Fixed some tenant scoping on searches.

eben-roux · eben-roux · commit fef756e891e8 · 2026-04-20T18:41:10.000+02:00
diff --git a/Shuttle.Access.Application/Shuttle.Access.Application.csproj b/Shuttle.Access.Application/Shuttle.Access.Application.csproj
@@ -32,7 +32,7 @@
 
   <PropertyGroup>
     <Description>Application concern implementations such as Shuttle.Mediator participants.</Description>
-    <Version>9.0.6</Version>
+    <Version>9.0.7</Version>
     <Authors>Eben Roux</Authors>
     <Company>Shuttle</Company>
     <Copyright>Copyright (c) 2025, Eben Roux</Copyright>
diff --git a/Shuttle.Access.AspNetCore/Shuttle.Access.AspNetCore.csproj b/Shuttle.Access.AspNetCore/Shuttle.Access.AspNetCore.csproj
@@ -33,7 +33,7 @@
 
   <PropertyGroup>
     <Description>Authorization middleware for web API endpoints using Shuttle.Access.</Description>
-    <Version>9.0.6</Version>
+    <Version>9.0.7</Version>
     <Authors>Eben Roux</Authors>
     <Company>Shuttle</Company>
     <Copyright>Copyright (c) 2025, Eben Roux</Copyright>
diff --git a/Shuttle.Access.Messages/Shuttle.Access.Messages.csproj b/Shuttle.Access.Messages/Shuttle.Access.Messages.csproj
@@ -27,7 +27,7 @@
 
   <PropertyGroup>
     <Description>Messages for use in Shuttle.Access implementations.</Description>
-    <Version>9.0.6</Version>
+    <Version>9.0.7</Version>
     <Authors>Eben Roux</Authors>
     <Company>Shuttle</Company>
     <Copyright>Copyright (c) 2025, Eben Roux</Copyright>
diff --git a/Shuttle.Access.RestClient/Shuttle.Access.RestClient.csproj b/Shuttle.Access.RestClient/Shuttle.Access.RestClient.csproj
@@ -33,7 +33,7 @@
 
   <PropertyGroup>
     <Description>A client used to interact with the restful Shuttle.Access web API.</Description>
-    <Version>9.0.6</Version>
+    <Version>9.0.7</Version>
     <Authors>Eben Roux</Authors>
     <Company>Shuttle</Company>
     <Copyright>Copyright (c) 2025, Eben Roux</Copyright>
diff --git a/Shuttle.Access.SqlServer/IdentityQuery.cs b/Shuttle.Access.SqlServer/IdentityQuery.cs
@@ -95,68 +95,68 @@ public async Task<IEnumerable<Guid>> TenantIdsAsync(Query.Identity.Specification
             });
     }
 
-    private IQueryable<Models.Identity> GetQueryable(Query.Identity.Specification identitySpecification)
+    private IQueryable<Models.Identity> GetQueryable(Query.Identity.Specification specification)
     {
         var queryable = _accessDbContext.Identities
             .AsNoTracking();
 
-        queryable = identitySpecification.ShouldIncludeTenants
+        queryable = specification.ShouldIncludeTenants
             ? queryable.Include(item => item.IdentityTenants).ThenInclude(item => item.Tenant)
             : queryable;
 
-        queryable = identitySpecification is { ShouldIncludeRoles: true, ShouldIncludePermissions: false }
-            ? queryable.Include(item => item.IdentityRoles)
+        queryable = specification is { ShouldIncludeRoles: true, ShouldIncludePermissions: false }
+            ? queryable.Include(item => item.IdentityRoles.Where(role => role.TenantId == specification.TenantId))
                 .ThenInclude(item => item.Role)
                 .ThenInclude(item => item.Tenant)
             : queryable;
 
-        queryable = identitySpecification.ShouldIncludePermissions
+        queryable = specification.ShouldIncludePermissions
             ? queryable.Include(item => item.IdentityRoles).ThenInclude(item => item.Role).ThenInclude(item => item.RolePermissions).ThenInclude(item => item.Permission) 
             : queryable;
 
-        if (!string.IsNullOrEmpty(identitySpecification.NameMatch))
+        if (!string.IsNullOrEmpty(specification.NameMatch))
         {
-            queryable = queryable.Where(e => e.Name.Contains(identitySpecification.NameMatch) || e.Description.Contains(identitySpecification.NameMatch));
+            queryable = queryable.Where(e => e.Name.Contains(specification.NameMatch) || e.Description.Contains(specification.NameMatch));
         }
 
-        if (!string.IsNullOrEmpty(identitySpecification.Name))
+        if (!string.IsNullOrEmpty(specification.Name))
         {
-            queryable = queryable.Where(e => e.Name == identitySpecification.Name || e.Description == identitySpecification.Name);
+            queryable = queryable.Where(e => e.Name == specification.Name || e.Description == specification.Name);
         }
 
-        if (identitySpecification.TenantId != null)
+        if (specification.TenantId != null)
         {
-            queryable = queryable.Where(e => e.IdentityTenants.Any(it => it.TenantId == identitySpecification.TenantId));
+            queryable = queryable.Where(e => e.IdentityTenants.Any(it => it.TenantId == specification.TenantId));
         }
 
-        if (!string.IsNullOrEmpty(identitySpecification.RoleName))
+        if (!string.IsNullOrEmpty(specification.RoleName))
         {
-            queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.Role.Name == identitySpecification.RoleName));
+            queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.Role.Name == specification.RoleName));
         }
 
-        if (identitySpecification.RoleId != null)
+        if (specification.RoleId != null)
         {
-            queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.RoleId == identitySpecification.RoleId));
+            queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.RoleId == specification.RoleId));
         }
 
-        if (identitySpecification.PermissionId != null)
+        if (specification.PermissionId != null)
         {
-            queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.Role.RolePermissions.Any(rp => rp.PermissionId == identitySpecification.PermissionId)));
+            queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.Role.RolePermissions.Any(rp => rp.PermissionId == specification.PermissionId)));
         }
 
-        if (identitySpecification.HasIds)
+        if (specification.HasIds)
         {
-            queryable = queryable.Where(e => identitySpecification.Ids.Contains(e.Id));
+            queryable = queryable.Where(e => specification.Ids.Contains(e.Id));
         }
 
-        if (identitySpecification.HasExcludedIds)
+        if (specification.HasExcludedIds)
         {
-            queryable = queryable.Where(e => !identitySpecification.ExcludedIds.Contains(e.Id));
+            queryable = queryable.Where(e => !specification.ExcludedIds.Contains(e.Id));
         }
 
-        if (identitySpecification.MaximumRows > 0)
+        if (specification.MaximumRows > 0)
         {
-            queryable = queryable.Take(identitySpecification.MaximumRows);
+            queryable = queryable.Take(specification.MaximumRows);
         }
 
         return queryable.AsSplitQuery();
diff --git a/Shuttle.Access.SqlServer/RoleQuery.cs b/Shuttle.Access.SqlServer/RoleQuery.cs
@@ -38,6 +38,7 @@ public async ValueTask<int> CountAsync(Query.Role.Specification specification, C
                 Id = e.Id,
                 Name = e.Name,
                 TenantId = e.TenantId,
+                TenantName = e.Tenant.Name,
                 Permissions = e.RolePermissions.Select(rolePermission => rolePermission.Permission).Select(permission => new Query.Permission
                 {
                     Id = permission.Id,
@@ -58,6 +59,7 @@ public async ValueTask<int> CountAsync(Query.Role.Specification specification, C
     {
         var queryable = _accessDbContext.Roles
             .AsNoTracking()
+            .Include(item => item.Tenant)
             .Include(item => item.RolePermissions).ThenInclude(item => item.Permission)
             .Include(item => item.IdentityRoles).ThenInclude(item => item.Identity)
             .AsSplitQuery();
diff --git a/Shuttle.Access.SqlServer/SessionQuery.cs b/Shuttle.Access.SqlServer/SessionQuery.cs
@@ -149,6 +149,11 @@ public async Task SaveAsync(Session session, CancellationToken cancellationToken
             queryable = queryable.Where(e => e.SessionPermissions.Any(p => specification.Permissions.Contains(p.Permission.Name)));
         }
 
+        if (specification.TenantId.HasValue)
+        {
+            queryable = queryable.Where(e => e.TenantId == specification.TenantId);
+        }
+
         return queryable;
     }
 }
diff --git a/Shuttle.Access.SqlServer/Shuttle.Access.SqlServer.csproj b/Shuttle.Access.SqlServer/Shuttle.Access.SqlServer.csproj
@@ -31,7 +31,7 @@
 
   <PropertyGroup>
     <Description>Provides a Sql Server implementation of the data access components used by Shuttle.Access.</Description>
-    <Version>9.0.6</Version>
+    <Version>9.0.7</Version>
     <Authors>Eben Roux</Authors>
     <Company>Shuttle</Company>
     <Copyright>Copyright (c) 2025, Eben Roux</Copyright>
diff --git a/Shuttle.Access.WebApi.Contracts/Shuttle.Access.WebApi.Contracts.csproj b/Shuttle.Access.WebApi.Contracts/Shuttle.Access.WebApi.Contracts.csproj
@@ -8,7 +8,7 @@
 
   <PropertyGroup>
     <Description>Shuttle.Access web API contracts.</Description>
-    <Version>9.0.6</Version>
+    <Version>9.0.7</Version>
     <Authors>Eben Roux</Authors>
     <Company>Shuttle</Company>
     <Copyright>Copyright (c) 2025, Eben Roux</Copyright>
diff --git a/Shuttle.Access.WebApi.Contracts/v1/Role.cs b/Shuttle.Access.WebApi.Contracts/v1/Role.cs
@@ -4,6 +4,8 @@ public class Role
 {
     public Guid Id { get; set; }
     public string Name { get; set; } = string.Empty;
+    public Guid TenantId { get; set; }
+    public string TenantName { get; set; } = string.Empty;
     public List<Permission> Permissions { get; set; } = [];
     public List<Identity> Identities { get; set; } = [];
 
diff --git a/Shuttle.Access.WebApi/Endpoints/IdentityEndpoints.cs b/Shuttle.Access.WebApi/Endpoints/IdentityEndpoints.cs
@@ -26,9 +26,14 @@ private static async Task<IResult> Delete(Guid id, ISessionContext sessionContex
         return Results.Accepted();
     }
 
-    private static async Task<IResult> Get(IIdentityQuery identityQuery, string value)
+    private static async Task<IResult> Get(ISessionContext sessionContext, IIdentityQuery identityQuery, string value)
     {
-        var specification = new Query.Identity.Specification().IncludeRoles();
+        if (!sessionContext.IsAuthorized)
+        {
+            return Results.Unauthorized();
+        }
+
+        var specification = new Query.Identity.Specification().IncludeRoles().WithTenantId(sessionContext.Session.TenantId);
 
         if (Guid.TryParse(value, out var id))
         {
diff --git a/Shuttle.Access.WebApi/Endpoints/RoleEndpoints.cs b/Shuttle.Access.WebApi/Endpoints/RoleEndpoints.cs
@@ -48,6 +48,8 @@ private static Contracts.v1.Role Map(Query.Role role)
         {
             Id = role.Id,
             Name = role.Name,
+            TenantId = role.TenantId,
+            TenantName = role.TenantName,
             Permissions = role.Permissions.Select(item => new Contracts.v1.Permission
             {
                 Id = item.Id,
diff --git a/Shuttle.Access.WebApi/Endpoints/SessionEndpoints.cs b/Shuttle.Access.WebApi/Endpoints/SessionEndpoints.cs
@@ -42,11 +42,16 @@ await bus.PublishAsync(new SessionDeleted
         return Results.Ok();
     }
 
-    private static async Task<IResult> DeleteAll(IBus bus, ISessionQuery sessionQuery, CancellationToken cancellationToken)
+    private static async Task<IResult> DeleteAll(ISessionContext sessionContext, IBus bus, ISessionQuery sessionQuery, CancellationToken cancellationToken)
     {
+        if (!sessionContext.IsAuthorized)
+        {
+            return Results.Unauthorized();
+        }
+
         using (var tx = new TransactionScope(TransactionScopeAsyncFlowOption.Enabled))
         {
-            await sessionQuery.RemoveAsync(new(), cancellationToken);
+            await sessionQuery.RemoveAsync(new Session.Specification().WithTenantId(sessionContext.Session.TenantId), cancellationToken);
 
             await bus.PublishAsync(new AllSessionsDeleted(), cancellationToken);
 
@@ -322,9 +327,14 @@ private static async Task<IResult> PostDelegated(IMediator mediator, RegisterDel
         return Results.Ok(registerSession.GetSessionResponse(false));
     }
 
-    private static async Task<IResult> PostSearch([FromBody] Contracts.v1.Session.Specification model, ISessionQuery sessionQuery, IHashingService hashingService)
+    private static async Task<IResult> PostSearch(ISessionContext sessionContext, ISessionQuery sessionQuery, IHashingService hashingService, [FromBody] Contracts.v1.Session.Specification model)
     {
-        var specification = GetSpecification(model, hashingService);
+        if (!sessionContext.IsAuthorized)
+        {
+            return Results.Unauthorized();
+        }
+
+        var specification = GetSpecification(model, hashingService).WithTenantId(sessionContext.Session.TenantId);
 
         return Results.Ok((await sessionQuery.SearchAsync(specification)).Select(session => session.Map()).ToList());
     }
diff --git a/Shuttle.Access/Shuttle.Access.csproj b/Shuttle.Access/Shuttle.Access.csproj
@@ -30,7 +30,7 @@
 
   <PropertyGroup>
     <Description>An abstraction for simple identity and access control.</Description>
-    <Version>9.0.6</Version>
+    <Version>9.0.7</Version>
     <Authors>Eben Roux</Authors>
     <Company>Shuttle</Company>
     <Copyright>Copyright (c) 2025, Eben Roux</Copyright>

Original file line number	Diff line number	Diff line change
`@@ -95,68 +95,68 @@ public async Task<IEnumerable<Guid>> TenantIdsAsync(Query.Identity.Specification`
`95`	`95`	`});`
`96`	`96`	`}`
`97`	`97`
`98`		`- private IQueryable<Models.Identity> GetQueryable(Query.Identity.Specification identitySpecification)`
	`98`	`+ private IQueryable<Models.Identity> GetQueryable(Query.Identity.Specification specification)`
`99`	`99`	`{`
`100`	`100`	`var queryable = _accessDbContext.Identities`
`101`	`101`	`.AsNoTracking();`
`102`	`102`
`103`		`- queryable = identitySpecification.ShouldIncludeTenants`
	`103`	`+ queryable = specification.ShouldIncludeTenants`
`104`	`104`	`? queryable.Include(item => item.IdentityTenants).ThenInclude(item => item.Tenant)`
`105`	`105`	`: queryable;`
`106`	`106`
`107`		`- queryable = identitySpecification is { ShouldIncludeRoles: true, ShouldIncludePermissions: false }`
`108`		`- ? queryable.Include(item => item.IdentityRoles)`
	`107`	`+ queryable = specification is { ShouldIncludeRoles: true, ShouldIncludePermissions: false }`
	`108`	`+ ? queryable.Include(item => item.IdentityRoles.Where(role => role.TenantId == specification.TenantId))`
`109`	`109`	`.ThenInclude(item => item.Role)`
`110`	`110`	`.ThenInclude(item => item.Tenant)`
`111`	`111`	`: queryable;`
`112`	`112`
`113`		`- queryable = identitySpecification.ShouldIncludePermissions`
	`113`	`+ queryable = specification.ShouldIncludePermissions`
`114`	`114`	`? queryable.Include(item => item.IdentityRoles).ThenInclude(item => item.Role).ThenInclude(item => item.RolePermissions).ThenInclude(item => item.Permission)`
`115`	`115`	`: queryable;`
`116`	`116`
`117`		`- if (!string.IsNullOrEmpty(identitySpecification.NameMatch))`
	`117`	`+ if (!string.IsNullOrEmpty(specification.NameMatch))`
`118`	`118`	`{`
`119`		`- queryable = queryable.Where(e => e.Name.Contains(identitySpecification.NameMatch) \|\| e.Description.Contains(identitySpecification.NameMatch));`
	`119`	`+ queryable = queryable.Where(e => e.Name.Contains(specification.NameMatch) \|\| e.Description.Contains(specification.NameMatch));`
`120`	`120`	`}`
`121`	`121`
`122`		`- if (!string.IsNullOrEmpty(identitySpecification.Name))`
	`122`	`+ if (!string.IsNullOrEmpty(specification.Name))`
`123`	`123`	`{`
`124`		`- queryable = queryable.Where(e => e.Name == identitySpecification.Name \|\| e.Description == identitySpecification.Name);`
	`124`	`+ queryable = queryable.Where(e => e.Name == specification.Name \|\| e.Description == specification.Name);`
`125`	`125`	`}`
`126`	`126`
`127`		`- if (identitySpecification.TenantId != null)`
	`127`	`+ if (specification.TenantId != null)`
`128`	`128`	`{`
`129`		`- queryable = queryable.Where(e => e.IdentityTenants.Any(it => it.TenantId == identitySpecification.TenantId));`
	`129`	`+ queryable = queryable.Where(e => e.IdentityTenants.Any(it => it.TenantId == specification.TenantId));`
`130`	`130`	`}`
`131`	`131`
`132`		`- if (!string.IsNullOrEmpty(identitySpecification.RoleName))`
	`132`	`+ if (!string.IsNullOrEmpty(specification.RoleName))`
`133`	`133`	`{`
`134`		`- queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.Role.Name == identitySpecification.RoleName));`
	`134`	`+ queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.Role.Name == specification.RoleName));`
`135`	`135`	`}`
`136`	`136`
`137`		`- if (identitySpecification.RoleId != null)`
	`137`	`+ if (specification.RoleId != null)`
`138`	`138`	`{`
`139`		`- queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.RoleId == identitySpecification.RoleId));`
	`139`	`+ queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.RoleId == specification.RoleId));`
`140`	`140`	`}`
`141`	`141`
`142`		`- if (identitySpecification.PermissionId != null)`
	`142`	`+ if (specification.PermissionId != null)`
`143`	`143`	`{`
`144`		`- queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.Role.RolePermissions.Any(rp => rp.PermissionId == identitySpecification.PermissionId)));`
	`144`	`+ queryable = queryable.Where(e => e.IdentityRoles.Any(ir => ir.Role.RolePermissions.Any(rp => rp.PermissionId == specification.PermissionId)));`
`145`	`145`	`}`
`146`	`146`
`147`		`- if (identitySpecification.HasIds)`
	`147`	`+ if (specification.HasIds)`
`148`	`148`	`{`
`149`		`- queryable = queryable.Where(e => identitySpecification.Ids.Contains(e.Id));`
	`149`	`+ queryable = queryable.Where(e => specification.Ids.Contains(e.Id));`
`150`	`150`	`}`
`151`	`151`
`152`		`- if (identitySpecification.HasExcludedIds)`
	`152`	`+ if (specification.HasExcludedIds)`
`153`	`153`	`{`
`154`		`- queryable = queryable.Where(e => !identitySpecification.ExcludedIds.Contains(e.Id));`
	`154`	`+ queryable = queryable.Where(e => !specification.ExcludedIds.Contains(e.Id));`
`155`	`155`	`}`
`156`	`156`
`157`		`- if (identitySpecification.MaximumRows > 0)`
	`157`	`+ if (specification.MaximumRows > 0)`
`158`	`158`	`{`
`159`		`- queryable = queryable.Take(identitySpecification.MaximumRows);`
	`159`	`+ queryable = queryable.Take(specification.MaximumRows);`
`160`	`160`	`}`
`161`	`161`
`162`	`162`	`return queryable.AsSplitQuery();`
Original file line number	Diff line number	Diff line change
`@@ -149,6 +149,11 @@ public async Task SaveAsync(Session session, CancellationToken cancellationToken`
`149`	`149`	`queryable = queryable.Where(e => e.SessionPermissions.Any(p => specification.Permissions.Contains(p.Permission.Name)));`
`150`	`150`	`}`
`151`	`151`
	`152`	`+ if (specification.TenantId.HasValue)`
	`153`	`+ {`
	`154`	`+ queryable = queryable.Where(e => e.TenantId == specification.TenantId);`
	`155`	`+ }`
	`156`	`+`
`152`	`157`	`return queryable;`
`153`	`158`	`}`
`154`	`159`	`}`
Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,8 @@ public class Role`
`4`	`4`	`{`
`5`	`5`	`public Guid Id { get; set; }`
`6`	`6`	`public string Name { get; set; } = string.Empty;`
	`7`	`+ public Guid TenantId { get; set; }`
	`8`	`+ public string TenantName { get; set; } = string.Empty;`
`7`	`9`	`public List<Permission> Permissions { get; set; } = [];`
`8`	`10`	`public List<Identity> Identities { get; set; } = [];`
`9`	`11`