hailin
/
it0
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(auth): use slug for tenant lookup in createInvite; fix getMemberCount search_path 

- createInvite: findOneBy({ slug }) instead of { id } since JWT tenantId is slug
- getMemberCount: use SET LOCAL + transaction to prevent pool search_path leak

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
hailin 2026-03-07 04:17:14 -08:00
parent 074e031685
commit 100ca43460
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
packages/services/auth-service/src/application/services/auth.service.ts
View File

@ -288,8 +288,8 @@ export class AuthService {
role: string, role: string,
invitedBy: string, invitedBy: string,
): Promise<TenantInvite> { ): Promise<TenantInvite> {
// Check tenant exists // Check tenant exists — tenantId here is the slug (matches user.tenantId in JWT)
const tenant = await this.tenantRepository.findOneBy({ id: tenantId }); const tenant = await this.tenantRepository.findOneBy({ slug: tenantId });
if (!tenant) { if (!tenant) {
throw new NotFoundException('Tenant not found'); throw new NotFoundException('Tenant not found');
} }

5
packages/services/auth-service/src/interfaces/rest/controllers/tenant.controller.ts
View File

@ -51,10 +51,13 @@ export class TenantController {
const qr = this.dataSource.createQueryRunner(); const qr = this.dataSource.createQueryRunner();
await qr.connect(); await qr.connect();
try { try {
await qr.query(`SET search_path TO "${schemaName}", public`); await qr.startTransaction();
await qr.query(`SET LOCAL search_path TO "${schemaName}", public`);
const result = await qr.query(`SELECT COUNT(*)::int AS count FROM users`); const result = await qr.query(`SELECT COUNT(*)::int AS count FROM users`);
await qr.commitTransaction();
return result[0]?.count ?? 0; return result[0]?.count ?? 0;
} catch { } catch {
await qr.rollbackTransaction().catch(() => {});
return 0; return 0;
} finally { } finally {
await qr.release(); await qr.release();