fix: visibility.py Defense-in-Depth tenant_id filter + entity_permissions deleted_at migration + cross-tenant tests

2026-07-29 16:12:04 +02:00
parent f1a2484055
commit 0448962d08
4 changed files with 1535 additions and 0 deletions
@@ -103,6 +103,11 @@ async def apply_visibility_filter(
    if is_system_admin:
        return query  # System admin sees everything

+    # Defense-in-Depth: Always filter by tenant_id first (P0.4 fix)
+    # This ensures cross-tenant data is never returned even if RLS is bypassed
+    if hasattr(model, 'tenant_id'):
+        query = query.where(model.tenant_id == tenant_id)
+
    # Get user's groups and role
    group_ids, role_id = await _get_user_principals(db, user_id, tenant_id)