fix

backend/src/routes/documents.rs

@@ -14,7 +14,7 @@ use tracing::{error, info};
 use utoipa::{IntoParams, ToSchema};
 use uuid::Uuid;
 
-use crate::auth::{ensure_active_tenant, jwt::DownloadSubject, TenantScopedConn};
+use crate::auth::{ensure_active_tenant_with_conn, jwt::DownloadSubject, TenantScopedConn};
 use crate::documents::asset::{
     asset_object_disposition, DocumentAssetDetailResponse, DocumentAssetResponse,
     DocumentVersionDetailResponse, DocumentVersionResponse,
@@ -575,9 +575,8 @@ pub async fn download_with_token(
         .verify_download_token(&token)
         .map_err(|_| AppError::unauthorized())?;
 
-    ensure_active_tenant(&state, claims.tenant_id)?;
-
     let mut conn = state.db_for_tenant(claims.tenant_id)?;
+    ensure_active_tenant_with_conn(&mut conn, claims.tenant_id)?;
 
     let now = Utc::now().naive_utc();
     let has_active_refresh: bool = select(exists(

backend/src/routes/webdav/mod.rs

@@ -18,7 +18,7 @@ use uuid::Uuid;
 
 use crate::auth::{
     api_tokens::{find_active_token_by_secret, touch_api_token},
-    ensure_active_tenant,
+    ensure_active_tenant_with_conn,
 };
 use crate::error::{AppError, AppResult};
 use crate::models::{ApiCapability, Document, DocumentVersion, Folder, User};
@@ -486,7 +486,7 @@ fn authenticate(state: &AppState, headers: &HeaderMap) -> Result<Option<WebDavCo
         }
     };
 
-    if let Err(err) = ensure_active_tenant(state, tenant_id) {
+    if let Err(err) = ensure_active_tenant_with_conn(&mut conn, tenant_id) {
         tracing::warn!(tenant_id = %tenant_id, error = ?err, "webdav tenant not active");
         return Ok(None);
     }