fix(db): grant regengine SELECT (status) on tenants (v139 / SEL-616)

alembic/versions/20260803_b71d9e4c2a60_v111_runtime_role_grants.py

@@ -649,8 +649,11 @@ def _build_migration_owner_posture() -> str:
     "public.api_keys": {"UPDATE": ("last_used_at", "total_requests")},
     # Runtime validation/background work may test one credential-bound UUID,
     # but tenant names, settings, and webhook configuration remain control-
-    # plane data.
-    "public.tenants": {"SELECT": ("id",)},
+    # plane data. ``status`` lets api_key_store.get_tenant_status (and the
+    # Compliance Dashboard readiness path) fail closed on suspended tenants
+    # without exposing names/settings. v139 applies the same column grant to
+    # databases already past v111; this inventory keeps it across cutover.
+    "public.tenants": {"SELECT": ("id", "status")},
     # v126 -- POST /api/v1/ingest/csv (#3122) retains each upload verbatim
     # in the ingest transaction (webhook_compat._open_ingestion_run). INSERT
     # is limited to the columns that statement writes, so storage_url and

alembic/versions/20261028_e7a1c9d2f4b0_v139_tenants_status_select_grant.py

@@ -0,0 +1,58 @@
+"""Grant regengine column-level SELECT on tenants.status (v139 / SEL-616).
+
+Prod auth for the Compliance Dashboard readiness path fails because
+``shared.api_key_store`` runs ``SELECT status FROM tenants WHERE id = ...``
+and v111 only granted ``SELECT (id)`` to ``regengine``. This revision adds
+the missing column privilege only — never a table-level SELECT — and the
+matching v111 ``REGENGINE_COLUMN_GRANTS`` inventory entry keeps the grant
+across ``apply_runtime_role_cutover``.
+
+Mirrors ``supabase/migrations/20261028120000_v139_tenants_status_select_grant.sql``.
+Do not apply to prod without C.Lee's approval via DevOps. Pairs with the
+UI degrade in #3740; this PR is the DB half of SEL-616.
+
+Revision ID: e7a1c9d2f4b0
+Revises: a3f7ce361b0e
+Create Date: 2026-10-28
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+revision: str = "e7a1c9d2f4b0"  # pragma: allowlist secret
+down_revision: Union[str, Sequence[str], None] = "a3f7ce361b0e"  # pragma: allowlist secret
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute(
+        """
+        DO $grant$
+        BEGIN
+            IF to_regclass('public.tenants') IS NOT NULL
+               AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'regengine') THEN
+                -- Column-level only. Do not GRANT SELECT ON public.tenants
+                -- (table-level); names/settings stay control-plane.
+                GRANT SELECT (status) ON TABLE public.tenants TO regengine;
+            END IF;
+        END
+        $grant$;
+        """
+    )
+
+
+def downgrade() -> None:
+    op.execute(
+        """
+        DO $revoke$
+        BEGIN
+            IF to_regclass('public.tenants') IS NOT NULL
+               AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'regengine') THEN
+                REVOKE SELECT (status) ON TABLE public.tenants FROM regengine;
+            END IF;
+        END
+        $revoke$;
+        """
+    )

supabase/migrations/20261028120000_v139_tenants_status_select_grant.sql

@@ -0,0 +1,30 @@
+-- v139 / SEL-616: column-level SELECT on public.tenants(status) for regengine.
+--
+-- Mirrors alembic/versions/20261028_e7a1c9d2f4b0_v139_tenants_status_select_grant.py.
+-- Auth (api_key_store.get_tenant_status) needs status to fail closed on
+-- suspended tenants. v111 only granted SELECT (id). Do NOT grant table-level
+-- SELECT — names, settings, and webhook config stay control-plane.
+--
+-- Idempotent. Do not apply to prod without C.Lee's approval via DevOps.
+-- Pairs with the Compliance Dashboard degrade in #3740.
+
+DO $grant$
+BEGIN
+    IF to_regclass('public.tenants') IS NOT NULL
+       AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'regengine') THEN
+        -- Column-level only. Never GRANT SELECT ON public.tenants (table-level).
+        GRANT SELECT (status) ON TABLE public.tenants TO regengine;
+    END IF;
+END
+$grant$;
+
+-- Downgrade (run by hand only):
+--
+-- DO $revoke$
+-- BEGIN
+--     IF to_regclass('public.tenants') IS NOT NULL
+--        AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'regengine') THEN
+--         REVOKE SELECT (status) ON TABLE public.tenants FROM regengine;
+--     END IF;
+-- END
+-- $revoke$;