Skip to content

fix: allow unbound users (tenant_id=None) to pass tenant-scoped login #328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nap-liu wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: allow unbound users (tenant_id=None) to pass tenant-scoped login #328

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions backend/app/api/auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -512,12 +512,18 @@ async def login(data: UserLogin, background_tasks: BackgroundTasks, db: AsyncSes
user = valid_users[0]
else:
# Specific tenant requested (Dedicated Link flow)
# Search for the user record in that tenant
user = next((u for u in valid_users if u.tenant_id == data.tenant_id), None)

# Search for the user record in that tenant.
# Also allow users with tenant_id=None (SSO-created but not yet
# assigned to a tenant) so they can proceed to company setup.
user = next(
(u for u in valid_users
if u.tenant_id == data.tenant_id or u.tenant_id is None),
None,
)

# Cross-tenant access check
if not user:
# Even platform admins must have a valid record in the targeted tenant
# Even platform admins must have a valid record in the targeted tenant
# when logging in via a dedicated tenant URL / tenant_id.
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
Expand Down