fix

backend/src/auth/mod.rs

@@ -11,6 +11,7 @@ use axum::{
     extract::FromRequestParts,
     http::{request::Parts, StatusCode},
 };
+use diesel::{pg::PgConnection, prelude::*};
 use axum_extra::headers::{authorization::Bearer, Authorization};
 use axum_extra::TypedHeader;
 use serde::{Deserialize, Serialize};
@@ -20,6 +21,7 @@ use crate::{
     auth::capability_sets::{load_capabilities_for_set, load_capability_set},
     error::{AppError, AppResult},
     models::{ApiCapability, TenantStatus},
+    schema::tenants::dsl as tenant_dsl,
     state::{AppState, PgPooledConnection},
 };
 use uuid::Uuid;
@@ -136,9 +138,7 @@ impl FromRequestParts<AppState> for TenantScopedConn {
         async move {
             let user = AuthenticatedUser::from_request_parts(parts, &state).await?;
             let tenant_id = user.tenant_id;
-            ensure_active_tenant(&state, tenant_id)?;
-
-            let conn = if let Some(holder) = parts.extensions.remove::<TenantConnectionHolder>() {
+            let mut conn = if let Some(holder) = parts.extensions.remove::<TenantConnectionHolder>() {
                 holder
                     .into_conn()
                     .ok_or_else(|| AppError::internal("tenant connection unavailable"))?
@@ -146,6 +146,8 @@ impl FromRequestParts<AppState> for TenantScopedConn {
                 state.db_for_tenant(tenant_id)?
             };
 
+            ensure_active_tenant_with_conn(&mut conn, tenant_id)?;
+
             Ok(Self {
                 conn,
                 tenant_id,
@@ -157,9 +159,24 @@ impl FromRequestParts<AppState> for TenantScopedConn {
 }
 
 pub(crate) fn ensure_active_tenant(state: &AppState, tenant_id: Uuid) -> AppResult<()> {
-    let tenant = state.tenants.get_by_id(tenant_id)?;
-    if tenant.status != TenantStatus::Active {
+    let mut conn = state.db_unscoped()?;
+    ensure_active_tenant_with_conn(&mut conn, tenant_id)
+}
+
+pub(crate) fn ensure_active_tenant_with_conn(
+    conn: &mut PgConnection,
+    tenant_id: Uuid,
+) -> AppResult<()> {
+    use tenant_dsl::tenants;
+
+    let status: TenantStatus = tenants
+        .find(tenant_id)
+        .select(tenant_dsl::status)
+        .first(conn)?;
+
+    if status != TenantStatus::Active {
         return Err(AppError::new(StatusCode::FORBIDDEN, "tenant is not active"));
     }
+
     Ok(())
 }