TenantScopeError (security/tenant_scope.py)

Resolve tenant scope from credentials to prevent cross-tenant data leaks.

# Source: https://github.com/beenuar/AiSOC | License: MIT | Copyright 2024-present AiSOC contributors
# Provided via justclaw.it.com; keep this notice with the code.
"""Resolve which tenant a request may read, from the caller's credential.

Vendored byte-identical into each Python service that needs it, following the
same convention as ``app/core/cors.py`` and ``app/security/service_auth.py``.
Keep the copies in sync — ``scripts/sync_vendored_tenant_scope.py --check``
fails the build if they drift.

Why this exists
---------------
``/fusion/entity-risk/*`` took the tenant as a query parameter with no auth
dependency on the route, on both the API gateway and the fusion service. The
console reaches fusion *directly* through a Next rewrite when ``FUSION_URL`` is
set, so that parameter was rea

... (truncated -- full source via MCP)