mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-11-10 19:59:20 +00:00
Oliver Kieselbach
ee96ff2d23
A Global Admin can send X-View-As-Tenant (optional X-View-As-Role) to read one tenant's portal exactly as a member of that tenant sees it. The policy middleware admits the headers only for a Global Admin in person (never an MCP call or a foreign client app), refuses every write with ViewAsReadOnly, and decides everything else with the same evaluators over an emulated member, so the emulation cannot drift from the real rules: a parity test compares every read route and tenant role against a real member. - RequestContext.ViewAs: TenantId and TargetTenantId become the viewed tenant and TenantHelper.GetTenantId follows them; identity uses keep the caller's home tenant (IdentityTenantId) - Route catalog: ViewAsAccess, GET reads and everything else writes, with each exception listed in a test - auth/me answers as the emulated member without any sign-in side effect - GET actions stay closed under view-as: re-analyze, re-scan, the consent flow and the homing auto-flip - SignalR binding, presence and the request row stay with the real caller; every telemetry item of such a request carries ViewAsTenantId - Ratchet: functions take the data tenant from the request context, never from the token Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>