tenants

backend/tests/auth_flow.rs

@@ -546,9 +546,7 @@ async fn login_returns_tenant_selection_when_multiple_memberships() -> Result<()
 
     let (login, refresh_cookie) = login_with_session(&app, "multipass", password).await?;
 
-    let tenants_response = app
-        .get("/api/auth/tenants", Some(&login.access_token))
-        .await?;
+    let tenants_response = app.get("/api/tenants", Some(&login.access_token)).await?;
     assert_eq!(tenants_response.status(), StatusCode::OK);
     let tenants_body = body_to_vec(tenants_response.into_body()).await?;
     let tenant_list: TenantListResponse = serde_json::from_slice(&tenants_body)?;

backend/tests/tenants_flow.rs

@@ -0,0 +1,51 @@
+use anyhow::Result;
+use axum::http::StatusCode;
+use chrono::Utc;
+use diesel::prelude::*;
+use papercrate::models::TenantStatus;
+use papercrate::schema::tenants::dsl as tenants_dsl;
+use papercrate::test_support::{acquire_db_lock, TestApp, TestUserRole};
+use serde_json::json;
+use uuid::Uuid;
+
+#[tokio::test]
+async fn tenant_management_is_scoped_to_memberships() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let username = "tenant-owner";
+    app.insert_user(username, TestUserRole::Owner).await?;
+    let token = app.login_token(username, "irrelevant").await?;
+
+    let other_tenant_id = app
+        .with_conn(|conn| {
+            let other_id = Uuid::new_v4();
+            let now = Utc::now().naive_utc();
+            diesel::insert_into(tenants_dsl::tenants)
+                .values((
+                    tenants_dsl::id.eq(other_id),
+                    tenants_dsl::name.eq(format!("foreign-{other_id}")),
+                    tenants_dsl::storage_root.eq(Some(format!("test-tenants/{other_id}/"))),
+                    tenants_dsl::quickwit_index.eq(None::<String>),
+                    tenants_dsl::config.eq(json!({})),
+                    tenants_dsl::created_at.eq(now),
+                    tenants_dsl::updated_at.eq(now),
+                    tenants_dsl::status.eq(TenantStatus::Active),
+                    tenants_dsl::created_by.eq(None::<Uuid>),
+                ))
+                .execute(conn)?;
+            Ok(other_id)
+        })
+        .await?;
+
+    let response = app
+        .patch_json(
+            &format!("/api/tenants/{other_tenant_id}"),
+            &json!({ "name": "should-not-work" }),
+            Some(&token),
+        )
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    Ok(())
+}