From 9d7b160e2a2b735b3a90034b4d5a9d3977961640 Mon Sep 17 00:00:00 2001
From: Agent Zero <agent@media-on.de>
Date: Fri, 31 Jul 2026 09:24:04 +0200
Subject: [PATCH] gate: fix password_reset RLS policy for crm_auth, set tenant
 context before token creation

---
 app/services/auth_service.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/services/auth_service.py b/app/services/auth_service.py
index 53257b2..07a4817 100644
--- a/app/services/auth_service.py
+++ b/app/services/auth_service.py
@@ -240,6 +240,10 @@ class AuthService:
         for prev_token in prev_result.scalars().all():
             prev_token.used_at = datetime.now(UTC)
 
+        # Set tenant context for RLS (auth session uses crm_auth role)
+        from app.core.db import set_tenant_context
+        await set_tenant_context(db, user_tenant.tenant_id)
+
         # Create new token
         import secrets