DataOps-platform/migrations/versions/20260817_504_tenant_gateway_revocation.py

"""Emergency revoke of payload-authorized tenant gateway execution."""

from alembic import op

revision = "20260817_504"
down_revision = "20260817_503"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute(
        """
        REVOKE ALL ON FUNCTION public.tenant_foundation_write(text,jsonb) FROM PUBLIC,dataops_app_runtime;
        REVOKE ALL ON FUNCTION public.tenant_quota_reserve(jsonb) FROM PUBLIC,dataops_app_runtime;
        REVOKE ALL ON FUNCTION public.tenant_lifecycle_transition(jsonb) FROM PUBLIC,dataops_app_runtime;
        REVOKE ALL ON TABLE public.tenants FROM PUBLIC,dataops_app_runtime;
        """
    )


def downgrade() -> None:
    op.execute(
        """
        GRANT EXECUTE ON FUNCTION public.tenant_foundation_write(text,jsonb) TO dataops_app_runtime;
        GRANT EXECUTE ON FUNCTION public.tenant_quota_reserve(jsonb) TO dataops_app_runtime;
        GRANT EXECUTE ON FUNCTION public.tenant_lifecycle_transition(jsonb) TO dataops_app_runtime;
        """
    )