From 17ebc203ff420aff0a36fab307f47dc0f228458e Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Wed, 4 Feb 2026 13:35:57 +0000
Subject: [PATCH] Test multi-tenant persistence guardrails

---
 internal/config/multi_tenant_test.go | 52 ++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 internal/config/multi_tenant_test.go

diff --git a/internal/config/multi_tenant_test.go b/internal/config/multi_tenant_test.go
new file mode 100644
index 000000000..d6d8cecfb
--- /dev/null
+++ b/internal/config/multi_tenant_test.go
@@ -0,0 +1,52 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestMultiTenantPersistence_InvalidOrgIDsRejected(t *testing.T) {
+	baseDir := t.TempDir()
+	mtp := NewMultiTenantPersistence(baseDir)
+
+	invalidIDs := []string{
+		"",
+		".",
+		"..",
+		"../bad",
+		"bad/..",
+		"bad/../evil",
+	}
+
+	for _, orgID := range invalidIDs {
+		if _, err := mtp.GetPersistence(orgID); err == nil {
+			t.Fatalf("expected error for orgID %q", orgID)
+		}
+		if mtp.OrgExists(orgID) {
+			t.Fatalf("OrgExists should be false for orgID %q", orgID)
+		}
+	}
+
+	if _, err := os.Stat(filepath.Join(baseDir, "orgs")); err == nil {
+		t.Fatalf("unexpected orgs directory created for invalid org IDs")
+	}
+}
+
+func TestMultiTenantPersistence_GetPersistence_CreatesOrgDir(t *testing.T) {
+	baseDir := t.TempDir()
+	mtp := NewMultiTenantPersistence(baseDir)
+
+	if _, err := mtp.GetPersistence("acme"); err != nil {
+		t.Fatalf("GetPersistence(acme) failed: %v", err)
+	}
+
+	orgDir := filepath.Join(baseDir, "orgs", "acme")
+	info, err := os.Stat(orgDir)
+	if err != nil {
+		t.Fatalf("expected org dir to exist: %v", err)
+	}
+	if !info.IsDir() {
+		t.Fatalf("expected org dir to be a directory")
+	}
+}