Sync GovOPlaN module state

src/govoplan_access/backend/api/v1/auth.py

@@ -38,6 +38,7 @@ from govoplan_core.security.permissions import normalize_email, scopes_grant
 from govoplan_core.security.time import utc_now
 from govoplan_core.settings import settings
 from govoplan_access.backend.semantic import collect_function_assignment_ids, collect_function_delegation_ids, identity_id_for_account
+from govoplan_access.backend.auth.tenant_context import AccessTenantContextSwitcher
 from govoplan_access.backend.security.passwords import verify_password
 from govoplan_access.backend.security.sessions import (
     collect_system_roles,
@@ -46,7 +47,6 @@ from govoplan_access.backend.security.sessions import (
     collect_user_roles,
     collect_user_scopes,
     create_auth_session,
-    switch_auth_session_tenant,
 )
 
 router = APIRouter(prefix="/auth", tags=["auth"])
@@ -413,12 +413,15 @@ def switch_tenant(
     if principal.auth_session is None:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="API keys cannot switch tenant context")
     try:
-        membership = switch_auth_session_tenant(session, principal.auth_session, payload.tenant_id)
+        switched = AccessTenantContextSwitcher().switch_tenant_context(session, principal=principal, tenant_id=payload.tenant_id)
     except LookupError as exc:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=str(exc)) from exc
-    tenant = session.get(Tenant, membership.tenant_id)
+    tenant = session.get(Tenant, switched.tenant_id)
+    membership = session.get(User, switched.membership_id)
     if tenant is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Tenant not found")
+    if membership is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Tenant membership not found")
     session.commit()
     return _me_response(
         session,