From e9d111dbc658837fef8957677d5583bb072aa3a6 Mon Sep 17 00:00:00 2001 From: Hongming Wang Date: Tue, 21 Apr 2026 07:59:25 -0700 Subject: [PATCH] fix(e2e): send X-Molecule-Org-Id on tenant calls MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TenantGuard middleware on the tenant platform returns 404 (not 403, by design — avoid leaking tenant existence to org scanners) when requests lack X-Molecule-Org-Id matching MOLECULE_ORG_ID. Harness hit this on POST /workspaces (section 5) despite having a valid Authorization bearer. - Capture org_id from admin-create response - Send X-Molecule-Org-Id on every tenant_call Confirmed via manual repro 2026-04-21T14:56Z: curl with Bearer but no org-id header → 404; with both headers → expected route reached. Co-Authored-By: Claude Opus 4.7 (1M context) --- tests/e2e/test_staging_full_saas.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tests/e2e/test_staging_full_saas.sh b/tests/e2e/test_staging_full_saas.sh index 619e9839..8e66f525 100755 --- a/tests/e2e/test_staging_full_saas.sh +++ b/tests/e2e/test_staging_full_saas.sh @@ -131,7 +131,12 @@ log "1/11 Creating org $SLUG via /cp/admin/orgs..." CREATE_RESP=$(admin_call POST /cp/admin/orgs \ -d "{\"slug\":\"$SLUG\",\"name\":\"E2E $SLUG\",\"owner_user_id\":\"e2e-runner:$SLUG\"}") echo "$CREATE_RESP" | python3 -m json.tool >/dev/null || fail "Org create returned non-JSON: $CREATE_RESP" -ok "Org created" +# Capture org_id for tenant-guard header on every subsequent tenant call. +# Without X-Molecule-Org-Id matching MOLECULE_ORG_ID on the tenant, the +# tenant-guard middleware returns 404 to avoid leaking tenant existence. +ORG_ID=$(echo "$CREATE_RESP" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))") +[ -z "$ORG_ID" ] && fail "Org create response missing 'id': $CREATE_RESP" +ok "Org created (id=$ORG_ID)" # ─── 2. Wait for tenant provisioning ──────────────────────────────────── log "2/11 Waiting for tenant provisioning (up to ${PROVISION_TIMEOUT_SECS}s)..." @@ -215,8 +220,11 @@ fi tenant_call() { local method="$1"; shift local path="$1"; shift + # X-Molecule-Org-Id is REQUIRED — tenant guard 404s anything without + # it (it does NOT 403, to hide tenant existence from org scanners). curl "${CURL_COMMON[@]}" -X "$method" "$TENANT_URL$path" \ -H "Authorization: Bearer $EFFECTIVE_TENANT_TOKEN" \ + -H "X-Molecule-Org-Id: $ORG_ID" \ "$@" }