Initial Commit
This commit is contained in:
88
openspec/changes/enterprise-api-plugin-tenant/proposal.md
Normal file
88
openspec/changes/enterprise-api-plugin-tenant/proposal.md
Normal file
@@ -0,0 +1,88 @@
|
||||
# OpenSpec Change: enterprise-api-plugin-tenant
|
||||
|
||||
- **Change ID**: enterprise-api-plugin-tenant
|
||||
- **Package**: `@suaveplan/api-plugin-tenant`
|
||||
- **Category**: api/auth
|
||||
- **Target path**: `api/auth/api-plugin-tenant`
|
||||
- **Status**: PROPOSED
|
||||
- **Date**: 2026-04-24
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
Deliver `@suaveplan/api-plugin-tenant` on the genesis branch from scratch at enterprise quality. The plugin provides multi-tenant management: tenant provisioning (create/update/suspend/delete), member invitation and role management, per-tenant feature flag overrides via `@suaveplan/feature-flags`, per-tenant settings/branding, and a tenant-scoped audit trail. Routes mounted under `/tenants`. Events: `tenant:created`, `tenant:suspended`, `tenant:deleted`, `tenant:member:invited`, `tenant:member:removed`.
|
||||
|
||||
---
|
||||
|
||||
## Available workspace deps on genesis
|
||||
|
||||
| Package | Role |
|
||||
|---|---|
|
||||
| `@suaveplan/api` (`workspace:^`) | `definePlugin` |
|
||||
| `@suaveplan/api-shared` (`workspace:^`) | Helpers |
|
||||
| `@suaveplan/api-plugin-auth` (`workspace:^`) | `requireAuth`, `requireRole` |
|
||||
| `@suaveplan/api-plugin-database` (`workspace:^`) | SurrealDB |
|
||||
| `@suaveplan/feature-flags` (`workspace:^`) | Per-tenant flag overrides |
|
||||
| `@suaveplan/audit-logging` (`workspace:^`) | Tenant audit trail |
|
||||
| `@suaveplan/events` (`workspace:^`) | Event bus |
|
||||
| `@suaveplan/error` (`workspace:^`) | `TenantError` hierarchy |
|
||||
| `@suaveplan/rate-limiter` (`workspace:^`) | Rate limits |
|
||||
| `hono` + `@hono/zod-openapi` + `zod` | Routes/schemas |
|
||||
| `@opentelemetry/api` | OTel |
|
||||
|
||||
---
|
||||
|
||||
## Public API surface
|
||||
|
||||
```ts
|
||||
function createTenantPlugin(config?: TenantPluginConfig): PluginDescriptor<TenantPluginConfig>
|
||||
|
||||
class TenantService {
|
||||
createTenant(data: CreateTenantInput): Promise<Tenant>
|
||||
getTenant(id: string): Promise<Tenant>
|
||||
updateTenant(id: string, data: UpdateTenantInput): Promise<Tenant>
|
||||
suspendTenant(id: string, reason: string): Promise<void>
|
||||
deleteTenant(id: string): Promise<void>
|
||||
inviteMember(tenantId: string, email: string, role: string): Promise<TenantInvite>
|
||||
acceptInvite(token: string): Promise<void>
|
||||
removeMember(tenantId: string, userId: string): Promise<void>
|
||||
listMembers(tenantId: string): Promise<TenantMember[]>
|
||||
getSettings(tenantId: string): Promise<TenantSettings>
|
||||
updateSettings(tenantId: string, settings: Partial<TenantSettings>): Promise<TenantSettings>
|
||||
}
|
||||
```
|
||||
|
||||
### Error codes
|
||||
|
||||
```ts
|
||||
type TenantErrorCode =
|
||||
| "TENANT_NOT_FOUND"
|
||||
| "TENANT_SUSPENDED"
|
||||
| "TENANT_INVITE_EXPIRED"
|
||||
| "TENANT_INVITE_INVALID"
|
||||
| "TENANT_MEMBER_NOT_FOUND"
|
||||
| "TENANT_MEMBER_ALREADY_EXISTS"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## File layout
|
||||
|
||||
```text
|
||||
api/auth/api-plugin-tenant/
|
||||
package.json tsconfig.json vitest.config.ts
|
||||
surql/ (tenant, tenant_member, tenant_invite, tenant_settings tables)
|
||||
src/
|
||||
index.ts events.ts
|
||||
types/ errors/
|
||||
services/tenant/
|
||||
routes/tenants/
|
||||
tests/integration.test.ts
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Impact
|
||||
|
||||
Prerequisites: `@suaveplan/api`, `@suaveplan/api-plugin-auth`, `@suaveplan/api-plugin-database`, `@suaveplan/feature-flags`, `@suaveplan/audit-logging`.
|
||||
64
openspec/changes/enterprise-api-plugin-tenant/tasks.md
Normal file
64
openspec/changes/enterprise-api-plugin-tenant/tasks.md
Normal file
@@ -0,0 +1,64 @@
|
||||
# Tasks: enterprise-api-plugin-tenant
|
||||
|
||||
**Change ID**: enterprise-api-plugin-tenant
|
||||
**Package**: `@suaveplan/api-plugin-tenant`
|
||||
**Target path**: `api/auth/api-plugin-tenant`
|
||||
**Prerequisite packages on Verdaccio**: `@suaveplan/api`, `@suaveplan/api-shared`, `@suaveplan/api-plugin-auth`, `@suaveplan/api-plugin-database`, `@suaveplan/feature-flags`, `@suaveplan/audit-logging`, `@suaveplan/events`, `@suaveplan/rate-limiter`, `@suaveplan/error`
|
||||
|
||||
---
|
||||
|
||||
## 0. Pre-flight (non-negotiable)
|
||||
|
||||
- [ ] 0.1 Confirm clean working tree (`git status` reports nothing) and no in-flight worktrees with uncommitted work (`git worktree list` then `git status` in each)
|
||||
- [ ] 0.2 If any worktrees exist under `.claude/worktrees/`, account for each one: still-active agent, work-pending-merge, or stale-and-prune. Stale worktrees MUST be removed (`git worktree remove`) before opening a new one — code that has been lost twice on main is the failure mode this guards against.
|
||||
- [ ] 0.3 Confirm the package set in `MANIFEST.md` matches `find packages -maxdepth 3 -name package.json` count. Drift here means a prior change archived without regenerating the manifest.
|
||||
|
||||
## 1. Scaffold
|
||||
|
||||
- [ ] Create directory with all subdirs; `package.json` v0.0.0, `"sideEffects": ["src/events.ts"]`; `tsconfig.json` + `vitest.config.ts`; standard scripts.
|
||||
|
||||
---
|
||||
|
||||
## 2. Types, errors, events
|
||||
|
||||
- [ ] Types: `Tenant`, `TenantMember`, `TenantInvite`, `TenantSettings`, `TenantPluginConfig` (Zod).
|
||||
- [ ] Errors: 6-code `TenantErrorCode` union + metadata + registration. Test + doc.
|
||||
- [ ] Events: `TenantEventMap` module augmentation (tenant:created, tenant:suspended, tenant:deleted, tenant:member:invited, tenant:member:removed).
|
||||
|
||||
---
|
||||
|
||||
## 3. SurrealQL
|
||||
|
||||
- [ ] `surql/tenant.surql`, `tenant_member.surql`, `tenant_invite.surql`, `tenant_settings.surql`.
|
||||
|
||||
---
|
||||
|
||||
## 4. TenantService
|
||||
|
||||
- [ ] All 11 methods from proposal.
|
||||
- [ ] `suspendTenant` / `deleteTenant`: emit events + write audit entries.
|
||||
- [ ] `inviteMember`: generate signed token (expires 72 h); send email via plugin context service injection.
|
||||
- [ ] Per-tenant feature flag overrides: `getSettings` returns `featureFlags` map; `FlagManager` reads these on tenant context.
|
||||
- [ ] OTel span per method.
|
||||
- [ ] `.test.ts` (all methods, error cases) + `.md`.
|
||||
|
||||
---
|
||||
|
||||
## 5. Routes
|
||||
|
||||
- [ ] `POST /tenants`, `GET /tenants/:id`, `PATCH /tenants/:id`, `DELETE /tenants/:id`, `POST /tenants/:id/suspend`.
|
||||
- [ ] `/tenants/:id/members` — list, invite, accept-invite, remove.
|
||||
- [ ] `/tenants/:id/settings` — get, update.
|
||||
- [ ] All behind `requireAuth()` + appropriate `requireRole`.
|
||||
- [ ] Rate limiting + idempotency on mutations.
|
||||
- [ ] Route `.test.ts` + `.md`.
|
||||
|
||||
---
|
||||
|
||||
## 6. Plugin factory + integration tests + publish
|
||||
|
||||
- [ ] `createTenantPlugin`: `definePlugin`, `dependencies: ["database", "auth"]`, `migrationsPath: "./surql"`.
|
||||
- [ ] Integration: create tenant → invite member → accept invite → list members → remove (real SurrealDB).
|
||||
- [ ] `bunx turbo lint typecheck test --filter=@suaveplan/api-plugin-tenant` — green; 100% coverage.
|
||||
- [ ] `bun scripts/publish.ts --package @suaveplan/api-plugin-tenant`.
|
||||
- [ ] Archive → `openspec/archive/2026-04-24-enterprise-api-plugin-tenant/`.
|
||||
Reference in New Issue
Block a user