fix: prevent cross-tenant organization user updates - #820

Merged

yaojin3616 merged 1 commit into

mainfrom

agent/debugger/9d168ae7

Aug 7, 2026

yaojin3616 commented Aug 5, 2026 •

edited

Loading

Collaborator

Summary

Scope organization user listing and updates to the caller tenant for organization admins.
Prevent organization admins from changing another member's global login email.
Add regression coverage for cross-tenant enumeration and email-update attempts.

Verification

PYTHONPATH=. uv run pytest tests/test_organization_tenant_scope.py
PYTHONPATH=. uv run ruff check app/api/organization.py tests/test_organization_tenant_scope.py

Fixes AND-148


          fix: enforce org user tenant boundaries

f04fe66

yaojin3616 merged commit 201e6e8 into main

1 check passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet