webdav fix

backend/src/auth/webdav_tokens.rs

@@ -13,6 +13,7 @@ use crate::{
     models::{NewWebdavToken, WebdavToken},
     schema::webdav_tokens,
     state::PgPooledConnection,
+    tenants::{apply_webdav_token_prefix, clear_webdav_token_prefix},
 };
 
 const TOKEN_PREFIX_LENGTH: usize = 12;
@@ -84,6 +85,7 @@ pub fn find_active_token_by_secret(
     }
 
     let prefix = &secret[..TOKEN_PREFIX_LENGTH];
+    apply_webdav_token_prefix(conn, prefix)?;
     let mut query = webdav_tokens::table
         .filter(webdav_tokens::user_id.eq(user_id))
         .filter(webdav_tokens::token_prefix.eq(prefix))
@@ -101,7 +103,10 @@ pub fn find_active_token_by_secret(
         query = query.filter(webdav_tokens::tenant_id.eq(tenant_id));
     }
 
-    let candidates = query.load::<WebdavToken>(conn)?;
+    let load_result = query.load::<WebdavToken>(conn);
+    let clear_result = clear_webdav_token_prefix(conn);
+    clear_result?;
+    let candidates = load_result?;
 
     for token in candidates {
         if verify_token_secret(secret, &token.token_hash)? {

backend/src/tenants.rs

@@ -148,7 +148,8 @@ pub fn clear_tenant_context(conn: &mut PgConnection) -> AppResult<()> {
         "SELECT \
             set_config('papercrate.tenant_id', '', false), \
             set_config('papercrate.user_id', '', false), \
-            set_config('papercrate.refresh_token_hash', '', false)"
+            set_config('papercrate.refresh_token_hash', '', false), \
+            set_config('papercrate.webdav_token_prefix', '', false)"
     )
     .execute(conn)
     .map(|_| ())
@@ -177,6 +178,21 @@ pub fn clear_refresh_token_hash(conn: &mut PgConnection) -> AppResult<()> {
         .map_err(AppError::from)
 }
 
+pub fn apply_webdav_token_prefix(conn: &mut PgConnection, prefix: &str) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.webdav_token_prefix', $1, false)")
+        .bind::<Text, _>(prefix)
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+pub fn clear_webdav_token_prefix(conn: &mut PgConnection) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.webdav_token_prefix', '', false)")
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
 fn normalize_storage_root(raw: Option<&str>, tenant_id: Uuid) -> String {
     match raw.map(str::trim) {
         Some(root) if !root.is_empty() => {

backend/src/workers/tenants.rs

@@ -57,6 +57,19 @@ impl JobHandler for ProvisionTenantJob {
             }
         };
 
+        drop(conn);
+
+        let mut conn = match state.db_for_tenant(tenant.id) {
+            Ok(conn) => conn,
+            Err(err) => {
+                warn!(job_id = %job.id, error = ?err, "failed to scope connection for tenant provisioning");
+                return JobExecution::Retry {
+                    delay: std::time::Duration::from_secs(30),
+                    error: "tenant connection unavailable".into(),
+                };
+            }
+        };
+
         if tenant.status == TenantStatus::Active {
             warn!(
                 job_id = %job.id,