Postgres RLS in Symfony: three green isolation tests, and the UPDATE that moves tenant 1's invoices into tenant 2's books
Two articles ago I wrote that the Postgres role which runs your migrations bypasses every row-level security policy. Last week I wrote that with one tenant in the fixture, your isolation suite passes with no policy at all. Both came out of the same comment thread, and by the end of it we had three assertions that, together, cover every broken database I had been able to build. Then Marco pointed…
In a recent investigation, it was discovered that the Postgres role responsible for running migrations bypasses every row-level security policy. This revelation led to the creation of three assertions that cover every broken database environment. Marco highlighted that these assertions never leave the enforcement boundary they are checking, making a green suite testing ineffective.
A single line of SQL revealed that tenant 1 could move every one of its invoices into tenant 2's books using just one statement, while all isolation tests remained green.
The issue arises when a table has FORCE ROW LEVEL SECURITY, making the owner subject to the policy. This becomes apparent during the seeding process, where the connection is the owner, and the policy reads current_setting( app.tenant_id ). The seeding step runs as the owner, under FORCE with no context, causing the first two tenants' rows to be refused due to the policy.
The obvious fix is to relax the check by creating a policy that allows tenant_id to match current_setting(app.tenant_id). However, this fix inadvertently creates a hole in the security system, allowing tenant 1 to move every one of its invoices into tenant 2's books while all isolation tests remain green.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
