Aug 20 - Session tenant binding

app/models/user.py

@@ -25,7 +25,15 @@ ROLE_LABELS = {
 @login_manager.user_loader
 def load_user(user_id):
     from app import db
-    return db.session.get(User, int(user_id))
+    from app.tenancy.session_binding import parse_user_id
+    # MT-21: the identity string is tenant-tagged in multi-tenant mode. A tag
+    # naming another tenant (a session or remember-me cookie replayed onto this
+    # host) resolves to None here rather than loading the same-numbered user out
+    # of whichever database happens to be bound.
+    uid = parse_user_id(user_id)
+    if uid is None:
+        return None
+    return db.session.get(User, uid)
 
 class User(UserMixin, db.Model):
     __tablename__ = 'users'
@@ -125,6 +133,15 @@ class User(UserMixin, db.Model):
     def is_active(self):
         return self.active
 
+    # MT-21: Flask-Login derives BOTH the session '_user_id' and the
+    # remember-me cookie payload from get_id(), and feeds both back through
+    # load_user(). Tagging the tenant here is therefore the single seam that
+    # binds every persisted identity to the tenant that issued it. Returns a
+    # bare id (today's format) whenever no tenant is bound.
+    def get_id(self):
+        from app.tenancy.session_binding import tag_user_id
+        return tag_user_id(self.id)
+
     def set_password(self, password):
         self.password_hash = generate_password_hash(password)