security: fix critical/high auth, idor, races and persistence

2026-04-10 19:41:59 +03:00
parent e9a26f7975
commit a5e9bfb15c
11 changed files with 868 additions and 505 deletions
@@ -202,6 +202,10 @@ func (s *TenantStore) CreateFromJWT(tenantID, sub, email string, maxQueues int)
 		s.mu.Unlock()
 		return existing, nil
 	}
+	if len(s.byID) >= MaxTenantsGlobal {
+		s.mu.Unlock()
+		return nil, fmt.Errorf("global tenant limit reached (%d)", MaxTenantsGlobal)
+	}

 	accessKey, err := generateAccessKey()
 	if err != nil {