[email protected]andClaude Opus 4.6 8f1e0df0cd feat: add TenantCtx for compile-time tenant isolation ...

Implements zmanian's architectural proposal from #1614 review:
two-tier scoped database access (TenantScope/AdminScope) so handler
code cannot accidentally bypass tenant scoping.

TenantScope (default): wraps user_id + Arc<dyn Database>, auto-binds
user_id on every operation. ID-based lookups return None for cross-
tenant resources. No escape hatch — forgetting to scope is a compile
error.

AdminScope (explicit opt-in): cross-tenant access for system-level
components (heartbeat, routine engine, self-repair, scheduler, worker).

TenantCtx bundles TenantScope + workspace + cost guard + per-user
rate limiting. Constructed once per request in handle_message, threaded
through all command handlers and ChatDelegate.

Key changes:
- New src/tenant.rs (~920 lines): TenantScope, AdminScope, TenantCtx,
  TenantRateState, TenantRateRegistry
- All command handlers: user_id: &str → ctx: &TenantCtx
- ChatDelegate: cost check/record/settings via self.tenant
- System components: store field changed to AdminScope
- Config: TENANT_MAX_LLM_CONCURRENT, TENANT_MAX_JOBS_CONCURRENT env vars
- Fixes bug: /status <job_id> cross-tenant leak (now auto-filtered)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

2026-03-25 16:36:11 -07:00

..

e2e

test: Google OAuth URL broken when initiated from Telegram channel (#1165)

2026-03-23 10:08:24 +01:00

fixtures

Default new lightweight routines to tools-enabled (#1573)

2026-03-23 11:01:26 -07:00

support

feat: add TenantCtx for compile-time tenant isolation

2026-03-25 16:36:11 -07:00

test-pages

test(html_to_markdown): refresh golden files after renderer bump (#1016)

2026-03-11 20:28:38 -07:00

batch_last_run_status_tests.rs

fix(routines): normalize status display across web and CLI (#1469)

2026-03-24 10:41:33 +01:00

batch_query_tests.rs

fix: N+1 query pattern in event trigger loop (routine_engine) (#1163)

2026-03-14 13:06:59 -07:00

config_round_trip.rs

feat(llm): add GitHub Copilot as LLM provider (#1512)

2026-03-21 00:02:00 -07:00

dispatched_routine_run_tests.rs

Use live owner tool scope for autonomous routines and jobs (#1453)

2026-03-20 10:12:32 -07:00

e2e_advanced_traces.rs

feat: multi-tenant auth with per-user workspace isolation (#1118)

2026-03-23 20:50:05 -07:00

e2e_attachments.rs

feat: WASM channel attachments with LLM pipeline integration (#596)

2026-03-07 18:01:40 +00:00

e2e_builtin_tool_coverage.rs

Default new lightweight routines to tools-enabled (#1573)

2026-03-23 11:01:26 -07:00

e2e_metrics_test.rs

Add generic host-verified /webhook/tools/{tool} ingress (#757)

2026-03-11 03:36:25 +00:00

e2e_recorded_trace.rs

feat: merge http/web_fetch tools, add tool output stash for large responses (#578)

2026-03-06 00:49:10 +00:00

e2e_routine_heartbeat.rs

feat: add TenantCtx for compile-time tenant isolation

2026-03-25 16:36:11 -07:00

e2e_safety_layer.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

e2e_spot_checks.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

e2e_status_events.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

e2e_telegram_message_routing.rs

feat: add TenantCtx for compile-time tenant isolation

2026-03-25 16:36:11 -07:00

e2e_thread_id_isolation.rs

fix(agent): block thread_id-based context pollution across users (#760)

2026-03-11 16:52:31 -07:00

e2e_thread_scheduling.rs

test: add 29 E2E trace tests for issues #571-575 (#593)

2026-03-06 08:12:56 +00:00

e2e_tool_coverage.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

e2e_tool_param_coercion.rs

fix: parameter coercion and validation for oneOf/anyOf/allOf schemas (#1397)

2026-03-21 12:41:46 -07:00

e2e_trace_error_path.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

e2e_trace_file_tools.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

e2e_trace_memory.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

e2e_wasm_github_coercion.rs

fix: parameter coercion and validation for oneOf/anyOf/allOf schemas (#1397)

2026-03-21 12:41:46 -07:00

e2e_worker_coverage.rs

perf: build system prompt once per turn, skip tools on force-text (#583)

2026-03-07 09:15:00 +00:00

e2e_workspace_coverage.rs

test: add 29 E2E trace tests for issues #571-575 (#593)

2026-03-06 08:12:56 +00:00

gateway_workflow_integration.rs

Use live owner tool scope for autonomous routines and jobs (#1453)

2026-03-20 10:12:32 -07:00

gemini_oauth_regression.rs

feat(gemini_oauth): full Gemini CLI OAuth integration with Cloud Code API (#1356)

2026-03-21 22:41:44 -07:00

heartbeat_integration.rs

feat: add AWS Bedrock LLM provider via native Converse API (#713)

2026-03-09 07:10:25 +00:00

html_to_markdown.rs

feat: hot-activate WASM channels, channel-first prompts, unified artifact resolution (#297)

2026-02-22 08:09:56 +00:00

identity_scope_isolation.rs

feat(workspace): multi-scope workspace reads (#1117)

2026-03-22 22:56:26 -07:00

import_openclaw_comprehensive.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw_e2e.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw_errors.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw_idempotency.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw_integration.rs

fix(ci): WASM WIT compat sqlite3 duplicate symbol conflict (#953)

2026-03-11 11:48:24 -07:00

import_openclaw.rs

feat: Import OpenClaw memory, history and settings (#903)

2026-03-10 18:37:10 -07:00

layered_memory.rs

feat(workspace): layered memory with sensitivity-based privacy redirect (#1112)

2026-03-20 22:15:29 -07:00

module_init_integration.rs

feat: multi-tenant auth with per-user workspace isolation (#1118)

2026-03-23 20:50:05 -07:00

multi_scope_functional.rs

feat(workspace): multi-scope workspace reads (#1117)

2026-03-22 22:56:26 -07:00

multi_tenant_integration.rs

feat: multi-tenant auth with per-user workspace isolation (#1118)

2026-03-23 20:50:05 -07:00

multi_tenant_system_prompt.rs

feat: multi-tenant auth with per-user workspace isolation (#1118)

2026-03-23 20:50:05 -07:00

openai_compat_integration.rs

feat: multi-tenant auth with per-user workspace isolation (#1118)

2026-03-23 20:50:05 -07:00

pairing_integration.rs

ci: Added CI/CD and release pipelines (#45)

2026-02-12 12:25:36 +01:00

provider_chaos.rs

feat: enable Anthropic prompt caching via automatic cache_control injection (#660)

2026-03-07 09:10:05 +00:00

relay_integration.rs

feat: receive relay events via webhook callbacks (#1254)

2026-03-19 11:53:46 -07:00

shell_risk_regression.rs

feat(shell): add Low/Medium/High risk levels for graduated command approval (closes #172) (#368)

2026-03-21 22:05:18 -07:00

sighup_reload_integration.rs

fix: Channel HTTP: server doesn't start after config change (no hot-r… (#779)

2026-03-10 08:11:21 -07:00

support_unit_tests.rs

fix(config): init_secrets no longer overwrites entire config (#726)

2026-03-08 13:32:42 -07:00

telegram_auth_integration.rs

ci: isolate heavy integration tests (#1266)

2026-03-16 16:10:20 -07:00

tool_schema_validation.rs

test: add 26 tests for multi-thread safety, db CRUD, concurrency, errors (#442)

2026-03-06 04:39:04 +00:00

trace_format.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

trace_llm_tests.rs

Trajectory benchmarks and e2e trace test rig (#553)

2026-03-05 09:13:09 +00:00

wasm_channel_integration.rs

Refactor owner scope across channels and fix default routing fallback (#1151)

2026-03-16 13:31:03 -07:00

wit_compat.rs

feat: WASM channel attachments with LLM pipeline integration (#596)

2026-03-07 18:01:40 +00:00

workspace_integration.rs

feat(workspace): multi-scope workspace reads (#1117)

2026-03-22 22:56:26 -07:00

ws_gateway_integration.rs

feat: multi-tenant auth with per-user workspace isolation (#1118)

2026-03-23 20:50:05 -07:00