Rollout IDOR protection to 31 tenant-aware controllers

src/AccountsPOC.Application/obj/Debug/net10.0/AccountsPOC.Application.AssemblyInfo.cs

@@ -13,7 +13,7 @@
 [assembly: System.Reflection.AssemblyCompanyAttribute("AccountsPOC.Application")]
 [assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")]
 [assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.0.0")]
-[assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.0+e7beb0051b6f03a612f4c6ef64a0b8604c8c7e4d")]
+[assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.0+d10972da693e5836e7d52e998f817e141c822cde")]
 [assembly: System.Reflection.AssemblyProductAttribute("AccountsPOC.Application")]
 [assembly: System.Reflection.AssemblyTitleAttribute("AccountsPOC.Application")]
 [assembly: System.Reflection.AssemblyVersionAttribute("1.0.0.0")]

src/AccountsPOC.Application/obj/Debug/net10.0/AccountsPOC.Application.AssemblyInfoInputs.cache

@@ -1 +1 @@
-1a61484957cc0120b42fdf7eae608344051881f43e862b495ce58466408dafe0
+bec299c3233f5c5262462e8a6404a55a2f0726142deff45074cdf6038a1bd301

src/AccountsPOC.Application/obj/Debug/net10.0/AccountsPOC.Application.sourcelink.json

@@ -1 +1 @@
-{"documents":{"/home/runner/work/accountspoc/accountspoc/*":"https://raw.githubusercontent.com/dotnetappdev/accountspoc/e7beb0051b6f03a612f4c6ef64a0b8604c8c7e4d/*"}}
+{"documents":{"/home/runner/work/accountspoc/accountspoc/*":"https://raw.githubusercontent.com/dotnetappdev/accountspoc/d10972da693e5836e7d52e998f817e141c822cde/*"}}

src/AccountsPOC.Domain/obj/Debug/net10.0/AccountsPOC.Domain.AssemblyInfo.cs

@@ -13,7 +13,7 @@
 [assembly: System.Reflection.AssemblyCompanyAttribute("AccountsPOC.Domain")]
 [assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")]
 [assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.0.0")]
-[assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.0+e7beb0051b6f03a612f4c6ef64a0b8604c8c7e4d")]
+[assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.0+d10972da693e5836e7d52e998f817e141c822cde")]
 [assembly: System.Reflection.AssemblyProductAttribute("AccountsPOC.Domain")]
 [assembly: System.Reflection.AssemblyTitleAttribute("AccountsPOC.Domain")]
 [assembly: System.Reflection.AssemblyVersionAttribute("1.0.0.0")]

src/AccountsPOC.Domain/obj/Debug/net10.0/AccountsPOC.Domain.AssemblyInfoInputs.cache

@@ -1 +1 @@
-21a0d98fc6746ce50a3f1a7e04d635ed5823613cfd083668ad84ae7dfe3f4e83
+58cb4ff381a91ad2c101cead004415c5048c8e26be4d5d4d8ccb1f38225a0668

src/AccountsPOC.Domain/obj/Debug/net10.0/AccountsPOC.Domain.sourcelink.json

@@ -1 +1 @@
-{"documents":{"/home/runner/work/accountspoc/accountspoc/*":"https://raw.githubusercontent.com/dotnetappdev/accountspoc/e7beb0051b6f03a612f4c6ef64a0b8604c8c7e4d/*"}}
+{"documents":{"/home/runner/work/accountspoc/accountspoc/*":"https://raw.githubusercontent.com/dotnetappdev/accountspoc/d10972da693e5836e7d52e998f817e141c822cde/*"}}

src/AccountsPOC.Infrastructure/obj/Debug/net10.0/AccountsPOC.Infrastructure.AssemblyInfo.cs

@@ -13,7 +13,7 @@
 [assembly: System.Reflection.AssemblyCompanyAttribute("AccountsPOC.Infrastructure")]
 [assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")]
 [assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.0.0")]
-[assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.0+e7beb0051b6f03a612f4c6ef64a0b8604c8c7e4d")]
+[assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.0+d10972da693e5836e7d52e998f817e141c822cde")]
 [assembly: System.Reflection.AssemblyProductAttribute("AccountsPOC.Infrastructure")]
 [assembly: System.Reflection.AssemblyTitleAttribute("AccountsPOC.Infrastructure")]
 [assembly: System.Reflection.AssemblyVersionAttribute("1.0.0.0")]

src/AccountsPOC.Infrastructure/obj/Debug/net10.0/AccountsPOC.Infrastructure.AssemblyInfoInputs.cache

@@ -1 +1 @@
-5213d3995ab3c7d9c196d91b336a905a019ca612ae56b3d39f4dda6c677bddb5
+9c5680eaafa8c56df3d9b2ac004298324416bdc5e07d5a41d626d39c3213b3e3

src/AccountsPOC.Infrastructure/obj/Debug/net10.0/AccountsPOC.Infrastructure.sourcelink.json

@@ -1 +1 @@
-{"documents":{"/home/runner/work/accountspoc/accountspoc/*":"https://raw.githubusercontent.com/dotnetappdev/accountspoc/e7beb0051b6f03a612f4c6ef64a0b8604c8c7e4d/*"}}
+{"documents":{"/home/runner/work/accountspoc/accountspoc/*":"https://raw.githubusercontent.com/dotnetappdev/accountspoc/d10972da693e5836e7d52e998f817e141c822cde/*"}}

src/AccountsPOC.WebAPI/Controllers/ApiKeyConfigController.cs

@@ -7,10 +7,9 @@ namespace AccountsPOC.WebAPI.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
-public class ApiKeyConfigController : ControllerBase
+public class ApiKeyConfigController : TenantAwareControllerBase
 {
     private readonly ApplicationDbContext _context;
-    private const int DefaultTenantId = 1;
 
     public ApiKeyConfigController(ApplicationDbContext context)
     {
@@ -20,9 +19,10 @@ public ApiKeyConfigController(ApplicationDbContext context)
     [HttpGet]
     public async Task<ActionResult<IEnumerable<object>>> GetAll()
     {
+        var tenantId = GetRequiredTenantId();
         // Return masked keys for security
         var configs = await _context.ApiKeyConfigs
-            .Where(c => c.TenantId == DefaultTenantId)
+            .Where(c => c.TenantId == tenantId)
             .OrderBy(c => c.ServiceName)
             .ThenBy(c => c.KeyName)
             .Select(c => new
@@ -48,8 +48,9 @@ public async Task<ActionResult<IEnumerable<object>>> GetAll()
     [HttpGet("{id}")]
     public async Task<ActionResult<object>> GetById(int id)
     {
+        var tenantId = GetRequiredTenantId();
         var config = await _context.ApiKeyConfigs
-            .Where(c => c.Id == id && c.TenantId == DefaultTenantId)
+            .Where(c => c.Id == id && c.TenantId == tenantId)
             .Select(c => new
             {
                 c.Id,
@@ -76,8 +77,9 @@ public async Task<ActionResult<object>> GetById(int id)
     [HttpGet("by-service/{serviceName}")]
     public async Task<ActionResult<IEnumerable<object>>> GetByService(string serviceName)
     {
+        var tenantId = GetRequiredTenantId();
         var configs = await _context.ApiKeyConfigs
-            .Where(c => c.ServiceName == serviceName && c.TenantId == DefaultTenantId)
+            .Where(c => c.ServiceName == serviceName && c.TenantId == tenantId)
             .Select(c => new
             {
                 c.Id,
@@ -101,9 +103,10 @@ public async Task<ActionResult<IEnumerable<object>>> GetByService(string service
     [HttpGet("{id}/reveal")]
     public async Task<ActionResult<string>> RevealKey(int id)
     {
+        var tenantId = GetRequiredTenantId();
         // In production, this should require additional authentication/authorization
         var config = await _context.ApiKeyConfigs
-            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == DefaultTenantId);
+            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == tenantId);
 
         if (config == null)
             return NotFound();
@@ -114,7 +117,8 @@ public async Task<ActionResult<string>> RevealKey(int id)
     [HttpPost]
     public async Task<ActionResult<ApiKeyConfig>> Create(ApiKeyConfig config)
     {
-        config.TenantId = DefaultTenantId;
+        var tenantId = GetRequiredTenantId();
+        config.TenantId = tenantId;
         config.CreatedDate = DateTime.UtcNow;
 
         _context.ApiKeyConfigs.Add(config);
@@ -141,8 +145,9 @@ public async Task<IActionResult> Update(int id, ApiKeyConfig config)
         if (id != config.Id)
             return BadRequest();
 
+        var tenantId = GetRequiredTenantId();
         var existing = await _context.ApiKeyConfigs
-            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == DefaultTenantId);
+            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == tenantId);
 
         if (existing == null)
             return NotFound();
@@ -165,8 +170,9 @@ public async Task<IActionResult> Update(int id, ApiKeyConfig config)
     [HttpDelete("{id}")]
     public async Task<IActionResult> Delete(int id)
     {
+        var tenantId = GetRequiredTenantId();
         var config = await _context.ApiKeyConfigs
-            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == DefaultTenantId);
+            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == tenantId);
 
         if (config == null)
             return NotFound();
@@ -180,8 +186,9 @@ public async Task<IActionResult> Delete(int id)
     [HttpPost("{id}/rotate")]
     public async Task<ActionResult<object>> RotateKey(int id, [FromBody] string newKeyValue)
     {
+        var tenantId = GetRequiredTenantId();
         var config = await _context.ApiKeyConfigs
-            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == DefaultTenantId);
+            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == tenantId);
 
         if (config == null)
             return NotFound();
@@ -202,8 +209,9 @@ public async Task<ActionResult<object>> RotateKey(int id, [FromBody] string newK
     [HttpPost("{id}/mark-used")]
     public async Task<IActionResult> MarkAsUsed(int id)
     {
+        var tenantId = GetRequiredTenantId();
         var config = await _context.ApiKeyConfigs
-            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == DefaultTenantId);
+            .FirstOrDefaultAsync(c => c.Id == id && c.TenantId == tenantId);
 
         if (config == null)
             return NotFound();

src/AccountsPOC.WebAPI/Controllers/BillOfMaterialsController.cs

@@ -7,7 +7,7 @@ namespace AccountsPOC.WebAPI.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
-public class BillOfMaterialsController : ControllerBase
+public class BillOfMaterialsController : TenantAwareControllerBase
 {
     private readonly ApplicationDbContext _context;
 
@@ -19,7 +19,9 @@ public BillOfMaterialsController(ApplicationDbContext context)
     [HttpGet]
     public async Task<ActionResult<IEnumerable<BillOfMaterial>>> GetBillOfMaterials()
     {
+        var tenantId = GetRequiredTenantId();
         return await _context.BillOfMaterials
+            .Where(b => b.TenantId == tenantId)
             .Include(b => b.Product)
             .Include(b => b.Components)
             .ThenInclude(c => c.Product)
@@ -30,12 +32,14 @@ public async Task<ActionResult<IEnumerable<BillOfMaterial>>> GetBillOfMaterials(
     [HttpGet("{id}")]
     public async Task<ActionResult<BillOfMaterial>> GetBillOfMaterial(int id)
     {
+        var tenantId = GetRequiredTenantId();
         var billOfMaterial = await _context.BillOfMaterials
+            .Where(b => b.Id == id && b.TenantId == tenantId)
             .Include(b => b.Product)
             .Include(b => b.Components)
             .ThenInclude(c => c.Product)
             .Include(b => b.Images)
-            .FirstOrDefaultAsync(b => b.Id == id);
+            .FirstOrDefaultAsync();
 
         if (billOfMaterial == null)
         {
@@ -48,6 +52,8 @@ public async Task<ActionResult<BillOfMaterial>> GetBillOfMaterial(int id)
     [HttpPost]
     public async Task<ActionResult<BillOfMaterial>> PostBillOfMaterial(BillOfMaterial billOfMaterial)
     {
+        var tenantId = GetRequiredTenantId();
+        billOfMaterial.TenantId = tenantId;
         billOfMaterial.CreatedDate = DateTime.UtcNow;
 
         int lineNumber = 1;
@@ -77,18 +83,22 @@ public async Task<IActionResult> PutBillOfMaterial(int id, BillOfMaterial billOf
             return BadRequest();
         }
 
-        billOfMaterial.LastModifiedDate = DateTime.UtcNow;
+        var tenantId = GetRequiredTenantId();
 
         var existingBOM = await _context.BillOfMaterials
+            .Where(b => b.Id == id && b.TenantId == tenantId)
             .Include(b => b.Components)
             .Include(b => b.Images)
-            .FirstOrDefaultAsync(b => b.Id == id);
+            .FirstOrDefaultAsync();
 
         if (existingBOM == null)
         {
             return NotFound();
         }
 
+        billOfMaterial.TenantId = tenantId;
+        billOfMaterial.LastModifiedDate = DateTime.UtcNow;
+
         _context.Entry(existingBOM).CurrentValues.SetValues(billOfMaterial);
 
         var existingComponents = existingBOM.Components.ToList();
@@ -154,7 +164,7 @@ public async Task<IActionResult> PutBillOfMaterial(int id, BillOfMaterial billOf
         }
         catch (DbUpdateConcurrencyException)
         {
-            if (!BillOfMaterialExists(id))
+            if (!await BillOfMaterialExistsForTenantAsync(id, tenantId))
             {
                 return NotFound();
             }
@@ -167,7 +177,10 @@ public async Task<IActionResult> PutBillOfMaterial(int id, BillOfMaterial billOf
     [HttpDelete("{id}")]
     public async Task<IActionResult> DeleteBillOfMaterial(int id)
     {
-        var billOfMaterial = await _context.BillOfMaterials.FindAsync(id);
+        var tenantId = GetRequiredTenantId();
+        var billOfMaterial = await _context.BillOfMaterials
+            .FirstOrDefaultAsync(b => b.Id == id && b.TenantId == tenantId);
+
         if (billOfMaterial == null)
         {
             return NotFound();
@@ -179,8 +192,8 @@ public async Task<IActionResult> DeleteBillOfMaterial(int id)
         return NoContent();
     }
 
-    private bool BillOfMaterialExists(int id)
+    private async Task<bool> BillOfMaterialExistsForTenantAsync(int id, int tenantId)
     {
-        return _context.BillOfMaterials.Any(e => e.Id == id);
+        return await _context.BillOfMaterials.AnyAsync(e => e.Id == id && e.TenantId == tenantId);
     }
 }