Add tenant-scope enforcement and tests to the analytics summary service in services/analytics/service.ts

[Baskarayelu]

📋 Description

The analytics service in src/services/analytics/service.ts (AnalyticsService.getSummary, refreshConcurrently, computeStaleness) serves aggregate metrics consumed by src/routes/analytics.ts. Aggregates must be computed within a single tenant's data; any path that omits the tenant filter risks cross-tenant data exposure.

This issue makes tenantId a required, validated input to getSummary and adds tests proving aggregates never include another tenant's rows — using the mandatory tenant context from src/middleware/tenantContext.ts.

Why this matters: an analytics aggregate that silently spans tenants is a serious data-isolation bug. Making tenant scope mandatory and tested closes the gap at the service boundary.

🎯 Requirements & Context

Functional requirements

• Require a validated tenantId argument on getSummary (no implicit/default tenant fallback).
• Ensure every underlying query filters by tenant_id.
• Reject a missing/empty tenant with a typed error rather than computing a global aggregate.
• Add tests with two seeded tenants asserting each summary reflects only its own data.
• Assert computeStaleness and the cached path also respect tenant scoping (no cross-tenant cache key collisions).

Context & constraints

• Align with the project's mandatory tenant-context conventions in src/middleware/tenantContext.ts and src/utils/tenantContext.ts.
• Do not change the metric definitions themselves; only their scoping.

🛠️ Suggested Execution

1. Fork & branch

git checkout -b security/analytics-tenant-scope

2. Implement changes

• Thread tenantId through getSummary and queries; namespace cache keys by tenant.
• Add TSDoc on the tenant-scoping contract.
• Extend src/services/analytics/service.test.ts with two-tenant isolation cases.

3. Test & commit

npm run test -- analytics
npm run lint
npm run build

• Edge cases: missing tenant, tenant with no data, identical metrics across tenants, cache key collision attempt.

Example commit message

security(analytics): require validated tenant scope on getSummary

Mandates tenantId, filters all queries, and namespaces cache keys per tenant
in services/analytics/service.ts.

✅ Acceptance Criteria & Guidelines

Requirement	Target
Mandatory validated tenant scope + cache namespacing	Required
Two-tenant isolation tests	Required
Coverage of analytics service	≥ 95%
npm run lint + npm run build clean	Required
Timeframe	96 hours from assignment

💬 Community & Support

Questions and design discussion — join the GrantFox contributor community on Discord: https://discord.gg/nmnPBkBge

Please comment on this issue to ask to be assigned before you start. 🚀

[Chigybillionz]

@Chigybillionz has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi, I’ve reviewed this issue and I’m confident I can fix it. I’d like to take it on.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Chigybillionz to this issue.

[Michealshodipo56]

@Michealshodipo56 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this kindly assign me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Michealshodipo56 to this issue.

[drips-wave]

Congratulations, @Michealshodipo56! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @Michealshodipo56: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊