feat: harden sessions and track downstream acknowledgements

api/src/tenants/tenants.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Delete, Get, Param, Post, Put } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
+import { RequireRecentAuthentication } from '../auth/require-recent-authentication.decorator';
 import { CreateTenantDto, TenantsService, UpdateTenantDto } from './tenants.service';
 
 @ApiTags('tenants')
@@ -23,21 +24,25 @@ export class TenantsController {
   }
 
   @Post()
+  @RequireRecentAuthentication()
   create(@Body() body: CreateTenantDto) {
     return this.tenants.create(body);
   }
 
   @Put(':id')
+  @RequireRecentAuthentication()
   update(@Param('id') id: string, @Body() body: UpdateTenantDto) {
     return this.tenants.update(id, body);
   }
 
   @Post(':id/status')
+  @RequireRecentAuthentication()
   changeStatus(@Param('id') id: string, @Body() body: { status: string }) {
     return this.tenants.changeStatus(id, body.status);
   }
 
   @Delete(':id')
+  @RequireRecentAuthentication()
   delete(@Param('id') id: string) {
     return this.tenants.delete(id);
   }