From 7dd9cd2f7279dee15a1450f3f6ba6a838b3ba2eb Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Wed, 1 Apr 2026 03:05:20 +0200
Subject: [PATCH] Fix cross-tenant vulnerability in test-notification endpoint

---
 .../AutopilotMonitor.Agent/buildcounter.txt     |  2 +-
 .../Config/TestWebhookNotificationFunction.cs   | 17 ++++++++++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
index 895152c2..cec64570 100644
--- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
@@ -1 +1 @@
-748
+749
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Config/TestWebhookNotificationFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Config/TestWebhookNotificationFunction.cs
index ceb9c590..097c4f79 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Config/TestWebhookNotificationFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Config/TestWebhookNotificationFunction.cs
@@ -36,7 +36,22 @@ namespace AutopilotMonitor.Functions.Functions.Config
             try
             {
                 // Authentication + TenantAdminOrGA authorization enforced by PolicyEnforcementMiddleware
-                string userIdentifier = TenantHelper.GetUserIdentifier(req);
+                var requestCtx = req.GetRequestContext();
+                string userIdentifier = requestCtx.UserPrincipalName;
+
+                // Validate tenant access: cross-tenant only for Global Admins
+                if (!requestCtx.IsGlobalAdmin && !string.Equals(requestCtx.TenantId, tenantId, StringComparison.OrdinalIgnoreCase))
+                {
+                    _logger.LogWarning("User {User} from tenant {AuthTenant} attempted to test notification for tenant {TargetTenant}",
+                        userIdentifier, requestCtx.TenantId, tenantId);
+                    var forbiddenResponse = req.CreateResponse(HttpStatusCode.Forbidden);
+                    await forbiddenResponse.WriteAsJsonAsync(new
+                    {
+                        success = false,
+                        message = "Access denied. You can only test notifications for your own tenant."
+                    });
+                    return forbiddenResponse;
+                }
 
                 _logger.LogInformation("Test webhook notification requested by {User} for tenant {TenantId}",
                     userIdentifier, tenantId);