Aug 20 - Session tenant binding

app/api/decorators.py

@@ -62,6 +62,20 @@ def jwt_required(f):
         if payload is None:
             return api_error('Access token is invalid or expired', 401)
 
+        # MT-21: a token signed for another tenant verifies fine here (shared
+        # SECRET_KEY), so check the tenant claim before 'sub' is resolved
+        # against the bound database. No-op in single-tenant mode.
+        from app.tenancy.session_binding import current_tenant_id
+        tenant_id = current_tenant_id()
+        if tenant_id is not None:
+            token_tid = payload.get('tid')
+            if token_tid != tenant_id:
+                logger.warning(
+                    'API tenant mismatch | token_tid=%s resolved=%s endpoint=%s',
+                    token_tid, tenant_id, request.endpoint,
+                )
+                return api_error('Access token is not valid for this workspace', 401)
+
         user_id = int(payload.get('sub', 0))
         user    = db.session.get(User, user_id)