P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check

2026-07-29 12:28:08 +02:00
parent 81ae5b7cb6
commit 26bf8d3a31
12 changed files with 423 additions and 39 deletions
@@ -127,6 +127,20 @@ async def get_current_user(
    is_admin = session_data.get("is_system_admin", False)
    await set_user_context(db, user_id, group_ids, is_admin)

+    # Check membership status (P1.7: suspended membership should not be usable)
+    from app.models.user import UserTenant
+    membership_q = await db.execute(
+        select(UserTenant.status)
+        .where(UserTenant.user_id == user_id)
+        .where(UserTenant.tenant_id == tenant_id)
+    )
+    membership_status = membership_q.scalar_one_or_none()
+    if membership_status is not None and membership_status != "active":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail={"detail": f"Mitgliedschaft ist {membership_status}, Zugriff verweigert", "code": "membership_suspended"},
+        )
+
    # Load resolved permissions from cache (or DB on miss)
    from app.core.permissions import get_cached_permissions