From 6e6addaf9520a19dbb7b9747548085e46dd8bbd4 Mon Sep 17 00:00:00 2001 From: dashevchenko Date: Wed, 24 Dec 2025 15:52:21 +0200 Subject: [PATCH 1/2] extended getTenantsByIds API for tenant admins --- .../server/controller/TenantController.java | 15 +++++++++++++-- .../server/controller/TenantControllerTest.java | 5 +++++ 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/application/src/main/java/org/thingsboard/server/controller/TenantController.java b/application/src/main/java/org/thingsboard/server/controller/TenantController.java index 2071918dc1..f278f4fd18 100644 --- a/application/src/main/java/org/thingsboard/server/controller/TenantController.java +++ b/application/src/main/java/org/thingsboard/server/controller/TenantController.java @@ -169,7 +169,7 @@ public class TenantController extends BaseController { return checkNotNull(tenantService.findTenantInfos(pageLink)); } - @PreAuthorize("hasAnyAuthority('SYS_ADMIN')") + @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')") @GetMapping(value = "/tenants", params = {"tenantIds"}) public List getTenantsByIds( @Parameter(description = "A list of tenant ids, separated by comma ','", array = @ArraySchema(schema = @Schema(type = "string"))) @@ -179,7 +179,18 @@ public class TenantController extends BaseController { for (UUID tenantIdUUID : tenantUUIDs) { tenantIds.add(TenantId.fromUUID(tenantIdUUID)); } - return tenantService.findTenantsByIds(tenantId, tenantIds); + List tenants = tenantService.findTenantsByIds(tenantId, tenantIds); + return filterTenantsByReadPermission(tenants); + } + + private List filterTenantsByReadPermission(List tenants) { + return tenants.stream().filter(tenant -> { + try { + return accessControlService.hasPermission(getCurrentUser(), Resource.TENANT, Operation.READ, tenant.getId(), tenant); + } catch (ThingsboardException e) { + return false; + } + }).toList(); } } diff --git a/application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java index 4b439ab4f9..1c0776c2ce 100644 --- a/application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java @@ -219,6 +219,11 @@ public class TenantControllerTest extends AbstractControllerTest { Assert.assertEquals(savedTenant, foundTenant); } + loginTenantAdmin(); + Tenant[] foundTenantsByTenant = doGet("/api/tenants?tenantIds=" + idsParam, Tenant[].class); + assertThat(foundTenantsByTenant).isEmpty(); + + loginSysAdmin(); for (Tenant savedTenant : savedTenants) { deleteTenant(savedTenant.getId()); } From 642614720dc814ebd723c4a4c45a39938d25badc Mon Sep 17 00:00:00 2001 From: dashevchenko Date: Thu, 8 Jan 2026 11:28:54 +0200 Subject: [PATCH 2/2] enhanced test --- .../thingsboard/server/controller/TenantControllerTest.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java index 1c0776c2ce..1ae03eba34 100644 --- a/application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java +++ b/application/src/test/java/org/thingsboard/server/controller/TenantControllerTest.java @@ -223,6 +223,10 @@ public class TenantControllerTest extends AbstractControllerTest { Tenant[] foundTenantsByTenant = doGet("/api/tenants?tenantIds=" + idsParam, Tenant[].class); assertThat(foundTenantsByTenant).isEmpty(); + Tenant[] foundCurrentTenant = doGet("/api/tenants?tenantIds=" + tenantId, Tenant[].class); + assertThat(foundCurrentTenant).hasSize(1); + assertThat(foundCurrentTenant[0].getTenantId()).isEqualTo(tenantId); + loginSysAdmin(); for (Tenant savedTenant : savedTenants) { deleteTenant(savedTenant.getId());