From 710df66fc433901721a7149b1c0afc6f019ab670 Mon Sep 17 00:00:00 2001
From: Chandrapal Badshah <12944530+Chan9390@users.noreply.github.com>
Date: Wed, 1 Oct 2025 00:03:08 +0530
Subject: [PATCH] fix: add validation for default_provider in tenant config

---
 api/src/backend/api/v1/serializers.py | 43 ++++++++++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/api/src/backend/api/v1/serializers.py b/api/src/backend/api/v1/serializers.py
index 4110822842..5b9d458ef9 100644
--- a/api/src/backend/api/v1/serializers.py
+++ b/api/src/backend/api/v1/serializers.py
@@ -18,7 +18,7 @@ from rest_framework_simplejwt.serializers import TokenObtainPairSerializer
 from rest_framework_simplejwt.tokens import RefreshToken
 
 from api.db_router import MainRouter
-from api.exceptions import ConflictException
+from api.exceptions import ConflictException, ModelValidationError
 from api.models import (
     Finding,
     Integration,
@@ -3139,6 +3139,47 @@ class LighthouseTenantConfigUpdateSerializer(BaseWriteSerializer):
             "id": {"read_only": True},
         }
 
+    def validate(self, attrs):
+        """
+        Validate only that default_provider (if supplied):
+        - is a supported provider type, and
+        - has an active provider configuration for this tenant.
+        """
+        validated_attrs = super().validate(attrs)
+
+        default_provider = validated_attrs.get("default_provider", None)
+
+        # To set a default provider, it must be one of the supported provider types and have an active configuration for this tenant
+        if default_provider is not None and default_provider != "":
+            supported_providers = [
+                choice[0]
+                for choice in LighthouseProviderConfiguration.ProviderChoices.choices
+            ]
+            if default_provider not in supported_providers:
+                raise ModelValidationError(
+                    detail=f"Unsupported provider '{default_provider}'",
+                    code="unsupported_default_provider",
+                    pointer="/data/attributes/default_provider",
+                )
+
+            tenant_id = (
+                self.instance.tenant_id
+                if self.instance
+                else self.context.get("tenant_id")
+            )
+            if not LighthouseProviderConfiguration.objects.filter(
+                tenant_id=tenant_id,
+                provider_type=default_provider,
+                is_active=True,
+            ).exists():
+                raise ModelValidationError(
+                    detail=f"No active configuration found for provider '{default_provider}'",
+                    code="invalid_default_provider",
+                    pointer="/data/attributes/default_provider",
+                )
+
+        return validated_attrs
+
 
 # Lighthouse: Provider models