From a3bb5423a89a1f4bf12f55a02e4ddd58c4d07557 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Mon, 13 Apr 2026 19:14:33 +0200
Subject: [PATCH] Add tenant scoping to LoadAllByCookieBannerID
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every other LoadAll* method in coredata takes a Scoper parameter
for tenant isolation. LoadAllByCookieBannerID was the only one
that omitted it, making the isolation invariant depend entirely
on callers first loading the banner with a scoped query.

Add scope.SQLFragment to the WHERE clause to match the pattern
used by the paginated sibling LoadByCookieBannerID.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/cookiebanner/service.go     | 10 +++++-----
 pkg/coredata/cookie_category.go |  7 ++++++-
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkg/cookiebanner/service.go b/pkg/cookiebanner/service.go
index 448fbdd9c..6ed6c1c35 100644
--- a/pkg/cookiebanner/service.go
+++ b/pkg/cookiebanner/service.go
@@ -283,7 +283,7 @@ func (s *Service) CreateCookieBanner(
 			}
 
 			var categories coredata.CookieCategories
-			if err := categories.LoadAllByCookieBannerID(ctx, tx, banner.ID); err != nil {
+			if err := categories.LoadAllByCookieBannerID(ctx, tx, scope, banner.ID); err != nil {
 				return fmt.Errorf("cannot load cookie categories: %w", err)
 			}
 
@@ -430,7 +430,7 @@ func (s *Service) UpdateCookieBanner(
 
 			if consentChanged {
 				var categories coredata.CookieCategories
-				if err := categories.LoadAllByCookieBannerID(ctx, tx, banner.ID); err != nil {
+				if err := categories.LoadAllByCookieBannerID(ctx, tx, scope, banner.ID); err != nil {
 					return fmt.Errorf("cannot load cookie categories: %w", err)
 				}
 
@@ -635,7 +635,7 @@ func (s *Service) CreateCookieCategory(
 			}
 
 			var categories coredata.CookieCategories
-			if err := categories.LoadAllByCookieBannerID(ctx, tx, req.CookieBannerID); err != nil {
+			if err := categories.LoadAllByCookieBannerID(ctx, tx, scope, req.CookieBannerID); err != nil {
 				return fmt.Errorf("cannot load cookie categories: %w", err)
 			}
 
@@ -779,7 +779,7 @@ func (s *Service) UpdateCookieCategory(
 			}
 
 			var categories coredata.CookieCategories
-			if err := categories.LoadAllByCookieBannerID(ctx, tx, category.CookieBannerID); err != nil {
+			if err := categories.LoadAllByCookieBannerID(ctx, tx, scope, category.CookieBannerID); err != nil {
 				return fmt.Errorf("cannot load cookie categories: %w", err)
 			}
 
@@ -829,7 +829,7 @@ func (s *Service) DeleteCookieCategory(
 			}
 
 			var categories coredata.CookieCategories
-			if err := categories.LoadAllByCookieBannerID(ctx, tx, bannerID); err != nil {
+			if err := categories.LoadAllByCookieBannerID(ctx, tx, scope, bannerID); err != nil {
 				return fmt.Errorf("cannot load cookie categories: %w", err)
 			}
 
diff --git a/pkg/coredata/cookie_category.go b/pkg/coredata/cookie_category.go
index e266d221b..0d9e13111 100644
--- a/pkg/coredata/cookie_category.go
+++ b/pkg/coredata/cookie_category.go
@@ -212,6 +212,7 @@ WHERE
 func (c *CookieCategories) LoadAllByCookieBannerID(
 	ctx context.Context,
 	conn pg.Querier,
+	scope Scoper,
 	cookieBannerID gid.GID,
 ) error {
 	q := `
@@ -229,12 +230,16 @@ SELECT
 FROM
 	cookie_categories
 WHERE
-	cookie_banner_id = @cookie_banner_id
+	%s
+	AND cookie_banner_id = @cookie_banner_id
 ORDER BY
 	rank ASC, id ASC;
 `
 
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
 	args := pgx.StrictNamedArgs{"cookie_banner_id": cookieBannerID}
+	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {