5 Commits

Include renames

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	4a49c630d4	feat(auth): membership authority endpoint + fail-closed API auth (RBAC Phase 1) ... GET /v1/users/{id}/memberships answers 'which tenants does this JWT subject belong to, with which org_roles and entitlements' (ratified auth design, model B2). Keycloak supplies user->tenant links and roles via the Adapter (attribute projection until the realm migrates to Organizations); registered tenants override status/plan/products from registry tables. New internal/authn verifies Keycloak bearer tokens (OIDC discovery + JWKS, audience AUTH_EXPECTED_AUDIENCE, default tenant-registry). With AUTH_ENABLED=true all routes except /healthz + /readyz require a token and the server refuses to start if the verifier cannot initialize; false (dev default) keeps the API open. Completes the M5.2-deferred org_roles lookup and replaces the 'M4.3 adds JWT validation' TODO in the spec. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-24 16:09:53 +02:00
sharang	9138731eea	feat(keycloak): M4.3 — Admin API adapter + claim resolver ... internal/keycloak Adapter (HTTPAdapter + Mock). POST /v1/tenants now provisions a KC organization + IT_ADMIN invite when admin_email is set; KC failures emit keycloak.provision_failed but don't roll back. POST /v1/internal/keycloak/claims resolves the current claim bundle for any (tenant_id|tenant_slug|user_attrs.*) lookup. Mock used in tests + when KEYCLOAK_ADMIN_URL is empty. HTTPAdapter tested against an in-process stub KC (httptest.Server). Refs: M4.3	2026-05-19 11:51:09 +00:00
sharang	ffab866c87	feat(api): M4.2 — REST surface + pgx Postgres store + OpenAPI 3.1 ... Full M4.2 deliverable: 16 endpoints (tenants CRUD + lifecycle, catalog, entitlements, API keys with argon2 hashing, audit append + filter), Store interface with pgx-backed Postgres + in-memory parallel implementations exercised by the same eachStore harness, openapi.yaml at 3.1 with kin-openapi contract test. M4.3 adds auth. Refs: M4.2	2026-05-19 10:51:59 +00:00
sharang	d66760b246	feat(schema): M4.1 — tenant_registry schema + migrate binary ... PLATFORM_ARCHITECTURE.md §5c schema as one initial migration: 6 tables + 4 enums + updated_at triggers. cmd/migrate binary (golang-migrate library, embedded SQL). testcontainers round-trip + seed + slug-constraint tests. Refs: M4.1	2026-05-19 10:10:14 +00:00
sharang	af9f331781	feat(server): tenant-registry skeleton boots against dev stack ... Minimal Go service: /healthz + /v1/tenants/by-slug/:slug + /v1/tenants/:id with an in-memory store seeded with the acme tenant. Stdlib-only; pgx + JWT validation land in M4.1 follow-up.	2026-05-19 09:35:04 +00:00