Enforce tenant isolation on verified audit firm domains

app/modules/system_settings/ui.py

@@ -114,6 +114,25 @@ def _store_active_branch_context(request: Request, branch: Branch | None) -> Non
     request.session["active_branch_code"] = branch.code
 
 
+_TENANT_BOUND_DOMAIN_TYPES = {"audit_firm_domain", "audit_firm_subdomain"}
+
+
+def _bound_domain_tenant_id(request: Request) -> int | None:
+    if not bool(getattr(request.state, "domain_resolved", False)):
+        return None
+    if not bool(getattr(request.state, "domain_is_verified", False)):
+        return None
+    if (getattr(request.state, "domain_status", None) or "").strip().lower() != "active":
+        return None
+    if (getattr(request.state, "domain_type", None) or "").strip() not in _TENANT_BOUND_DOMAIN_TYPES:
+        return None
+    value = getattr(request.state, "domain_tenant_id", None)
+    try:
+        return int(value) if value not in (None, "", 0, "0") else None
+    except (TypeError, ValueError):
+        return None
+
+
 def _can_manage_financial_years(db, user) -> bool:
     roles = set(get_user_roles(db, user.id))
     perms = set(get_user_permissions(db, user.id))
@@ -1435,6 +1454,10 @@ def switch_active_tenant(request: Request, tenant_id: int):
         if not user:
             return RedirectResponse(url="/login", status_code=303)
 
+        bound_tenant_id = _bound_domain_tenant_id(request)
+        if bound_tenant_id is not None and int(tenant_id) != int(bound_tenant_id):
+            return _redirect_denied()
+
         roles = get_user_roles(db, user.id)
         perms = set(get_user_permissions(db, user.id))
         if "System Admin" not in roles or "services.cross_tenant" not in perms: