Extend tenant maintenance lock for imports

backend/src/plugins/auth.ts

@@ -9,6 +9,7 @@ import {
     authRolePermissions,
     authUsers,
     m2mApiKeys,
+    tenants,
 } from "../../db/schema"
 
 import { eq, and, inArray } from "drizzle-orm"
@@ -23,6 +24,19 @@ export default fp(async (server: FastifyInstance) => {
         url === "/api/mcp" ||
         url.startsWith("/api/mcp/")
 
+    const isWriteMethod = (method: string) =>
+        ["POST", "PUT", "PATCH", "DELETE"].includes(method)
+
+    const isTenantLockAllowedRoute = (urlPath: string) =>
+        urlPath === "/api/auth/me" ||
+        urlPath === "/auth/me" ||
+        urlPath === "/api/tenant/switch" ||
+        urlPath === "/tenant/switch" ||
+        urlPath.startsWith("/api/admin/") ||
+        urlPath.startsWith("/admin/") ||
+        urlPath.startsWith("/api/auth/") ||
+        urlPath.startsWith("/auth/")
+
     const authenticateMcpApiKey = async (apiKey: string) => {
         if (!apiKey.startsWith("fedeo_mcp_")) return false
 
@@ -150,6 +164,25 @@ export default fp(async (server: FastifyInstance) => {
             const tenantId = req.user.tenant_id
             const userId = req.user.user_id
 
+            if (isWriteMethod(req.method) && !isTenantLockAllowedRoute(urlPath)) {
+                const [tenant] = await server.db
+                    .select({
+                        locked: tenants.locked,
+                        lockedByExportJobId: tenants.lockedByExportJobId,
+                    })
+                    .from(tenants)
+                    .where(eq(tenants.id, tenantId))
+                    .limit(1)
+
+                if (tenant?.locked === "maintenance_tenant") {
+                    return reply.code(423).send({
+                        error: "Tenant is locked for maintenance",
+                        locked: tenant.locked,
+                        lockedByExportJobId: tenant.lockedByExportJobId,
+                    })
+                }
+            }
+
             // --------------------------------------------------------
             // 3️⃣ Rollen des Nutzers im Tenant holen
             // --------------------------------------------------------