Edit Issue - .issue.db

Title *

Description

GET /api/v1/activities built its SQL with WHERE 1=1 and never filtered by tenant: any tenant's API key listed every tenant's activities (function names, workflow names, errors, worker ids — response rows even carried tenant_id). Found during the #819 UX-review Wave A while implementing the workflow_name filter: demo tenant's real activity count is 172, but the dashboard showed 'All 1281' — the excess was other tenants' data, so the leak was user-visible in production.

Fix (commit a043585): both the page query and the count query now share one filter fragment including wr.tenant_id = g.tenant_id (count query gained the workflow_run JOIN). Orphan activities with no workflow_run row are excluded — rows that cannot be attributed to a tenant must not be shown to one. Verified live: demo-scoped total=172, workflow_name filter returns demo-only rows.

LESSON: list endpoints must be tenant-filtered at the SQL layer, not assumed safe via RBAC decorators — @require_permission checks the caller has 'view_workflows', not WHOSE rows they may view. Audit other list endpoints for the same pattern.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #820