Add tenant context gate for Rust app migration

Author: ewilhelm1979-netizen

docs/RUST_REWRITE_ROADMAP.md

@@ -39,3 +39,37 @@ ISCY schrittweise von Django/Python auf Rust ueberfuehren, ohne Fachfunktionalit
 3. Performance-Benchmark dokumentiert
 4. Security-Review abgeschlossen
 5. Rollback getestet
+
+## Stand 2026-04-18
+
+- Rust-Backend ist in CI mit Format, Clippy und Tests verdrahtet.
+- NVD-CVE-Normalisierung, Collection/Recent-Import und Einzel-CVE-Upsert laufen ueber Rust.
+- Rust schreibt CVERecord-Daten direkt in die bestehende Django-Tabelle `vulnerability_intelligence_cverecord`.
+- Django bleibt aktuell noch Kompatibilitaets-/Web-Schicht und liest nach Rust-Upserts bestehende Models zurueck.
+- Rust hat einen ersten Request-Kontext-Vertrag fuer Tenant/User-Header:
+  - `GET /api/v1/context/whoami` fuer Diagnose/Bridge-Kontext
+  - `GET /api/v1/context/tenant` als Muster fuer geschuetzte tenantgebundene Rust-Routen
+
+## App-Migrationsreihenfolge
+
+Die Apps werden nicht alle gleichzeitig ersetzt. Jede Zeile bekommt eigene Rust-Routen, Tests, Datenzugriff und danach erst Django-Cutover.
+
+| Reihenfolge | Apps | Ziel in Rust | Warum diese Reihenfolge |
+| --- | --- | --- | --- |
+| 1 | `core`, `accounts`, `organizations` | Auth-/Tenant-Kontext, Berechtigungen, Tenant-Read-APIs | Ohne diese Basis waeren alle weiteren App-Endpunkte unsicher oder doppelt implementiert. |
+| 2 | `vulnerability_intelligence`, `reports`, `dashboard` | Read-/Summary-APIs, CVE-Importe, Reporting | Bereits angefangen; hoher Nutzen, gut testbar, wenig Form-UI-Abhaengigkeit. |
+| 3 | `guidance`, `requirements_app`, `catalog` | Regel-/Katalogdaten, Guided Journey Evaluation | Viel Fachlogik, aber vergleichsweise klare Datenmodelle. |
+| 4 | `product_security`, `assets_app`, `processes`, `risks` | Tenant-gebundene CRUD-APIs und Bewertungslogik | Stark miteinander verknuepft; profitiert von fertiger Tenant-Schicht. |
+| 5 | `assessments`, `evidence`, `roadmap`, `import_center`, `wizard` | Workflows, Writes, Importjobs, Evidence/Assessment-Flows | Hohe UI-/Form- und Workflow-Dichte; braucht stabile Rust-Basis. |
+| 6 | Django-Web/Admin-Reste | Abschalten oder durch Rust-Web/Frontend ersetzen | Erst nach Funktionsparitaet sinnvoll. |
+
+## Dauer grob
+
+Diese Schaetzung gilt fuer einen kontrollierten Strangler-Umbau mit Tests und laufender CI:
+
+- Rust-Core + Auth/Tenant/App-API-Basis: ca. 2-4 Arbeitstage
+- Read-only APIs fuer Dashboard, Reports, CVE, Guidance: ca. 1-2 Wochen
+- Schreibende APIs fuer Assets, Prozesse, Risiken, Assessments, Evidence: ca. 2-4 Wochen
+- Weboberflaeche/Admin-Ersatz und finaler Django-Cutover: ca. 2-4 Wochen
+
+Realistisch: Ein belastbarer Rust-Core kann schnell wachsen; die komplette Django-Abloesung aller Apps ist eher ein mehrwoechiges Projekt. Der sichere Weg ist: pro App ein Rust-API-Slice, Tests gruen, Django-Route umschalten, alten Python-Pfad entfernen.

rust/iscy-backend/src/lib.rs

@@ -71,6 +71,16 @@ pub struct ContextWhoamiResponse {
     pub user_email: Option<String>,
 }
 
+#[derive(Debug, Serialize)]
+pub struct TenantContextResponse {
+    pub api_version: &'static str,
+    pub authenticated: bool,
+    pub tenant_id: i64,
+    pub user_id: i64,
+    pub user_email: Option<String>,
+    pub authorization_model: &'static str,
+}
+
 #[derive(Debug, Deserialize)]
 pub struct LlmGenerateRequest {
     pub prompt: String,
@@ -228,6 +238,33 @@ async fn context_whoami(headers: HeaderMap) -> Response {
     }
 }
 
+async fn context_tenant(headers: HeaderMap) -> Response {
+    match RequestContext::authenticated_tenant_from_headers(&headers) {
+        Ok(context) => (
+            StatusCode::OK,
+            Json(TenantContextResponse {
+                api_version: "v1",
+                authenticated: true,
+                tenant_id: context.tenant_id,
+                user_id: context.user_id,
+                user_email: context.user_email,
+                authorization_model: "header-bridged-django-context-v1",
+            }),
+        )
+            .into_response(),
+        Err(err) => (
+            err.status_code(),
+            Json(ApiErrorResponse {
+                accepted: false,
+                api_version: "v1",
+                error_code: err.error_code(),
+                message: err.message().to_string(),
+            }),
+        )
+            .into_response(),
+    }
+}
+
 async fn web_index() -> Html<String> {
     Html(
         r#"<!doctype html>
@@ -590,6 +627,7 @@ pub fn app_router_with_state(state: AppState) -> Router {
         .route("/health/ready", get(health_live))
         .route("/health/live", get(health_live))
         .route("/api/v1/context/whoami", get(context_whoami))
+        .route("/api/v1/context/tenant", get(context_tenant))
         .route("/", get(web_index))
         .route("/login/", get(web_login))
         .route("/navigator/", get(web_navigator))

rust/iscy-backend/src/request_context.rs

@@ -1,4 +1,4 @@
-use axum::http::HeaderMap;
+use axum::http::{HeaderMap, StatusCode};
 use serde::Serialize;
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
@@ -9,12 +9,26 @@ pub struct RequestContext {
     pub user_email: Option<String>,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct AuthenticatedTenantContext {
+    pub tenant_id: i64,
+    pub user_id: i64,
+    pub user_email: Option<String>,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum RequestContextError {
     InvalidTenantId,
     InvalidUserId,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RequiredTenantContextError {
+    InvalidHeaders(RequestContextError),
+    MissingUser,
+    MissingTenant,
+}
+
 impl RequestContext {
     pub fn from_headers(headers: &HeaderMap) -> Result<Self, RequestContextError> {
         let tenant_id = optional_i64_header(headers, "x-iscy-tenant-id")
@@ -30,6 +44,30 @@ impl RequestContext {
             user_email,
         })
     }
+
+    pub fn authenticated_tenant_from_headers(
+        headers: &HeaderMap,
+    ) -> Result<AuthenticatedTenantContext, RequiredTenantContextError> {
+        Self::from_headers(headers)
+            .map_err(RequiredTenantContextError::InvalidHeaders)?
+            .require_authenticated_tenant()
+    }
+
+    pub fn require_authenticated_tenant(
+        self,
+    ) -> Result<AuthenticatedTenantContext, RequiredTenantContextError> {
+        let user_id = self
+            .user_id
+            .ok_or(RequiredTenantContextError::MissingUser)?;
+        let tenant_id = self
+            .tenant_id
+            .ok_or(RequiredTenantContextError::MissingTenant)?;
+        Ok(AuthenticatedTenantContext {
+            tenant_id,
+            user_id,
+            user_email: self.user_email,
+        })
+    }
 }
 
 impl RequestContextError {
@@ -48,6 +86,32 @@ impl RequestContextError {
     }
 }
 
+impl RequiredTenantContextError {
+    pub fn status_code(&self) -> StatusCode {
+        match self {
+            Self::InvalidHeaders(_) => StatusCode::BAD_REQUEST,
+            Self::MissingUser => StatusCode::UNAUTHORIZED,
+            Self::MissingTenant => StatusCode::FORBIDDEN,
+        }
+    }
+
+    pub fn error_code(&self) -> &'static str {
+        match self {
+            Self::InvalidHeaders(err) => err.error_code(),
+            Self::MissingUser => "missing_user_context",
+            Self::MissingTenant => "missing_tenant_context",
+        }
+    }
+
+    pub fn message(&self) -> &'static str {
+        match self {
+            Self::InvalidHeaders(err) => err.message(),
+            Self::MissingUser => "Authentifizierte Rust-App-Routen benoetigen X-ISCY-User-ID.",
+            Self::MissingTenant => "Tenant-gebundene Rust-App-Routen benoetigen X-ISCY-Tenant-ID.",
+        }
+    }
+}
+
 fn optional_i64_header(headers: &HeaderMap, name: &'static str) -> Result<Option<i64>, ()> {
     let Some(raw) = headers.get(name) else {
         return Ok(None);
@@ -76,7 +140,7 @@ fn optional_string_header(headers: &HeaderMap, name: &'static str) -> Option<Str
 mod tests {
     use axum::http::{HeaderMap, HeaderValue};
 
-    use super::{RequestContext, RequestContextError};
+    use super::{RequestContext, RequestContextError, RequiredTenantContextError};
 
     #[test]
     fn parses_empty_context_as_anonymous() {
@@ -115,4 +179,38 @@ mod tests {
             RequestContextError::InvalidTenantId
         );
     }
+
+    #[test]
+    fn requires_authenticated_user_for_tenant_context() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-iscy-tenant-id", HeaderValue::from_static("42"));
+
+        assert_eq!(
+            RequestContext::authenticated_tenant_from_headers(&headers).unwrap_err(),
+            RequiredTenantContextError::MissingUser
+        );
+    }
+
+    #[test]
+    fn requires_tenant_for_authenticated_tenant_context() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-iscy-user-id", HeaderValue::from_static("7"));
+
+        assert_eq!(
+            RequestContext::authenticated_tenant_from_headers(&headers).unwrap_err(),
+            RequiredTenantContextError::MissingTenant
+        );
+    }
+
+    #[test]
+    fn builds_authenticated_tenant_context() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-iscy-tenant-id", HeaderValue::from_static("42"));
+        headers.insert("x-iscy-user-id", HeaderValue::from_static("7"));
+
+        let context = RequestContext::authenticated_tenant_from_headers(&headers).unwrap();
+
+        assert_eq!(context.tenant_id, 42);
+        assert_eq!(context.user_id, 7);
+    }
 }

rust/iscy-backend/tests/http_tests.rs

@@ -100,6 +100,77 @@ async fn context_whoami_rejects_invalid_tenant_header() {
     assert_eq!(payload["error_code"], "invalid_tenant_id");
 }
 
+#[tokio::test]
+async fn context_tenant_requires_user_header() {
+    let response = app_router()
+        .oneshot(
+            Request::builder()
+                .uri("/api/v1/context/tenant")
+                .header("x-iscy-tenant-id", "42")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    let payload: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(payload["accepted"], false);
+    assert_eq!(payload["api_version"], "v1");
+    assert_eq!(payload["error_code"], "missing_user_context");
+}
+
+#[tokio::test]
+async fn context_tenant_requires_tenant_header() {
+    let response = app_router()
+        .oneshot(
+            Request::builder()
+                .uri("/api/v1/context/tenant")
+                .header("x-iscy-user-id", "7")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    let payload: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(payload["accepted"], false);
+    assert_eq!(payload["api_version"], "v1");
+    assert_eq!(payload["error_code"], "missing_tenant_context");
+}
+
+#[tokio::test]
+async fn context_tenant_returns_authenticated_tenant_context() {
+    let response = app_router()
+        .oneshot(
+            Request::builder()
+                .uri("/api/v1/context/tenant")
+                .header("x-iscy-tenant-id", "42")
+                .header("x-iscy-user-id", "7")
+                .header("x-iscy-user-email", "security@example.test")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    let payload: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(payload["api_version"], "v1");
+    assert_eq!(payload["authenticated"], true);
+    assert_eq!(payload["tenant_id"], 42);
+    assert_eq!(payload["user_id"], 7);
+    assert_eq!(payload["user_email"], "security@example.test");
+    assert_eq!(
+        payload["authorization_model"],
+        "header-bridged-django-context-v1"
+    );
+}
+
 #[tokio::test]
 async fn rust_web_surface_routes_return_ok() {
     let paths = vec![