enforce unique tenant resolution keys at every write (clean 409)

app/routes/admin.py

@@ -185,12 +185,8 @@ async def get_tenants(db: AsyncSession = Depends(get_session)) -> list[TenantOut
 async def post_tenant(body: TenantIn, db: AsyncSession = Depends(get_session)) -> TenantOut:
     if await get_tenant_by_slug(db, body.slug) is not None:
         raise HTTPException(status_code=409, detail="slug already exists")
-    # A shop maps to exactly one tenant (every channel resolves by it). Refuse to
-    # create a second row for a store another tenant already owns.
-    if body.shopify_shop and (
-        await db.execute(select(Tenant).where(Tenant.shopify_shop == body.shopify_shop))
-    ).scalar_one_or_none() is not None:
-        raise HTTPException(status_code=409, detail="shopify_shop already assigned to another tenant")
+    # Uniqueness of shopify_shop / whatsapp_phone_id is enforced centrally in
+    # create_tenant (clean 409 if another tenant owns the value).
     fields = body.model_dump(
         exclude={"slug", "shopify_client_secret", "whatsapp_token"}, exclude_none=True
     )

app/tenancy.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 from typing import Any
 
+from fastapi import HTTPException
 from sqlalchemy import delete, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -76,6 +77,31 @@ _TENANT_FIELDS = {
 }
 
 
+# A shop / WhatsApp number / Stripe customer maps to EXACTLY ONE tenant. These keys
+# are how inbound requests resolve a client, so a duplicate would mix two accounts.
+_UNIQUE_TENANT_KEYS = ("shopify_shop", "whatsapp_phone_id", "stripe_customer_id")
+
+
+async def _assert_unique_keys(
+    db: AsyncSession, fields: dict[str, Any], *, exclude_id: int | None = None
+) -> None:
+    """Refuse to assign a shop/phone/customer-id another tenant already owns — a
+    clean 409 at write time instead of a later MultipleResultsFound 500 (empty
+    values never collide). The partial-unique DB indexes (migration 0027) are the
+    backstop; this is the friendly, early guard at every create/edit path."""
+    for key in _UNIQUE_TENANT_KEYS:
+        val = fields.get(key)
+        if not val:
+            continue
+        stmt = select(Tenant.id).where(getattr(Tenant, key) == val)
+        if exclude_id is not None:
+            stmt = stmt.where(Tenant.id != exclude_id)
+        if (await db.execute(stmt)).first() is not None:
+            raise HTTPException(
+                status_code=409, detail=f"{key} already assigned to another tenant"
+            )
+
+
 async def create_tenant(
     db: AsyncSession,
     slug: str,
@@ -85,6 +111,7 @@ async def create_tenant(
     **fields: Any,
 ) -> Tenant:
     data = {k: v for k, v in fields.items() if k in _TENANT_FIELDS and v is not None}
+    await _assert_unique_keys(db, data)
     tenant = Tenant(slug=slug, **data)
     if shopify_client_secret:
         tenant.shopify_client_secret_enc = encrypt(shopify_client_secret)
@@ -104,6 +131,9 @@ async def update_tenant(
     whatsapp_token: str | None = None,
     **fields: Any,
 ) -> Tenant:
+    await _assert_unique_keys(
+        db, {k: v for k, v in fields.items() if k in _TENANT_FIELDS}, exclude_id=tenant.id
+    )
     for k, v in fields.items():
         if k in _TENANT_FIELDS and v is not None:
             setattr(tenant, k, v)

tests/test_multitenant.py

@@ -122,3 +122,26 @@ async def test_get_tenant_by_slug(db_session):
     await db_session.flush()
     assert (await get_tenant_by_slug(db_session, "toorx")).slug == "toorx"
     assert await get_tenant_by_slug(db_session, "missing") is None
+
+
+async def test_resolution_keys_unique_clean_409(db_session):
+    """shopify_shop / whatsapp_phone_id map to exactly ONE tenant: a duplicate is a
+    clean 409 at write time, never two rows that would mix two client accounts."""
+    from fastapi import HTTPException
+
+    from app.tenancy import update_tenant
+
+    a = await create_tenant(db_session, "shop-a", shopify_shop="a.myshopify.com")
+    b = await create_tenant(db_session, "shop-b", shopify_shop="b.myshopify.com")
+    with pytest.raises(HTTPException) as e1:  # new tenant grabbing A's shop
+        await create_tenant(db_session, "shop-a-dup", shopify_shop="a.myshopify.com")
+    assert e1.value.status_code == 409
+    with pytest.raises(HTTPException) as e2:  # B editing onto A's shop
+        await update_tenant(db_session, b, shopify_shop="a.myshopify.com")
+    assert e2.value.status_code == 409
+    await update_tenant(db_session, a, shopify_shop="a.myshopify.com")  # own value -> ok
+    await update_tenant(db_session, a, whatsapp_phone_id="PHONE1")
+    with pytest.raises(HTTPException) as e3:  # B grabbing A's WhatsApp number
+        await update_tenant(db_session, b, whatsapp_phone_id="PHONE1")
+    assert e3.value.status_code == 409
+    await update_tenant(db_session, b, whatsapp_phone_id="")  # empty never collides