feat(security): multi-tenant identity registry, host resolution and tenant context (#434 stage 1)

[izzywdev]

Stage 1 of #434. Lays the foundation for security-service to front several identity tenants, each backed by its own Authentik instance and therefore its own account directory.

This does not yet make a MendysRobotics login work — see Not done below. #434 stays open.

Why

security-service is the single front door for identity; Authentik is an implementation detail behind it (config.ts: "no vendor name leaks past this boundary into the API surface"). But the implementation was single-tenant, reading AUTHENTIK_* straight from process.env at ~12 sites with a FuzeFront default at each.

What's here

• providers/authentik/tenants.ts — the registry. Host → Authentik instance, carrying per-tenant issuer, in-cluster base URL, client credentials, admin token and enrollment flow slug.
• middleware/tenant-context.ts — resolves the tenant from the request host, binds it via AsyncLocalStorage, and provides assertTenantMatches for cross-tenant session rejection.
• config.ts — appBaseUrl() and googleBrokeredEnabled() read the ambient tenant instead of process.env. Signatures unchanged, so no call site churns.

Two modes, and the split is the point

	LEGACY (SECURITY_TENANTS unset)	MULTI (set)
Tenants	one, synthesised from today's env vars	as declared
Unknown host	served (today's behaviour)	REJECTED
Caching	none — rebuilt per read	memoised

Fail-closed engages only in MULTI, deliberately. Applying it in legacy mode would break FuzeFront immediately, because requests legitimately arrive there on app.fuzefront.com, fuzefront.dev.local, localhost and in-cluster service DNS. Once you declare tenants you are asserting the full host list — and at that point falling back to a default would authenticate a user against the wrong directory, the single failure this whole split exists to prevent. So: no fallback, no default tenant, reject.

Legacy is not memoised, also deliberately. The functions it replaces each read process.env per call, so a late env change took effect immediately; caching would silently change that for every existing deployment and for tests that set env per case. There's a test pinning this.

Design choices worth reviewing

• AsyncLocalStorage over threading a tenant parameter. The deep callers (authentikPassword, machine-identity, accountApi) are also invoked from provisioning scripts and seed jobs with no request in scope. runWithTenant() serves both without a sprawling diff across a live auth path.
• X-Forwarded-Host is deliberately NOT read. Behind the ingress it is caller-supplied; letting it pick the tenant would let a client choose which directory to authenticate against. Uses req.hostname (which honours trust-proxy) falling back to Host.
• Misconfiguration fails at BOOT, not at request time: duplicate host claims, duplicate tenant ids, missing required fields and malformed JSON all throw on load.

Verification

• 28 new tests pass — legacy parity, host routing, fail-closed rejection, boot validation, host normalisation, cross-tenant session rejection.
• tsc --noEmit clean for these files. (One pre-existing unrelated error in eventPublisher.ts, an artifact of a partial workspace install.)
• No regression, measured rather than asserted: the 8 Authentik/OIDC suites give 96 passed / 2 failed both with and without this change — identical. I ran the same set against a stashed, pristine tree to confirm. Those 2 failures (google-brokered-signin extra-arg assertion, authentik-provider email verification) reproduce on clean master and are pre-existing, not caused here — worth a separate look.

Not done (why #434 stays open)

oidc.ts, authentikPassword.ts, machine-identity.ts, accountApi.ts and the routes still read process.env.AUTHENTIK_* directly, so the "no process.env.AUTHENTIK_* outside the registry" criterion is unmet, and the middleware is not yet mounted on the auth routers. oidc.ts is a stateful singleton with discovery caching and background retry that must become one instance per tenant — and that is where the iss-rewriting subtlety lives, so it deserves its own reviewable change rather than being bolted on here.

Also still open from #434: per-tenant Google client credentials (shared client vs one per tenant — a consent-screen branding decision), tenant-scoped session claims at mint time, and the chart wiring.

Related: #428, #433, #439, izzywdev/FuzeInfra#421, izzywdev/MendysRobotics#253.

🤖 Generated with Claude Code

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.