[cultron]

Why

Since 0.45, Go and Python services check who's calling but don't filter rows by tenant. In a multi-tenant schema, any signed-in user could read and change every tenant's rows.

What

With auth configured, Go and Python now match TypeScript:

• lists and reads only return the caller's tenant's rows;
• a create stores the caller's tenant, whatever the body says;
• an update can't move a row to another tenant;
• another tenant's row returns 404;
• a caller with no tenant gets 403;
• bypassRoles and enforceOn are honored.

How each language does it:

• Go: the middleware also puts the caller on the request context. Scoped services add a tenant WHERE before the user's filters, and those filters (including the grouped or) are ANDed with it. The tenant is compared as text, because claims are strings and the column may be an integer or a uuid. Shared helpers live in services/scope.go and handlers/scope.go.
• Python: QueryBuilder takes scope conditions. Routers pass request.state.auth to the service, which scopes every query and sets the tenant on create.
• TypeScript fix found by the new checks: a PATCH with another tenant's organizationId moved the row to that tenant. The scope guard now forces the caller's tenant on update.

Nested scopeBy paths (task.workspaceId) are still TypeScript-only. Go and Python print a warning for them.

Tests

• The auth smoke now runs the tenant checks in all three languages. Another tenant can't read, list, update or delete the row; the owner's update can't move it; a caller with no tenant gets 403; and a field named orgId scopes like organizationId. It runs for all six provider cases.
• Unit tests: 518 pass.

Locally, every auth check passes in TypeScript, Go and Python.