tenant gate active

backend/src/routes/documents.rs

@@ -14,7 +14,7 @@ use tracing::{error, info};
 use utoipa::{IntoParams, ToSchema};
 use uuid::Uuid;
 
-use crate::auth::{jwt::DownloadSubject, TenantScopedConn};
+use crate::auth::{ensure_active_tenant, jwt::DownloadSubject, TenantScopedConn};
 use crate::documents::asset::{
     asset_object_disposition, DocumentAssetDetailResponse, DocumentAssetResponse,
     DocumentVersionDetailResponse, DocumentVersionResponse,
@@ -573,6 +573,8 @@ pub async fn download_with_token(
         .verify_download_token(&token)
         .map_err(|_| AppError::unauthorized())?;
 
+    ensure_active_tenant(&state, claims.tenant_id)?;
+
     let mut conn = state.db_for_tenant(claims.tenant_id)?;
 
     let now = Utc::now().naive_utc();