Scenarios outside the portfolio refuse the run 🟩

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/modelling/router.py

@@ -13,7 +13,7 @@ from typing import Any, cast
 
 import boto3
 from fastapi import APIRouter, Depends, HTTPException
-from sqlmodel import Session
+from sqlmodel import Session, col, select
 
 from backend.app.config import get_settings
 from backend.app.db.connection import db_engine
@@ -25,6 +25,7 @@ from backend.app.modelling.property_filters import (
 )
 from backend.app.modelling.schemas import TriggerRunRequest
 from domain.tasks.subtasks import SubTask
+from infrastructure.postgres.modelling import ScenarioModel
 from repositories.tasks.subtask_postgres_repository import SubTaskPostgresRepository
 
 # Sends pre-serialised message bodies to the modelling_e2e queue. A seam so
@@ -80,6 +81,24 @@ async def trigger_run(
             ),
         )
 
+    scenario_rows = session.exec(
+        select(ScenarioModel).where(col(ScenarioModel.id).in_(body.scenario_ids))
+    ).all()
+    portfolio_by_scenario = {row.id: row.portfolio_id for row in scenario_rows}
+    invalid = [
+        scenario_id
+        for scenario_id in body.scenario_ids
+        if portfolio_by_scenario.get(scenario_id) != body.portfolio_id
+    ]
+    if invalid:
+        raise HTTPException(
+            status_code=400,
+            detail=(
+                f"Scenarios {invalid} do not belong to portfolio "
+                f"{body.portfolio_id}."
+            ),
+        )
+
     properties: list[FilteredProperty] = resolve_filtered_property_ids(
         session, body.portfolio_id, body.filters
     )