Fix business tenant binding and update password on cross-site signup.

Resolve the active business from the host domain so multi-business staff no longer load another tenant’s CMS data, and replace the Meshkee password when linking an existing account to a new site.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/business/src/context/AuthContext.tsx

@@ -50,26 +50,26 @@ function canAccessBusinessDashboard(user: AuthUser) {
 
 async function prepareBusinessContext(user: AuthUser) {
   const domain = getBusinessDomain()
+  // Always resolve the host → business id. Never fall back to businesses[0]:
+  // slug ≠ first DNS label (e.g. arjmand-pharmacy vs arjmandpharmacy.com) and
+  // multi-business staff would otherwise load the wrong tenant's CMS data.
+  const tenant = await resolveTenantByDomain(domain)
+  setActiveBusinessById(String(tenant.id), tenant.domain)
 
   if (isSuperAdminUser(user)) {
-    const tenant = await resolveTenantByDomain(domain)
-    setActiveBusinessById(String(tenant.id), tenant.domain)
     return
   }
 
-  const membership =
-    user.businesses.find((business) => business.slug === tenantSlugFromDomain(domain)) ??
-    user.businesses[0]
+  const membership = user.businesses.find(
+    (business) => String(business.id) === String(tenant.id),
+  )
 
   if (!membership) {
-    throw new ApiError('No business membership found for this account.', 403)
+    throw new ApiError(
+      'This account is not a staff member of this business.',
+      403,
+    )
   }
-
-  setActiveBusinessById(String(membership.id), domain)
-}
-
-function tenantSlugFromDomain(domain: string) {
-  return domain.split('.')[0]?.toLowerCase() ?? domain
 }
 
 async function assertBusinessAccess(user: AuthUser) {

apps/business/src/lib/businessContext.ts

@@ -4,12 +4,14 @@ import { getBusinessDomain } from './config'
 const ACTIVE_BUSINESS_ID_KEY = 'meshkee_active_business_id'
 const ACTIVE_BUSINESS_DOMAIN_KEY = 'meshkee_active_business_domain'
 
-export function setActiveBusiness(user: AuthUser) {
+/** Prefer resolving the host tenant, then {@link setActiveBusinessById}. */
+export function setActiveBusiness(user: AuthUser, businessId?: string) {
   const domain = getBusinessDomain()
   localStorage.setItem(ACTIVE_BUSINESS_DOMAIN_KEY, domain)
 
-  if (user.businesses.length > 0) {
-    localStorage.setItem(ACTIVE_BUSINESS_ID_KEY, String(user.businesses[0].id))
+  const id = businessId ?? (user.businesses[0] ? String(user.businesses[0].id) : null)
+  if (id) {
+    localStorage.setItem(ACTIVE_BUSINESS_ID_KEY, id)
   }
 }