refactor(api)!: remove the tenant concept entirely - single-network ban backend#105
Merged
Conversation
…claim enforcement
Removes TenantContext and the tenantId JWT claim entirely - every tenant-scoped
endpoint now takes tenantId as a URL path variable and trusts it directly instead
of verifying it against the caller's token. This is a deliberate simplification:
a role's JWT (STAFF, SERVICE, etc.) now works identically against every tenant,
since nothing on the token distinguishes which tenant it belongs to anymore.
- Standardizes tenant-scoped create/list endpoints to take {tenantId} from the
URL path instead of a JWT claim, request body field, or loaded-entity lookup.
- Splits PunishTemplateDTO/PunishProfileDTO/ReportDTO into tenantId-free
*RequestDTO request types; response types are unchanged.
- Removes the tenantId claim from minted JWTs (AuthController, ConnectorAuthController)
and the TENANT_ADMIN-own-tenant restriction on token minting.
- Regenerates the OpenAPI client from a new blackhole-api-0.0.4.yml spec and
updates the Velocity proxy's call sites to the new path-based signatures.
BREAKING CHANGE: tenant-scoped REST endpoints change shape (tenantId moves from
body/claim to a URL path variable on several routes - see updated OpenAPI spec).
JWTs no longer carry a tenantId claim, so tenant isolation is no longer enforced
by the API - callers must not treat a role token as tenant-restricted anymore.
…an backend Blackhole is now a single-network ban backend with no multi-tenancy anywhere - not even as a URL parameter. Removes TenantEntity/TenantHandler/TenantDTO, TenantEloSettings (entity/repository/controller/DTO/service, replaced with static application.yml config), and every tenantId field/column/parameter across entities, repositories, services and controllers. - Collapses PunishmentProfileEntity/EloProfileEntity's (tenantId, owner) composite key down to a plain owner primary key; deletes PunishmentProfileId. - New V9__remove_tenants.sql migration drops the tenants/tenant_elo_settings tables and every tenant_id column/index/composite-PK, since tenantId was baked into V1__baseline.sql and can't be edited. - Collapses the PLATFORM_ADMIN/TENANT_ADMIN role split into a single ADMIN role - they were never used to gate different behavior anywhere except tenant CRUD, which is now gone. - WebhookDispatchConsumer now fans every domain event out to every active connector subscription matching its event type, network-wide, instead of filtering by tenant. - Regenerates the OpenAPI client from a new blackhole-api-0.0.6.yml spec and updates the Velocity proxy's BlackholeConfig/listeners/commands/Redis mirror to the tenant-free call shapes. BREAKING CHANGE: every tenant-scoped REST endpoint drops tenantId from its URL/body/response entirely (see the updated OpenAPI spec). JWTs no longer carry any tenant claim, and PLATFORM_ADMIN/TENANT_ADMIN no longer exist as roles - only ADMIN. The database migration drops all tenant-related tables and columns with no data preservation.
TheMeinerLP
force-pushed
the
worktree-snappy-weaving-nebula
branch
from
July 8, 2026 15:42
80b5544 to
91f9271
Compare
TheMeinerLP
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Blackhole is now a single-network ban backend with no multi-tenancy anywhere - not even as a URL parameter (an interim step in this same PR briefly moved tenant resolution to be purely URL-based; the tenant concept has since been removed outright, per the repo owner's follow-up direction).
TenantEntity/TenantHandler/TenantDTO/TenantStatus,TenantEloSettings(entity/repository/controller/DTO/service, replaced with staticapplication.ymlconfig), and everytenantIdfield/column/parameter across entities, repositories, services, and controllers.PunishmentProfileEntity/EloProfileEntity's(tenantId, owner)composite key down to a plainownerprimary key; deletesPunishmentProfileId.db.changelog-master.xml(this PR was rebased past refactor(database)!: replace Flyway with Liquibase XML changelogs #101's Flyway→Liquibase swap) dropping thetenants/tenant_elo_settingstables and everytenant_idcolumn/index/composite-PK.PLATFORM_ADMIN/TENANT_ADMINrole split into a singleADMINrole - they were never used to gate different behavior anywhere except tenant CRUD, which is now gone.WebhookDispatchConsumernow fans every domain event out to every active connector subscription matching its event type, network-wide, instead of filtering by tenant.blackhole-api-0.0.6.ymlspec and updates the Velocity proxy'sBlackholeConfig/listeners/commands/Redis mirror to the tenant-free call shapes.Why
The repo owner explicitly wanted Blackhole simplified into a single-network ban backend: if multiple networks are ever needed, that's handled by running separate deployments, not by sharing one deployment across them. This removes the multi-tenancy data model entirely rather than just its enforcement (the prior state of this PR).
Breaking changes
tenantIdfrom its URL/body/response entirely (see the updated OpenAPI spec).PLATFORM_ADMIN/TENANT_ADMINno longer exist as roles - onlyADMIN.Test plan
./gradlew clean buildpasses across all modules (backend, client, velocity, phoca)./gradlew :client:openApiGenerateregenerates cleanly from the new specpunishment_profiles/elo_profilesend up withowneras sole PK and notenants/tenant_elo_settings/tenant_idremnantsADMIN/SERVICEtokens (decoded JWT confirms no tenant claim, role isADMINnotPLATFORM_ADMIN) → exercised create/list endpoints (report, template, punishment, profile, elo) with fully tenant-free URLs