Row Level Security

RLS garante que cada usuário acesse apenas dados do seu Workspace.

Como funciona

O middleware de auth injeta o ID do usuário no contexto PostgreSQL:

// api/src/middleware/auth.middleware.ts
await db.query(`SET app.current_user_id = '${userId}'`)

O PostgreSQL usa esse valor nas políticas RLS:

CREATE POLICY contacts_workspace_isolation ON contacts
  USING (workspace_id IN (
    SELECT workspace_id FROM workspace_members
    WHERE user_id = current_setting('app.current_user_id')::UUID
  ));

Tabelas com RLS ativo

workspaces, contacts, conversations, messages, channels, flows, automations, broadcasts, tags, custom_field_definitions, ai_assistants, knowledge_bases, api_keys