Third in the multitenancy series (#2084 empty-orX, #2089 Source lookup, #2093 schema object-source lookup — all merged). After those, external-register (DBAL) reads + filtering work under saasMode:true, but an internal-register object read now fails: DocuDesk report generation returns User 'admin' does not have permission to 'read' objects in schema 'Document Template'.
The template objects live in a different organisation than admin's active org; adminOverride:true is set but does not appear to grant the cross-org read on this path. So saasMode:true still isn't fully functional for a mixed-org dataset.
Repro: enable occ config:app:set openregister multitenancy --value='{"saasMode":true,"adminOverride":true}', POST /apps/docudesk/api/documents/generate with a template in another org → 403-style JSON error.
Questions for the fix: should adminOverride:true bypass org scoping for reads by an actual NC admin? Or is the template schema's org assignment the real issue (should config-owned schemas be org-agnostic)?
Dev instance runs saasMode:false (single-admin box, the known-working state); this issue tracks completing real SaaS multitenancy support.
Third in the multitenancy series (#2084 empty-orX, #2089 Source lookup, #2093 schema object-source lookup — all merged). After those, external-register (DBAL) reads + filtering work under
saasMode:true, but an internal-register object read now fails: DocuDesk report generation returnsUser 'admin' does not have permission to 'read' objects in schema 'Document Template'.The template objects live in a different organisation than admin's active org;
adminOverride:trueis set but does not appear to grant the cross-org read on this path. SosaasMode:truestill isn't fully functional for a mixed-org dataset.Repro: enable
occ config:app:set openregister multitenancy --value='{"saasMode":true,"adminOverride":true}', POST /apps/docudesk/api/documents/generate with a template in another org → 403-style JSON error.Questions for the fix: should
adminOverride:truebypass org scoping for reads by an actual NC admin? Or is the template schema's org assignment the real issue (should config-owned schemas be org-agnostic)?Dev instance runs
saasMode:false(single-admin box, the known-working state); this issue tracks completing real SaaS multitenancy support.