2 Commits

Include renames

Author	SHA1	Message	Date
jpmschweitzerandClaude Sonnet 5	99ee994023	feat(tenants): add the tenant registry, the one enforcement point Book and Scribe now share (T-8) ... A tenant has been an unchecked string since T-4/T-7: the Office's X-Office-Tenant header or a user JWT's tatlock_user claim, with Book and Scribe each running their own _require_tenant that checked only presence. A typo'd claim opened a fresh, empty namespace rather than being refused. src/domains/tenants/ (controller/models/schemas/service) adds tenants and tenant_consumers (migration 007, down_revision="006"): tenants.id is the slug a tatlock tenant carries, kind (household|person|test) and status (active|suspended) CHECK-constrained; tenant_consumers is the grant pairing a consumer to a tenant. Migration 007 seeds the two tenants in use today — jpmschweitzer (household, "Jeroen") and llm_tester (test, "Playground") — each granted to office-claude, the only Office consumer configured in Authentik. Every existing owner_tenant column (book_records, book_tenant_counters, scribe_addresses, scribe_messages, scribe_mailbox_entries — five, grepped and confirmed) now carries a foreign key to tenants.id, ON DELETE RESTRICT, at both the migration and the ORM model. TenantsService.require_tenant is the one enforcement point: no tenant is 400 tenant_required (unchanged); an unknown tenant is 403 tenant_unknown; a suspended one is 403 tenant_suspended; an Office caller whose consumer holds no grant in that tenant is 403 consumer_not_granted. One query — a LEFT JOIN against the grant — so presence, status and the grant are all read in a single round trip. Book's and Scribe's own _require_tenant now delegate to it, translating TenantError to their own exception type so every call site and each controller's single except clause keep working unchanged. Read-only this round: GET /tenants/me answers the caller's own tenant and its granted consumers (the cheap "am I allowed here" probe); GET /tenants answers every tenant for a tatlock/scheduler caller, or a list of one for a tenant-bearing caller — another tenant's existence is never revealed. No write routes; provisioning a tenant is workspace T-195. Tests: tests/test_tenants.py and tests/test_tenants_migration.py (new); a TestTenantRegistryEnforcement class added to both tests/test_book.py and tests/test_scribe.py proving all four cases (unknown, suspended, ungranted-consumer, and the control) on a live Book and Scribe route, not only on /tenants itself. tests/conftest.py gains a tenant_registry schema fixture and a suspended_tenant fixture (inserted and deleted per test; no FK references it); book_schema and scribe_schema each independently grant a second, test-environment-only consumer (office-gemini) in both seeded tenants, since test_book.py and test_scribe.py have used it as a stand-in second consumer since before this grant check existed — the migration itself still seeds only office-claude, matching the dossier. Mutation-checked: dropping the grant check fails the three consumer_not_granted tests (200 instead of 403); dropping the status check fails the three tenant_suspended tests; making Book bypass the helper fails its unknown-tenant test (200 instead of 403). All three restored and the full suite re-verified green (508 + 35 = 543 passed). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-10-19 17:30:55 +02:00
jpmschweitzerandClaude Sonnet 5	ccdbc44d67	feat(scribe): add the Scribe domain — addresses, send, mailbox, history, find, mark, tag (T-5) ... The Office (workspace D-66, D-68, D-73) needs a message bus: an address is a topic named for an identity, owned by a tenant and a consumer. D-68 puts it here, in core-api's own database, behind its own auth, following src/domains/book/. Migration 006 lands the whole schema by hand (down_revision="005"): scribe_addresses (owner_tenant + name primary key — no surrogate id, since no route ever references an address except by name), scribe_messages (retained; a generated tsvector search column + GIN index on subject/body, and a GIN index on the topics array for history's lookup), and scribe_mailbox_entries (one row per recipient address per message, unique on address+message_id). No data: seeding `jeroen` and `tower-control` is a deploy step through `register`, not this migration. Routes, every one behind require_caller("office", "user"), tenant from the caller (T-4): - register/list addresses — register is idempotent for the same consumer, 409 address_taken for another consumer in the tenant; list marks which addresses the caller's consumer owns. - send — `from` is always the caller's own identity, stamped server-side, never read from the body; 403 identity_not_owned if that identity is not a registered address owned by the caller's consumer; 404 unknown_address (naming the missing ones) if any recipient does not exist in the tenant; writes one mailbox entry per recipient. - mailbox / find — the caller's own identity's entries (mailbox: unread first; find: full text via websearch_to_tsquery), both requiring the identity be owned by the caller's consumer. - history — the retained messages sent to an address, oldest first; reading never consumes or marks, and reads scribe_messages directly rather than joining through mailbox entries. - mark / tag / untag — share one PATCH route; an entry outside the caller's tenant, or addressed to an identity the caller isn't reading as, answers 404 not_found — indistinguishable from a nonexistent entry. Every query filters on the caller's tenant (D-73): an address or message in another tenant answers exactly like one that does not exist, so no id is ever confirmed across that boundary (test_scribe.py::TestTenantIsolation, including two tests proving the tenant filter is load-bearing even when the same address *name* legitimately exists, differently owned, in two tenants — not just when the caller's own identity is unregistered there). Messaging only this round: groups, subscriptions, the notification matrix and delivery are explicitly not built (workspace T-176) — the schema already carries what `topics`/`tags` need for them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-10-19 15:18:52 +02:00