New enterprise feature

services/tenant/app/api/tenant_operations.py

@@ -290,13 +290,46 @@ async def get_user_owned_tenants(
 
     # Users can only get their own tenants unless they're admin
     user_role = current_user.get('role', '').lower()
-    if user_id != current_user["user_id"] and user_role != 'admin':
+
+    # Handle demo user: frontend uses "demo-user" but backend has actual demo user UUID
+    is_demo_user = current_user.get("is_demo", False) and user_id == "demo-user"
+
+    if user_id != current_user["user_id"] and not is_demo_user and user_role != 'admin':
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Can only access your own tenants"
         )
 
-    tenants = await tenant_service.get_user_tenants(user_id)
+    # For demo sessions, we need to handle the special case where virtual tenants are not owned by the
+    # demo user ID but are instead associated with the demo session
+    if current_user.get("is_demo", False):
+        # Extract demo session info from headers (gateway should set this when processing demo tokens)
+        demo_session_id = current_user.get("demo_session_id")
+        demo_account_type = current_user.get("demo_account_type", "")
+
+        if demo_session_id:
+            # For demo sessions, get virtual tenants associated with the session
+            # Rather than returning all tenants owned by the shared demo user ID
+            logger.info("Fetching virtual tenants for demo session",
+                       demo_session_id=demo_session_id,
+                       demo_account_type=demo_account_type)
+
+            # Special logic for demo sessions: return virtual tenants associated with this session
+            virtual_tenants = await tenant_service.get_virtual_tenants_for_session(demo_session_id, demo_account_type)
+            return virtual_tenants
+        else:
+            # Fallback: if no session ID but is a demo user, return based on account type
+            # Individual bakery demo user should have access to the professional demo tenant
+            # Enterprise demo session should have access only to enterprise parent tenant and its child
+            virtual_tenants = await tenant_service.get_demo_tenants_by_session_type(
+                demo_account_type,
+                str(current_user["user_id"])
+            )
+            return virtual_tenants
+
+    # For regular users, use the original logic
+    actual_user_id = current_user["user_id"] if is_demo_user else user_id
+    tenants = await tenant_service.get_user_tenants(actual_user_id)
     return tenants
 
 @router.get(route_builder.build_base_route("search", include_tenant_prefix=False), response_model=List[TenantResponse])