fix(multi-tenancy): scope inject listings so inject_type resolves (#7605)

[Romuald Lemesle (RomuDeuxfois)]

Proposed changes

• Add the TxCtx parameter to the inject read endpoints (exerciseInjects, exerciseInjectsSimple, searchExerciseInjects, exerciseInjectsResults, scenarioInjects, scenarioInject, scenarioInjectsSimple) and to the single-inject mutations that return an Inject (activation, trigger, status, teams). Without it the transaction never sets app.current_tenants, so can_access_tenant fails closed on the v2-scoped injectors table: Inject#getType() and the inject_type criteria selection both resolve the injector through that table and came back null, which the frontend renders as the generic "unknown" icon.
• Register those entrypoints in TenantScopedEntrypointsTxCtxArchTest so the parameter cannot be dropped again.

Testing Instructions

1. Create a simulation with a couple of email injects, run it, open the Execution screen.
2. Injects show their injector logo instead of a question mark, during and after the run.
3. Same check on the scenario Execution tab and on the simulation/scenario Injects list.

Related issues

• Closes fix(general): Injector icons not visible #7605
• Closes fix(injects): inject logos display as a question mark icon on scenario/simulation execution screen #7621

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

[github-actions]

📖 Documentation check — ✅ Passed

2 functional file(s), 0 doc file(s) changed.

No documentation gaps detected.

[Copilot]

Pull request overview

This PR addresses a multi-tenancy v2 scoping regression where inject listings/mutations could serialize inject_type as null (causing the frontend to show the “unknown” icon) because app.current_tenants wasn’t set for the transaction, making can_access_tenant fail closed on the v2-scoped injectors table.

Changes:

• Add a TxCtx controller parameter to multiple simulation/scenario inject read endpoints and inject mutations that return an Inject, ensuring v2 tenant scope is established for serialization paths.
• Register those entrypoints in TenantScopedEntrypointsTxCtxArchTest to prevent future accidental removal of the required TxCtx parameter.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
openaev-api/src/main/java/io/openaev/rest/inject/SimulationInjectApi.java	Adds TxCtx to inject listing/search/results and inject mutation endpoints so v2 tenant scope is set for injector resolution.
openaev-api/src/main/java/io/openaev/rest/inject/ScenarioInjectApi.java	Adds TxCtx to scenario inject listing/single read and activation mutation so injector resolution remains tenant-scoped.
openaev-api/src/test/java/io/openaev/architecture/TenantScopedEntrypointsTxCtxArchTest.java	Extends the ArchUnit guard list to enforce TxCtx presence on the affected entrypoints.

Suppressed comments (2)

openaev-api/src/main/java/io/openaev/rest/inject/ScenarioInjectApi.java:131

• issue (blocking): scenarioInject validates the scenario but then loads the inject with findById(injectId) without scoping it to the scenarioId. With @AccessControl keyed on scenarioId, this can allow reading an inject that belongs to another scenario (within the same tenant) if its id is known. Fetch the inject via a scenario-scoped query (or delegate to ScenarioInjectService#findInjectForScenario).

    Scenario scenario = this.scenarioService.scenario(scenarioId);
    assert scenarioId.equals(scenario.getId());
    return injectRepository.findById(injectId).orElseThrow(ElementNotFoundException::new);

openaev-api/src/main/java/io/openaev/rest/inject/ScenarioInjectApi.java:127

• suggestion (non-blocking): this is a read-only endpoint; switching the surrounding transaction to transactional(readOnly = true) avoids unnecessary dirty-checking overhead (the current annotation above the mapping is read/write).

  public Inject scenarioInject(
      TxCtx ctx,
      @PathVariable @NotBlank final String scenarioId,

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.