Issue:
Bug: feat(user_roles): support tenant_id reads



For tenancy support tenant_id in user roles queries
- Adding tenant id to reads, deletes and updates queries.

Pull request description:
## Type of Change
<!-- Put an `x` in the boxes that apply -->

- [ ] Bugfix
- [x] New feature
- [x] Enhancement
- [ ] Refactoring
- [ ] Dependency updates
- [ ] Documentation
- [ ] CI/CD

## Description
Support tenant id  in user roles queries.

### Additional Changes

- [ ] This PR modifies the API contract
- [ ] This PR modifies the database schema
- [ ] This PR modifies application configuration/environment variables

<!--
Provide links to the files with corresponding changes.

Following are the paths where you can find config files:
1. `config`
2. `crates/router/src/configs`
3. `loadtest/config`
-->


## Motivation and Context
Closes [#6660](https://github.com/juspay/hyperswitch/issues/6660)


## How did you test it?
With tenancy feature flag enabled these changes will be tested when upcoming tenant related PRs from dashboard gets merged.

The current behaviour of user apis should not change. Since hyperswitch has its own tenant id and we don't have tenant_id feature flag enabled for now.
Tested the sanity flows for users. Working as expected.




## Checklist
<!-- Put an `x` in the boxes that apply -->

- [x] I formatted the code `cargo +nightly fmt --all`
- [x] I addressed lints thrown by `cargo clippy`
- [x] I reviewed the submitted code
- [ ] I added unit tests for my changes where possible


Testing:
With tenancy feature flag enabled these changes will be tested when upcoming tenant related PRs from dashboard gets merged.

The current behaviour of user apis should not change. Since hyperswitch has its own tenant id and we don't have tenant_id feature flag enabled for now.
Tested the sanity flows for users. Working as expected.

Patch:
diff --git a/crates/diesel_models/src/query/user_role.rs b/crates/diesel_models/src/query/user_role.rs
index ed018cc2381..bb07f671824 100644
--- a/crates/diesel_models/src/query/user_role.rs
+++ b/crates/diesel_models/src/query/user_role.rs
@@ -1,7 +1,11 @@
 use async_bb8_diesel::AsyncRunQueryDsl;
 use common_utils::id_type;
 use diesel::{
-    associations::HasTable, debug_query, pg::Pg, result::Error as DieselError,
+    associations::HasTable,
+    debug_query,
+    pg::Pg,
+    result::Error as DieselError,
+    sql_types::{Bool, Nullable},
     BoolExpressionMethods, ExpressionMethods, QueryDsl,
 };
 use error_stack::{report, ResultExt};
@@ -22,89 +26,70 @@ impl UserRoleNew {
 }
 
 impl UserRole {
-    pub async fn find_by_user_id(
-        conn: &PgPooledConn,
-        user_id: String,
-        version: UserRoleVersion,
-    ) -> StorageResult<Self> {
-        generics::generic_find_one::<<Self as HasTable>::Table, _, _>(
-            conn,
-            dsl::user_id.eq(user_id).and(dsl::version.eq(version)),
-        )
-        .await
-    }
-
-    pub async fn find_by_user_id_merchant_id(
-        conn: &PgPooledConn,
-        user_id: String,
-        merchant_id: id_type::MerchantId,
-        version: UserRoleVersion,
-    ) -> StorageResult<Self> {
-        generics::generic_find_one::<<Self as HasTable>::Table, _, _>(
-            conn,
-            dsl::user_id
-                .eq(user_id)
-                .and(dsl::merchant_id.eq(merchant_id))
-                .and(dsl::version.eq(version)),
-        )
-        .await
-    }
-
-    pub async fn list_by_user_id(
-        conn: &PgPooledConn,
-        user_id: String,
-        version: UserRoleVersion,
-    ) -> StorageResult<Vec<Self>> {
-        generics::generic_filter::<<Self as HasTable>::Table, _, _, _>(
-            conn,
-            dsl::user_id.eq(user_id).and(dsl::version.eq(version)),
-            None,
-            None,
-            Some(dsl::created_at.asc()),
-        )
-        .await
-    }
-
-    pub async fn list_by_merchant_id(
-        conn: &PgPooledConn,
-        merchant_id: id_type::MerchantId,
-        version: UserRoleVersion,
-    ) -> StorageResult<Vec<Self>> {
-        generics::generic_filter::<<Self as HasTable>::Table, _, _, _>(
-            conn,
-            dsl::merchant_id
-                .eq(merchant_id)
-                .and(dsl::version.eq(version)),
-            None,
-            None,
-            Some(dsl::created_at.asc()),
+    fn check_user_in_lineage(
+        tenant_id: id_type::TenantId,
+        org_id: Option<id_type::OrganizationId>,
+        merchant_id: Option<id_type::MerchantId>,
+        profile_id: Option<id_type::ProfileId>,
+    ) -> Box<
+        dyn diesel::BoxableExpression<<Self as HasTable>::Table, Pg, SqlType = Nullable<Bool>>
+            + 'static,
+    > {
+        // Checking in user roles, for a user in token hierarchy, only one of the relations will be true:
+        // either tenant level, org level, merchant level, or profile level
+        // Tenant-level: (tenant_id = ? && org_id = null && merchant_id = null && profile_id = null)
+        // Org-level: (org_id = ? && merchant_id = null && profile_id = null)
+        // Merchant-level: (org_id = ? && merchant_id = ? && profile_id = null)
+        // Profile-level: (org_id = ? && merchant_id = ? && profile_id = ?)
+        Box::new(
+            // Tenant-level condition
+            dsl::tenant_id
+                .eq(tenant_id.clone())
+                .and(dsl::org_id.is_null())
+                .and(dsl::merchant_id.is_null())
+                .and(dsl::profile_id.is_null())
+                .or(
+                    // Org-level condition
+                    dsl::tenant_id
+                        .eq(tenant_id.clone())
+                        .and(dsl::org_id.eq(org_id.clone()))
+                        .and(dsl::merchant_id.is_null())
+                        .and(dsl::profile_id.is_null()),
+                )
+                .or(
+                    // Merchant-level condition
+                    dsl::tenant_id
+                        .eq(tenant_id.clone())
+                        .and(dsl::org_id.eq(org_id.clone()))
+                        .and(dsl::merchant_id.eq(merchant_id.clone()))
+                        .and(dsl::profile_id.is_null()),
+                )
+                .or(
+                    // Profile-level condition
+                    dsl::tenant_id
+                        .eq(tenant_id)
+                        .and(dsl::org_id.eq(org_id))
+                        .and(dsl::merchant_id.eq(merchant_id))
+                        .and(dsl::profile_id.eq(profile_id)),
+                ),
         )
-        .await
     }
 
-    pub async fn find_by_user_id_org_id_merchant_id_profile_id(
+    pub async fn find_by_user_id_tenant_id_org_id_merchant_id_profile_id(
         conn: &PgPooledConn,
         user_id: String,
+        tenant_id: id_type::TenantId,
         org_id: id_type::OrganizationId,
         merchant_id: id_type::MerchantId,
         profile_id: id_type::ProfileId,
         version: UserRoleVersion,
     ) -> StorageResult<Self> {
-        // Checking in user roles, for a user in token hierarchy, only one of the relation will be true, either org level, merchant level or profile level
-        // (org_id = ? && merchant_id = null && profile_id = null)  || (org_id = ? && merchant_id = ? && profile_id = null) || (org_id = ? && merchant_id = ? && profile_id = ?)
-        let check_lineage = dsl::org_id
-            .eq(org_id.clone())
-            .and(dsl::merchant_id.is_null().and(dsl::profile_id.is_null()))
-            .or(dsl::org_id.eq(org_id.clone()).and(
-                dsl::merchant_id
-                    .eq(merchant_id.clone())
-                    .and(dsl::profile_id.is_null()),
-            ))
-            .or(dsl::org_id.eq(org_id).and(
-                dsl::merchant_id
-                    .eq(merchant_id)
-                    .and(dsl::profile_id.eq(profile_id)),
-            ));
+        let check_lineage = Self::check_user_in_lineage(
+            tenant_id,
+            Some(org_id),
+            Some(merchant_id),
+            Some(profile_id),
+        );
 
         let predicate = dsl::user_id
             .eq(user_id)
@@ -114,30 +99,46 @@ impl UserRole {
         generics::generic_find_one::<<Self as HasTable>::Table, _, _>(conn, predicate).await
     }
 
-    pub async fn update_by_user_id_org_id_merchant_id_profile_id(
+    #[allow(clippy::too_many_arguments)]
+    pub async fn update_by_user_id_tenant_id_org_id_merchant_id_profile_id(
         conn: &PgPooledConn,
         user_id: String,
+        tenant_id: id_type::TenantId,
         org_id: id_type::OrganizationId,
         merchant_id: Option<id_type::MerchantId>,
         profile_id: Option<id_type::ProfileId>,
         update: UserRoleUpdate,
         version: UserRoleVersion,
     ) -> StorageResult<Self> {
-        // Checking in user roles, for a user in token hierarchy, only one of the relation will be true, either org level, merchant level or profile level
-        // (org_id = ? && merchant_id = null && profile_id = null)  || (org_id = ? && merchant_id = ? && profile_id = null) || (org_id = ? && merchant_id = ? && profile_id = ?)
-        let check_lineage = dsl::org_id
-            .eq(org_id.clone())
-            .and(dsl::merchant_id.is_null().and(dsl::profile_id.is_null()))
-            .or(dsl::org_id.eq(org_id.clone()).and(
-                dsl::merchant_id
-                    .eq(merchant_id.clone())
+        let check_lineage = dsl::tenant_id
+            .eq(tenant_id.clone())
+            .and(dsl::org_id.is_null())
+            .and(dsl::merchant_id.is_null())
+            .and(dsl::profile_id.is_null())
+            .or(
+                // Org-level condition
+                dsl::tenant_id
+                    .eq(tenant_id.clone())
+                    .and(dsl::org_id.eq(org_id.clone()))
+                    .and(dsl::merchant_id.is_null())
+                    .and(dsl::profile_id.is_null()),
+            )
+            .or(
+                // Merchant-level condition
+                dsl::tenant_id
+                    .eq(tenant_id.clone())
+                    .and(dsl::org_id.eq(org_id.clone()))
+                    .and(dsl::merchant_id.eq(merchant_id.clone()))
                     .and(dsl::profile_id.is_null()),
-            ))
-            .or(dsl::org_id.eq(org_id).and(
-                dsl::merchant_id
-                    .eq(merchant_id)
+            )
+            .or(
+                // Profile-level condition
+                dsl::tenant_id
+                    .eq(tenant_id)
+                    .and(dsl::org_id.eq(org_id))
+                    .and(dsl::merchant_id.eq(merchant_id))
                     .and(dsl::profile_id.eq(profile_id)),
-            ));
+            );
 
         let predicate = dsl::user_id
             .eq(user_id)
@@ -153,29 +154,21 @@ impl UserRole {
         .await
     }
 
-    pub async fn delete_by_user_id_org_id_merchant_id_profile_id(
+    pub async fn delete_by_user_id_tenant_id_org_id_merchant_id_profile_id(
         conn: &PgPooledConn,
         user_id: String,
+        tenant_id: id_type::TenantId,
         org_id: id_type::OrganizationId,
         merchant_id: id_type::MerchantId,
         profile_id: id_type::ProfileId,
         version: UserRoleVersion,
     ) -> StorageResult<Self> {
-        // Checking in user roles, for a user in token hierarchy, only one of the relation will be true, either org level, merchant level or profile level
-        // (org_id = ? && merchant_id = null && profile_id = null)  || (org_id = ? && merchant_id = ? && profile_id = null) || (org_id = ? && merchant_id = ? && profile_id = ?)
-        let check_lineage = dsl::org_id
-            .eq(org_id.clone())
-            .and(dsl::merchant_id.is_null().and(dsl::profile_id.is_null()))
-            .or(dsl::org_id.eq(org_id.clone()).and(
-                dsl::merchant_id
-                    .eq(merchant_id.clone())
-                    .and(dsl::profile_id.is_null()),
-            ))
-            .or(dsl::org_id.eq(org_id).and(
-                dsl::merchant_id
-                    .eq(merchant_id)
-                    .and(dsl::profile_id.eq(profile_id)),
-            ));
+        let check_lineage = Self::check_user_in_lineage(
+            tenant_id,
+            Some(org_id),
+            Some(merchant_id),
+            Some(profile_id),
+        );
 
         let predicate = dsl::user_id
             .eq(user_id)
@@ -190,6 +183,7 @@ impl UserRole {
     pub async fn generic_user_roles_list_for_user(
         conn: &PgPooledConn,
         user_id: String,
+        tenant_id: id_type::TenantId,
         org_id: Option<id_type::OrganizationId>,
         merchant_id: Option<id_type::MerchantId>,
         profile_id: Option<id_type::ProfileId>,
@@ -199,7 +193,7 @@ impl UserRole {
         limit: Option<u32>,
     ) -> StorageResult<Vec<Self>> {
         let mut query = <Self as HasTable>::table()
-            .filter(dsl::user_id.eq(user_id))
+            .filter(dsl::user_id.eq(user_id).and(dsl::tenant_id.eq(tenant_id)))
             .into_boxed();
 
         if let Some(org_id) = org_id {
@@ -248,9 +242,11 @@ impl UserRole {
         }
     }
 
+    #[allow(clippy::too_many_arguments)]
     pub async fn generic_user_roles_list_for_org_and_extra(
         conn: &PgPooledConn,
         user_id: Option<String>,
+        tenant_id: id_type::TenantId,
         org_id: id_type::OrganizationId,
         merchant_id: Option<id_type::MerchantId>,
         profile_id: Option<id_type::ProfileId>,
@@ -258,7 +254,7 @@ impl UserRole {
         limit: Option<u32>,
     ) -> StorageResult<Vec<Self>> {
         let mut query = <Self as HasTable>::table()
-            .filter(dsl::org_id.eq(org_id))
+            .filter(dsl::org_id.eq(org_id).and(dsl::tenant_id.eq(tenant_id)))
             .into_boxed();
 
         if let Some(user_id) = user_id {
diff --git a/crates/router/src/analytics.rs b/crates/router/src/analytics.rs
index 96f41f75ee0..d957c3071ff 100644
--- a/crates/router/src/analytics.rs
+++ b/crates/router/src/analytics.rs
@@ -1864,6 +1864,7 @@ pub mod routes {
                     .global_store
                     .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                         user_id: &auth.user_id,
+                        tenant_id: auth.tenant_id.as_ref().unwrap_or(&state.tenant.tenant_id),
                         org_id: Some(&auth.org_id),
                         merchant_id: None,
                         profile_id: None,
@@ -1987,6 +1988,7 @@ pub mod routes {
                     .global_store
                     .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                         user_id: &auth.user_id,
+                        tenant_id: auth.tenant_id.as_ref().unwrap_or(&state.tenant.tenant_id),
                         org_id: Some(&auth.org_id),
                         merchant_id: None,
                         profile_id: None,
diff --git a/crates/router/src/core/user.rs b/crates/router/src/core/user.rs
index 2087d01dbb4..53db3cf07e1 100644
--- a/crates/router/src/core/user.rs
+++ b/crates/router/src/core/user.rs
@@ -614,6 +614,10 @@ async fn handle_existing_user_invitation(
         .global_store
         .find_user_role_by_user_id_and_lineage(
             invitee_user_from_db.get_user_id(),
+            user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             &user_from_token.org_id,
             &user_from_token.merchant_id,
             &user_from_token.profile_id,
@@ -630,6 +634,10 @@ async fn handle_existing_user_invitation(
         .global_store
         .find_user_role_by_user_id_and_lineage(
             invitee_user_from_db.get_user_id(),
+            user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             &user_from_token.org_id,
             &user_from_token.merchant_id,
             &user_from_token.profile_id,
@@ -660,6 +668,10 @@ async fn handle_existing_user_invitation(
         .global_store
         .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
             user_id: invitee_user_from_db.get_user_id(),
+            tenant_id: user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             org_id,
             merchant_id,
             profile_id,
@@ -962,6 +974,10 @@ pub async fn resend_invite(
         .global_store
         .find_user_role_by_user_id_and_lineage(
             user.get_user_id(),
+            user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             &user_from_token.org_id,
             &user_from_token.merchant_id,
             &user_from_token.profile_id,
@@ -985,6 +1001,10 @@ pub async fn resend_invite(
             .global_store
             .find_user_role_by_user_id_and_lineage(
                 user.get_user_id(),
+                user_from_token
+                    .tenant_id
+                    .as_ref()
+                    .unwrap_or(&state.tenant.tenant_id),
                 &user_from_token.org_id,
                 &user_from_token.merchant_id,
                 &user_from_token.profile_id,
@@ -1064,6 +1084,10 @@ pub async fn accept_invite_from_email_token_only_flow(
         utils::user_role::get_lineage_for_user_id_and_entity_for_accepting_invite(
             &state,
             &user_token.user_id,
+            user_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             entity.entity_id.clone(),
             entity.entity_type,
         )
@@ -1074,6 +1098,10 @@ pub async fn accept_invite_from_email_token_only_flow(
     let (update_v1_result, update_v2_result) = utils::user_role::update_v1_and_v2_user_roles_in_db(
         &state,
         user_from_db.get_user_id(),
+        user_token
+            .tenant_id
+            .as_ref()
+            .unwrap_or(&state.tenant.tenant_id),
         &org_id,
         merchant_id.as_ref(),
         profile_id.as_ref(),
@@ -1260,6 +1288,10 @@ pub async fn list_user_roles_details(
         .global_store
         .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
             user_id: required_user.get_user_id(),
+            tenant_id: user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             org_id: Some(&user_from_token.org_id),
             merchant_id: (requestor_role_info.get_entity_type() <= EntityType::Merchant)
                 .then_some(&user_from_token.merchant_id),
@@ -2435,6 +2467,10 @@ pub async fn list_orgs_for_user(
         .global_store
         .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
             user_id: user_from_token.user_id.as_str(),
+            tenant_id: user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             org_id: None,
             merchant_id: None,
             profile_id: None,
@@ -2500,6 +2536,10 @@ pub async fn list_merchants_for_user_in_org(
                 .global_store
                 .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                     user_id: user_from_token.user_id.as_str(),
+                    tenant_id: user_from_token
+                        .tenant_id
+                        .as_ref()
+                        .unwrap_or(&state.tenant.tenant_id),
                     org_id: Some(&user_from_token.org_id),
                     merchant_id: None,
                     profile_id: None,
@@ -2579,6 +2619,10 @@ pub async fn list_profiles_for_user_in_org_and_merchant_account(
                 .global_store
                 .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                     user_id: user_from_token.user_id.as_str(),
+                    tenant_id: user_from_token
+                        .tenant_id
+                        .as_ref()
+                        .unwrap_or(&state.tenant.tenant_id),
                     org_id: Some(&user_from_token.org_id),
                     merchant_id: Some(&user_from_token.merchant_id),
                     profile_id: None,
@@ -2655,6 +2699,10 @@ pub async fn switch_org_for_user(
         .global_store
         .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
             user_id: &user_from_token.user_id,
+            tenant_id: user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             org_id: Some(&request.org_id),
             merchant_id: None,
             profile_id: None,
@@ -2828,6 +2876,10 @@ pub async fn switch_merchant_for_user_in_org(
                     .global_store
                     .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                         user_id: &user_from_token.user_id,
+                        tenant_id: user_from_token
+                            .tenant_id
+                            .as_ref()
+                            .unwrap_or(&state.tenant.tenant_id),
                         org_id: Some(&user_from_token.org_id),
                         merchant_id: Some(&request.merchant_id),
                         profile_id: None,
@@ -2944,6 +2996,10 @@ pub async fn switch_profile_for_user_in_org_and_merchant(
                 .global_store
                 .list_user_roles_by_user_id(ListUserRolesByUserIdPayload{
                     user_id:&user_from_token.user_id,
+                    tenant_id: user_from_token
+                        .tenant_id
+                        .as_ref()
+                        .unwrap_or(&state.tenant.tenant_id),
                     org_id: Some(&user_from_token.org_id),
                     merchant_id: Some(&user_from_token.merchant_id),
                     profile_id:Some(&request.profile_id),
diff --git a/crates/router/src/core/user_role.rs b/crates/router/src/core/user_role.rs
index 6641e553fd8..eaa655a07f3 100644
--- a/crates/router/src/core/user_role.rs
+++ b/crates/router/src/core/user_role.rs
@@ -159,6 +159,10 @@ pub async fn update_user_role(
         .global_store
         .find_user_role_by_user_id_and_lineage(
             user_to_be_updated.get_user_id(),
+            user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             &user_from_token.org_id,
             &user_from_token.merchant_id,
             &user_from_token.profile_id,
@@ -213,6 +217,10 @@ pub async fn update_user_role(
             .global_store
             .update_user_role_by_user_id_and_lineage(
                 user_to_be_updated.get_user_id(),
+                user_from_token
+                    .tenant_id
+                    .as_ref()
+                    .unwrap_or(&state.tenant.tenant_id),
                 &user_from_token.org_id,
                 Some(&user_from_token.merchant_id),
                 Some(&user_from_token.profile_id),
@@ -232,6 +240,10 @@ pub async fn update_user_role(
         .global_store
         .find_user_role_by_user_id_and_lineage(
             user_to_be_updated.get_user_id(),
+            user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             &user_from_token.org_id,
             &user_from_token.merchant_id,
             &user_from_token.profile_id,
@@ -286,6 +298,10 @@ pub async fn update_user_role(
             .global_store
             .update_user_role_by_user_id_and_lineage(
                 user_to_be_updated.get_user_id(),
+                user_from_token
+                    .tenant_id
+                    .as_ref()
+                    .unwrap_or(&state.tenant.tenant_id),
                 &user_from_token.org_id,
                 Some(&user_from_token.merchant_id),
                 Some(&user_from_token.profile_id),
@@ -320,6 +336,10 @@ pub async fn accept_invitations_v2(
         utils::user_role::get_lineage_for_user_id_and_entity_for_accepting_invite(
             &state,
             &user_from_token.user_id,
+            user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             entity.entity_id,
             entity.entity_type,
         )
@@ -335,6 +355,10 @@ pub async fn accept_invitations_v2(
                 utils::user_role::update_v1_and_v2_user_roles_in_db(
                     &state,
                     user_from_token.user_id.as_str(),
+                    user_from_token
+                        .tenant_id
+                        .as_ref()
+                        .unwrap_or(&state.tenant.tenant_id),
                     org_id,
                     merchant_id.as_ref(),
                     profile_id.as_ref(),
@@ -372,6 +396,10 @@ pub async fn accept_invitations_pre_auth(
         utils::user_role::get_lineage_for_user_id_and_entity_for_accepting_invite(
             &state,
             &user_token.user_id,
+            user_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             entity.entity_id,
             entity.entity_type,
         )
@@ -387,6 +415,10 @@ pub async fn accept_invitations_pre_auth(
                 utils::user_role::update_v1_and_v2_user_roles_in_db(
                     &state,
                     user_token.user_id.as_str(),
+                    user_token
+                        .tenant_id
+                        .as_ref()
+                        .unwrap_or(&state.tenant.tenant_id),
                     org_id,
                     merchant_id.as_ref(),
                     profile_id.as_ref(),
@@ -473,6 +505,10 @@ pub async fn delete_user_role(
         .global_store
         .find_user_role_by_user_id_and_lineage(
             user_from_db.get_user_id(),
+            user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             &user_from_token.org_id,
             &user_from_token.merchant_id,
             &user_from_token.profile_id,
@@ -520,6 +556,10 @@ pub async fn delete_user_role(
             .global_store
             .delete_user_role_by_user_id_and_lineage(
                 user_from_db.get_user_id(),
+                user_from_token
+                    .tenant_id
+                    .as_ref()
+                    .unwrap_or(&state.tenant.tenant_id),
                 &user_from_token.org_id,
                 &user_from_token.merchant_id,
                 &user_from_token.profile_id,
@@ -535,6 +575,10 @@ pub async fn delete_user_role(
         .global_store
         .find_user_role_by_user_id_and_lineage(
             user_from_db.get_user_id(),
+            user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             &user_from_token.org_id,
             &user_from_token.merchant_id,
             &user_from_token.profile_id,
@@ -582,6 +626,10 @@ pub async fn delete_user_role(
             .global_store
             .delete_user_role_by_user_id_and_lineage(
                 user_from_db.get_user_id(),
+                user_from_token
+                    .tenant_id
+                    .as_ref()
+                    .unwrap_or(&state.tenant.tenant_id),
                 &user_from_token.org_id,
                 &user_from_token.merchant_id,
                 &user_from_token.profile_id,
@@ -602,6 +650,11 @@ pub async fn delete_user_role(
         .global_store
         .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
             user_id: user_from_db.get_user_id(),
+            tenant_id: user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
+
             org_id: None,
             merchant_id: None,
             profile_id: None,
@@ -650,6 +703,10 @@ pub async fn list_users_in_lineage(
                 &state,
                 ListUserRolesByOrgIdPayload {
                     user_id: None,
+                    tenant_id: user_from_token
+                        .tenant_id
+                        .as_ref()
+                        .unwrap_or(&state.tenant.tenant_id),
                     org_id: &user_from_token.org_id,
                     merchant_id: None,
                     profile_id: None,
@@ -665,6 +722,10 @@ pub async fn list_users_in_lineage(
                 &state,
                 ListUserRolesByOrgIdPayload {
                     user_id: None,
+                    tenant_id: user_from_token
+                        .tenant_id
+                        .as_ref()
+                        .unwrap_or(&state.tenant.tenant_id),
                     org_id: &user_from_token.org_id,
                     merchant_id: Some(&user_from_token.merchant_id),
                     profile_id: None,
@@ -680,6 +741,10 @@ pub async fn list_users_in_lineage(
                 &state,
                 ListUserRolesByOrgIdPayload {
                     user_id: None,
+                    tenant_id: user_from_token
+                        .tenant_id
+                        .as_ref()
+                        .unwrap_or(&state.tenant.tenant_id),
                     org_id: &user_from_token.org_id,
                     merchant_id: Some(&user_from_token.merchant_id),
                     profile_id: Some(&user_from_token.profile_id),
@@ -779,6 +844,10 @@ pub async fn list_invitations_for_user(
         .global_store
         .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
             user_id: &user_from_token.user_id,
+            tenant_id: user_from_token
+                .tenant_id
+                .as_ref()
+                .unwrap_or(&state.tenant.tenant_id),
             org_id: None,
             merchant_id: None,
             profile_id: None,
diff --git a/crates/router/src/db/kafka_store.rs b/crates/router/src/db/kafka_store.rs
index a9df1abbc08..8b7e7dc0306 100644
--- a/crates/router/src/db/kafka_store.rs
+++ b/crates/router/src/db/kafka_store.rs
@@ -3048,6 +3048,7 @@ impl UserRoleInterface for KafkaStore {
     async fn find_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: &id_type::MerchantId,
         profile_id: &id_type::ProfileId,
@@ -3056,6 +3057,7 @@ impl UserRoleInterface for KafkaStore {
         self.diesel_store
             .find_user_role_by_user_id_and_lineage(
                 user_id,
+                tenant_id,
                 org_id,
                 merchant_id,
                 profile_id,
@@ -3067,6 +3069,7 @@ impl UserRoleInterface for KafkaStore {
     async fn update_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: Option<&id_type::MerchantId>,
         profile_id: Option<&id_type::ProfileId>,
@@ -3076,6 +3079,7 @@ impl UserRoleInterface for KafkaStore {
         self.diesel_store
             .update_user_role_by_user_id_and_lineage(
                 user_id,
+                tenant_id,
                 org_id,
                 merchant_id,
                 profile_id,
@@ -3088,6 +3092,7 @@ impl UserRoleInterface for KafkaStore {
     async fn delete_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: &id_type::MerchantId,
         profile_id: &id_type::ProfileId,
@@ -3096,6 +3101,7 @@ impl UserRoleInterface for KafkaStore {
         self.diesel_store
             .delete_user_role_by_user_id_and_lineage(
                 user_id,
+                tenant_id,
                 org_id,
                 merchant_id,
                 profile_id,
diff --git a/crates/router/src/db/user_role.rs b/crates/router/src/db/user_role.rs
index e4e564dc9a4..0da51898326 100644
--- a/crates/router/src/db/user_role.rs
+++ b/crates/router/src/db/user_role.rs
@@ -15,6 +15,7 @@ use crate::{
 
 pub struct ListUserRolesByOrgIdPayload<'a> {
     pub user_id: Option<&'a String>,
+    pub tenant_id: &'a id_type::TenantId,
     pub org_id: &'a id_type::OrganizationId,
     pub merchant_id: Option<&'a id_type::MerchantId>,
     pub profile_id: Option<&'a id_type::ProfileId>,
@@ -24,6 +25,7 @@ pub struct ListUserRolesByOrgIdPayload<'a> {
 
 pub struct ListUserRolesByUserIdPayload<'a> {
     pub user_id: &'a str,
+    pub tenant_id: &'a id_type::TenantId,
     pub org_id: Option<&'a id_type::OrganizationId>,
     pub merchant_id: Option<&'a id_type::MerchantId>,
     pub profile_id: Option<&'a id_type::ProfileId>,
@@ -43,15 +45,18 @@ pub trait UserRoleInterface {
     async fn find_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: &id_type::MerchantId,
         profile_id: &id_type::ProfileId,
         version: enums::UserRoleVersion,
     ) -> CustomResult<storage::UserRole, errors::StorageError>;
 
+    #[allow(clippy::too_many_arguments)]
     async fn update_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: Option<&id_type::MerchantId>,
         profile_id: Option<&id_type::ProfileId>,
@@ -62,6 +67,7 @@ pub trait UserRoleInterface {
     async fn delete_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: &id_type::MerchantId,
         profile_id: &id_type::ProfileId,
@@ -98,15 +104,17 @@ impl UserRoleInterface for Store {
     async fn find_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: &id_type::MerchantId,
         profile_id: &id_type::ProfileId,
         version: enums::UserRoleVersion,
     ) -> CustomResult<storage::UserRole, errors::StorageError> {
         let conn = connection::pg_connection_read(self).await?;
-        storage::UserRole::find_by_user_id_org_id_merchant_id_profile_id(
+        storage::UserRole::find_by_user_id_tenant_id_org_id_merchant_id_profile_id(
             &conn,
             user_id.to_owned(),
+            tenant_id.to_owned(),
             org_id.to_owned(),
             merchant_id.to_owned(),
             profile_id.to_owned(),
@@ -120,6 +128,7 @@ impl UserRoleInterface for Store {
     async fn update_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: Option<&id_type::MerchantId>,
         profile_id: Option<&id_type::ProfileId>,
@@ -127,9 +136,10 @@ impl UserRoleInterface for Store {
         version: enums::UserRoleVersion,
     ) -> CustomResult<storage::UserRole, errors::StorageError> {
         let conn = connection::pg_connection_write(self).await?;
-        storage::UserRole::update_by_user_id_org_id_merchant_id_profile_id(
+        storage::UserRole::update_by_user_id_tenant_id_org_id_merchant_id_profile_id(
             &conn,
             user_id.to_owned(),
+            tenant_id.to_owned(),
             org_id.to_owned(),
             merchant_id.cloned(),
             profile_id.cloned(),
@@ -144,15 +154,17 @@ impl UserRoleInterface for Store {
     async fn delete_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: &id_type::MerchantId,
         profile_id: &id_type::ProfileId,
         version: enums::UserRoleVersion,
     ) -> CustomResult<storage::UserRole, errors::StorageError> {
         let conn = connection::pg_connection_write(self).await?;
-        storage::UserRole::delete_by_user_id_org_id_merchant_id_profile_id(
+        storage::UserRole::delete_by_user_id_tenant_id_org_id_merchant_id_profile_id(
             &conn,
             user_id.to_owned(),
+            tenant_id.to_owned(),
             org_id.to_owned(),
             merchant_id.to_owned(),
             profile_id.to_owned(),
@@ -170,6 +182,7 @@ impl UserRoleInterface for Store {
         storage::UserRole::generic_user_roles_list_for_user(
             &conn,
             payload.user_id.to_owned(),
+            payload.tenant_id.to_owned(),
             payload.org_id.cloned(),
             payload.merchant_id.cloned(),
             payload.profile_id.cloned(),
@@ -190,6 +203,7 @@ impl UserRoleInterface for Store {
         storage::UserRole::generic_user_roles_list_for_org_and_extra(
             &conn,
             payload.user_id.cloned(),
+            payload.tenant_id.to_owned(),
             payload.org_id.to_owned(),
             payload.merchant_id.cloned(),
             payload.profile_id.cloned(),
@@ -243,6 +257,7 @@ impl UserRoleInterface for MockDb {
     async fn find_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: &id_type::MerchantId,
         profile_id: &id_type::ProfileId,
@@ -251,21 +266,32 @@ impl UserRoleInterface for MockDb {
         let user_roles = self.user_roles.lock().await;
 
         for user_role in user_roles.iter() {
-            let org_level_check = user_role.org_id.as_ref() == Some(org_id)
+            let tenant_level_check = user_role.tenant_id == *tenant_id
+                && user_role.org_id.is_none()
                 && user_role.merchant_id.is_none()
                 && user_role.profile_id.is_none();
 
-            let merchant_level_check = user_role.org_id.as_ref() == Some(org_id)
+            let org_level_check = user_role.tenant_id == *tenant_id
+                && user_role.org_id.as_ref() == Some(org_id)
+                && user_role.merchant_id.is_none()
+                && user_role.profile_id.is_none();
+
+            let merchant_level_check = user_role.tenant_id == *tenant_id
+                && user_role.org_id.as_ref() == Some(org_id)
                 && user_role.merchant_id.as_ref() == Some(merchant_id)
                 && user_role.profile_id.is_none();
 
-            let profile_level_check = user_role.org_id.as_ref() == Some(org_id)
+            let profile_level_check = user_role.tenant_id == *tenant_id
+                && user_role.org_id.as_ref() == Some(org_id)
                 && user_role.merchant_id.as_ref() == Some(merchant_id)
                 && user_role.profile_id.as_ref() == Some(profile_id);
 
             // Check if any condition matches and the version matches
             if user_role.user_id == user_id
-                && (org_level_check || merchant_level_check || profile_level_check)
+                && (tenant_level_check
+                    || org_level_check
+                    || merchant_level_check
+                    || profile_level_check)
                 && user_role.version == version
             {
                 return Ok(user_role.clone());
@@ -282,6 +308,7 @@ impl UserRoleInterface for MockDb {
     async fn update_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: Option<&id_type::MerchantId>,
         profile_id: Option<&id_type::ProfileId>,
@@ -291,21 +318,32 @@ impl UserRoleInterface for MockDb {
         let mut user_roles = self.user_roles.lock().await;
 
         for user_role in user_roles.iter_mut() {
-            let org_level_check = user_role.org_id.as_ref() == Some(org_id)
+            let tenant_level_check = user_role.tenant_id == *tenant_id
+                && user_role.org_id.is_none()
+                && user_role.merchant_id.is_none()
+                && user_role.profile_id.is_none();
+
+            let org_level_check = user_role.tenant_id == *tenant_id
+                && user_role.org_id.as_ref() == Some(org_id)
                 && user_role.merchant_id.is_none()
                 && user_role.profile_id.is_none();
 
-            let merchant_level_check = user_role.org_id.as_ref() == Some(org_id)
+            let merchant_level_check = user_role.tenant_id == *tenant_id
+                && user_role.org_id.as_ref() == Some(org_id)
                 && user_role.merchant_id.as_ref() == merchant_id
                 && user_role.profile_id.is_none();
 
-            let profile_level_check = user_role.org_id.as_ref() == Some(org_id)
+            let profile_level_check = user_role.tenant_id == *tenant_id
+                && user_role.org_id.as_ref() == Some(org_id)
                 && user_role.merchant_id.as_ref() == merchant_id
                 && user_role.profile_id.as_ref() == profile_id;
 
-            // Check if the user role matches the conditions and the version matches
+            // Check if any condition matches and the version matches
             if user_role.user_id == user_id
-                && (org_level_check || merchant_level_check || profile_level_check)
+                && (tenant_level_check
+                    || org_level_check
+                    || merchant_level_check
+                    || profile_level_check)
                 && user_role.version == version
             {
                 match &update {
@@ -336,6 +374,7 @@ impl UserRoleInterface for MockDb {
     async fn delete_user_role_by_user_id_and_lineage(
         &self,
         user_id: &str,
+        tenant_id: &id_type::TenantId,
         org_id: &id_type::OrganizationId,
         merchant_id: &id_type::MerchantId,
         profile_id: &id_type::ProfileId,
@@ -345,21 +384,32 @@ impl UserRoleInterface for MockDb {
 
         // Find the position of the user role to delete
         let index = user_roles.iter().position(|role| {
-            let org_level_check = role.org_id.as_ref() == Some(org_id)
+            let tenant_level_check = role.tenant_id == *tenant_id
+                && role.org_id.is_none()
+                && role.merchant_id.is_none()
+                && role.profile_id.is_none();
+
+            let org_level_check = role.tenant_id == *tenant_id
+                && role.org_id.as_ref() == Some(org_id)
                 && role.merchant_id.is_none()
                 && role.profile_id.is_none();
 
-            let merchant_level_check = role.org_id.as_ref() == Some(org_id)
+            let merchant_level_check = role.tenant_id == *tenant_id
+                && role.org_id.as_ref() == Some(org_id)
                 && role.merchant_id.as_ref() == Some(merchant_id)
                 && role.profile_id.is_none();
 
-            let profile_level_check = role.org_id.as_ref() == Some(org_id)
+            let profile_level_check = role.tenant_id == *tenant_id
+                && role.org_id.as_ref() == Some(org_id)
                 && role.merchant_id.as_ref() == Some(merchant_id)
                 && role.profile_id.as_ref() == Some(profile_id);
 
             // Check if the user role matches the conditions and the version matches
             role.user_id == user_id
-                && (org_level_check || merchant_level_check || profile_level_check)
+                && (tenant_level_check
+                    || org_level_check
+                    || merchant_level_check
+                    || profile_level_check)
                 && role.version == version
         });
 
diff --git a/crates/router/src/services/authentication.rs b/crates/router/src/services/authentication.rs
index c05e4514aaa..d50933b708d 100644
--- a/crates/router/src/services/authentication.rs
+++ b/crates/router/src/services/authentication.rs
@@ -273,6 +273,7 @@ pub struct UserFromToken {
 
 pub struct UserIdFromAuth {
     pub user_id: String,
+    pub tenant_id: Option<id_type::TenantId>,
 }
 
 #[cfg(feature = "olap")]
@@ -858,6 +859,7 @@ where
             Ok((
                 UserIdFromAuth {
                     user_id: payload.user_id.clone(),
+                    tenant_id: payload.tenant_id,
                 },
                 AuthenticationType::SinglePurposeOrLoginJwt {
                     user_id: payload.user_id,
@@ -899,6 +901,7 @@ where
             Ok((
                 UserIdFromAuth {
                     user_id: payload.user_id.clone(),
+                    tenant_id: payload.tenant_id,
                 },
                 AuthenticationType::SinglePurposeOrLoginJwt {
                     user_id: payload.user_id,
diff --git a/crates/router/src/types/domain/user/decision_manager.rs b/crates/router/src/types/domain/user/decision_manager.rs
index 634c781da7f..10990da6ccb 100644
--- a/crates/router/src/types/domain/user/decision_manager.rs
+++ b/crates/router/src/types/domain/user/decision_manager.rs
@@ -1,4 +1,5 @@
 use common_enums::TokenPurpose;
+use common_utils::id_type;
 use diesel_models::{enums::UserStatus, user_role::UserRole};
 use error_stack::{report, ResultExt};
 use masking::Secret;
@@ -24,9 +25,10 @@ impl UserFlow {
         user: &UserFromStorage,
         path: &[TokenPurpose],
         state: &SessionState,
+        user_tenant_id: &id_type::TenantId,
     ) -> UserResult<bool> {
         match self {
-            Self::SPTFlow(flow) => flow.is_required(user, path, state).await,
+            Self::SPTFlow(flow) => flow.is_required(user, path, state, user_tenant_id).await,
             Self::JWTFlow(flow) => flow.is_required(user, state).await,
         }
     }
@@ -50,6 +52,7 @@ impl SPTFlow {
         user: &UserFromStorage,
         path: &[TokenPurpose],
         state: &SessionState,
+        user_tenant_id: &id_type::TenantId,
     ) -> UserResult<bool> {
         match self {
             // Auth
@@ -68,6 +71,7 @@ impl SPTFlow {
                 .global_store
                 .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                     user_id: user.get_user_id(),
+                    tenant_id: user_tenant_id,
                     org_id: None,
                     merchant_id: None,
                     profile_id: None,
@@ -220,6 +224,7 @@ pub struct CurrentFlow {
     origin: Origin,
     current_flow_index: usize,
     path: Vec<TokenPurpose>,
+    tenant_id: Option<id_type::TenantId>,
 }
 
 impl CurrentFlow {
@@ -239,6 +244,7 @@ impl CurrentFlow {
             origin: token.origin,
             current_flow_index: index,
             path,
+            tenant_id: token.tenant_id,
         })
     }
 
@@ -247,12 +253,21 @@ impl CurrentFlow {
         let remaining_flows = flows.iter().skip(self.current_flow_index + 1);
 
         for flow in remaining_flows {
-            if flow.is_required(&user, &self.path, state).await? {
+            if flow
+                .is_required(
+                    &user,
+                    &self.path,
+                    state,
+                    self.tenant_id.as_ref().unwrap_or(&state.tenant.tenant_id),
+                )
+                .await?
+            {
                 return Ok(NextFlow {
                     origin: self.origin.clone(),
                     next_flow: *flow,
                     user,
                     path: self.path,
+                    tenant_id: self.tenant_id,
                 });
             }
         }
@@ -265,6 +280,7 @@ pub struct NextFlow {
     next_flow: UserFlow,
     user: UserFromStorage,
     path: Vec<TokenPurpose>,
+    tenant_id: Option<id_type::TenantId>,
 }
 
 impl NextFlow {
@@ -276,12 +292,16 @@ impl NextFlow {
         let flows = origin.get_flows();
         let path = vec![];
         for flow in flows {
-            if flow.is_required(&user, &path, state).await? {
+            if flow
+                .is_required(&user, &path, state, &state.tenant.tenant_id)
+                .await?
+            {
                 return Ok(Self {
                     origin,
                     next_flow: *flow,
                     user,
                     path,
+                    tenant_id: Some(state.tenant.tenant_id.clone()),
                 });
             }
         }
@@ -304,6 +324,7 @@ impl NextFlow {
                     .global_store
                     .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                         user_id: self.user.get_user_id(),
+                        tenant_id: self.tenant_id.as_ref().unwrap_or(&state.tenant.tenant_id),
                         org_id: None,
                         merchant_id: None,
                         profile_id: None,
@@ -352,12 +373,16 @@ impl NextFlow {
             .ok_or(UserErrors::InternalServerError)?;
         let remaining_flows = flows.iter().skip(index + 1);
         for flow in remaining_flows {
-            if flow.is_required(&user, &self.path, state).await? {
+            if flow
+                .is_required(&user, &self.path, state, &state.tenant.tenant_id)
+                .await?
+            {
                 return Ok(Self {
                     origin: self.origin.clone(),
                     next_flow: *flow,
                     user,
                     path: self.path,
+                    tenant_id: Some(state.tenant.tenant_id.clone()),
                 });
             }
         }
diff --git a/crates/router/src/utils/user_role.rs b/crates/router/src/utils/user_role.rs
index aaf313a196e..0bd0e81149f 100644
--- a/crates/router/src/utils/user_role.rs
+++ b/crates/router/src/utils/user_role.rs
@@ -133,6 +133,7 @@ pub async fn set_role_permissions_in_cache_if_required(
 pub async fn update_v1_and_v2_user_roles_in_db(
     state: &SessionState,
     user_id: &str,
+    tenant_id: &id_type::TenantId,
     org_id: &id_type::OrganizationId,
     merchant_id: Option<&id_type::MerchantId>,
     profile_id: Option<&id_type::ProfileId>,
@@ -145,6 +146,7 @@ pub async fn update_v1_and_v2_user_roles_in_db(
         .global_store
         .update_user_role_by_user_id_and_lineage(
             user_id,
+            tenant_id,
             org_id,
             merchant_id,
             profile_id,
@@ -161,6 +163,7 @@ pub async fn update_v1_and_v2_user_roles_in_db(
         .global_store
         .update_user_role_by_user_id_and_lineage(
             user_id,
+            tenant_id,
             org_id,
             merchant_id,
             profile_id,
@@ -210,6 +213,7 @@ pub async fn get_single_merchant_id(
 pub async fn get_lineage_for_user_id_and_entity_for_accepting_invite(
     state: &SessionState,
     user_id: &str,
+    tenant_id: &id_type::TenantId,
     entity_id: String,
     entity_type: EntityType,
 ) -> UserResult<
@@ -231,6 +235,7 @@ pub async fn get_lineage_for_user_id_and_entity_for_accepting_invite(
                 .global_store
                 .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                     user_id,
+                    tenant_id,
                     org_id: Some(&org_id),
                     merchant_id: None,
                     profile_id: None,
@@ -275,6 +280,7 @@ pub async fn get_lineage_for_user_id_and_entity_for_accepting_invite(
                 .global_store
                 .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                     user_id,
+                    tenant_id,
                     org_id: None,
                     merchant_id: Some(&merchant_id),
                     profile_id: None,
@@ -320,6 +326,7 @@ pub async fn get_lineage_for_user_id_and_entity_for_accepting_invite(
                 .global_store
                 .list_user_roles_by_user_id(ListUserRolesByUserIdPayload {
                     user_id,
+                    tenant_id: &state.tenant.tenant_id,
                     org_id: None,
                     merchant_id: None,
                     profile_id: Some(&profile_id),