Multitenancy

database/init/01_app_role.sql

@@ -0,0 +1,38 @@
+-- ============================================================
+-- Ruolo PostgreSQL applicativo pechub_app
+--
+-- Questo script viene eseguito al primo avvio del container DB.
+-- Il ruolo viene creato PRIMA che Alembic esegua le migrazioni.
+-- I GRANT sulle singole tabelle vengono gestiti dalla migration 0006.
+--
+-- Scopo:
+--   - pechub_app è un utente non-superuser su cui RLS è attiva
+--   - Il backend e il worker usano DATABASE_URL con pechub_app
+--   - Alembic usa DATABASE_URL_SYNC con l'utente pechub (superuser)
+-- ============================================================
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_roles WHERE rolname = 'pechub_app'
+    ) THEN
+        CREATE USER pechub_app WITH PASSWORD 'pechub_app_password'
+            NOSUPERUSER NOCREATEDB NOCREATEROLE;
+        RAISE NOTICE '[pechub] Ruolo pechub_app creato';
+    ELSE
+        RAISE NOTICE '[pechub] Ruolo pechub_app già presente – skip';
+    END IF;
+END
+$$;
+
+-- Permessi di base (i GRANT sulle tabelle vengono dopo le migrazioni)
+GRANT CONNECT ON DATABASE pechub TO pechub_app;
+GRANT USAGE ON SCHEMA public TO pechub_app;
+
+-- Default privileges: tutte le future tabelle create da pechub
+-- ricevono automaticamente i permessi per pechub_app
+ALTER DEFAULT PRIVILEGES FOR ROLE pechub IN SCHEMA public
+    GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO pechub_app;
+
+ALTER DEFAULT PRIVILEGES FOR ROLE pechub IN SCHEMA public
+    GRANT USAGE, SELECT ON SEQUENCES TO pechub_app;

database/seeds/dev_tenant.sql

@@ -1,17 +1,23 @@
 -- ============================================================
--- SEED: Tenant demo + utenti per sviluppo locale
--- 
--- Credenziali:
---   Admin:    admin@demo.pechub.it  / Demo@PEChub2026!
+-- SEED: Tenant demo + Tenant acme + utenti per sviluppo locale
+--
+-- Tenant demo:
+--   Admin:    admin@demo.pechub.it   / Demo@PEChub2026!
 --   Operator: operator@demo.pechub.it / Oper@PEChub2026!
 --
+-- Tenant acme (secondo tenant per test isolamento):
+--   Admin:    admin@acme.pechub.it  / Acme@PEChub2026!
+--
+-- Super Admin (cross-tenant):
+--   superadmin@pechub.it / SuperAdmin@PEChub2026!
+--
 -- Esegui con: make seed
 -- ============================================================
 
 -- Disabilita RLS temporaneamente per il seed
 SET session_replication_role = replica;
 
--- Tenant demo
+-- ── Tenant demo ──────────────────────────────────────────────────────────────
 INSERT INTO tenants (id, slug, name, plan, is_active, max_mailboxes, max_users)
 VALUES (
     '11111111-1111-1111-1111-111111111111',
@@ -24,48 +30,75 @@ VALUES (
 )
 ON CONFLICT (slug) DO NOTHING;
 
--- Utente super_admin (global, senza tenant specifico usa il tenant demo)
+-- ── Tenant acme (secondo tenant per test isolamento) ─────────────────────────
+INSERT INTO tenants (id, slug, name, plan, is_active, max_mailboxes, max_users)
+VALUES (
+    '22222222-2222-2222-2222-222222222222',
+    'acme',
+    'Acme Corp SpA',
+    'starter',
+    TRUE,
+    5,
+    10
+)
+ON CONFLICT (slug) DO NOTHING;
+
+-- ── Utente super_admin (ruolo globale, associato al tenant demo) ──────────────
 -- Password: SuperAdmin@PEChub2026! (bcrypt hash)
 INSERT INTO users (id, tenant_id, email, password_hash, full_name, role, is_active)
 VALUES (
     '00000000-0000-0000-0000-000000000001',
     '11111111-1111-1111-1111-111111111111',
     'superadmin@pechub.it',
-    '$2b$12$y2yq6X2f3dZi22wqWZd1aumP03IU6OWrrevRMFj9054aGnUms116W', -- SuperAdmin@PEChub2026!
+    '$2b$12$XVHODc6nahpMm.XO5ifDku77IFDqCcMkJpSc7.uwElpML4wo3gfQu',
     'Super Admin PEChub',
     'super_admin',
     TRUE
 )
 ON CONFLICT (tenant_id, email) DO NOTHING;
 
--- Utente admin del tenant demo
+-- ── Admin del tenant demo ─────────────────────────────────────────────────────
 -- Password: Demo@PEChub2026! (bcrypt hash)
 INSERT INTO users (id, tenant_id, email, password_hash, full_name, role, is_active)
 VALUES (
     '11111111-0000-0000-0000-000000000001',
     '11111111-1111-1111-1111-111111111111',
     'admin@demo.pechub.it',
-    '$2b$12$PmyaJvF0i7ACFR39k6hfMO2.6U.FVPYma.7OyXyrGuGuokiJOfX8y', -- Demo@PEChub2026!
+    '$2b$12$xBbzU5vPAibZWx/jnEwJoO8aAAK9EdIBMzQbo7naD22t37EJeIy9q',
     'Admin Demo',
     'admin',
     TRUE
 )
 ON CONFLICT (tenant_id, email) DO NOTHING;
 
--- Utente operator del tenant demo
+-- ── Operator del tenant demo ──────────────────────────────────────────────────
 -- Password: Oper@PEChub2026! (bcrypt hash)
 INSERT INTO users (id, tenant_id, email, password_hash, full_name, role, is_active)
 VALUES (
     '11111111-0000-0000-0000-000000000002',
     '11111111-1111-1111-1111-111111111111',
     'operator@demo.pechub.it',
-    '$2b$12$Z0REc7flPCD3Sb8fZHsuW.Uk2X4JiJO7HhTajNSuPiQgzppkCDmLu', -- Oper@PEChub2026!
+    '$2b$12$8stUJfKKTB5Tqjrd3Aamm.sOrQe9T0kygbkTbN7raItjhD0exdyVm',
     'Operatore Demo',
     'operator',
     TRUE
 )
 ON CONFLICT (tenant_id, email) DO NOTHING;
 
+-- ── Admin del tenant acme ─────────────────────────────────────────────────────
+-- Password: Acme@PEChub2026! (bcrypt hash)
+INSERT INTO users (id, tenant_id, email, password_hash, full_name, role, is_active)
+VALUES (
+    '22222222-0000-0000-0000-000000000001',
+    '22222222-2222-2222-2222-222222222222',
+    'admin@acme.pechub.it',
+    '$2b$12$lGN3ckunwsI2pS2VKPjLAemnvJgv3DzPddcv4W4KzwjeVvRQh.jhO',
+    'Admin Acme Corp',
+    'admin',
+    TRUE
+)
+ON CONFLICT (tenant_id, email) DO NOTHING;
+
 -- Ripristina RLS
 SET session_replication_role = DEFAULT;
 
@@ -73,8 +106,11 @@ SET session_replication_role = DEFAULT;
 DO $$
 BEGIN
     RAISE NOTICE '✅ Seed completato!';
-    RAISE NOTICE '   Tenant demo: 11111111-1111-1111-1111-111111111111';
-    RAISE NOTICE '   Admin: admin@demo.pechub.it / Demo@PEChub2026!';
-    RAISE NOTICE '   Operator: operator@demo.pechub.it / Oper@PEChub2026!';
+    RAISE NOTICE '   Tenant demo:  11111111-1111-1111-1111-111111111111';
+    RAISE NOTICE '   Tenant acme:  22222222-2222-2222-2222-222222222222';
+    RAISE NOTICE '   SuperAdmin:   superadmin@pechub.it / SuperAdmin@PEChub2026!';
+    RAISE NOTICE '   Admin demo:   admin@demo.pechub.it / Demo@PEChub2026!';
+    RAISE NOTICE '   Operator demo: operator@demo.pechub.it / Oper@PEChub2026!';
+    RAISE NOTICE '   Admin acme:   admin@acme.pechub.it / Acme@PEChub2026!';
 END
 $$;