Scope the per-step participation read to the acting tenant, as the run-wide one already is

Frank Mablyrequested to merge
issue/orchestra-3624395:3624395-scope-the-per-step into 1.x

Issue #3624395.

WorkItemManager::isAccountParticipant() carries a tenant condition; its per-step sibling isAccountTaskParticipant() did not, although the caller describes the two as one question asked of a run and of a step. AssignmentResumer::checkViewAccess() gates an open step on the tenant-scoped checkActionAccess() and a finished one on the unscoped isAccountTaskParticipant(), so a completed step could be read from outside its own tenant.

This adds the tenant condition, so the two agree.

WorkItemParticipationTest::testOtherTenantExcludedForOneToken() mirrors the existing testOtherTenantExcluded() onto the per-token question. It was confirmed to fail without the change (Failed asserting that true is false) and to pass with it.

AI-Generated: Yes (Claude Code was used to help draft this change and its test case. I reviewed both, and the new test was confirmed to fail without the fix and to pass with it.)

Merge request reports