fix(security): rebuild tenant-scoped analytics query on current main

[seonghobae]

Objective

Reconstruct the storage-scoped analytics tenant boundary directly on current protected main, without importing stale ancestry or reading a global conversion-job inventory into the controller process.

Exact reconstruction identity

• protected base: eb0a32e87e7470469c8fa0f8c67d9583654bef57;
• exact current head: c2ee90a90666a715b35a7be1973cc5b0916e7373;
• predecessor semantic authority: fix(security): reconcile tenant-scoped analytics query on current main #432 exact head e0c02dc3305020ae1ad6900d0a04790aee7104d3;
• changed paths: analytics controller, repository contract, in-memory adapter, and focused boundary regression only.

Security invariant

The analytics controller passes the authenticated tenant predicate into ConversionJobRepository.findAllByTenantId(...) and never obtains a global job inventory merely to filter it in process. The repository default fails closed with an empty result and cannot invoke findAll(). The in-memory adapter normalizes nonblank tenant authority and applies ownership filtering at its storage boundary. Missing permission fails before either query is invoked.

Scope boundary

This is a process-local query-boundary contract. It does not add durable database row-level security, alter KPI denominator/version semantics, change authentication, persist analytics, or complete issue #326. Durable adapters must implement the same tenant predicate in storage.

Test-first lineage

The focused regression proves the controller calls only the scoped query, authorization failure touches neither query, the interface default cannot fall back to the global inventory, and the in-memory adapter returns only owned jobs. Predecessor checks and reviews do not transfer to this exact current-main reconstruction.

Merge gate

Keep Draft until exact-head CI, Security Scan, SAST Semgrep, fuzz, zero valid unresolved findings, and a qualifying independent non-author approval are present. Any head movement requires complete revalidation.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 73c0e693-6d0d-4939-be0c-63524301b5e0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}