From 714db3b7f52eb4f4f62d5fd04b62cd21d2454018 Mon Sep 17 00:00:00 2001
From: Clifton Cunningham <clifton.cunningham@gmail.com>
Date: Sun, 27 Sep 2026 20:48:05 +0100
Subject: [PATCH] analytics: scope the dashboard-visibility setup delete by
 tenant

The kit's unscoped-allowlist scan walks every tracked file under src/,
plugin tests included, and flagged the delete by pageId alone.

Fixes #8.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../tests/api/dashboard-visibility.test.ts         |  8 ++++++--
 plugins/analytics/docs/upgrades/unreleased.md      | 14 +++++++++++---
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/plugins/analytics/apps/web/src/plugins/analytics/tests/api/dashboard-visibility.test.ts b/plugins/analytics/apps/web/src/plugins/analytics/tests/api/dashboard-visibility.test.ts
index 942490f..2ef4a4e 100644
--- a/plugins/analytics/apps/web/src/plugins/analytics/tests/api/dashboard-visibility.test.ts
+++ b/plugins/analytics/apps/web/src/plugins/analytics/tests/api/dashboard-visibility.test.ts
@@ -30,7 +30,7 @@ import {
   sessionCookieHeader,
   setupTestDatabase,
 } from '@testkit/integration'
-import { eq } from 'drizzle-orm'
+import { and, eq } from 'drizzle-orm'
 import { beforeAll, describe, expect, it } from 'vitest'
 import { groupMembers, groups, groupTypes } from '@/db/schema/kit'
 import { analyticsPageGroups } from '../../db/schema/analytics-page-groups'
@@ -155,7 +155,11 @@ describe('a dashboard restricted to a group', () => {
 describe('an EMPTY grant list is private, not public', () => {
   it('narrows to the creator and admins when the last group goes', async () => {
     const orphaned = await page(creator.userId, 'groups', [groupId])
-    await db.delete(analyticsPageGroups).where(eq(analyticsPageGroups.pageId, orphaned))
+    await db
+      .delete(analyticsPageGroups)
+      .where(
+        and(eq(analyticsPageGroups.tenantId, tenantId), eq(analyticsPageGroups.pageId, orphaned))
+      )
 
     for (const [label, get, isAdminLevel] of [
       ['the creator', () => creator, true],
diff --git a/plugins/analytics/docs/upgrades/unreleased.md b/plugins/analytics/docs/upgrades/unreleased.md
index 963d6ee..9c374dd 100644
--- a/plugins/analytics/docs/upgrades/unreleased.md
+++ b/plugins/analytics/docs/upgrades/unreleased.md
@@ -4,7 +4,7 @@ previous: 3.4.1
 date: null
 breaking: false
 migrations: []
-areas: []
+areas: [api]
 touches_surfaces: []
 requires_surfaces: []
 manual: false
@@ -12,11 +12,19 @@ manual: false
 
 ## What changed
 
-_Nothing yet. Add an entry here in the same pull request as the change — see `README.md` beside this
-file for the fields and for what "How to apply" has to say._
+The dashboard-visibility test's setup delete now names the tenant, so an app with analytics installed passes the kit's `unscoped-allowlist` scan.
+
+- `apps/web/src/plugins/analytics/tests/api/dashboard-visibility.test.ts`: the delete that removes a page's last group grant filters on `tenantId` as well as `pageId` (#8).
 
 ## How to apply
 
+1. `pnpm plugin upgrade analytics --apply` replaces the test file; nothing else changes.
+2. If the app added `src/plugins/analytics/tests/api/dashboard-visibility.test.ts` to `CORE_UNSCOPED_ALLOWLIST` in `apps/web/tests/config/unscoped-allowlist.test.ts` as a workaround, delete that entry: the test fails a stale allow-list entry.
+
 ## Conflicts to expect
 
+None.
+
 ## Verify
+
+1. `pnpm web test:config` passes, including `tests/config/unscoped-allowlist.test.ts`.