Restrict rendered template artifacts

tests/test_templates.py

@@ -10,6 +10,7 @@ from govoplan_core.core.templates import (
     CAPABILITY_TEMPLATE_CATALOG,
     CAPABILITY_TEMPLATE_RENDERER,
     TemplateCompatibilityError,
+    TemplateRenderError,
     TemplateRenderRequest,
 )
 from govoplan_core.db.base import Base
@@ -20,7 +21,11 @@ from govoplan_templates.backend.db.models import (
     TemplateRender,
     TemplateRevision,
 )
-from govoplan_templates.backend.rendering import render_template
+from govoplan_templates.backend.rendering import (
+    get_render_for_principal,
+    list_renders,
+    render_template,
+)
 from govoplan_templates.backend.schemas import (
     TemplateCreateRequest,
     TemplateUpdateRequest,
@@ -33,23 +38,28 @@ from govoplan_templates.backend.service import (
 )
 
 
-def principal(tenant_id: str = "tenant-1") -> ApiPrincipal:
+def principal(
+    tenant_id: str = "tenant-1",
+    *,
+    account_id: str = "account-1",
+    admin: bool = True,
+) -> ApiPrincipal:
+    scopes = {
+        "templates:template:read",
+        "templates:template:write",
+        "templates:template:publish",
+        "templates:template:render",
+        "files:file:upload",
+    }
+    if admin:
+        scopes.add("templates:template:admin")
     return ApiPrincipal(
         principal=PrincipalRef(
-            account_id="account-1",
+            account_id=account_id,
             membership_id="membership-1",
             tenant_id=tenant_id,
             identity_id="identity-1",
-            scopes=frozenset(
-                {
-                    "templates:template:read",
-                    "templates:template:write",
-                    "templates:template:publish",
-                    "templates:template:render",
-                    "templates:template:admin",
-                    "files:file:upload",
-                }
-            ),
+            scopes=frozenset(scopes),
         ),
         account=object(),
         user=type("User", (), {"id": "user-1"})(),
@@ -188,6 +198,45 @@ class TemplateServiceTests(unittest.TestCase):
             self.assertIn(b"Ada", first.payload)
             self.assertIn(b"Grace", first.payload)
 
+    def test_bounded_render_history_and_payload_are_owner_scoped(self) -> None:
+        owner = principal(admin=False)
+        other = principal(account_id="account-2", admin=False)
+        administrator = principal(account_id="account-admin")
+        with self.database.session() as session:
+            item, _ = create_template(session, owner, payload())
+            result = render_template(
+                session,
+                owner,
+                registry=_Registry(),
+                request=TemplateRenderRequest(
+                    template_id=item.id,
+                    usage="campaign.postal",
+                    items=(
+                        {
+                            "name": "Ada",
+                            "postal": {"address": "Street 1"},
+                        },
+                    ),
+                ),
+            )
+            session.commit()
+
+            self.assertEqual(
+                result.render_id,
+                get_render_for_principal(session, owner, result.render_id).id,
+            )
+            with self.assertRaisesRegex(TemplateRenderError, "not found"):
+                get_render_for_principal(session, other, result.render_id)
+            self.assertEqual([], list_renders(session, other))
+            self.assertEqual(
+                result.render_id,
+                get_render_for_principal(
+                    session,
+                    administrator,
+                    result.render_id,
+                ).id,
+            )
+
     def test_label_sheet_page_count_and_missing_fields(self) -> None:
         with self.database.session() as session:
             item, _ = create_template(