fix(multi-tenancy): fix organization access validation across tenants (#300) by GaetanSantucci · Pull Request #8002 · OpenAEV-Platform/openaev

Gaetan Santucci (GaetanSantucci) · 2026-09-16T14:33:46Z

Proposed changes

Improved cross-tenant security handling for organization-related access.
Ensured organization data is resolved within the correct tenant/request scope.
Added safeguards to prevent unauthorized access across tenant boundaries.

Testing Instructions

Reproduce the organization access flow in a multi-tenant environment.
Verify that access is allowed for the correct tenant.
Verify that cross-tenant access is rejected as expected.
Confirm existing organization functionality still works normally.

Related issues

Related OpenAEV-Platform/filigran-private#300

I consider the submitted work as finished
I tested the code for its functionality
For bug fix -> I implemented a test that covers the bug

github-actions · 2026-09-16T14:34:00Z

📖 Documentation check — ✅ Passed

3 functional file(s), 0 doc file(s) changed.

No documentation gaps detected.

Copilot

Pull request overview

Improves organization tenant isolation by threading TxCtx through organization access paths and adding extensive HTTP isolation tests.

Changes:

Adds tenant-aware organization CRUD, search, options, and bulk operations.
Restricts related tags, teams, and injects by tenant.
Adds multi-tenant integration coverage.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
openaev-model/src/main/java/io/openaev/database/repository/OrganizationRepository.java	Updated as part of this pull request.
openaev-api/src/test/java/io/openaev/rest/organization/OrganizationHttpIsolationTest.java	Updated as part of this pull request.
openaev-api/src/main/java/io/openaev/service/organization/OrganizationService.java	Updated as part of this pull request.
openaev-api/src/main/java/io/openaev/rest/organization/OrganizationApi.java	Updated as part of this pull request.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+  private Specification<Organization> inScope(TxCtx ctx) {
+    Set<String> tenantIds = TxCtxScopeUtils.tenantIdsFromHTTPCtx(ctx);
+    return (root, query, cb) ->
+        tenantIds.isEmpty() ? cb.disjunction() : root.get("tenant").get("id").in(tenantIds);


    return injectSearchService.getPageOfInjectResultsForOrganization(
        organizationId, searchPaginationInput);


+    @Test
+    @DisplayName("Tenant-prefixed collections and options contain only owned organizations")
+    void given_tenantPath_should_filterAllCollections() throws Exception {
+      // Arrange
+      tenantHelper.attachCurrentUserToTenant(tenantA.getId());


+@TestInstance(TestInstance.Lifecycle.PER_CLASS)
+@TestPropertySource(properties = "openaev.tenant.active-tables=tags")
+@DisplayName("Organization HTTP tenant isolation")
+class OrganizationHttpIsolationTest extends IntegrationTest {


codecov · 2026-09-17T09:37:55Z

Codecov Report

❌ Patch coverage is 94.02985% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 46.30%. Comparing base (99d8945) to head (8efac89).
⚠️ Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
...naev/service/organization/OrganizationService.java	92.98%	1 Missing and 3 partials ⚠️

❌ Your project check has failed because the head coverage (11.57%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #8002      +/-   ##
============================================
- Coverage     46.82%   46.30%   -0.52%     
- Complexity    12406    12482      +76     
============================================
  Files          3039     3020      -19     
  Lines        101275   101141     -134     
  Branches      16390    16281     -109     
============================================
- Hits          47420    46833     -587     
- Misses        50039    50567     +528     
+ Partials       3816     3741      -75

Flag	Coverage Δ
backend	`46.30% <94.02%> (-0.52%)`	⬇️
e2e	`46.30% <94.02%> (-0.52%)`	⬇️
frontend	`46.30% <94.02%> (-0.52%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Yann (impolitepanda) · 2026-09-18T14:44:10Z

+  private final EntityManager entityManager;
+
+  /** Lists organizations in the legacy tenant scope, bounded by the caller's authorized scope. */
+  @Transactional(readOnly = true)


Seeing as these functions are all called from the API layer where all methods are all already under a transactional, so it's not necessary to add it here. (same for following methods)

Yann (impolitepanda) · 2026-09-18T14:45:54Z

+  private final TagService tagService;
+  private final EntityManager entityManager;
+
+  /** Lists organizations in the legacy tenant scope, bounded by the caller's authorized scope. */


Javadoc is incorrect (missing parameters, etc.)

Yann (impolitepanda) · 2026-09-18T14:51:33Z

+  /** Creates an organization in the tenant explicitly resolved by the API write-scope resolver. */
+  @Transactional(rollbackFor = Exception.class)
+  public Organization createOrganization(
+      TxCtx ctx, OrganizationCreateInput input, String tenantId) {


ctx isn't useful here as the check was already done on the API layer

Yann (impolitepanda) · 2026-09-18T15:01:28Z

+        tenantIds.isEmpty() ? cb.disjunction() : root.get("tenant").get("id").in(tenantIds);
+  }
+
+  private Set<Tag> resolveTags(List<String> tagIds, String tenantId) {


This function should not exist here. Instead, it whould call the tagSet function from TagService. But tagSet doesn't seem to support the tenant filter. So a new function doing this should be created in the tagService class.

Also, this class still fetches all tags requested by their ID and then filter them in memory instead of filtering directly in the select in the database which would be more efficient.

Yann (impolitepanda) · 2026-09-18T15:06:58Z

+  private Organization findAccessibleById(TxCtx ctx, String organizationId) {
+    Specification<Organization> specification =
+        inTenantScope(ctx).and((root, query, cb) -> cb.equal(root.get("id"), organizationId));
+    Session session = entityManager.unwrap(Session.class);


Not sure why we need to disable the filtering here before making our query

Copilot AI lite review requested due to automatic review settings September 16, 2026 14:33

github-actions Bot added the filigran team Item from the Filigran team. label Sep 16, 2026

Copilot started reviewing on behalf of Gaetan Santucci (GaetanSantucci) September 16, 2026 14:34 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Gaetan Santucci (GaetanSantucci) changed the title ~~fix in progress~~ fix(multi-tenancy): fix organization access validation across tenants (#300) Sep 17, 2026

Gaetan Santucci (GaetanSantucci) added 3 commits September 18, 2026 15:14

fix in progress

5a7744c

Allow explicit tenant IDs to scope organization queries

552a614

improve code

c231ab6

Gaetan Santucci (GaetanSantucci) force-pushed the fix/300-security-cross-tenant-organization branch from 8577344 to c231ab6 Compare September 18, 2026 13:31

Yann (impolitepanda) reviewed Sep 18, 2026

View reviewed changes

remove useless code

b4cf54f

Navigation Menu

fix(multi-tenancy): fix organization access validation across tenants (#300) - #8002

fix(multi-tenancy): fix organization access validation across tenants (#300)#8002
Gaetan Santucci (GaetanSantucci) wants to merge 4 commits into
mainfrom
fix/300-security-cross-tenant-organization

Gaetan Santucci (GaetanSantucci) commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

codecov Bot commented Sep 17, 2026

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		return injectSearchService.getPageOfInjectResultsForOrganization(
		organizationId, searchPaginationInput);

Conversation

Gaetan Santucci (GaetanSantucci) commented Sep 16, 2026

Proposed changes

Testing Instructions

Related issues

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

codecov Bot commented Sep 17, 2026

Codecov Report

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

Yann (impolitepanda) Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants