tenant-registry

14 Commits 3 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sharangandSharang Parnerkar	ce75ed04c2	RBAC Phase 1: membership authority endpoint + fail-closed API auth (#14 ) ci / shared (push) Failing after 14s Details ci / test (push) Successful in 21m13s Details ci / image (push) Skipped Details Implements the model-B2 membership authority (ratified compliance auth design) and inbound token verification. - GET /v1/users/{id}/memberships: Keycloak supplies user->tenant links + org_roles (attribute projection until the realm migrates to Organizations); registered tenants override status/plan/products from registry tables (source: registry\|keycloak). Closes the M5.2-deferred org_roles stub. - New internal/authn: OIDC discovery + JWKS verification (go-oidc/v3), audience tenant-registry. /healthz + /readyz stay PUBLIC_EXPLICIT; all other routes INTERNAL_SERVICE_ONLY. AUTH_ENABLED=true refuses to start on incomplete config (fail-closed); false (dev default) keeps current behavior. - Full suite green incl. postgres testcontainers; openapi.yaml updated (contract test passes). Activation is a separate step (Auth-5): requires the orca-infra env merge and a portal service token (portal currently calls with no auth). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #14	2026-08-24 18:21:46 +00:00
sharang	9138731eea	feat(keycloak): M4.3 — Admin API adapter + claim resolver ci / shared (push) Successful in 5s Details ci / test (push) Successful in 1m32s Details ci / image (push) Has been skipped Details internal/keycloak Adapter (HTTPAdapter + Mock). POST /v1/tenants now provisions a KC organization + IT_ADMIN invite when admin_email is set; KC failures emit keycloak.provision_failed but don't roll back. POST /v1/internal/keycloak/claims resolves the current claim bundle for any (tenant_id\|tenant_slug\|user_attrs.*) lookup. Mock used in tests + when KEYCLOAK_ADMIN_URL is empty. HTTPAdapter tested against an in-process stub KC (httptest.Server). Refs: M4.3	2026-05-19 11:51:09 +00:00
sharang	ffab866c87	feat(api): M4.2 — REST surface + pgx Postgres store + OpenAPI 3.1 ci / shared (push) Successful in 6s Details ci / test (push) Successful in 1m15s Details ci / image (push) Has been skipped Details Full M4.2 deliverable: 16 endpoints (tenants CRUD + lifecycle, catalog, entitlements, API keys with argon2 hashing, audit append + filter), Store interface with pgx-backed Postgres + in-memory parallel implementations exercised by the same eachStore harness, openapi.yaml at 3.1 with kin-openapi contract test. M4.3 adds auth. Refs: M4.2	2026-05-19 10:51:59 +00:00

Author

SHA1

Message

Date

sharangandSharang Parnerkar

ce75ed04c2

RBAC Phase 1: membership authority endpoint + fail-closed API auth (#14 )

ci / shared (push) Failing after 14s

Details

ci / test (push) Successful in 21m13s

Details

ci / image (push) Skipped

Details

Implements the model-B2 membership authority (ratified compliance auth design) and inbound token verification.

- GET /v1/users/{id}/memberships: Keycloak supplies user->tenant links + org_roles (attribute projection until the realm migrates to Organizations); registered tenants override status/plan/products from registry tables (source: registry|keycloak). Closes the M5.2-deferred org_roles stub.
- New internal/authn: OIDC discovery + JWKS verification (go-oidc/v3), audience tenant-registry. /healthz + /readyz stay PUBLIC_EXPLICIT; all other routes INTERNAL_SERVICE_ONLY. AUTH_ENABLED=true refuses to start on incomplete config (fail-closed); false (dev default) keeps current behavior.
- Full suite green incl. postgres testcontainers; openapi.yaml updated (contract test passes).

Activation is a separate step (Auth-5): requires the orca-infra env merge and a portal service token (portal currently calls with no auth).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Reviewed-on: #14

2026-08-24 18:21:46 +00:00

sharang

9138731eea

feat(keycloak): M4.3 — Admin API adapter + claim resolver

ci / shared (push) Successful in 5s

Details

ci / test (push) Successful in 1m32s

Details

ci / image (push) Has been skipped

Details

internal/keycloak Adapter (HTTPAdapter + Mock). POST /v1/tenants now provisions a KC organization + IT_ADMIN invite when admin_email is set; KC failures emit keycloak.provision_failed but don't roll back. POST /v1/internal/keycloak/claims resolves the current claim bundle for any (tenant_id|tenant_slug|user_attrs.*) lookup. Mock used in tests + when KEYCLOAK_ADMIN_URL is empty. HTTPAdapter tested against an in-process stub KC (httptest.Server).

Refs: M4.3

2026-05-19 11:51:09 +00:00

sharang

ffab866c87

feat(api): M4.2 — REST surface + pgx Postgres store + OpenAPI 3.1

ci / shared (push) Successful in 6s

Details

ci / test (push) Successful in 1m15s

Details

ci / image (push) Has been skipped

Details

Full M4.2 deliverable: 16 endpoints (tenants CRUD + lifecycle, catalog, entitlements, API keys with argon2 hashing, audit append + filter), Store interface with pgx-backed Postgres + in-memory parallel implementations exercised by the same eachStore harness, openapi.yaml at 3.1 with kin-openapi contract test. M4.3 adds auth.

Refs: M4.2

2026-05-19 10:51:59 +00:00