release: finalize BZOD v0.8.0

src/auth/session.rs

@@ -198,9 +198,9 @@ pub fn authenticate_user_session(
         return Ok(None);
     }
 
-    // Get tenant user (status must be 'active')
+    // Get tenant user (status must be 'active', account_type != 'admin', and tenant_id is Some)
     let user_opt = crate::db::users::get_user_by_id(users_conn, session.user_id)?
-        .filter(|u| u.status == "active");
+        .filter(|u| u.status == "active" && u.account_type != "admin" && u.tenant_id.is_some());
 
     if let Some(user) = user_opt {
         Ok(Some((user, session.id)))
@@ -234,8 +234,8 @@ pub fn authenticate_api_key(
     let user_id_opt: Option<i64> = stmt.query_row([&hashed_key], |row| row.get(0)).optional()?;
 
     if let Some(user_id) = user_id_opt {
-        let user_opt =
-            crate::db::users::get_user_by_id(users_conn, user_id)?.filter(|u| u.status == "active");
+        let user_opt = crate::db::users::get_user_by_id(users_conn, user_id)?
+            .filter(|u| u.status == "active" && u.account_type != "admin" && u.tenant_id.is_some());
 
         if let Some(user) = user_opt {
             return Ok(Some(ApiActor::User(user)));

src/templates/pages.rs

@@ -5,11 +5,17 @@ use axum::{
     response::{Html, IntoResponse, Response},
 };
 
+pub struct AdminPageRow {
+    pub page: LandingPage,
+    pub owner_tenant_id: String,
+    pub owner_username: Option<String>,
+}
+
 #[derive(Template)]
 #[template(path = "pages.html")]
 pub struct PagesTemplate {
     pub admin_username: String,
-    pub pages: Vec<LandingPage>,
+    pub pages: Vec<AdminPageRow>,
     pub csrf_token: String,
     pub error: Option<String>,
     pub current_page: usize,

src/templates/urls.rs

@@ -5,11 +5,17 @@ use axum::{
     response::{Html, IntoResponse, Response},
 };
 
+pub struct AdminUrlRow {
+    pub url: Url,
+    pub owner_tenant_id: String,
+    pub owner_username: Option<String>,
+}
+
 #[derive(Template)]
 #[template(path = "urls.html")]
 pub struct UrlsTemplate {
     pub admin_username: String,
-    pub urls: Vec<Url>,
+    pub urls: Vec<AdminUrlRow>,
     pub csrf_token: String,
     pub error: Option<String>,
     pub tag_filter: Option<String>,

src/web/admin/auth.rs

@@ -116,6 +116,31 @@ fn audit_meta(ip: &str, headers: &HeaderMap) -> String {
     )
 }
 
+pub(crate) fn clear_admin_cookie(jar: CookieJar) -> CookieJar {
+    let cookie = Cookie::build("bzod_session")
+        .path("/")
+        .max_age(time::Duration::ZERO)
+        .build();
+    jar.add(cookie)
+}
+
+pub(crate) fn clear_user_cookie(jar: CookieJar) -> CookieJar {
+    let cookie = Cookie::build("bzod_user_session")
+        .path("/")
+        .max_age(time::Duration::ZERO)
+        .build();
+    jar.add(cookie)
+}
+
+pub(crate) fn invalidate_session_in_db(state: &AppState, session_id: &str) {
+    if session_id.trim().is_empty() {
+        return;
+    }
+    if let Ok(conn) = state.users_db.lock() {
+        let _ = conn.execute("DELETE FROM sessions WHERE id = ?1;", [session_id]);
+    }
+}
+
 // POST /admin/login
 pub async fn login_post(
     State(state): State<AppState>,
@@ -233,6 +258,14 @@ pub async fn login_post(
             let session_token = generate_token(32);
             let expires = (Utc::now() + chrono::Duration::days(30)).to_rfc3339();
 
+            // Invalidate any existing sessions from the jar
+            if let Some(old_admin_cookie) = jar.get("bzod_session") {
+                invalidate_session_in_db(&state, old_admin_cookie.value());
+            }
+            if let Some(old_user_cookie) = jar.get("bzod_user_session") {
+                invalidate_session_in_db(&state, old_user_cookie.value());
+            }
+
             {
                 let conn = match state.users_db.lock() {
                     Ok(c) => c,
@@ -279,6 +312,7 @@ pub async fn login_post(
                 .build();
 
             let mut response_jar = jar.clone();
+            response_jar = clear_user_cookie(response_jar);
             response_jar = response_jar.add(cookie).add(clear_temp);
 
             (response_jar, Redirect::to("/admin/dashboard")).into_response()
@@ -301,14 +335,17 @@ pub async fn login_post(
 }
 
 // GET /logout
-pub async fn public_logout(State(_state): State<AppState>, jar: CookieJar) -> Response {
-    let cookie = Cookie::build("bzod_user_session")
-        .path("/")
-        .max_age(time::Duration::ZERO)
-        .build();
+pub async fn public_logout(State(state): State<AppState>, jar: CookieJar) -> Response {
+    if let Some(user_cookie) = jar.get("bzod_user_session") {
+        invalidate_session_in_db(&state, user_cookie.value());
+    }
+    if let Some(admin_cookie) = jar.get("bzod_session") {
+        invalidate_session_in_db(&state, admin_cookie.value());
+    }
 
     let mut response_jar = jar.clone();
-    response_jar = response_jar.add(cookie);
+    response_jar = clear_user_cookie(response_jar);
+    response_jar = clear_admin_cookie(response_jar);
 
     (response_jar, Redirect::to("/login")).into_response()
 }
@@ -383,6 +420,14 @@ pub async fn public_login_post(
             let session_token = generate_token(32);
             let expires = (Utc::now() + chrono::Duration::days(30)).to_rfc3339();
 
+            // Invalidate any existing sessions from the jar
+            if let Some(old_admin_cookie) = jar.get("bzod_session") {
+                invalidate_session_in_db(&state, old_admin_cookie.value());
+            }
+            if let Some(old_user_cookie) = jar.get("bzod_user_session") {
+                invalidate_session_in_db(&state, old_user_cookie.value());
+            }
+
             {
                 let conn = state.users_db.lock().unwrap();
                 let _ =
@@ -406,23 +451,51 @@ pub async fn public_login_post(
 
             let secure_flag =
                 crate::utils::resolve_cookie_secure(state.config.cookie_secure, &headers);
-            let cookie = Cookie::build(("bzod_user_session", session_token))
-                .path("/")
-                .secure(secure_flag)
-                .http_only(true)
-                .same_site(axum_extra::extract::cookie::SameSite::Strict)
-                .max_age(time::Duration::days(30))
-                .build();
 
-            let clear_temp = Cookie::build("bzod_temp_csrf")
-                .path("/login")
-                .max_age(time::Duration::ZERO)
-                .build();
+            if user.account_type == "admin" {
+                let cookie = Cookie::build(("bzod_session", session_token))
+                    .path("/")
+                    .secure(secure_flag)
+                    .http_only(true)
+                    .same_site(axum_extra::extract::cookie::SameSite::Strict)
+                    .max_age(time::Duration::days(30))
+                    .build();
 
-            let mut response_jar = jar.clone();
-            response_jar = response_jar.add(cookie).add(clear_temp);
+                let clear_temp = Cookie::build("bzod_temp_csrf")
+                    .path("/login")
+                    .max_age(time::Duration::ZERO)
+                    .build();
 
-            (response_jar, Redirect::to("/user/dashboard")).into_response()
+                let mut response_jar = jar.clone();
+                response_jar = clear_user_cookie(response_jar);
+                response_jar = response_jar.add(cookie).add(clear_temp);
+
+                (response_jar, Redirect::to("/admin/dashboard")).into_response()
+            } else {
+                if user.tenant_id.is_none() {
+                    return Redirect::to("/login?error=Invalid tenant configuration")
+                        .into_response();
+                }
+
+                let cookie = Cookie::build(("bzod_user_session", session_token))
+                    .path("/")
+                    .secure(secure_flag)
+                    .http_only(true)
+                    .same_site(axum_extra::extract::cookie::SameSite::Strict)
+                    .max_age(time::Duration::days(30))
+                    .build();
+
+                let clear_temp = Cookie::build("bzod_temp_csrf")
+                    .path("/login")
+                    .max_age(time::Duration::ZERO)
+                    .build();
+
+                let mut response_jar = jar.clone();
+                response_jar = clear_admin_cookie(response_jar);
+                response_jar = response_jar.add(cookie).add(clear_temp);
+
+                (response_jar, Redirect::to("/user/dashboard")).into_response()
+            }
         }
         None => {
             let system_conn = state.system_db.lock().unwrap();
@@ -446,18 +519,16 @@ pub async fn public_login_post(
 
 // GET /admin/logout
 pub async fn logout(State(state): State<AppState>, jar: CookieJar) -> Response {
-    if let Ok((_, session_id)) = require_auth(&state, &jar).await {
-        let conn = state.users_db.lock().unwrap();
-        let _ = conn.execute("DELETE FROM sessions WHERE id = ?1;", [&session_id]);
+    if let Some(admin_cookie) = jar.get("bzod_session") {
+        invalidate_session_in_db(&state, admin_cookie.value());
+    }
+    if let Some(user_cookie) = jar.get("bzod_user_session") {
+        invalidate_session_in_db(&state, user_cookie.value());
     }
 
-    let cookie = Cookie::build("bzod_session")
-        .path("/")
-        .max_age(time::Duration::ZERO)
-        .build();
-
     let mut response_jar = jar.clone();
-    response_jar = response_jar.add(cookie);
+    response_jar = clear_admin_cookie(response_jar);
+    response_jar = clear_user_cookie(response_jar);
 
     (response_jar, Redirect::to("/admin/login")).into_response()
 }

src/web/admin/mod.rs

@@ -86,32 +86,74 @@ pub(crate) fn write_audit_log(
 pub(crate) const PAGE_SIZE: usize = 25;
 pub(crate) const ANALYTICS_PAGE_SIZE: usize = 50;
 pub(crate) const MAX_JSON_EXPORT_ROWS: usize = 50_000;
-// Helper: Verify admin session and return user or redirect to login
+// Helper: Verify admin session and return user or error response (403 Forbidden / login redirect)
 pub(crate) async fn require_auth(
     state: &AppState,
     jar: &CookieJar,
-) -> Result<(User, String), Redirect> {
+) -> Result<(User, String), Response> {
     let conn = match state.users_db.lock() {
         Ok(c) => c,
-        Err(_) => return Err(Redirect::to("/admin/login")),
+        Err(_) => return Err(Redirect::to("/admin/login").into_response()),
     };
+
     match authenticate_admin_session(&conn, jar) {
         Ok(Some((user, session_id))) => Ok((user, session_id)),
-        _ => Err(Redirect::to("/admin/login")),
+        Ok(None) => {
+            // Check if user is logged in as a normal tenant user trying to access admin route
+            if let Ok(Some((tenant_user, _))) = authenticate_user_session(&conn, jar) {
+                if tenant_user.account_type != "admin" {
+                    return Err((
+                        StatusCode::FORBIDDEN,
+                        "Forbidden: Standard users cannot access Admin routes",
+                    )
+                        .into_response());
+                }
+            }
+            Err(Redirect::to("/admin/login").into_response())
+        }
+        Err(_) => Err(Redirect::to("/admin/login").into_response()),
     }
 }
-// Helper: Verify tenant user session and return user or redirect to login
+
+// Helper: Verify tenant user session and return tenant user or error response (403 Forbidden / login redirect)
 pub(crate) async fn require_user_auth(
     state: &AppState,
     jar: &CookieJar,
-) -> Result<(crate::models::TenantUser, String), Redirect> {
+) -> Result<(crate::models::TenantUser, String), Response> {
     let conn = match state.users_db.lock() {
         Ok(c) => c,
-        Err(_) => return Err(Redirect::to("/login")),
+        Err(_) => return Err(Redirect::to("/login").into_response()),
     };
+
+    // If an Admin session is present, Core Admin is trying to access /user/* routes -> Reject with 403 Forbidden
+    if let Ok(Some((_admin_user, _))) = authenticate_admin_session(&conn, jar) {
+        return Err((
+            StatusCode::FORBIDDEN,
+            "Forbidden: Core Admin cannot access tenant application routes; use /admin/...",
+        )
+            .into_response());
+    }
+
+    // Now check tenant user session
     match authenticate_user_session(&conn, jar) {
-        Ok(Some((user, session_id))) => Ok((user, session_id)),
-        _ => Err(Redirect::to("/login")),
+        Ok(Some((user, session_id))) => {
+            if user.account_type == "admin" {
+                return Err((
+                    StatusCode::FORBIDDEN,
+                    "Forbidden: Core Admin cannot access tenant application routes; use /admin/...",
+                )
+                    .into_response());
+            }
+            if user.tenant_id.is_none() {
+                return Err((
+                    StatusCode::FORBIDDEN,
+                    "Forbidden: User has no assigned TenantId",
+                )
+                    .into_response());
+            }
+            Ok((user, session_id))
+        }
+        _ => Err(Redirect::to("/login").into_response()),
     }
 }
 #[derive(Deserialize)]

src/web/admin/pages.rs

@@ -118,9 +118,10 @@ pub async fn user_pages_create(
         }
     }
 
-    let owner_tid = user
-        .tenant_id
-        .unwrap_or_else(crate::identity::TenantId::generate);
+    let owner_tid = match user.tenant_id {
+        Some(tid) => tid,
+        None => return (StatusCode::FORBIDDEN, "Missing tenant identity").into_response(),
+    };
 
     {
         let reserved_conn = state.db.reserved.lock().unwrap();
@@ -319,10 +320,10 @@ pub async fn pages_get(
                     }
                 }
             }
-            if let Some(p) = resolved_page {
-                pages.push(p);
+            let page = if let Some(p) = resolved_page {
+                p
             } else {
-                pages.push(crate::models::LandingPage {
+                crate::models::LandingPage {
                     id: target_id,
                     code: slug.clone(),
                     slug,
@@ -331,8 +332,23 @@ pub async fn pages_get(
                     state: status,
                     created_at,
                     updated_at,
-                });
-            }
+                }
+            };
+            let owner_username = {
+                let u_conn = state.users_db.lock().unwrap();
+                u_conn
+                    .query_row(
+                        "SELECT username FROM users WHERE tenant_id = ?1;",
+                        [&owner_tid_str],
+                        |r| r.get(0),
+                    )
+                    .ok()
+            };
+            pages.push(crate::templates::pages::AdminPageRow {
+                page,
+                owner_tenant_id: owner_tid_str,
+                owner_username,
+            });
         }
 
         let start_page = current_page.saturating_sub(3).max(1);
@@ -382,7 +398,11 @@ pub async fn pages_create(
         Err(redir) => return redir.into_response(),
     };
 
-    Redirect::to("/admin/pages?error=Admin is a platform operator and cannot create unowned application pages; create landing pages via a tenant user account").into_response()
+    (
+        StatusCode::FORBIDDEN,
+        "Admin is a platform operator and cannot create unowned application pages; create landing pages via a tenant user account",
+    )
+        .into_response()
 }
 
 // POST /admin/pages/delete/:id

src/web/admin/settings.rs

@@ -253,9 +253,7 @@ pub async fn user_restore_backup_post(
         let mut archive = tar::Archive::new(tar_gz);
         archive.unpack(&temp_unpack_dir)?;
 
-        let target_tenant_id = user
-            .tenant_id
-            .unwrap_or_else(crate::identity::TenantId::generate);
+        let target_tenant_id = user.tenant_id.ok_or("User is missing assigned TenantId")?;
         let temp_content_db = temp_unpack_dir.join("content.db");
         if !temp_content_db.exists() {
             return Err("Backup is missing content.db".into());

src/web/admin/urls.rs

@@ -153,9 +153,10 @@ pub async fn user_urls_create(
         }
     }
 
-    let owner_tid = user
-        .tenant_id
-        .unwrap_or_else(crate::identity::TenantId::generate);
+    let owner_tid = match user.tenant_id {
+        Some(tid) => tid,
+        None => return (StatusCode::FORBIDDEN, "Missing tenant identity").into_response(),
+    };
 
     {
         let reserved_conn = state.db.reserved.lock().unwrap();
@@ -415,10 +416,10 @@ pub async fn urls_get(
                     }
                 }
             }
-            if let Some(u) = resolved_url {
-                urls.push(u);
+            let url = if let Some(u) = resolved_url {
+                u
             } else {
-                urls.push(crate::models::Url {
+                crate::models::Url {
                     id: target_id,
                     code: slug,
                     destination: String::new(),
@@ -435,8 +436,23 @@ pub async fn urls_get(
                     expired: false,
                     last_latency_ms: None,
                     last_status: None,
-                });
-            }
+                }
+            };
+            let owner_username = {
+                let u_conn = state.users_db.lock().unwrap();
+                u_conn
+                    .query_row(
+                        "SELECT username FROM users WHERE tenant_id = ?1;",
+                        [&owner_tid_str],
+                        |r| r.get(0),
+                    )
+                    .ok()
+            };
+            urls.push(crate::templates::urls::AdminUrlRow {
+                url,
+                owner_tenant_id: owner_tid_str,
+                owner_username,
+            });
         }
 
         let start_page = current_page.saturating_sub(3).max(1);
@@ -505,7 +521,11 @@ pub async fn urls_create(
         Err(redir) => return redir.into_response(),
     };
 
-    Redirect::to("/admin/urls?error=Admin is a platform operator and cannot create unowned application URLs; create links via a tenant user account").into_response()
+    (
+        StatusCode::FORBIDDEN,
+        "Admin is a platform operator and cannot create unowned application URLs; create links via a tenant user account",
+    )
+        .into_response()
 }
 
 // POST /admin/urls/delete/:id

src/web/api.rs

@@ -164,7 +164,7 @@ pub async fn api_create_url(
     let (target_user_id, target_tenant_id, content_db) = match user.0 {
         crate::models::ApiActor::Admin(_) => {
             return (
-                StatusCode::BAD_REQUEST,
+                StatusCode::FORBIDDEN,
                 Json(ApiError {
                     error: "Admin is a platform operator and cannot create application URLs directly without tenant context".to_string(),
                 }),
@@ -184,9 +184,18 @@ pub async fn api_create_url(
                         .into_response()
                 }
             };
-            let tid = u
-                .tenant_id
-                .unwrap_or_else(crate::identity::TenantId::generate);
+            let tid = match u.tenant_id {
+                Some(t) => t,
+                None => {
+                    return (
+                        StatusCode::FORBIDDEN,
+                        Json(ApiError {
+                            error: "User has no assigned TenantId".to_string(),
+                        }),
+                    )
+                        .into_response();
+                }
+            };
             (u.id, tid, user_dbs.content.clone())
         }
     };
@@ -560,7 +569,7 @@ pub async fn api_create_page(
     let (target_user_id, target_tenant_id, content_db) = match user.0 {
         crate::models::ApiActor::Admin(_) => {
             return (
-                StatusCode::BAD_REQUEST,
+                StatusCode::FORBIDDEN,
                 Json(ApiError {
                     error: "Admin is a platform operator and cannot create application landing pages directly without tenant context".to_string(),
                 }),
@@ -580,9 +589,18 @@ pub async fn api_create_page(
                         .into_response()
                 }
             };
-            let tid = u
-                .tenant_id
-                .unwrap_or_else(crate::identity::TenantId::generate);
+            let tid = match u.tenant_id {
+                Some(t) => t,
+                None => {
+                    return (
+                        StatusCode::FORBIDDEN,
+                        Json(ApiError {
+                            error: "User has no assigned TenantId".to_string(),
+                        }),
+                    )
+                        .into_response();
+                }
+            };
             (u.id, tid, user_dbs.content.clone())
         }
     };

src/web/bulk.rs

@@ -217,7 +217,7 @@ pub async fn api_bulk_url(
     let (target_user_id, target_tenant_id, content_db) = match user.0 {
         crate::models::ApiActor::Admin(_) => {
             return (
-                StatusCode::BAD_REQUEST,
+                StatusCode::FORBIDDEN,
                 Json(BulkErrorResponse {
                     error: "Admin is a platform operator and cannot create application URLs directly without tenant context".to_string(),
                 }),