Remove platform tenancy from SXCHNGE customer BFF (#34)

backend/edge/shared/internal/transport/http/router/public/login.go

@@ -46,7 +46,7 @@ func (pr *PublicRouter) authenticateAccount(ctx context.Context, req *srequest.L
 		return nil, true, response.Unauthorized(pr.logger, pr.service, "invalid credentials")
 	}
 
-	if !account.IsActive() {
+	if !account.IsActive() || account.IsArchived() {
 		return nil, false, response.Forbidden(pr.logger, pr.service, "account_not_verified", "Account verification required")
 	}
 

backend/edge/shared/internal/transport/http/router/public/login_test_support_test.go

@@ -87,10 +87,6 @@ func (db *testAccountDB) GetByEmail(ctx context.Context, email string) (*model.A
 	return db.result, db.err
 }
 
-func (db *testAccountDB) GetAccountsByRefs(ctx context.Context, orgRef bson.ObjectID, refs []bson.ObjectID) ([]model.Account, error) {
-	return nil, merrors.NotImplemented("stub")
-}
-
 func (db *testAccountDB) Create(ctx context.Context, object *model.Account) error {
 	return merrors.NotImplemented("stub")
 }

backend/edge/shared/internal/transport/http/router/public/refresh_test.go

@@ -135,3 +135,17 @@ func TestNativeRefreshRejectsStaleTokenWithoutCookieMutation(t *testing.T) {
 	require.Contains(t, response.Body.String(), `"error":"unauthorized"`)
 	require.Empty(t, response.Header().Get("Set-Cookie"))
 }
+
+func TestRefreshRejectsInactiveCustomerAndClientMismatch(t *testing.T) {
+	for _, status := range []model.AccountStatus{model.AccountBlocked, model.AccountPendingVerification} {
+		t.Run(string(status), func(t *testing.T) {
+			router, _ := newBrowserRefreshRouter(t, time.Now().Add(24*time.Hour))
+			router.db.(*testAccountDB).result.Status = status
+			require.Equal(t, http.StatusUnauthorized, executeBrowserRefresh(t, router).Code)
+		})
+	}
+	router, sessions := newBrowserRefreshRouter(t, time.Now().Add(24*time.Hour))
+	other := testActiveAccount(t)
+	sessions.client.AccountRef = &other.ID
+	require.Equal(t, http.StatusUnauthorized, executeBrowserRefresh(t, router).Code)
+}

backend/edge/shared/internal/transport/http/router/public/validate.go

@@ -88,6 +88,13 @@ func (pr *PublicRouter) validateRefreshToken(ctx context.Context, r *http.Reques
 		return nil, nil, nil, err
 	}
 
+	if !account.IsActive() || account.IsArchived() {
+		return nil, nil, nil, merrors.Unauthorized("customer is inactive")
+	}
+	if client.AccountRef != nil && *client.AccountRef != account.ID {
+		return nil, nil, nil, merrors.Unauthorized("client account mismatch")
+	}
+
 	accessToken, err := pr.imp.CreateAccessTokenForSession(&account, rt.SessionIdentifier)
 	if err != nil {
 		pr.logger.Warn("Failed to generate access token", zap.Error(err))