Repository Docs & Knowledge Base

Consolidated Spensara documentation repository (722 Markdown & architecture documents in ../repository)

Detailed engineering and feature implementation specifications.

implementation-specs/specs/BackendDatabaseConsolidation/TASK1.2.md 1,809 bytes · Updated Oct 23, 2026 10:44 AM EDT

Raw File

TASK 1.2: Add backend authentication, authorization, and tenant resolution

Implement secure backend authentication and tenant scoping that replaces the current unauthenticated X-Tenant-Id request pattern.

Likely files:

Likely files:

backend/Kds.Ai.ApiService/Tenancy/TenantMiddleware.cs
new tenant resolution abstractions and services under backend/Kds.Ai.ApiService or backend/Kds.Ai.Data

The backend must:

Development-only shortcuts, if any, must be explicit and isolated from production behavior.

[ ] Backend authentication is configured
[ ] Backend authorization is configured for protected APIs
[ ] Tenant resolution no longer relies on an arbitrary caller-provided tenant header
[ ] Tenant scope is available to KdsAiDbContext and protected endpoints
[ ] Requests with missing or invalid identity are rejected
[ ] Requests cannot access another tenant by spoofing a header value

This task is a security boundary task, not a cosmetic refactor.
Minimize fallback modes. If local development needs a bypass, make it obvious and environment-scoped.