GetConnects

1. Centralise tenant scoping in middleware. Read the session tenant, reject any request whose organisationId in the body does not match.
2. Audit every analytics handler against the pattern used by the sibling endpoint that does enforce the check. Copy the pattern into any handler that reads events, activity, or campaign data.
3. Add response-shape testing in CI that runs the analytics endpoints under three synthetic sessions (unauthenticated, low-priv-A, admin-B), failing the build if any returns data outside the caller's scope.
4. Alert on cross-tenant reads at the log ingestion layer. Any request where session.tenant_id does not match the requested tenant should page on-call, since there is no legitimate reason a normal user would trigger one.

Proof-of-concept request:

POST /api/analytics/admin-events HTTP/2
Host: [REDACTED]
Content-Type: application/json
Cookie: token=<low_priv_user>

{
  "json": {
    "organisationId": "<target_org_id>",
    "fromDate": "2026-03-24T06:03:45.531Z",
    "toDate": "2026-04-23T06:03:45.531Z",
    "page": 1,
    "limit": 20
  }
}

Response, truncated and redacted:

{
  "json": {
    "events": [
      {
        "organisation": { "name": "[Tenant name redacted]" },
        "contact": {
          "firstName": "[Redacted]",
          "lastName": "[Redacted]",
          "mobile": { "normalised": "+XX XXX XXX XXX" }
        },
        "eventContent": {
          "data": "[SMS message body redacted]"
        },
        "type": "SMS Sent"
      }
    ]
  }
}