- Add TestRequireRole_CrossTenantSuperuserBypass: pin the
CanAccessAllTenants -> Owner-gate bypass behaviour for RequireRole,
matching the existing coverage on RequireOwnershipOrRole. Catches
reorderings of the fast paths that would re-lock org-level
superusers out of foreign-tenant Owner-only routes.
- Add TestAgentCreatorLookup_CrossTenantIsHiddenAsNotFound: lock down
the defence-in-depth tenant re-check inside AgentCreatorLookup so a
future refactor that loosens the service-layer scope (or wires a
cross-tenant variant by mistake) cannot leak access via the
ownership shortcut.
- Reword RequireOwnershipOrRole step 7-8 doc comment so "role check
already failed" is unambiguous (it refers to step 1 above).
- Annotate the synthetic-system-user construction in middleware/auth.go
with a back-pointer to types.IsSyntheticUserID so anyone changing
the prefix or numeric suffix knows to update the helper too.
wizardchen
0f0f7e4339