akvo / akvo-mis / #773

89%

main: 89%

Pull #280

coveralls-python

[#271] Enforce tenant ownership on every write (#282)

* [#271] Add the tenant stamping mixin and scoped related field

Two write-side mechanisms mirroring the read-side for_user. The
stamping mixin sets a new row's tenant from the authenticated user
(never the payload) in create(). The scoped related field narrows a
foreign-key input's candidates to for_user(user), so a pk pointing at
another tenant's object fails validation as does_not_exist. Both
resolve the acting user from either the "user" or the DRF "request"
context key.

A test covers the case that matters most for trust: a payload carrying
an explicit tenant id is ignored, and the row is stamped to the caller.

* [#271] Stamp direct-FK creates with the creator's tenant

Form, organisation, user, entity, attribute and single-administration
creates now set tenant from the authenticated user. Rows that landed
tenant-less before were invisible to their own creator the moment read
filtering arrived — a form saved in the builder and vanished. A test
covers exactly that: create, then list, and find it.

The plan expected two variants, the mixin where create() is default and
explicit assignment where it is overridden. Only the mixin is needed:
all three custom create() methods call super().create(), so the mixin
sits behind them in the MRO and stamps on the way through. One
mechanism, applied uniformly.

Two unscoped level lookups had to be fixed to get here. validate_parent
and _assign_level both resolved the child tier with
Levels.objects.get(level=n), which is unique per tenant but not
globally: with a second tenant present they matched two rows and raised
MultipleObjectsReturned, so creating any child administration was a 500
rather than a leak. Both now resolve within the parent's tenant. Read
filtering missed them because they live in a serializer validator, not
a view queryset.

* [#271] Reject write payloads referencing another tenant's objects

Foreign-key inputs to tenant-owned objects — a... (continued)

5733 of 6629 branches covered (86.48%)

Branch coverage included in aggregate %.

10877 of 12079 relevant lines covered (90.05%)

0.9 hits per line