ADUANASOFT/service_manager
10
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Roles

Browse Source
This commit is contained in:
icamarillo
2026-03-03 14:02:18 -07:00
parent f10b15d91b
commit 3b46f48655
13 changed files with 1041 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
backend/app/api/deps.py
View File

@@ -89,9 +89,10 @@ async def get_current_user(
raise HTTPException(status_code=400, detail="Inactive user")
# Enforce that tenant header (if present) matches the authenticated user's tenant.
# Prevents cross-tenant header impersonation.
# Roles globales (is_global) pueden operar en cualquier tenant → omitir chequeo.
# Roles de cliente (is_client) deben coincidir con su propio tenant.
request_tenant_id = getattr(getattr(request, "state", None), "tenant_id", None)
if request_tenant_id and str(user.tenant_id) != str(request_tenant_id):
if request_tenant_id and user.role.is_client and str(user.tenant_id) != str(request_tenant_id):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Tenant header does not match authenticated user",