Added detailed logging to help diagnose empty tenant list issues:
- Log demo_session_id, demo_account_type, and tenant_count
- Log actual tenant IDs returned
- Log when demo user detected but no session ID
This will help identify:
1. If demo_session_id is being passed correctly from gateway
2. If tenants exist in DB for the session
3. Timing issues (API called before session fully initialized)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit fixes a critical security issue where multiple concurrent demo
sessions would see each other's data due to sharing the same demo user IDs.
## The Problem:
When two enterprise demo sessions run simultaneously:
- Session A: user_id=Director, tenants=[parent_A, child_A1, child_A2]
- Session B: user_id=Director, tenants=[parent_B, child_B1, child_B2]
The endpoint /api/v1/tenants/user/{user_id}/tenants was querying by user_id
only, so Session A would see BOTH its own tenants AND Session B's tenants!
## The Solution:
Added demo_session_id filtering to get_user_tenants endpoint:
- For demo sessions, use get_virtual_tenants_for_session(demo_session_id)
- This filters tenants by the demo_session_id field (set during cloning)
- Each session now sees ONLY its own virtual tenants
## Implementation:
services/tenant/app/api/tenants.py (lines 180-194):
- Check if user is_demo
- Extract demo_session_id from current_user context (set by gateway)
- Call get_virtual_tenants_for_session() instead of get_user_tenants()
- This method filters by: demo_session_id + is_active + account_type
## Database Schema:
The tenants table has a demo_session_id column (indexed) that links
each virtual tenant to its specific demo session. This is set during
tenant cloning in internal_demo.py.
## Impact:
✅ Complete isolation between concurrent demo sessions
✅ Users only see their own session's data
✅ No performance impact (demo_session_id is indexed)
✅ Backward compatible (non-demo users unchanged)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
When the frontend requests tenants with user_id='demo-user' in demo mode,
the backend now correctly maps this to the actual demo owner ID from the
current_user context (set by the gateway middleware).
This fixes the issue where the tenant list API was returning empty results
even though it returned 200 OK, because it was looking for a user with
id='demo-user' which doesn't exist in the database.
The actual user IDs are:
- Professional: c1a2b3c4-d5e6-47a8-b9c0-d1e2f3a4b5c6 (María García López)
- Enterprise: d2e3f4a5-b6c7-48d9-e0f1-a2b3c4d5e6f7 (Director)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit refactors the demo session architecture to consolidate all demo
configuration data into the fixture files, removing redundant metadata files.
## Changes Made:
### 1. Data Consolidation
- **Removed**: `shared/demo/metadata/demo_users.json`
- **Removed**: `shared/demo/metadata/tenant_configs.json`
- **Updated**: Merged all user data into `02-auth.json` files
- **Updated**: Merged all tenant config data into `01-tenant.json` files
### 2. Enterprise Parent Tenant Updates
- Updated owner name to "Director" (matching auth fixtures)
- Added description field matching tenant_configs.json
- Added `base_tenant_id` to all child tenant entries
- Now includes all 5 child locations (Madrid, Barcelona, Valencia, Seville, Bilbao)
### 3. Professional Tenant Updates
- Added description field from tenant_configs.json
- Ensured consistency with auth fixtures
### 4. Code Updates
- **services/tenant/app/api/internal_demo.py**:
- Fixed child tenant staff members to use enterprise parent users
- Changed from professional staff IDs to enterprise staff IDs (Laura López, José Martínez, Francisco Moreno)
- **services/demo_session/app/core/config.py**:
- Updated DEMO_ACCOUNTS configuration with all 5 child outlets
- Updated enterprise tenant name and email to match fixtures
- Added descriptions for all child locations
- **gateway/app/middleware/demo_middleware.py**:
- Updated comments to reference fixture files as source of truth
- Clarified that owner IDs come from 01-tenant.json files
- **frontend/src/stores/useTenantInitializer.ts**:
- Updated tenant names and descriptions to match fixture files
- Added comments linking to source fixture files
## Benefits:
1. **Single Source of Truth**: All demo data now lives in fixture files
2. **Consistency**: No more sync issues between metadata and fixtures
3. **Maintainability**: Easier to update demo data (one place per tenant type)
4. **Clarity**: Clear separation between template data (fixtures) and runtime config
## Enterprise Demo Fix:
The enterprise owner is now correctly added as a member of all child tenants, fixing
the issue where the tenant switcher didn't show parent/child tenants and the
establishments page didn't load tenants for the demo enterprise user.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
