Scope device enrollment token deletes

Delete and DeleteExpired omitted Scoper, breaking the
tenant-isolation pattern used elsewhere in coredata. Pass a
tenant scope from ExchangeEnrollmentToken and NewNoScope from
the ITAM GC so cross-tenant cleanup stays explicit.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/coredata/device_enrollment_token.go

@@ -133,15 +133,22 @@ FOR UPDATE;
 func (t *DeviceEnrollmentToken) DeleteExpired(
 	ctx context.Context,
 	conn pg.Tx,
+	scope Scoper,
 	now time.Time,
 ) (int64, error) {
 	q := `
 DELETE FROM device_enrollment_tokens
 WHERE
-    expires_at < @now
+    %s
+    AND expires_at < @now
 `
 
-	result, err := conn.Exec(ctx, q, pgx.StrictNamedArgs{"now": now})
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"now": now}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
 	if err != nil {
 		return 0, fmt.Errorf("cannot delete expired device_enrollment_tokens: %w", err)
 	}
@@ -152,14 +159,19 @@ WHERE
 func (t *DeviceEnrollmentToken) Delete(
 	ctx context.Context,
 	conn pg.Tx,
+	scope Scoper,
 ) error {
 	q := `
 DELETE FROM device_enrollment_tokens
 WHERE
-    id = @id
+    %s
+    AND id = @id
 `
 
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
 	args := pgx.StrictNamedArgs{"id": t.ID}
+	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {

pkg/itam/gc.go

@@ -95,7 +95,7 @@ func (h *gcHandler) cleanup(ctx context.Context) error {
 		func(ctx context.Context, tx pg.Tx) error {
 			var token coredata.DeviceEnrollmentToken
 
-			tokensDeleted, err := token.DeleteExpired(ctx, tx, now)
+			tokensDeleted, err := token.DeleteExpired(ctx, tx, coredata.NewNoScope(), now)
 			if err != nil {
 				return fmt.Errorf("cannot delete expired device enrollment tokens: %w", err)
 			}

pkg/itam/service.go

@@ -324,16 +324,16 @@ func (s *Service) ExchangeEnrollmentToken(
 				return fmt.Errorf("cannot load device enrollment token: %w", err)
 			}
 
+			scope := coredata.NewScope(token.TenantID)
+
 			if now.After(token.ExpiresAt) {
-				if err := token.Delete(ctx, conn); err != nil {
+				if err := token.Delete(ctx, conn, scope); err != nil {
 					return fmt.Errorf("cannot delete expired device enrollment token: %w", err)
 				}
 
 				return ErrEnrollmentTokenExpired
 			}
 
-			scope := coredata.NewScope(token.TenantID)
-
 			device := &coredata.Device{}
 			if err := device.LoadByIDForUpdate(ctx, conn, scope, token.DeviceID); err != nil {
 				return fmt.Errorf("cannot load device: %w", err)
@@ -361,7 +361,7 @@ func (s *Service) ExchangeEnrollmentToken(
 				return fmt.Errorf("cannot set device api key hash: %w", err)
 			}
 
-			if err := token.Delete(ctx, conn); err != nil {
+			if err := token.Delete(ctx, conn, scope); err != nil {
 				return fmt.Errorf("cannot delete device enrollment token: %w", err)
 			}