fix(security): scope onboarding status to caller's tenant

server/__tests__/testnet-onboarding.test.ts

@@ -2,11 +2,18 @@ import { describe, it, expect, beforeEach, afterEach, mock } from 'bun:test';
 import { Database } from 'bun:sqlite';
 import { runMigrations } from '../db/schema';
 import { handleOnboardingRoutes, type OnboardingStatus } from '../routes/onboarding';
+import type { RequestContext } from '../middleware/guards';
 import { createProject } from '../db/projects';
 import { createAgent } from '../db/agents';
 
 let db: Database;
 
+const mockContext: RequestContext = {
+    authenticated: true,
+    tenantId: 'default',
+    rateLimitHeaders: {},
+};
+
 beforeEach(() => {
     db = new Database(':memory:');
     db.exec('PRAGMA foreign_keys = ON');
@@ -115,21 +122,21 @@ describe('GET /api/onboarding/status', () => {
     it('returns null for non-matching routes', () => {
         const req = new Request('http://localhost/api/agents', { method: 'GET' });
         const url = new URL(req.url);
-        const result = handleOnboardingRoutes(req, url, db, null, null);
+        const result = handleOnboardingRoutes(req, url, db, null, null, mockContext);
         expect(result).toBeNull();
     });
 
     it('returns null for POST method', () => {
         const req = new Request('http://localhost/api/onboarding/status', { method: 'POST' });
         const url = new URL(req.url);
-        const result = handleOnboardingRoutes(req, url, db, null, null);
+        const result = handleOnboardingRoutes(req, url, db, null, null, mockContext);
         expect(result).toBeNull();
     });
 
     it('returns incomplete status when no services configured', async () => {
         const req = new Request('http://localhost/api/onboarding/status', { method: 'GET' });
         const url = new URL(req.url);
-        const response = handleOnboardingRoutes(req, url, db, null, null);
+        const response = handleOnboardingRoutes(req, url, db, null, null, mockContext);
         expect(response).not.toBeNull();
 
         const resolved = response instanceof Promise ? await response : response;
@@ -152,7 +159,7 @@ describe('GET /api/onboarding/status', () => {
 
         const req = new Request('http://localhost/api/onboarding/status', { method: 'GET' });
         const url = new URL(req.url);
-        const response = handleOnboardingRoutes(req, url, db, null, null);
+        const response = handleOnboardingRoutes(req, url, db, null, null, mockContext);
         const resolved = response instanceof Promise ? await response : response;
         const body: OnboardingStatus = await resolved!.json();
 

server/routes/index.ts

@@ -357,7 +357,7 @@ async function handleRoutes(
   if (tenantResponse) return tenantResponse;
 
   // Onboarding status (lightweight, no auth dependency on services)
-  const onboardingResponse = handleOnboardingRoutes(req, url, db, algochatBridge, agentWalletService ?? null);
+  const onboardingResponse = handleOnboardingRoutes(req, url, db, algochatBridge, agentWalletService ?? null, context);
   if (onboardingResponse) return onboardingResponse;
 
   const projectResponse = handleProjectRoutes(req, url, db, context);

server/routes/onboarding.ts

@@ -7,6 +7,7 @@
 import type { Database } from 'bun:sqlite';
 import type { AlgoChatBridge } from '../algochat/bridge';
 import type { AgentWalletService } from '../algochat/agent-wallet';
+import type { RequestContext } from '../middleware/guards';
 import { listProjects } from '../db/projects';
 import { listAgents } from '../db/agents';
 import { json } from '../lib/response';
@@ -30,15 +31,17 @@ export function handleOnboardingRoutes(
     db: Database,
     algochatBridge: AlgoChatBridge | null,
     _agentWalletService: AgentWalletService | null,
+    context: RequestContext,
 ): Response | Promise<Response> | null {
     if (url.pathname !== '/api/onboarding/status' || req.method !== 'GET') return null;
 
-    return handleOnboardingStatus(db, algochatBridge);
+    return handleOnboardingStatus(db, algochatBridge, context);
 }
 
 async function handleOnboardingStatus(
     db: Database,
     algochatBridge: AlgoChatBridge | null,
+    context: RequestContext,
 ): Promise<Response> {
     // Wallet status
     let walletConfigured = false;
@@ -59,12 +62,12 @@ async function handleOnboardingStatus(
         : null;
 
     // Agent status
-    const agents = listAgents(db);
+    const agents = listAgents(db, context.tenantId);
     const agentExists = agents.length > 0;
     const agentWalletConfigured = agents.some((a) => !!a.walletAddress);
 
     // Project status
-    const projects = listProjects(db);
+    const projects = listProjects(db, context.tenantId);
     const projectExists = projects.length > 0;
 
     const complete = walletConfigured && walletFunded && bridgeRunning && agentExists && projectExists;