From 15f0a07d4eb82538279cb8a271611ea5eb8e2db7 Mon Sep 17 00:00:00 2001
From: Agent Zero <agent@media-on.de>
Date: Fri, 31 Jul 2026 02:28:29 +0200
Subject: [PATCH] phase1: fix auth_service tenant context for audit_log, add
 sessions+audit_log to crm_auth grants

- auth_service.py: set tenant context before audit log write in login
- migration 0085: add sessions and audit_log to AUTH_TABLES for crm_auth
- Login now works on production with RLS enabled
---
 alembic/versions/0085_restore_tenant_rls.py | 2 ++
 app/services/auth_service.py                | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/alembic/versions/0085_restore_tenant_rls.py b/alembic/versions/0085_restore_tenant_rls.py
index 5fad194..5c6cd27 100644
--- a/alembic/versions/0085_restore_tenant_rls.py
+++ b/alembic/versions/0085_restore_tenant_rls.py
@@ -77,6 +77,8 @@ AUTH_TABLES = {
     "user_tenants": ["SELECT"],
     "tenants": ["SELECT"],
     "password_reset_tokens": ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    "sessions": ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    "audit_log": ["SELECT", "INSERT"],
 }
 
 WORKER_GLOBAL_TABLES = {
diff --git a/app/services/auth_service.py b/app/services/auth_service.py
index 330b0b8..be5c19e 100644
--- a/app/services/auth_service.py
+++ b/app/services/auth_service.py
@@ -109,6 +109,10 @@ class AuthService:
             db, redis, user, tenant.id, role=user_tenant.role
         )
 
+        # Set tenant context for audit log write (auth session uses crm_auth role)
+        from app.core.db import set_tenant_context
+        await set_tenant_context(db, tenant.id)
+
         # Log the login in audit trail
         await log_audit(
             db,