akvo / akvo-mis / #770

89%

main: 89%

Pull #280

coveralls-python

[#270] Filter every read by tenant (#281)

* [#270] Add the for_user tenant-scoping mechanism

Each tenant-owned model declares TENANT_PATH — the ORM lookup to its
owning tenant, "tenant" for direct-FK tables and a join like
"form__tenant" for derived ones — and gains Model.objects.for_user(user),
which filters uniformly by that path. A tenant-less user filters on
NULL and matches tenant-less rows, which is what keeps the existing
test suite (seeded tenant-less) green.

The method lives on the querysets via a shared mixin and is delegated
by each manager family, so callers write the same for_user everywhere
regardless of a model's manager. UserManager needs nothing of its own:
it already extends SoftDeletesManager and inherits the delegation.

TENANT_PATH is a deliberate opt-in — a model without it raises rather
than silently returning unscoped rows, so a forgotten declaration
fails loudly instead of leaking.

* [#270] Scope v1_data reads to the requester's tenant

Most of this app is keyed on a form id and builds its queryset from
form.form_form_data, so scoping the form lookup scopes the datapoint,
pending and draft lists with it: a foreign form id now 404s instead of
serving another tenant's submissions. Data-id-keyed lookups are scoped
directly, so a guessed id 404s rather than revealing that the row
exists.

The superuser branch of the list filter looked up the first root
administration in the table, which after multi-tenancy could be another
tenant's root; it is scoped too.

Those lookups also serve the PUT and DELETE handlers on the same views.
Leaving the write paths unscoped would have meant adding code to keep
them permissive, so they inherit the scoping. Full write-path
enforcement is still a separate iteration.

for_user reads the tenant with getattr because AnonymousUser has no
tenant attribute and a handful of endpoints are reachable without a
token — GET /api/v1/data/{id} among them. Anonymous callers now behave
like any tenant-less act... (continued)

5712 of 6609 branches covered (86.43%)

Branch coverage included in aggregate %.

10862 of 12067 relevant lines covered (90.01%)

0.9 hits per line