Update

nikhilwoodruff · nikhilwoodruff · commit b26cf71b82b0 · 2025-11-21T16:49:31.000Z
diff --git a/src/policyengine_api/models/output.py b/src/policyengine_api/models/output.py
@@ -16,7 +16,7 @@ class AggregateType(str, Enum):
 class AggregateOutputBase(SQLModel):
     """Base aggregate output fields."""
 
-    simulation_id: UUID
+    simulation_id: UUID = Field(foreign_key="simulations.id")
     variable: str
     aggregate_type: AggregateType
     entity: str | None = None
diff --git a/src/policyengine_api/models/parameter.py b/src/policyengine_api/models/parameter.py
@@ -11,7 +11,7 @@ class ParameterBase(SQLModel):
     description: str | None = None
     data_type: str | None = None
     unit: str | None = None
-    tax_benefit_model_version_id: UUID
+    tax_benefit_model_version_id: UUID = Field(foreign_key="tax_benefit_model_versions.id")
 
 
 class Parameter(ParameterBase, table=True):
diff --git a/src/policyengine_api/models/parameter_value.py b/src/policyengine_api/models/parameter_value.py
@@ -7,7 +7,7 @@
 class ParameterValueBase(SQLModel):
     """Base parameter value fields."""
 
-    parameter_id: UUID
+    parameter_id: UUID = Field(foreign_key="parameters.id")
     value: dict = Field(default_factory=dict, sa_column=Column(JSON))  # Store as JSON
     start_date: datetime
     end_date: datetime | None = None
diff --git a/src/policyengine_api/models/simulation.py b/src/policyengine_api/models/simulation.py
@@ -17,8 +17,8 @@ class SimulationStatus(str, Enum):
 class SimulationBase(SQLModel):
     """Base simulation fields."""
 
-    dataset_id: UUID
-    policy_id: UUID | None = None
+    dataset_id: UUID = Field(foreign_key="datasets.id")
+    policy_id: UUID | None = Field(default=None, foreign_key="policies.id")
     tax_benefit_model: str  # e.g., "uk_latest", "us_latest"
     status: SimulationStatus = SimulationStatus.PENDING
     error_message: str | None = None
diff --git a/src/policyengine_api/models/tax_benefit_model_version.py b/src/policyengine_api/models/tax_benefit_model_version.py
@@ -7,7 +7,7 @@
 class TaxBenefitModelVersionBase(SQLModel):
     """Base tax-benefit model version fields."""
 
-    model_id: UUID
+    model_id: UUID = Field(foreign_key="tax_benefit_models.id")
     version: str  # e.g., "1.0.0", "latest"
     description: str | None = None
 
diff --git a/src/policyengine_api/models/variable.py b/src/policyengine_api/models/variable.py
@@ -11,7 +11,7 @@ class VariableBase(SQLModel):
     entity: str
     description: str | None = None
     data_type: str | None = None  # Store as string representation
-    tax_benefit_model_version_id: UUID
+    tax_benefit_model_version_id: UUID = Field(foreign_key="tax_benefit_model_versions.id")
 
 
 class Variable(VariableBase, table=True):
diff --git a/supabase/.temp/gotrue-version b/supabase/.temp/gotrue-version
@@ -0,0 +1 @@
+v2.182.1
diff --git a/supabase/.temp/pooler-url b/supabase/.temp/pooler-url
@@ -0,0 +1 @@
+postgresql://postgres.zoogijcmzdgpqfxwdxca:[YOUR-PASSWORD]@aws-1-eu-west-1.pooler.supabase.com:6543/postgres
diff --git a/supabase/.temp/postgres-version b/supabase/.temp/postgres-version
@@ -0,0 +1 @@
+17.6.1.052
diff --git a/supabase/.temp/project-ref b/supabase/.temp/project-ref
@@ -0,0 +1 @@
+zoogijcmzdgpqfxwdxca
diff --git a/supabase/.temp/rest-version b/supabase/.temp/rest-version
@@ -0,0 +1 @@
+v13.0.5
diff --git a/supabase/.temp/storage-version b/supabase/.temp/storage-version
@@ -0,0 +1 @@
+iceberg-catalog-ids
diff --git a/supabase/migrations/20241121000001_rls_policies.sql b/supabase/migrations/20241121000001_rls_policies.sql
@@ -0,0 +1,120 @@
+-- Enable RLS on all application tables
+ALTER TABLE datasets ENABLE ROW LEVEL SECURITY;
+ALTER TABLE simulations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE policies ENABLE ROW LEVEL SECURITY;
+ALTER TABLE aggregate_outputs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tax_benefit_models ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tax_benefit_model_versions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE variables ENABLE ROW LEVEL SECURITY;
+ALTER TABLE parameters ENABLE ROW LEVEL SECURITY;
+ALTER TABLE parameter_values ENABLE ROW LEVEL SECURITY;
+
+-- Service role policies (full access to everything)
+DO $$
+BEGIN
+    -- Datasets
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'datasets' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON datasets FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+
+    -- Simulations
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'simulations' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON simulations FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+
+    -- Policies
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'policies' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON policies FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+
+    -- Aggregate outputs
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'aggregate_outputs' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON aggregate_outputs FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+
+    -- Tax benefit models
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'tax_benefit_models' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON tax_benefit_models FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+
+    -- Tax benefit model versions
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'tax_benefit_model_versions' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON tax_benefit_model_versions FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+
+    -- Variables
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'variables' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON variables FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+
+    -- Parameters
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'parameters' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON parameters FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+
+    -- Parameter values
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'parameter_values' AND policyname = 'Service role full access') THEN
+        CREATE POLICY "Service role full access" ON parameter_values FOR ALL TO service_role USING (true) WITH CHECK (true);
+    END IF;
+END $$;
+
+-- Public read access for read-only tables
+DO $$
+BEGIN
+    -- Tax benefit models (read-only for public)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'tax_benefit_models' AND policyname = 'Public read access') THEN
+        CREATE POLICY "Public read access" ON tax_benefit_models FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+
+    -- Tax benefit model versions (read-only for public)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'tax_benefit_model_versions' AND policyname = 'Public read access') THEN
+        CREATE POLICY "Public read access" ON tax_benefit_model_versions FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+
+    -- Variables (read-only for public)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'variables' AND policyname = 'Public read access') THEN
+        CREATE POLICY "Public read access" ON variables FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+
+    -- Parameters (read-only for public)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'parameters' AND policyname = 'Public read access') THEN
+        CREATE POLICY "Public read access" ON parameters FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+
+    -- Parameter values (read-only for public)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'parameter_values' AND policyname = 'Public read access') THEN
+        CREATE POLICY "Public read access" ON parameter_values FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+
+    -- Datasets (read-only for public)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'datasets' AND policyname = 'Public read access') THEN
+        CREATE POLICY "Public read access" ON datasets FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+END $$;
+
+-- User-created content policies
+DO $$
+BEGIN
+    -- Simulations (users can create and read their own)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'simulations' AND policyname = 'Users can create simulations') THEN
+        CREATE POLICY "Users can create simulations" ON simulations FOR INSERT TO anon, authenticated WITH CHECK (true);
+    END IF;
+
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'simulations' AND policyname = 'Users can read simulations') THEN
+        CREATE POLICY "Users can read simulations" ON simulations FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+
+    -- Policies (users can create and read their own)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'policies' AND policyname = 'Users can create policies') THEN
+        CREATE POLICY "Users can create policies" ON policies FOR INSERT TO anon, authenticated WITH CHECK (true);
+    END IF;
+
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'policies' AND policyname = 'Users can read policies') THEN
+        CREATE POLICY "Users can read policies" ON policies FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+
+    -- Aggregate outputs (read access for all)
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'public' AND tablename = 'aggregate_outputs' AND policyname = 'Users can read aggregate outputs') THEN
+        CREATE POLICY "Users can read aggregate outputs" ON aggregate_outputs FOR SELECT TO anon, authenticated USING (true);
+    END IF;
+END $$;

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+postgresql://postgres.zoogijcmzdgpqfxwdxca:[YOUR-PASSWORD]@aws-1-eu-west-1.pooler.supabase.com:6543/postgres`