Skip to main content

2. Basic Departmental Isolation

Our first requirement is Strict Departmental Isolation.

A "Sales" employee must never see "Engineering" documents.

This seems simple, but it is the foundation of multi-tenant security.

The Approach: Without django-rls​

In a traditional Django application, you are responsible for enforcing this rule in every single place data is accessed.

1. The View Layer​

You must remember to filter every QuerySet.

# views.py (The Manual Way)
def document_list(request):
    # DANGER: If you type .all() here, you just leaked data!
    # docs = ERPDocument.objects.all()  <-- WRONG

    # You must always filter:
    user_dept = request.user.profile.department
    docs = ERPDocument.objects.filter(department=user_dept)

    return render(request, 'list.html', {'docs': docs})

2. The API Layer​

If you use Django REST Framework, you must override get_queryset on every ViewSet.

# api.py (The Manual Way)
class DocumentViewSet(viewsets.ModelViewSet):
    def get_queryset(self):
        # Again, easy to forget or get wrong
        return ERPDocument.objects.filter(department=self.request.user.profile.department)

3. The Admin Panel​

Often overlooked! By default, the Django Admin matches queryset.all(). This means any staff member can see everything. You have to override get_queryset in admin.py too.

The Risk​

If you have 50 views and you forget the filter in just one, you have a security breach.

The Approach: With django-rls​

With Row-Level Security, we move this logic into the database. We define it once, on the model, and it applies everywhere automatically.

1. Setting the Context​

First, we need to ensure the database knows which department the current user belongs to. We use django-rls Context Middleware.

# myapp/middleware.py
from django_rls.db.functions import set_rls_context

class MegaCorpMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        if request.user.is_authenticated:
            set_rls_context('user_id', request.user.id)

            # Set Department ID as 'tenant_id'
            try:
                dept_id = request.user.userprofile.department_id
                set_rls_context('tenant_id', dept_id)
            except AttributeError:
                pass

        return self.get_response(request)

2. Defining the Policy​

Now we add the policy to ERPDocument.

# myapp/models.py
from django.db.models import Q
from django_rls.policies import ModelPolicy, RLS

class ERPDocument(RLSModel):
    # ... fields ...

    class Meta:
        rls_policies = [
            # Basic Isolation: Document Dept == User Dept
            ModelPolicy(
                'department_isolation',
                filters=Q(department=RLS.tenant_id())
            )
        ]

3. The Result​

Now, your view becomes:

# views.py (The RLS Way)
def document_list(request):
    # SAFE! automatically filtered by the DB
    docs = ERPDocument.objects.all()
    return render(request, 'list.html', {'docs': docs})

Even if you write ERPDocument.objects.all() in the Django shell, API, or Admin, the database will silently rewrite it to:

SELECT * FROM myapp_erpdocument
WHERE department_id = current_setting('rls.tenant_id')::integer;

The data leakage vector is eliminated at the source.