Harden report views and add tenant-isolation tests

Author: Codex

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
           python manage.py seed_requirements || true
           python manage.py seed_product_security || true
           python manage.py check
-          python manage.py test apps.core
+          python manage.py test apps.core apps.reports
 
   nix-devshell:
     runs-on: ubuntu-24.04
@@ -56,7 +56,7 @@ jobs:
             cp .env.example .env
             mkdir -p static media staticfiles
             python manage.py check
-            python manage.py test apps.core
+            python manage.py test apps.core apps.reports
           '
 
   llm-runtime-build:

Makefile

@@ -14,7 +14,7 @@ local-check:
 	. .venv/bin/activate && python manage.py check
 
 local-test:
-	. .venv/bin/activate && python manage.py test
+	. .venv/bin/activate && python manage.py test apps.core apps.reports
 
 dev-up:
 	$(COMPOSE_DEV) up --build

README.md

@@ -164,6 +164,8 @@ make local-check
 make local-test
 ```
 
+`make local-test` deckt aktuell die Basis-Gesundheitschecks und die mandantenbezogenen Report-Views ab.
+
 ## Support-Matrix
 
 Siehe [`SUPPORT_MATRIX.md`](SUPPORT_MATRIX.md).

apps/reports/tests.py

@@ -0,0 +1,97 @@
+from django.contrib.auth import get_user_model
+from django.test import TestCase
+from django.urls import reverse
+
+from apps.organizations.models import Tenant
+from apps.reports.models import ReportSnapshot
+from apps.wizard.models import AssessmentSession
+
+
+User = get_user_model()
+
+
+class ReportViewTests(TestCase):
+    def setUp(self):
+        self.tenant_a = Tenant.objects.create(name="Tenant A", slug="tenant-a", country="DE")
+        self.tenant_b = Tenant.objects.create(name="Tenant B", slug="tenant-b", country="DE")
+
+        self.user_a = User.objects.create_user(
+            username="tenant-a-user",
+            password="testpass123",
+            tenant=self.tenant_a,
+        )
+        self.user_b = User.objects.create_user(
+            username="tenant-b-user",
+            password="testpass123",
+            tenant=self.tenant_b,
+        )
+
+        self.session_a = AssessmentSession.objects.create(
+            tenant=self.tenant_a,
+            started_by=self.user_a,
+            applicability_result="relevant",
+            executive_summary="Kurzfassung Tenant A",
+        )
+        self.session_b = AssessmentSession.objects.create(
+            tenant=self.tenant_b,
+            started_by=self.user_b,
+            applicability_result="not_relevant",
+            executive_summary="Kurzfassung Tenant B",
+        )
+
+        self.report_a = ReportSnapshot.objects.create(
+            tenant=self.tenant_a,
+            session=self.session_a,
+            title="Report A",
+            executive_summary="Executive Summary A",
+            applicability_result="relevant",
+            compliance_versions_json={
+                "ISO27001": {"version": "2022"},
+                "NIS2": {"version": "2024"},
+            },
+            domain_scores_json=[
+                {"domain": "Governance", "score_percent": 82, "maturity_level": "Managed"}
+            ],
+            top_measures_json=[{"title": "MFA einführen", "priority": "HIGH"}],
+            roadmap_summary=[{"name": "Phase 1", "duration_weeks": 6, "objective": "Basis schaffen"}],
+            next_steps_json={"dependencies": []},
+        )
+        self.report_b = ReportSnapshot.objects.create(
+            tenant=self.tenant_b,
+            session=self.session_b,
+            title="Report B",
+            executive_summary="Executive Summary B",
+            applicability_result="not_relevant",
+        )
+
+    def test_report_list_only_shows_current_tenant(self):
+        self.client.force_login(self.user_a)
+
+        response = self.client.get(reverse("reports:list"))
+
+        self.assertEqual(response.status_code, 200)
+        reports = list(response.context["reports"])
+        self.assertEqual(reports, [self.report_a])
+
+    def test_report_detail_blocks_foreign_tenant_access(self):
+        self.client.force_login(self.user_a)
+
+        response = self.client.get(reverse("reports:detail", args=[self.report_b.pk]))
+
+        self.assertEqual(response.status_code, 404)
+
+    def test_report_pdf_is_generated_for_own_tenant(self):
+        self.client.force_login(self.user_a)
+
+        response = self.client.get(reverse("reports:pdf", args=[self.report_a.pk]))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Content-Type"], "application/pdf")
+        self.assertTrue(response.content.startswith(b"%PDF"))
+
+    def test_report_pdf_blocks_foreign_tenant_access(self):
+        self.client.force_login(self.user_a)
+
+        response = self.client.get(reverse("reports:pdf", args=[self.report_b.pk]))
+
+        self.assertEqual(response.status_code, 404)

apps/reports/views.py

@@ -1,6 +1,7 @@
 import io
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.http import HttpResponse
+from django.shortcuts import get_object_or_404
 from django.views.generic import DetailView, ListView, View
 from apps.core.mixins import TenantAccessMixin
 from reportlab.lib import colors
@@ -42,7 +43,12 @@ class ReportPdfView(TenantAccessMixin, View):
     tenant_filter_field = 'tenant'
 
     def get(self, request, pk):
-        report = self.filter_queryset_for_tenant(ReportSnapshot.objects.select_related('tenant', 'session')).get(pk=pk)
+        report = get_object_or_404(
+            self.filter_queryset_for_tenant(
+                ReportSnapshot.objects.select_related('tenant', 'session')
+            ),
+            pk=pk,
+        )
         evidence_needs = RequirementEvidenceNeed.objects.filter(
             tenant=report.tenant,
             session=report.session,
@@ -135,7 +141,12 @@ class ReportProPdfView(TenantAccessMixin, View):
     tenant_filter_field = 'tenant'
 
     def get(self, request, pk):
-        report = self.filter_queryset_for_tenant(ReportSnapshot.objects.select_related('tenant', 'session')).get(pk=pk)
+        report = get_object_or_404(
+            self.filter_queryset_for_tenant(
+                ReportSnapshot.objects.select_related('tenant', 'session')
+            ),
+            pk=pk,
+        )
         from .pdf_export import generate_audit_report_pdf
         pdf_bytes = generate_audit_report_pdf(report, report.session, report.tenant)
         response = HttpResponse(content_type='application/pdf')