feat/PRWLR-3989 Add RLS full implementation (#18)

* feat(Backend): PRWLR-3989 add RLS to postgresql db and base models

* feat(API): PRWLR-3989 add TenantMiddleware

* chore(API, Backend): PRWLR-3989 create new db user without RLS bypass on migrations

* chore(Backend): PRWLR-3989 fix RLS bypasser for POST requests

* fix(Backend): PRWLR-3989 fix user permissions when migrating new models

* chore(Backend): PRWLR-3989 add testing view for RLS manual tests

* feat(API): PRWLR-3989 add tenant_id to API logging

* chore(API, Backend): PRWLR-3989 add TODOs

* test(API): PRWLR-3989 add new middleware unit tests

* chore(API): PRWLR-3989 refactor RLS code

* fix(tests): PRWLR-3989 fix testing db connector

* chore: PRWLR-3989 add references to JIRA tickets

* fix: PRWLR-3989 remove bypass logic and fix serializers

* fix: PRWLR-3989 improve drop SQL query for RLS models

* feat(Backend): PRWLR-3989 add specific permissions on each model

* fix(Backend): PRWLR-3989 fix database routing and grant select perms

* fix(test): PRWLR-3989 fix routing issues with unit tests

* chore: PRWLR-3989 remove references to JIRA tickets

* chore(Backend): PRWLR-3989 adjust privileges for user on table tenant

* chore: PRWLR-3989 add comments on migrations

src/backend/api/models.py

@@ -1,25 +1,17 @@
-import uuid
-
 from django.db import models
 
+from api.rls import RowLevelSecurityProtectedModel, RowLevelSecurityConstraint
 
-class Base(models.Model):
-    """
-    Abstract base model class that provides common fields for all models.
-    """
 
-    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
-
-    inserted_at = models.DateTimeField(auto_now_add=True, editable=False)
-    updated_at = models.DateTimeField(auto_now=True, editable=False)
+class Test(RowLevelSecurityProtectedModel):
+    name = models.CharField(max_length=100)
 
     class Meta:
-        abstract = True
-
-
-class Tenant(Base):
-    """
-    The Tenant is the basic grouping in the system. It is used to separate data between customers.
-    """
-
-    name = models.CharField(max_length=100)
+        db_table = "test"
+        constraints = [
+            RowLevelSecurityConstraint(
+                field="tenant_id",
+                name="rls_on_%(class)s",
+                statements=["SELECT", "INSERT", "UPDATE", "DELETE"],
+            )
+        ]