fix(arch-043,arch-052): deterministic system tenant lookup; async-safe file metadata

2026-08-23 16:39:09 +02:00
parent ed8ee5cda1
commit 17516d2783
5 changed files with 201 additions and 20 deletions
@@ -246,11 +246,12 @@ class AutomationPlugin(BasePlugin):
            from app.plugins.builtins.automation.prebuilt.report_agent import create_report_agent
            from sqlalchemy import select as sa_select

-            # Get first tenant + admin user for seeding
+            # Get system tenant + admin user for seeding (ARCH-043:
+            # deterministic slug lookup instead of arbitrary first row)
+            from app.core.db import get_system_tenant
            from app.models.user import User
-            from app.models.tenant import Tenant
-            tenant_result = await db.execute(sa_select(Tenant).limit(1))
-            tenant = tenant_result.scalar_one_or_none()
+
+            tenant = await get_system_tenant(db)
            if tenant:
                user_result = await db.execute(
                    sa_select(User)
@@ -418,16 +419,16 @@ class AutomationPlugin(BasePlugin):
        from another plugin's manifest. Uses plugin name prefixing for conflict resolution."""
        from sqlalchemy import select

-        # Get default tenant_id from the first tenant in the DB
-        from app.models.tenant import Tenant
+        # Get system tenant for contributions (ARCH-043: deterministic slug
+        # lookup instead of arbitrary first row)
+        from app.core.db import get_system_tenant
        from app.plugins.builtins.automation.models import AutomationCronJob
        from app.plugins.builtins.automation.services import (
            AgentService,
            AutomationService,
            CronJobService,
        )
-        tenant_result = await db.execute(select(Tenant).limit(1))
-        tenant = tenant_result.scalar_one_or_none()
+        tenant = await get_system_tenant(db)
        default_tenant_id = tenant.id if tenant else None
        if default_tenant_id is None:
            logger.warning("No tenant found — skipping plugin contributions registration")