@onlineapps/infrastructure-tools 1.1.2 → 1.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlineapps/infrastructure-tools",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Infrastructure orchestration utilities for OA Drive infrastructure services (health tracking, queue initialization, service discovery)",
   "main": "src/index.js",
   "scripts": {
@@ -19,8 +19,8 @@
   "license": "MIT",
   "dependencies": {
     "@onlineapps/infra-logger": "1.0.0",
-    "@onlineapps/mq-client-core": "1.0.81",
-    "@onlineapps/service-common": "1.0.17",
+    "@onlineapps/mq-client-core": "1.0.82",
+    "@onlineapps/service-common": "1.0.18",
     "@onlineapps/storage-core": "1.0.12",
     "jsonwebtoken": "^9.0.3",
     "uuid": "^9.0.1"

package/src/jwt/extractTenantContext.js

@@ -9,13 +9,14 @@
  * Rules (per JWT_AUTH.md section 7):
  *  - Single tenant: auto-pick, x-tenant-uuid header optional
  *  - Multiple tenants: x-tenant-uuid header required
- *  - workspace_id defaults to 1 if header absent
+ *  - workspace_id is required (no fallback) — see docs/standards/tenant-context-contract.md
  *
  * @param {object} auth - req.auth from createJwtValidator: { person_uuid, person_id, email, tenants }
  * @param {object} headers - HTTP request headers (lowercase keys)
  * @returns {object} { tenant_id, tenant_uuid, workspace_id, person_id, person_uuid, role }
- * @throws {Error} with .statusCode = 400 or 403
+ * @throws {Error} with .statusCode = 400, 401, or 403
  */
+// See: docs/standards/tenant-context-contract.md
 function extractTenantContext(auth, headers) {
   if (!auth || !Array.isArray(auth.tenants)) {
     const err = new Error('[TenantContext] Missing auth data - Expected auth object with tenants array');
@@ -25,7 +26,18 @@ function extractTenantContext(auth, headers) {
 
   const tenantUuid = headers['x-tenant-uuid'];
   const rawWorkspaceId = headers['x-workspace-id'];
-  const workspaceId = rawWorkspaceId ? parseInt(rawWorkspaceId, 10) : 1;
+
+  if (!rawWorkspaceId) {
+    const err = new Error('[TenantContext] Missing x-workspace-id header - workspace is required for business operations');
+    err.statusCode = 400;
+    throw err;
+  }
+  const workspaceId = parseInt(rawWorkspaceId, 10);
+  if (isNaN(workspaceId) || workspaceId < 1) {
+    const err = new Error(`[TenantContext] Invalid x-workspace-id '${rawWorkspaceId}' - must be a positive integer`);
+    err.statusCode = 400;
+    throw err;
+  }
 
   if (tenantUuid) {
     const membership = auth.tenants.find(t => t.tenant_uuid === tenantUuid);