feat(tenants): provision the product tenant with the registry UUID on create (#21)

2026-09-01 21:20:03 +00:00
parent 80565fdbf2
commit a048d47959
6 changed files with 255 additions and 3 deletions
@@ -13,6 +13,7 @@ import (
 	"gitea.meghsakha.com/platform/tenant-registry/internal/authn"
 	"gitea.meghsakha.com/platform/tenant-registry/internal/config"
 	"gitea.meghsakha.com/platform/tenant-registry/internal/keycloak"
+	"gitea.meghsakha.com/platform/tenant-registry/internal/product"
 	"gitea.meghsakha.com/platform/tenant-registry/internal/server"
 	"gitea.meghsakha.com/platform/tenant-registry/internal/store"
 )
@@ -74,7 +75,19 @@ func main() {
 		slog.Warn("AUTH_ENABLED=false — API is unauthenticated (dev only)")
 	}

-	handler := server.NewRouter(&server.Server{Cfg: cfg, Log: logger, Store: s, Keycloak: kc, Auth: av})
+	// Downstream product provisioning. Wired only when PRODUCT_API_URL is set;
+	// otherwise a no-op so an unconfigured deployment still creates tenants.
+	// The product's gate is not yet enforcing, so no token is attached today —
+	// AuthHeaderFunc is the seam for when it is.
+	var pv product.Provisioner = product.NoopProvisioner{}
+	if cfg.ProductAPIURL != "" {
+		pv = product.NewHTTPProvisioner(cfg.ProductAPIURL, cfg.ProductAPIPath, nil, cfg.ProductTimeout)
+		slog.Info("product provisioner configured", "url", cfg.ProductAPIURL, "path", cfg.ProductAPIPath)
+	} else {
+		slog.Warn("PRODUCT_API_URL not set — product tenant provisioning disabled (anchors may diverge)")
+	}
+
+	handler := server.NewRouter(&server.Server{Cfg: cfg, Log: logger, Store: s, Keycloak: kc, Auth: av, Product: pv})
 	srv := &http.Server{
 		Addr:         cfg.Addr,
 		Handler:      handler,