← All tests

Cross-tenant login fix STAGING

Narong reported: signing in at another company's portal URL logged you in anyway — ending in a confusing "logged in but not your account" state. Fixed on the NIX Commerce side (login + backend). Gate-2 3/3 + staging smoke 5/5.

Root cause: the shared nix_session cookie is scoped to .nixtech.app, so it travels to every tenant subdomain. The backend already rejected cross-tenant cookies on authed routes, but the public /login route didn't scope to the subdomain (so a tenant-A account got a valid session at tenant-B's URL), and the client left the resulting mismatch in a broken state.

Fix: /login now scopes to the subdomain from the request Origin (server-authoritative); the portal passes its subdomain at sign-in and, on a TENANT_MISMATCH, clears the stale session and bounces to this portal's login. No product data was ever cross-accessible — the JWT is tenant-scoped — so this is an auth-hygiene fix, not a data-leak fix.

1 — A different company's account is rejected at sign-in

Entering a demo account's credentials at lumiere-coffee's portal is now rejected — no session is issued.

POST /tenant/auth/login @ lumiere-coffee.staging · email=owner@demo.com → 401 Invalid credentials (stays on login)

Cross-tenant login rejected — demo account at lumiere's portal → rejected with an error, not logged in.

2 — Legit same-tenant login still works (control)

The same account at its own portal signs in normally.

Legit login works — demo account at demo's portal → authenticated (launchpad).

3 — An existing cross-tenant cookie is bounced cleanly

With a live demo session, visiting lumiere-coffee's portal no longer shows the confusing "not your account" state — the stale session is cleared and you land on that portal's login.

demo cookie → GET lumiere-coffee.staging/ → /me 401 TENANT_MISMATCH → redirect to /auth/login

Cross-tenant cookie bounced — A demo cookie on lumiere's portal → bounced to login, not "logged in but not your account".

nix-outdoor-sales-backend ddeae51 (staging Fly 17b8985) + nix-commerce 3ec952f (staging 916a368). Touches shared tenant auth (Commerce + Cafe/Outdoor SSO login) — parked on staging for a scheduled prod promote.