bcgov / digital-trust-common-service / 32272109878

88%

push

github

feat(auth): AU-05 TenantGuard claim-match (#38) (#170)

* feat(auth): AU-05 TenantGuard claim-match (#38)

Implement TenantGuard with platform-admin bypass, route :tenantId
claim-match, TENANT_ACCESS_DENIED 403 responses, and request.tenantId
stamping. Add integration A≠B coverage; defer membership lookup and
controller rollout to AU-02/AU-09 and #165.

Stacked on feat/AU-04-scope-guard (PR #166).

Co-authored-by: Cursor <cursoragent@cursor.com>

* test(auth): use other-tenant client and document TenantGuard rollout gaps

Add the reverse A≠B integration case so the second tenant client fixture
is exercised, clarify request.tenantId vs auth.tenantId, and document
:id/body/resource isolation gaps for #165.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(auth): align TenantGuard missing-auth with ScopeGuard 401

Match AU-04 hardening: missing request.auth is AuthenticationRequired
(401), not TENANT_ACCESS_DENIED (403). Document the distinction.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

1591 of 1997 branches covered (79.67%)

Branch coverage included in aggregate %.

37 of 37 new or added lines in 4 files covered. (100.0%)

2973 of 3215 relevant lines covered (92.47%)

9.04 hits per line