feat: Funcion de sistema tenants

backend/app/api/deps.py

@@ -1,4 +1,5 @@
 from fastapi import Depends, HTTPException, status
+from starlette.requests import Request
 from fastapi.security import OAuth2PasswordBearer
 from jose import jwt, JWTError
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -17,6 +18,7 @@ settings = get_settings()
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl=f"/{settings.API_VERSION}/auth/login")
 
 async def get_current_user(
+    request: Request,
     token: str = Depends(oauth2_scheme),
     db: AsyncSession = Depends(get_db)
 ) -> User:
@@ -43,6 +45,15 @@ async def get_current_user(
         
     if not user.is_active:
         raise HTTPException(status_code=400, detail="Inactive user")
+
+    # Enforce that tenant header (if present) matches the authenticated user's tenant.
+    # Prevents cross-tenant header impersonation.
+    request_tenant_id = getattr(getattr(request, "state", None), "tenant_id", None)
+    if request_tenant_id and str(user.tenant_id) != str(request_tenant_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Tenant header does not match authenticated user",
+        )
         
     return user