From 21498a0d8a94a071fa27746700effda87bb874c8 Mon Sep 17 00:00:00 2001 From: dytsou Date: Sun, 28 Jun 2026 02:04:39 +0800 Subject: [PATCH 1/3] fix: update DELETE organization endpoint to use tenant authentication middleware --- cmd/backend/main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/backend/main.go b/cmd/backend/main.go index 37e86c10..d8e0b772 100644 --- a/cmd/backend/main.go +++ b/cmd/backend/main.go @@ -307,7 +307,7 @@ func main() { mux.Handle("GET /api/orgs/{slug}", tenantAuthMiddleware.Append(unitRole.Require(auth.RoleMember, slugResolver)).HandlerFunc(unitHandler.GetOrgByID)) mux.Handle("POST /api/orgs", authMiddleware.Append(globalAdmin).HandlerFunc(unitHandler.CreateOrg)) mux.Handle("PUT /api/orgs/{slug}", tenantAuthMiddleware.Append(unitRole.Require(auth.RoleAdmin, slugResolver)).HandlerFunc(unitHandler.UpdateOrg)) - mux.Handle("DELETE /api/orgs/{slug}", authMiddleware.Append(globalAdmin).HandlerFunc(unitHandler.DeleteOrg)) + mux.Handle("DELETE /api/orgs/{slug}", tenantAuthMiddleware.Append(globalAdmin).HandlerFunc(unitHandler.DeleteOrg)) // Organization Relations // ---------------------- From dfe12cbf50f29ce0dc1e636486b2ed99e19a9ce9 Mon Sep 17 00:00:00 2001 From: dytsou Date: Sun, 28 Jun 2026 02:10:42 +0800 Subject: [PATCH 2/3] fix: handle non-existent organization slug in tenant middleware --- internal/tenant/middleware.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/internal/tenant/middleware.go b/internal/tenant/middleware.go index 3fef7066..9d606e25 100644 --- a/internal/tenant/middleware.go +++ b/internal/tenant/middleware.go @@ -54,12 +54,16 @@ func (m *Middleware) Middleware(next http.HandlerFunc) http.HandlerFunc { return } - _, orgID, err := m.reader.GetSlugStatus(traceCtx, slug) + exists, orgID, err := m.reader.GetSlugStatus(traceCtx, slug) if err != nil { span.RecordError(err) problem.New().WriteError(traceCtx, w, err, logger) return } + if !exists { + problem.New().WriteError(traceCtx, w, internal.ErrOrgSlugNotFound, logger) + return + } tenant, err := m.reader.Get(traceCtx, orgID) if err != nil { From 7b30cf0a01aa724291498e31609b26406a47f4ff Mon Sep 17 00:00:00 2001 From: dytsou Date: Sun, 28 Jun 2026 02:32:54 +0800 Subject: [PATCH 3/3] fix: update tenant middleware to utilize problem writer for error handling --- cmd/backend/main.go | 2 +- internal/tenant/middleware.go | 31 ++++++++++++++++--------------- 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/cmd/backend/main.go b/cmd/backend/main.go index d8e0b772..ecc09acc 100644 --- a/cmd/backend/main.go +++ b/cmd/backend/main.go @@ -215,7 +215,7 @@ func main() { traceMiddleware := trace.NewMiddleware(logger, cfg.Debug) corsMiddleware := cors.NewMiddleware(logger, cfg.AllowOrigins) jwtMiddleware := jwt.NewMiddleware(logger, validator, problemWriter, jwtService) - tenantMiddleware := tenant.NewMiddleware(logger, dbPool, tenantService) + tenantMiddleware := tenant.NewMiddleware(logger, dbPool, problemWriter, tenantService) formMiddleware := form.NewMiddleware(logger, formService, problemWriter) // Basic Middleware (Tracing and Recovery) diff --git a/internal/tenant/middleware.go b/internal/tenant/middleware.go index 9d606e25..0524ac6f 100644 --- a/internal/tenant/middleware.go +++ b/internal/tenant/middleware.go @@ -20,24 +20,25 @@ type reader interface { } type Middleware struct { - tracer trace.Tracer - logger *zap.Logger - masterDBPool *pgxpool.Pool - - reader reader + tracer trace.Tracer + logger *zap.Logger + masterDBPool *pgxpool.Pool + problemWriter *problem.HttpWriter + reader reader } func NewMiddleware( logger *zap.Logger, masterDBPool *pgxpool.Pool, - + problemWriter *problem.HttpWriter, reader reader, ) *Middleware { return &Middleware{ - tracer: otel.Tracer("tenant/middleware"), - logger: logger, - reader: reader, - masterDBPool: masterDBPool, + tracer: otel.Tracer("tenant/middleware"), + logger: logger, + reader: reader, + masterDBPool: masterDBPool, + problemWriter: problemWriter, } } @@ -50,25 +51,25 @@ func (m *Middleware) Middleware(next http.HandlerFunc) http.HandlerFunc { slug := r.PathValue("slug") if slug == "" { logger.Error("User slug is empty", zap.String("path", r.URL.Path)) - problem.New().WriteError(traceCtx, w, handlerutil.ErrInternalServer, logger) + m.problemWriter.WriteError(traceCtx, w, handlerutil.ErrInternalServer, logger) return } exists, orgID, err := m.reader.GetSlugStatus(traceCtx, slug) if err != nil { span.RecordError(err) - problem.New().WriteError(traceCtx, w, err, logger) + m.problemWriter.WriteError(traceCtx, w, err, logger) return } if !exists { - problem.New().WriteError(traceCtx, w, internal.ErrOrgSlugNotFound, logger) + m.problemWriter.WriteError(traceCtx, w, internal.ErrOrgSlugNotFound, logger) return } tenant, err := m.reader.Get(traceCtx, orgID) if err != nil { span.RecordError(err) - problem.New().WriteError(traceCtx, w, err, logger) + m.problemWriter.WriteError(traceCtx, w, err, logger) return } @@ -77,7 +78,7 @@ func (m *Middleware) Middleware(next http.HandlerFunc) http.HandlerFunc { conn = m.masterDBPool } else { logger.Error("unsupported tenant database strategy", zap.String("strategy", string(tenant.DbStrategy))) - problem.New().WriteError(traceCtx, w, handlerutil.ErrInternalServer, logger) + m.problemWriter.WriteError(traceCtx, w, handlerutil.ErrInternalServer, logger) return }