feat(tenants): provision the product tenant with the registry UUID on create #21

2026-09-01T21:16:36Z

sharang commented

2026-09-01 21:16:36 +00:00

Closes the tenant-anchor divergence that blocked the Auth-5 sdk/backend flips.

The registry is the authority for tenant identity (model B2), but nothing ever told the product about a new tenant. The anchors drifted: the registry held acme/matrix-acme while the product database held only the legacy seed tenant 9282a473. With the SDK gate enabled, its TenantResolver does GetTenantBySlug and would 403 every authenticated request.

New internal/product port, mirroring keycloak.Adapter: handlers depend on the interface; main wires HTTPProvisioner when PRODUCT_API_URL is set and NoopProvisioner otherwise, so an unconfigured deployment still creates tenants.

Tenant creation now also provisions the product tenant with our UUID, using the same best-effort contract as Keycloak provisioning: failure does not roll the tenant back, it emits product.provision_failed so the divergence is traceable; success emits product.tenant_provisioned. A 409 counts as success — onboarding may retry and the product insert is idempotent (compliance#217).

Server.productProvisioner() guarantees the documented never-nil invariant (tests construct Server directly and would otherwise panic mid-tenant-creation).

Already proven live: all 6 registry tenants were provisioned into the product DB through this exact endpoint with UUIDs preserved (HTTP 201, UUID MATCHES), and a re-POST left exactly 1 row.

5 new tests; full suite green with -race, coverage 71.4% (gate 70).

**Closes the tenant-anchor divergence that blocked the Auth-5 sdk/backend flips.** The registry is the authority for tenant identity (model B2), but nothing ever told the product about a new tenant. The anchors drifted: the registry held `acme`/`matrix-acme` while the product database held only the legacy seed tenant `9282a473`. With the SDK gate enabled, its TenantResolver does `GetTenantBySlug` and would **403 every authenticated request**. **New `internal/product` port**, mirroring `keycloak.Adapter`: handlers depend on the interface; `main` wires `HTTPProvisioner` when `PRODUCT_API_URL` is set and `NoopProvisioner` otherwise, so an unconfigured deployment still creates tenants. Tenant creation now also provisions the product tenant **with our UUID**, using the same best-effort contract as Keycloak provisioning: failure does not roll the tenant back, it emits `product.provision_failed` so the divergence is traceable; success emits `product.tenant_provisioned`. A 409 counts as success — onboarding may retry and the product insert is idempotent (compliance#217). `Server.productProvisioner()` guarantees the documented never-nil invariant (tests construct Server directly and would otherwise panic mid-tenant-creation). **Already proven live:** all 6 registry tenants were provisioned into the product DB through this exact endpoint with UUIDs preserved (HTTP 201, `UUID MATCHES`), and a re-POST left exactly 1 row. 5 new tests; full suite green with `-race`, coverage **71.4%** (gate 70).

sharang added 1 commit 2026-09-01 21:16:38 +00:00

feat(tenants): provision the product tenant with the registry UUID on create

ci / shared (pull_request) Successful in 14s

Details

ci / test (pull_request) Failing after 16m9s

Details

ci / image (pull_request) Skipped

Details

576d733eae

Closes the tenant-anchor divergence that blocked the Auth-5 sdk/backend flips.

The registry is the authority for tenant identity (model B2), but nothing ever
told the product about a new tenant. The anchors drifted: the registry held
acme/matrix-acme while the product database held only the legacy seed tenant
9282a473. With the SDK gate enabled its TenantResolver does GetTenantBySlug and
would 403 EVERY authenticated request, because no real user's org slug existed
locally.

New internal/product port, mirroring keycloak.Adapter: handlers depend on the
interface, main wires HTTPProvisioner when PRODUCT_API_URL is set and
NoopProvisioner otherwise, so an unconfigured deployment still creates tenants.
Tenant creation now also provisions the product tenant with OUR uuid, using the
same best-effort contract as Keycloak provisioning: a failure does not roll the
tenant back, it emits a product.provision_failed audit event so the divergence
is traceable. Success emits product.tenant_provisioned.

A 409 from the product counts as success — onboarding may retry and the
product's insert is idempotent on the primary key (compliance#217).

Server.productProvisioner() guarantees the documented never-nil invariant;
tests construct Server directly and would otherwise panic mid-tenant-creation.

5 tests incl. the point of the whole port (the registry UUID is what gets sent).
Full suite green with -race, coverage 71.4% (gate 70).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD

sharang referenced this issue from a commit

2026-09-01 21:17:43 +00:00

feat(tenant-registry): wire product tenant provisioning (Auth-5 1.4)

sharang merged commit a048d47959 into main

2026-09-01 21:20:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: platform/tenant-registry#21