Fix: require_active_plugin nutzt Request statt get_current_user Dependency

app/deps.py

@@ -374,7 +374,7 @@ def require_active_plugin(plugin_name: str):
     Fails closed (503) on errors.
     """
     async def _check(
-        current_user: dict[str, Any] = Depends(get_current_user),
+        request: Request,
         db: AsyncSession = Depends(get_db),
     ) -> None:
         from app.core.permission_registry import get_permission_registry
@@ -388,8 +388,26 @@ def require_active_plugin(plugin_name: str):
                         "code": "plugin_inactive",
                     },
                 )
-            # Get tenant_id from current_user — NOT from current_setting()
-            tenant_id_str = current_user.get("tenant_id")
+            # Get tenant_id from session cookie — NOT from current_setting()
+            from app.config import get_settings
+            from app.core.auth import get_session_data, get_redis
+
+            settings = get_settings()
+            session_id = request.cookies.get(settings.session_cookie_name)
+            if not session_id:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail={"detail": "Not authenticated", "code": "not_authenticated"},
+                )
+
+            redis = get_redis()
+            session_data = await get_session_data(redis, session_id)
+            if session_data is None:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail={"detail": "Session expired", "code": "session_expired"},
+                )
+            tenant_id_str = session_data.get("tenant_id")
             if not tenant_id_str:
                 raise HTTPException(
                     status_code=status.HTTP_403_FORBIDDEN,