ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
3b1dd98f52
TenantAtlas/specs/062-tenant-rbac-v1/data-model.md
Ahmed Darrazi 3b1dd98f52 feat(rbac): Implement Tenant RBAC v1 
This commit introduces a comprehensive Role-Based Access Control (RBAC) system for TenantAtlas.

- Implements authentication via Microsoft Entra ID (OIDC).
- Manages authorization on a per-Suite-Tenant basis using a  table.
- Follows a capabilities-first approach, using Gates and Policies.
- Includes a break-glass mechanism for platform superadmins.
- Adds policies for bootstrapping tenants and managing admin responsibilities.
2026-01-25 16:01:50 +01:00

1.5 KiB
Raw Blame History

Data Model for Tenant RBAC v1

This document outlines the data models for the Tenant RBAC feature.

users

Represents a user identity, linked to an Entra ID.

  • id (PK)
  • entra_tenant_id (string) - The Entra ID tenant ID (tid).
  • entra_object_id (string) - The Entra ID object ID (oid).
  • name (string)
  • email (string, nullable)
  • timestamps

Indexes:

  • Unique index on (entra_tenant_id, entra_object_id).

tenant_memberships

Links a User to a Suite Tenant with a specific role. This is the source of truth for authorization.

  • id (PK, uuid)
  • tenant_id (FK to tenants.id)
  • user_id (FK to users.id)
  • role (enum: owner, manager, operator, readonly)
  • source (enum: manual, entra_group, entra_app_role, break_glass)
  • source_ref (string, nullable) - e.g., Entra group ID or app role ID.
  • created_by_user_id (FK to users.id, nullable)
  • timestamps

Indexes:

  • Unique index on (tenant_id, user_id).
  • Index on (tenant_id, role).

tenant_role_mappings

Defines the mapping between an Entra group/app-role and a TenantAtlas role for a Suite Tenant.

  • id (PK, uuid)
  • tenant_id (FK to tenants.id)
  • mapping_type (enum: entra_group, entra_app_role)
  • external_id (string) - The Entra group GUID or appRole string.
  • role (enum: owner, manager, operator, readonly)
  • is_enabled (boolean)
  • timestamps

Indexes:

  • Unique index on (tenant_id, mapping_type, external_id).