tenant gate active

backend/src/auth/mod.rs

@@ -7,7 +7,10 @@ pub mod password;
 
 use std::sync::{Arc, Mutex};
 
-use axum::{extract::FromRequestParts, http::request::Parts};
+use axum::{
+    extract::FromRequestParts,
+    http::{request::Parts, StatusCode},
+};
 use axum_extra::headers::{authorization::Bearer, Authorization};
 use axum_extra::TypedHeader;
 use serde::{Deserialize, Serialize};
@@ -15,8 +18,8 @@ use utoipa::ToSchema;
 
 use crate::{
     auth::capability_sets::{load_capabilities_for_set, load_capability_set},
-    error::AppError,
-    models::ApiCapability,
+    error::{AppError, AppResult},
+    models::{ApiCapability, TenantStatus},
     state::{AppState, PgPooledConnection},
 };
 use uuid::Uuid;
@@ -133,6 +136,8 @@ impl FromRequestParts<AppState> for TenantScopedConn {
         async move {
             let user = AuthenticatedUser::from_request_parts(parts, &state).await?;
             let tenant_id = user.tenant_id;
+            ensure_active_tenant(&state, tenant_id)?;
+
             let conn = if let Some(holder) = parts.extensions.remove::<TenantConnectionHolder>() {
                 holder
                     .into_conn()
@@ -150,3 +155,11 @@ impl FromRequestParts<AppState> for TenantScopedConn {
         }
     }
 }
+
+pub(crate) fn ensure_active_tenant(state: &AppState, tenant_id: Uuid) -> AppResult<()> {
+    let tenant = state.tenants.get_by_id(tenant_id)?;
+    if tenant.status != TenantStatus::Active {
+        return Err(AppError::new(StatusCode::FORBIDDEN, "tenant is not active"));
+    }
+    Ok(())
+}