Aug 20 - Session tenant binding

app/tenancy/middleware.py

@@ -139,6 +139,13 @@ def init_tenancy(app):
                         )
                         g.tenant = ctx
                         g.tenant_engine = get_tenant_engine(ctx)
+                        # MT-21: impersonation deliberately rebinds the session
+                        # to the impersonated tenant, so stamp it rather than
+                        # clearing it. /auth/impersonate has already written the
+                        # same marker; this keeps it correct if the superadmin's
+                        # target changes mid-session.
+                        from app.tenancy.session_binding import bind_session_tenant
+                        bind_session_tenant()
                         return  # skip normal Host resolution
             except Exception:
                 logger.warning('TENANCY | impersonation_failed | tenant_id=%s', imp_id)
@@ -156,6 +163,14 @@ def init_tenancy(app):
         g.tenant = tenant
         g.tenant_engine = get_tenant_engine(tenant)
 
+        # MT-21: a session cookie signed for a different tenant validates fine
+        # here — same app, same SECRET_KEY — so drop it before any downstream
+        # code reads identity out of it. Covers pre-auth session state
+        # (mfa_pending_user_id); the tenant tag in User.get_id() covers the
+        # authenticated session and the remember-me cookie.
+        from app.tenancy.session_binding import enforce_session_tenant
+        enforce_session_tenant()
+
     @app.before_request
     def _billing_gate():
         """MT-8: Enforce subscription status. Inert when BILLING_ENABLED=False."""