Oliver Kieselbach 80d0b30cba fix(backend): activation-gate review findings - OnboardedBy immutable via PUT, suspension gate reads fresh ...

Two findings from the re-run public-availability review:

- UpdateTenantConfigurationFunction preserved HomedAppClientId, LastAuth*
  and plan fields against round-trip clobber but not OnboardedBy, despite
  AuthFunction documenting it as write-once: any own-tenant admin PUT could
  overwrite or null it, corrupting audit provenance and letting a
  revoke -> re-approve cycle auto-promote an attacker-chosen UPN. Now
  preserved like the other system-owned fields.

- TenantAutoApproveHandler checked the suspension gate through the cached
  TryGetConfigurationAsync (5-min per-instance TTL): a tenant suspended
  right after signup could still be auto-approved from a stale view. Now
  reads via GetConfigurationFreshAsync; a storage error propagates so the
  message retries (flag re-checked per attempt) instead of silently
  downgrading the tenant to manual approval.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-02 16:13:31 +02:00

..

AutopilotMonitor.Functions

fix(backend): activation-gate review findings - OnboardedBy immutable via PUT, suspension gate reads fresh

2026-08-02 16:13:31 +02:00

AutopilotMonitor.Functions.Tests

fix(backend): activation-gate review findings - OnboardedBy immutable via PUT, suspension gate reads fresh

2026-08-02 16:13:31 +02:00

LICENSE

update license

2026-03-26 07:02:33 +01:00