Patched code sample

import sys

# A mock database store to simulate multi-tenancy in ChromaDB.
# Data is structured as: {tenant_id: {collection_name: [data]}}
_db_data = {
    "tenant_acme": {
        "user_profiles": {"data": ["user_a", "user_b"]},
        "invoices": {"data": ["invoice_123", "invoice_456"]},
    },
    "tenant_globex": {
        "user_profiles": {"data": ["user_x", "user_y"]},
        "projects": {"data": ["project_alpha"]},
    },
}

class AuthorizationError(Exception):
    """Custom exception for authorization failures."""
    pass

def get_collection(auth_user_tenant: str, target_tenant: str, collection_name: str):
    """
    Retrieves a collection, but only if the authenticated user's tenant
    matches the tenant of the collection being accessed.

    The vulnerable version of this function would lack the authorization check.
    """
    
    # --- START OF THE FIX ---
    #
    # The vulnerability was a lack of authorization validation. The fix is to
    # explicitly verify that the tenant associated with the authenticated user
    # matches the tenant of the resource they are attempting to access.
    # If this check is omitted, any user can specify any `target_tenant` and
    # access its data.
    
    if auth_user_tenant != target_tenant:
        raise AuthorizationError(
            f"User from tenant '{auth_user_tenant}' is not authorized to "
            f"access resources in tenant '{target_tenant}'."
        )
        
    # --- END OF THE FIX ---

    # If authorization check passes, proceed with the data retrieval.
    tenant_collections = _db_data.get(target_tenant, {})
    return tenant_collections.get(collection_name)

# # --- Example Usage Demonstrating the Fix ---
#
# # 1. A legitimate user from 'tenant_acme' trying to access their own data.
# # This operation is allowed.
# try:
#     legitimate_user = "tenant_acme"
#     collection = get_collection(
#         auth_user_tenant=legitimate_user,
#         target_tenant="tenant_acme",
#         collection_name="user_profiles"
#     )
#     # print(f"Success: ACME user accessed their data: {collection}")
# except AuthorizationError as e:
#     # This block will not be reached.
#     # print(f"Error: {e}", file=sys.stderr)
#     pass
#
# # 2. An attacker from 'tenant_globex' trying to access 'tenant_acme' data.
# # In the vulnerable version, this would succeed. With the fix, it fails.
# try:
#     attacker_user = "tenant_globex"
#     collection = get_collection(
#         auth_user_tenant=attacker_user,
#         target_tenant="tenant_acme", # Attempting to access a different tenant
#         collection_name="invoices"
#     )
#     # This line will not be reached.
#     # print(f"VULNERABILITY! Attacker accessed ACME data: {collection}")
# except AuthorizationError as e:
#     # The fix ensures this exception is raised, preventing the data leak.
#     # print(f"Fixed: Access was correctly denied. Reason: {e}")
#     pass