Coverage for node / src / stigmem_node / multi_tenant_gate.py: 100%

1"""Runtime gate for multi-tenant isolation (experimental plugin). 

2 

3Without the multi-tenant plugin, the ``tenant_resolve`` hook collapses every 

4identity to the default tenant, so a key registered under a non-default 

5``tenant_id`` is NOT actually isolated — it shares the default partition. That 

6single-partition collapse is an intentional default-install behavior (see 

7``test_default_install_uses_one_audit_partition``); the F-ID-1 hazard is that it 

8was *silent*. :func:`warn_if_tenant_not_isolatable` makes it loud. 

9""" 

10 

11from __future__ import annotations 

12 

13import logging 

14 

15logger = logging.getLogger("stigmem.tenant") 

16 

17MULTI_TENANT_PLUGIN_NAME = "stigmem-plugin-multi-tenant" 

18 

19 

20def multi_tenant_plugin_registered() -> bool: 

21 """Return True when the multi-tenant plugin is active in the registry.""" 

22 from .plugins import get_registry 

23 

24 return MULTI_TENANT_PLUGIN_NAME in get_registry().registered_plugins() 

25 

26 

27def warn_if_tenant_not_isolatable(normalized_tenant_id: str) -> bool: 

28 """Log a SECURITY WARNING when a non-default tenant can't actually be isolated. 

29 

30 The key is still registered — single-tenant installs intentionally collapse 

31 non-default tenants into one partition; this only removes the *silence* 

32 (F-ID-1). Returns True iff a warning was emitted. 

33 """ 

34 from .tenant import DEFAULT_TENANT_ID 

35 

36 if normalized_tenant_id == DEFAULT_TENANT_ID: 

37 return False 

38 if multi_tenant_plugin_registered(): 

39 return False 

40 logger.warning( 

41 "SECURITY WARNING: API key registered under tenant_id=%r, but the " 

42 "multi-tenant plugin is not active. This key is NOT isolated — its " 

43 "traffic collapses to the default tenant and shares one partition. " 

44 "Install/enable stigmem-plugin-multi-tenant for real tenant isolation, " 

45 "or register under the default tenant.", 

46 normalized_tenant_id, 

47 ) 

48 return True