fix(auth): allow verified platform users through RLS

app/middleware/auth_middleware.py

@@ -43,6 +43,12 @@ def get_current_user(
                 text("SELECT set_config('app.tenant_id', :tenant_id, true)"),
                 {"tenant_id": str(token_tenant_id)},
             )
+        else:
+            # A platform user's signed token intentionally has no tenant claim.
+            # Enable transaction-local discovery only long enough to resolve the
+            # exact token subject; the result is validated below before platform
+            # access remains enabled for the rest of this request.
+            db.execute(text("SELECT set_config('app.bypass_rls', 'on', true)"))
     except HTTPException:
         raise
     except Exception:
@@ -53,11 +59,28 @@ def get_current_user(
 
     user = db.query(User).filter(User.id == user_id).first()
     if user is None:
+        if not token_tenant_id:
+            db.execute(text("SELECT set_config('app.bypass_rls', 'off', true)"))
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="User not found"
         )
 
+    if token_tenant_id:
+        if str(user.tenant_id) != str(token_tenant_id):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Token tenant does not match user tenant"
+            )
+    elif user.tenant_id is not None:
+        # Fail closed for a validly signed tenant-user token that is malformed,
+        # stale, or missing its canonical tenant claim.
+        db.execute(text("SELECT set_config('app.bypass_rls', 'off', true)"))
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Tenant claim required for tenant user"
+        )
+
     setattr(user, "_saas_db_session", db)
     
     if user.status != "active":