fix

backend/src/auth/mod.rs

@@ -5,6 +5,8 @@ pub mod jwt;
 pub mod passkeys;
 pub mod password;
 
+use std::sync::{Arc, Mutex};
+
 use axum::{async_trait, extract::FromRequestParts, http::request::Parts};
 use axum_extra::headers::{authorization::Bearer, Authorization};
 use axum_extra::TypedHeader;
@@ -21,6 +23,23 @@ use uuid::Uuid;
 
 use crate::auth::jwt::PrincipalKind;
 
+#[derive(Clone)]
+pub struct TenantConnectionHolder {
+    inner: Arc<Mutex<Option<PgPooledConnection>>>,
+}
+
+impl TenantConnectionHolder {
+    pub fn new(conn: PgPooledConnection) -> Self {
+        Self {
+            inner: Arc::new(Mutex::new(Some(conn))),
+        }
+    }
+
+    pub fn into_conn(self) -> Option<PgPooledConnection> {
+        self.inner.lock().ok()?.take()
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
 pub struct AuthenticatedUser {
     pub user_id: uuid::Uuid,
@@ -78,6 +97,9 @@ impl FromRequestParts<AppState> for AuthenticatedUser {
         };
 
         parts.extensions.insert(user.clone());
+        parts
+            .extensions
+            .insert(TenantConnectionHolder::new(tenant_conn));
 
         Ok(user)
     }
@@ -106,7 +128,13 @@ impl FromRequestParts<AppState> for TenantScopedConn {
     ) -> Result<Self, Self::Rejection> {
         let user = AuthenticatedUser::from_request_parts(parts, state).await?;
         let tenant_id = user.tenant_id;
-        let conn = state.db_for_tenant(tenant_id)?;
+        let conn = if let Some(holder) = parts.extensions.remove::<TenantConnectionHolder>() {
+            holder
+                .into_conn()
+                .ok_or_else(|| AppError::internal("tenant connection unavailable"))?
+        } else {
+            state.db_for_tenant(tenant_id)?
+        };
 
         Ok(Self {
             conn,