wizardchen
af23483433
POST /auth/switch-tenant mints an access token whose `tenant_id` claim
points to the target tenant, but the middleware previously discarded
that claim entirely:
user, err := userService.ValidateToken(ctx, token) // returned only *User
targetTenantID := user.TenantID // always the home tenant
The session therefore stayed scoped to the user's home tenant despite
the supposedly fresh token, making the new endpoint a no-op once
the request hit any tenant-scoped query.
This change widens the contract:
- UserService.ValidateToken now returns (user, activeTenantID, error)
where activeTenantID is the JWT's `tenant_id` claim, falling back to
user.TenantID when the claim is absent (backward compatibility with
pre-RBAC tokens still in the wild).
- middleware/auth.go uses activeTenantID as the default target before
applying any X-Tenant-ID header override, and recomputes
crossTenantSwitch from `activeTenantID != user.TenantID` so the
resolveTenantRole branches stay correct for switch-tenant sessions.
- The non-middleware /auth/validate handler in handler/auth.go absorbs
the new return value (it only cares about user identity).
Tests:
- internal/application/service/user_jwt_test.go pins the JWT->tenant-id
projection (`tenantIDFromClaims`) — claim present beats fallback,
zero/negative/string claims fall back, int64/uint64 are accepted for
test-built tokens.
Required for PR 2 multi-tenant integration tests, where a single user
needs to switch between Owner-in-A and Viewer-in-B sessions and observe
distinct authority on each side.
77 lines
1.9 KiB
Go
77 lines
1.9 KiB
Go
package service
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
// tenantIDFromClaims is the JWT->tenant-id projection used by
|
|
// userService.ValidateToken. It must:
|
|
// - prefer the claim when present (so /auth/switch-tenant takes effect)
|
|
// - fall back to the caller-supplied default when the claim is absent
|
|
// (backward compatibility with tokens minted before tenant-level RBAC)
|
|
// - reject zero / negative claim values rather than scoping the session
|
|
// to "tenant 0"
|
|
//
|
|
// These tests are pure-function so they don't need any DB/repo plumbing.
|
|
func TestTenantIDFromClaims(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
claims jwt.MapClaims
|
|
fallback uint64
|
|
want uint64
|
|
}{
|
|
{
|
|
name: "json number wins over fallback",
|
|
claims: jwt.MapClaims{"tenant_id": float64(99)},
|
|
fallback: 1,
|
|
want: 99,
|
|
},
|
|
{
|
|
name: "missing claim falls back to home tenant",
|
|
claims: jwt.MapClaims{"user_id": "u1"},
|
|
fallback: 7,
|
|
want: 7,
|
|
},
|
|
{
|
|
name: "zero claim treated as missing",
|
|
claims: jwt.MapClaims{"tenant_id": float64(0)},
|
|
fallback: 5,
|
|
want: 5,
|
|
},
|
|
{
|
|
name: "negative claim treated as missing",
|
|
claims: jwt.MapClaims{"tenant_id": float64(-3)},
|
|
fallback: 5,
|
|
want: 5,
|
|
},
|
|
{
|
|
name: "string claim treated as missing",
|
|
claims: jwt.MapClaims{"tenant_id": "12"},
|
|
fallback: 8,
|
|
want: 8,
|
|
},
|
|
{
|
|
name: "int64 claim accepted (test-built tokens)",
|
|
claims: jwt.MapClaims{"tenant_id": int64(42)},
|
|
fallback: 1,
|
|
want: 42,
|
|
},
|
|
{
|
|
name: "uint64 claim accepted",
|
|
claims: jwt.MapClaims{"tenant_id": uint64(123)},
|
|
fallback: 1,
|
|
want: 123,
|
|
},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
if got := tenantIDFromClaims(tc.claims, tc.fallback); got != tc.want {
|
|
t.Fatalf("tenantIDFromClaims(%v, %d) = %d, want %d",
|
|
tc.claims, tc.fallback, got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|