Tenant Isolation Review
Esta vista canónica refleja el endpoint /api/growth-platform/tenant-isolation-review y conserva el alcance sandbox: referencias de proveedor, evidencia de sandbox y handoff sin fondos bajo custodia de AltiroPay.
- tenant isolation review ready local only
- Referencias env-only
- Sin custodia de fondos
- Pendiente de revision previa
Resumen de campos
| field | value |
|---|---|
| id | tenant_isolation_review_company_client_demo_brand_demo_store |
| status | tenant isolation review ready local only |
| companyId | company_client_demo |
| companyName | Cliente Demo |
| brandId | brand_demo_store |
| brandName | Demo Store |
| clientPortalId | client_portal_company_client_demo |
| tenantScope | company level rls |
| accessModel | Vista cliente lectura |
| rlsStatus | local rls target documented not applied |
| productionEnabled | false |
| productionReadiness | Pendiente de revision previa |
| noCustodyOfFunds | true |
| notPaymentGateway | true |
| providerFeesIncluded | false |
| settlementHandledByProvider | true |
isolationChecks
| id | label | status | evidence |
|---|---|---|---|
| growth_company_members | Company-level RLS through growth_company_members | documented local target | supabase/migrations/20260625174800_growth_platform_rls.sql |
| no_anon_grants | No anon grants for Growth Platform tables | documented local target | docs/contracts/data-contract.md |
| brand_company_match | Brand belongs to requested company | pass local dataset | brand_demo_store -> company_client_demo |
| read_only_portal | Client portal remains read-only | pass local view | Vista cliente lectura |
| credential_references_omitted | Credential references and bank fields omitted from review | pass sanitized output | review payload |
evidenceRequired
| id | label | href | status |
|---|---|---|---|
| supabase_rls_lint | Run Supabase RLS lint against local database | docs/contracts/security-contract.md | Requerido antes de produccion |
| two_user_rls_test | Validate two-user company isolation with authenticated users | docs/contracts/data-contract.md | Requerido antes de produccion |
| client_portal_read_only_review | Review client portal read-only access model | /growth-platform/client-portal/company_client_demo | client portal ready read only local |
| security_preflight | Run local revision previa preflight | /api/security/preflight | Requerido antes de produccion |
blockedDecisions
| id | label | status |
|---|---|---|
| production_tenant_readiness | Production tenant readiness | Pendiente de revision previa |
| public_client_portal | Public client portal exposure | blocked until access review |
| live_provider_access | Live provider credentials or routing | prohibited local only |
exports
| label | href | format |
|---|---|---|
| Exportar tenant isolation JSON | /api/growth-platform/tenant-isolation-review?companyId=company_client_demo&brandId=brand_demo_store | json |
| Exportar tenant isolation Markdown | /api/growth-platform/tenant-isolation-review?companyId=company_client_demo&brandId=brand_demo_store&format=markdown | markdown |