From 1271101acd9e37d7dced6bb1a5c325d8b6c312cc Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Mon, 3 Aug 2026 16:23:21 +0200 Subject: [PATCH] Fix: require_active_plugin nutzt Request statt get_current_user Dependency --- app/deps.py | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/app/deps.py b/app/deps.py index bd184be..9201ef4 100644 --- a/app/deps.py +++ b/app/deps.py @@ -374,7 +374,7 @@ def require_active_plugin(plugin_name: str): Fails closed (503) on errors. """ async def _check( - current_user: dict[str, Any] = Depends(get_current_user), + request: Request, db: AsyncSession = Depends(get_db), ) -> None: from app.core.permission_registry import get_permission_registry @@ -388,8 +388,26 @@ def require_active_plugin(plugin_name: str): "code": "plugin_inactive", }, ) - # Get tenant_id from current_user — NOT from current_setting() - tenant_id_str = current_user.get("tenant_id") + # Get tenant_id from session cookie — NOT from current_setting() + from app.config import get_settings + from app.core.auth import get_session_data, get_redis + + settings = get_settings() + session_id = request.cookies.get(settings.session_cookie_name) + if not session_id: + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail={"detail": "Not authenticated", "code": "not_authenticated"}, + ) + + redis = get_redis() + session_data = await get_session_data(redis, session_id) + if session_data is None: + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail={"detail": "Session expired", "code": "session_expired"}, + ) + tenant_id_str = session_data.get("tenant_id") if not tenant_id_str: raise HTTPException( status_code=status.HTTP_403_FORBIDDEN,