Aplicar lógica de validación de tenant y compañía a todos los endpoints relevantes en los módulos: client_and_provider, classes, country_rule_oct, exchange_rate, fraction_rule_octave, package, parts, permission_rule_oct, seal

backend/api/v1/modules/a76/classes/routes.py

@@ -35,6 +35,13 @@ async def list_classes(
     """
     List classes with optional filters and pagination
     """
+    # Validate access to the tenant and company
+    tenant_id = current_user.get("tenant_id")
+    company_id = current_user.get("company_id")
+
+    if not tenant_id or not company_id:
+        raise HTTPException(status_code=403, detail="Access denied: Tenant or Company not found")
+
     service = ClassService(db)
     search_params = ClassSearchDTO(
         client_id=client_id,
@@ -58,6 +65,13 @@ async def get_classes_by_client(
     """
     Get all classes for a specific client
     """
+    # Validate access to the tenant and company
+    tenant_id = current_user.get("tenant_id")
+    company_id = current_user.get("company_id")
+
+    if not tenant_id or not company_id:
+        raise HTTPException(status_code=403, detail="Access denied: Tenant or Company not found")
+
     service = ClassService(db)
     return service.search_by_client(client_id, skip, limit)
 

backend/api/v1/modules/a76/classes/test_classes.py

@@ -0,0 +1,31 @@
+import pytest
+from fastapi.testclient import TestClient
+from .routes import router
+from fastapi import FastAPI
+
+app = FastAPI()
+app.include_router(router)
+client = TestClient(app)
+
+@pytest.mark.usefixtures("client", "access_token")
+def test_list_classes(client, access_token):
+    headers = {"Authorization": f"Bearer {access_token}"}
+    response = client.get("/classes/", headers=headers)
+    assert response.status_code == 200
+    assert "items" in response.json()
+    assert "page" in response.json()
+    assert "page_size" in response.json()
+
+@pytest.mark.usefixtures("client", "access_token")
+def test_get_class_not_found(client, access_token):
+    headers = {"Authorization": f"Bearer {access_token}"}
+    response = client.get("/classes/invalid_id", headers=headers)
+    assert response.status_code == 404
+
+def test_create_class_forbidden():
+    response = client.post("/classes/", json={"name": "Test Class"})
+    assert response.status_code in (403, 405, 404)
+
+def test_update_class_forbidden():
+    response = client.put("/classes/1", json={"name": "Updated Class"})
+    assert response.status_code in (403, 405, 404)