Status: Resolved
Severity: Low
Date: 2026-08-01
Affected: test-client.gp.veripath.co.uk login redirect
Related: 2026-08-01 — test-client DB outage
After restoring the test-client tenant DB (see related incident) and creating the
admin user, logging in at test-client.gp.veripath.co.uk landed on
/dashboard/admin/ — the VeriPath staff superuser dashboard — instead of the
client's own dashboard.
test-client realm), but the post-login redirecttenancy/login_redirect → role ADMIN →dashboards:superuser_dashboard.The role→dashboard routing was duplicated across six files:
| File | Behaviour |
|---|---|
tenancy/views.py (login_redirect) |
Inline if chain — actually handles login (LOGIN_REDIRECT_URL) |
dashboards/routing.py |
Claimed "single source of truth" but not used by the login path; also contained a duplicate dead PARTNER_ROLE_DASHBOARD_URL dict |
dashboards/views/dashboard_redirect.py |
Two copies (function + class) |
dashboards/views/base.py |
get_available_dashboard_url() fallback |
users/views.py |
Signup get_success_url() |
partner/views.py |
handle_no_permission() backstop |
Every map treated ADMIN as the VeriPath staff superuser dashboard, regardless of
tenant context. A client-tenant ADMIN (Keycloak attribute role=ADMIN,
org_id=test-client) was therefore routed to /dashboard/admin/, which is a
partner-only view.
Centralised routing into a single source of truth — dashboards/routing.py →
get_dashboard_url(role, partner_org, tenant) — and delegated every call site to it:
tenancy/views.py, dashboards/views/dashboard_redirect.py (function + class),dashboards/views/base.py, users/views.py, partner/views.py.ADMIN → /partner/PARTNER_ROLE_DASHBOARD_URL dict.dashboards/tests/test_routing.py (behaviour table +routing.py).get_dashboard_url() in dashboards/routing.py. Never add inline role maps in views.python -m django test dashboards.tests.test_routingrole_to_dashboard,ROLE_DASHBOARD_URL, or PARTNER_ROLE_DASHBOARD_URL appear outside routing.py.test-client ADMIN login → /partner/ ✅ADMIN → staff dashboard (unchanged) ✅gp.veripath.co.uk and test-client.gp.veripath.co.uk return 302 → login ✅