in Provider.objects.using(MainRouter.admin_read).filter(tenant_id=pk): with rls_transaction(pk): summary = delete_provider(provider.id) deletion_summary.update(summary)