fix(JWT): Generate tenant claims and validate them. (#914)

---------

Co-authored-by: Zach Daniel <[email protected]>

lib/ash_authentication/jwt.ex

@@ -98,14 +98,13 @@ defmodule AshAuthentication.Jwt do
       extra_claims
       |> Map.put("sub", subject)
 
-    {extra_claims, action_opts} =
+    action_opts =
       case Map.fetch(user.__metadata__, :tenant) do
         {:ok, tenant} ->
-          tenant = to_string(Ash.ToTenant.to_tenant(tenant, resource))
-          {Map.put(extra_claims, "tenant", tenant), Keyword.put(opts, :tenant, tenant)}
+          Keyword.put(opts, :tenant, tenant)
 
         :error ->
-          {extra_claims, opts}
+          opts
       end
 
     default_claims = Config.default_claims(resource, action_opts)

lib/ash_authentication/jwt/config.ex

@@ -48,6 +48,20 @@ defmodule AshAuthentication.Jwt.Config do
       &Joken.generate_jti/0,
       &validate_jti(&1, &2, &3, opts)
     )
+    |> maybe_add_tenant_claim(resource, opts[:tenant])
+  end
+
+  defp maybe_add_tenant_claim(cfg, resource, tenant) do
+    if Ash.Resource.Info.multitenancy_strategy(resource) do
+      Config.add_claim(
+        cfg,
+        "tenant",
+        fn -> tenant end,
+        &validate_tenant(&1, tenant)
+      )
+    else
+      cfg
+    end
   end
 
   @doc """
@@ -77,6 +91,12 @@ defmodule AshAuthentication.Jwt.Config do
     "~> #{vsn.major}.#{vsn.minor}"
   end
 
+  @doc """
+  Validate that the "tenant" claim matches the provided tenant option.
+  """
+  @spec validate_tenant(nil | String.t(), nil | String) :: boolean()
+  def validate_tenant(maybe_tenant, tenant), do: maybe_tenant == tenant
+
   @doc """
   The validation function used to validate the "aud" claim.
 

priv/repo/migrations/20250218213646_fix_multitenancy.exs

@@ -0,0 +1,51 @@
+defmodule Example.Repo.Migrations.FixMultitenancy do
+  @moduledoc """
+  Updates resources based on their most recent snapshots.
+
+  This file was autogenerated with `mix ash_postgres.generate_migrations`
+  """
+
+  use Ecto.Migration
+
+  def up do
+    drop(constraint(:mt_user_identities, "mt_user_identities_user_id_fkey"))
+
+    alter table(:mt_user_identities) do
+      modify(
+        :user_id,
+        references(:mt_user,
+          column: :id,
+          name: "mt_user_identities_user_id_fkey",
+          type: :uuid,
+          prefix: "public"
+        )
+      )
+    end
+
+    drop_if_exists(unique_index(:mt_user, [:username], name: "mt_user_username_index"))
+
+    create unique_index(:mt_user, [:organisation_id, :username], name: "mt_user_username_index")
+  end
+
+  def down do
+    drop_if_exists(
+      unique_index(:mt_user, [:organisation_id, :username], name: "mt_user_username_index")
+    )
+
+    create unique_index(:mt_user, [:organisation_id, :username], name: "mt_user_username_index")
+
+    drop(constraint(:mt_user_identities, "mt_user_identities_user_id_fkey"))
+
+    alter table(:mt_user_identities) do
+      modify(
+        :user_id,
+        references(:mt_user,
+          column: :id,
+          name: "mt_user_identities_user_id_fkey",
+          type: :uuid,
+          prefix: "public"
+        )
+      )
+    end
+  end
+end

priv/resource_snapshots/repo/mt_user/20250218213646.json

@@ -0,0 +1,143 @@
+{
+  "attributes": [
+    {
+      "allow_nil?": true,
+      "default": "nil",
+      "generated?": false,
+      "primary_key?": false,
+      "references": null,
+      "size": null,
+      "source": "confirmed_at",
+      "type": "utc_datetime_usec"
+    },
+    {
+      "allow_nil?": false,
+      "default": "fragment(\"gen_random_uuid()\")",
+      "generated?": false,
+      "primary_key?": true,
+      "references": null,
+      "size": null,
+      "source": "id",
+      "type": "uuid"
+    },
+    {
+      "allow_nil?": false,
+      "default": "nil",
+      "generated?": false,
+      "primary_key?": false,
+      "references": null,
+      "size": null,
+      "source": "username",
+      "type": "citext"
+    },
+    {
+      "allow_nil?": true,
+      "default": "nil",
+      "generated?": false,
+      "primary_key?": false,
+      "references": null,
+      "size": null,
+      "source": "extra_stuff",
+      "type": "text"
+    },
+    {
+      "allow_nil?": true,
+      "default": "nil",
+      "generated?": false,
+      "primary_key?": false,
+      "references": null,
+      "size": null,
+      "source": "not_accepted_extra_stuff",
+      "type": "text"
+    },
+    {
+      "allow_nil?": true,
+      "default": "nil",
+      "generated?": false,
+      "primary_key?": false,
+      "references": null,
+      "size": null,
+      "source": "hashed_password",
+      "type": "text"
+    },
+    {
+      "allow_nil?": false,
+      "default": "fragment(\"(now() AT TIME ZONE 'utc')\")",
+      "generated?": false,
+      "primary_key?": false,
+      "references": null,
+      "size": null,
+      "source": "created_at",
+      "type": "utc_datetime_usec"
+    },
+    {
+      "allow_nil?": false,
+      "default": "fragment(\"(now() AT TIME ZONE 'utc')\")",
+      "generated?": false,
+      "primary_key?": false,
+      "references": null,
+      "size": null,
+      "source": "updated_at",
+      "type": "utc_datetime_usec"
+    },
+    {
+      "allow_nil?": true,
+      "default": "nil",
+      "generated?": false,
+      "primary_key?": false,
+      "references": {
+        "deferrable": false,
+        "destination_attribute": "id",
+        "destination_attribute_default": null,
+        "destination_attribute_generated": null,
+        "index?": false,
+        "match_type": null,
+        "match_with": null,
+        "multitenancy": {
+          "attribute": "id",
+          "global": true,
+          "strategy": "attribute"
+        },
+        "name": "mt_user_organisation_id_fkey",
+        "on_delete": null,
+        "on_update": null,
+        "primary_key?": true,
+        "schema": "public",
+        "table": "mt_organisations"
+      },
+      "size": null,
+      "source": "organisation_id",
+      "type": "uuid"
+    }
+  ],
+  "base_filter": null,
+  "check_constraints": [],
+  "custom_indexes": [],
+  "custom_statements": [],
+  "has_create_action": true,
+  "hash": "E91884DBA76BFF56614A2A94307466EB6BA1605CE6E0D291507A3AADF362892A",
+  "identities": [
+    {
+      "all_tenants?": false,
+      "base_filter": null,
+      "index_name": "mt_user_username_index",
+      "keys": [
+        {
+          "type": "atom",
+          "value": "username"
+        }
+      ],
+      "name": "username",
+      "nils_distinct?": true,
+      "where": null
+    }
+  ],
+  "multitenancy": {
+    "attribute": "organisation_id",
+    "global": true,
+    "strategy": "attribute"
+  },
+  "repo": "Elixir.Example.Repo",
+  "schema": null,
+  "table": "mt_user"
+}