Resolve public poll invitations to tenant policy

src/govoplan_poll/backend/capabilities.py

@@ -32,6 +32,7 @@ from govoplan_poll.backend.participation import (
     PollInvitationRevocationRef,
     PollOptionMutationRef,
     PollParticipationContextRef,
+    PollPublicInvitationRef,
     PollResponseGatewayRef,
 )
 from govoplan_poll.backend.participation_service import (
@@ -323,6 +324,28 @@ class SqlPollSchedulingProvider(PollSchedulingProvider):
         except (PollError, ValidationError) as exc:
             raise PollCapabilityError(str(exc)) from exc
 
+    def resolve_public_invitation(
+        self,
+        session: object,
+        *,
+        token: str,
+        gateway: PollResponseGatewayRef,
+    ) -> PollPublicInvitationRef:
+        try:
+            invitation = governed_invitation(
+                session,
+                token=token,
+                gateway=gateway,
+            )
+        except (PollError, ValidationError) as exc:
+            raise PollCapabilityError(str(exc)) from exc
+        return PollPublicInvitationRef(
+            invitation_id=invitation.id,
+            tenant_id=invitation.tenant_id,
+            poll_id=invitation.poll_id,
+            gateway=gateway,
+        )
+
     def submit_governed_response(
         self,
         session: object,

src/govoplan_poll/backend/manifest.py

@@ -90,7 +90,8 @@ DOCUMENTATION = (
         body=(
             "An invitation or signed participation link determines which poll and participant identity a response belongs to. "
             "The poll policy controls anonymity, response updates, result visibility, open and close times, and whether Maybe is allowed. "
-            "Submitting a response is atomic: capacity and choice constraints are checked before the saved response replaces any earlier answer."
+            "Submitting a response is atomic: capacity and choice constraints are checked before the saved response replaces any earlier answer. "
+            "A valid signed link also resolves its tenant before Poll runs, so tenant module policy can withdraw the public surface without exposing another tenant's state."
         ),
         layer="configured",
         documentation_types=("user",),
@@ -117,6 +118,21 @@ def _poll_router(_context: ModuleContext):
     return router
 
 
+def _public_tenant_resolver(request: object, session: object) -> str | None:
+    path_params = getattr(request, "path_params", {})
+    token = str(path_params.get("token") or "").strip()
+    path = str(getattr(getattr(request, "url", None), "path", ""))
+    if not token or "/poll/public/" not in path:
+        return None
+    from govoplan_poll.backend.service import PollError, get_poll_by_invitation_token
+
+    try:
+        poll = get_poll_by_invitation_token(session, token=token)
+    except PollError:
+        return None
+    return poll.tenant_id
+
+
 def _poll_scheduling_provider(context: ModuleContext) -> object:
     del context
     from govoplan_poll.backend.capabilities import SqlPollSchedulingProvider
@@ -147,6 +163,7 @@ manifest = ModuleManifest(
     permissions=PERMISSIONS,
     role_templates=ROLE_TEMPLATES,
     route_factory=_poll_router,
+    public_tenant_resolver=_public_tenant_resolver,
     tenant_summary_providers=(_tenant_summary,),
     capability_factories={
         CAPABILITY_POLL_SCHEDULING: _poll_scheduling_provider,

src/govoplan_poll/backend/participation.py

@@ -19,6 +19,7 @@ from govoplan_core.core.poll_participation import (
     PollParticipationContextRef,
     PollParticipationGatewayProvider,
     PollParticipationPolicy,
+    PollPublicInvitationRef,
     PollResponseGatewayRef,
     participation_token_fingerprint,
     poll_participation_gateway_provider,
@@ -37,6 +38,7 @@ __all__ = [
     "PollParticipationContextRef",
     "PollParticipationGatewayProvider",
     "PollParticipationPolicy",
+    "PollPublicInvitationRef",
     "PollResponseGatewayRef",
     "participation_token_fingerprint",
     "poll_participation_gateway_provider",