From 5708127dbb7072e083a94c35fda1181cdba8f74c Mon Sep 17 00:00:00 2001 From: Schalli Date: Sat, 20 Jun 2026 09:31:59 +0200 Subject: [PATCH] fix(03): module guard uses JWT tenantId fallback for deactivation enforcement ModuleGuard now reads tenantId from req.user?.tenantId as fallback (same pattern as module-registry controller), and throws 403 instead of silently allowing access when no tenant context exists. Co-Authored-By: Claude Sonnet 4.6 --- apps/api/src/module-registry/module.guard.ts | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/apps/api/src/module-registry/module.guard.ts b/apps/api/src/module-registry/module.guard.ts index 608bbf6..a080ca3 100644 --- a/apps/api/src/module-registry/module.guard.ts +++ b/apps/api/src/module-registry/module.guard.ts @@ -42,11 +42,10 @@ export class ModuleGuard implements CanActivate { } const request = context.switchToHttp().getRequest(); - const tenantId = request.tenantId; + const tenantId = request.tenantId ?? request.user?.tenantId; - // Public routes or routes without tenant context skip module check if (!tenantId) { - return true; + throw new ForbiddenException('No tenant context'); } const isActive = await this.moduleRegistryService.isModuleActive(