Tenant Isolation Report

Scope

This report summarizes committed Tenant Isolation tenant-isolation tests and S04 evidence using categorical labels only. Fixture identifiers, credentials, row IDs, relationship IDs, tenant IDs, emails, tokens, and source snippets are intentionally redacted from this document.

Source Evidence

apps/api/src/isolation/api-key-entity-rows.test.ts
apps/api/src/isolation/api-key-fixtures.test.ts
apps/api/src/isolation/api-key-relationships.test.ts
apps/api/src/isolation/api-key-service-boundaries.test.ts
apps/web/app/test/isolation/admin-routes.test.ts
apps/web/app/test/isolation/fixtures/user-session-isolation.test.ts
docs/security/tenant-isolation-s04-summary.md

Boundary Matrix

Source	Test count	Checked access boundaries	Deny-path evidence
apps/api/src/isolation/api-key-entity-rows.test.ts	15	tenant and user scoped resolver	403 response for unauthorized tenant access; denied path skips data mutation or lookup
apps/api/src/isolation/api-key-fixtures.test.ts	4	tenant and user scoped resolver	none observed
apps/api/src/isolation/api-key-relationships.test.ts	12	relationship parent/child authorization; tenant and user scoped resolver	403 response for unauthorized tenant access; denied credentials stop downstream access; denied path skips data mutation or lookup
apps/api/src/isolation/api-key-service-boundaries.test.ts	10	tenant and user scoped resolver	403 response for unauthorized tenant access; denied path skips data mutation or lookup
apps/web/app/test/isolation/admin-routes.test.ts	4	admin permission gate; tenant and user scoped resolver	403 response for unauthorized tenant access; denied credentials stop downstream access; denied path skips data mutation or lookup; foreign tenant resource denied; skips cross-tenant API-key access when admin permission is denied; skips cross-tenant API-log access when admin auth is denied
apps/web/app/test/isolation/fixtures/user-session-isolation.test.ts	6	API-key status logging boundary; tenant and user scoped resolver; tenant-scoped usage reporting	403 response for unauthorized tenant access; denied credentials stop downstream access; foreign tenant resource denied; resets shared mocks and supports denied access status assertions

Prior Slice Evidence

Source: docs/security/tenant-isolation-s04-summary.md
Verification status: passed
Summary: Slice S04 complete. Admin-uebergreifende API-Flaechen und gesperrte Zugangsdaten sind durch fokussierte Isolationstests abgesichert.
Established patterns:
- Abweisungspruefungen kontrollieren Status, Fehlermeldung und ausbleibende nachgelagerte Datenzugriffe.
- Gemeinsame Isolationstestdaten fuer Admin-, Mandanten- und gesperrte Zugangsszenarien.
- Negativtests pruefen, dass nach fehlender Berechtigung keine [redacted token] Datenquellen aufgerufen werden.

Deny-Path Coverage

The boundary matrix records denial outcomes for unauthorized credentials, foreign tenant resources, skipped downstream mutations/lookups, and 403 responses. These entries are derived from test names and assertion patterns rather than concrete fixture values.

Redaction Rules

The renderer reports tenant A, tenant B, admin, user session, API credential, row record, and relationship record categories instead of concrete fixture values.

Verification Commands

pnpm exec eslint scripts/tenant-isolation-report.ts scripts/tenant-isolation-report.test.ts --max-warnings=0
pnpm exec vitest run scripts/tenant-isolation-report.test.ts
pnpm exec tsx scripts/tenant-isolation-report.ts --check
pnpm exec tsx scripts/docs-link-check.ts

Redaction Contract