Merge branch 'main' into feature/copy-role

CHANGELOG.md

@@ -23,6 +23,7 @@
 - v24.29-alpha1
 
 ### Fix
+- Do not check tenant existence when unassigning tenant (#415, `v24.29-alpha8`)
 - Hotfix: Session expiration in userinfo must match access token expiration (#414, `v24.29-alpha7`)
 - Non-editable items are marked with read_only flag (#411, `v24.29-alpha5`)
 - Handle session decryption error (#410, `v24.29-alpha2`)

seacatauth/tenant/service.py

@@ -184,7 +184,7 @@ async def set_tenants(self, session, credentials_id: str, tenants: list):
 		tenants_to_assign = new_tenants.difference(existing_tenants)
 		tenants_to_unassign = existing_tenants.difference(new_tenants)
 
-		for tenant in tenants_to_assign.union(tenants_to_unassign):
+		for tenant in tenants_to_assign:
 			# Check if tenant exists
 			try:
 				await self.TenantsProvider.get(tenant)
@@ -197,7 +197,21 @@ async def set_tenants(self, session, credentials_id: str, tenants: list):
 				}
 			# Check permission
 			if not rbac_svc.has_resource_access(session.Authorization.Authz, tenant, ["seacat:tenant:assign"]):
-				message = "Not authorized for tenant un/assignment"
+				message = "Not authorized for tenant assignment."
+				L.error(message, struct_data={
+					"agent_cid": session.Credentials.Id,
+					"tenant": tenant
+				})
+				return {
+					"result": "NOT-AUTHORIZED",
+					"message": message,
+					"error_data": {"tenant": tenant},
+				}
+
+		for tenant in tenants_to_unassign:
+			# Check permission
+			if not rbac_svc.has_resource_access(session.Authorization.Authz, tenant, ["seacat:tenant:assign"]):
+				message = "Not authorized for tenant unassignment."
 				L.error(message, struct_data={
 					"agent_cid": session.Credentials.Id,
 					"tenant": tenant