fix(auth): bind admins to enterprise tenant context

server/tests/test_auth_service.py

@@ -7,6 +7,7 @@ from sqlalchemy.pool import StaticPool
 
 from app.db.base import Base
 from app.models.auth_session import AuthSession
+from app.models.tenant import Tenant
 from app.models.user_session_metric import UserSessionMetric
 from app.schemas.auth import LoginRequest
 from app.schemas.settings import SettingsWrite
@@ -16,7 +17,7 @@ from app.services.employee import EmployeeService
 from app.services.settings import SettingsService
 
 
-def build_session() -> Session:
+def build_session() -> Session:
     engine = create_engine(
         "sqlite+pysqlite:///:memory:",
         connect_args={"check_same_thread": False},
@@ -24,7 +25,16 @@ def build_session() -> Session:
     )
     Base.metadata.create_all(bind=engine)
     session_factory = sessionmaker(bind=engine, autoflush=False, autocommit=False)
-    return session_factory()
+    return session_factory()
+
+
+def configure_admin(db: Session, *, account: str = "admin", password: str = "admin") -> None:
+    settings_service = SettingsService(db)
+    payload = settings_service.get_settings_snapshot().model_dump()
+    payload["adminForm"]["adminAccount"] = account
+    payload["adminForm"]["newPassword"] = password
+    payload["adminForm"]["confirmPassword"] = password
+    settings_service.save_settings_snapshot(SettingsWrite(**payload))
 
 
 def test_employee_can_login_with_seed_default_password() -> None:
@@ -65,13 +75,8 @@ def test_current_user_snapshot_refreshes_employee_position() -> None:
 
 
 def test_admin_can_login_with_database_password() -> None:
-    with build_session() as db:
-        settings_service = SettingsService(db)
-        payload = settings_service.get_settings_snapshot().model_dump()
-        payload["adminForm"]["adminAccount"] = "superadmin"
-        payload["adminForm"]["newPassword"] = "admin123"
-        payload["adminForm"]["confirmPassword"] = "admin123"
-        settings_service.save_settings_snapshot(SettingsWrite(**payload))
+    with build_session() as db:
+        configure_admin(db, account="superadmin", password="admin123")
 
         result = AuthService(db).login(
             LoginRequest(username="superadmin", password="admin123")
@@ -82,6 +87,67 @@ def test_admin_can_login_with_database_password() -> None:
         assert result.user.isAdmin is True
         assert result.user.position == "系统管理员"
         assert result.user.roleCodes == ["manager"]
+        assert result.user.tenantId == "platform"
+
+
+def test_admin_login_uses_requested_active_tenant_and_restores_session_scope() -> None:
+    with build_session() as db:
+        configure_admin(db)
+        db.add(
+            Tenant(
+                tenant_id="default",
+                tenant_code="default",
+                name="默认企业",
+                status="active",
+            )
+        )
+        db.commit()
+
+        result = AuthService(db).login(
+            LoginRequest(username="admin", password="admin", tenantId="default")
+        )
+        auth_session = db.query(AuthSession).one()
+        restored = AuthService(db).get_session_user(auth_session)
+
+        assert result.user.isAdmin is True
+        assert result.user.tenantId == "default"
+        assert auth_session.principal_type == "admin"
+        assert auth_session.tenant_id == "default"
+        assert restored is not None
+        assert restored.is_admin is True
+        assert restored.tenant_id == "default"
+
+
+def test_admin_login_rejects_unknown_or_inactive_requested_tenant() -> None:
+    with build_session() as db:
+        configure_admin(db)
+        db.add(
+            Tenant(
+                tenant_id="tenant-disabled",
+                tenant_code="company-disabled",
+                name="停用企业",
+                status="disabled",
+            )
+        )
+        db.commit()
+
+        with pytest.raises(ValueError, match="企业代码不存在或当前不可用"):
+            AuthService(db).login(
+                LoginRequest(
+                    username="admin",
+                    password="admin",
+                    tenantId="company-disabled",
+                )
+            )
+
+        with pytest.raises(ValueError, match="企业代码不存在或当前不可用"):
+            AuthService(db).login(
+                LoginRequest(
+                    username="admin",
+                    password="admin",
+                    tenantId="missing-tenant",
+                )
+            )
 
 
 def test_disabled_employee_cannot_login() -> None: