Add tenant-aware API routing with auth middleware #11

New Issue

2026-02-25T16:05:13+01:00

libretech commented

2026-02-25 16:05:13 +01:00

Summary

Add middleware that extracts tenant context from JWT tokens and enforces tenant-scoped access across all API endpoints.

Design

JWT middleware extracts user_id and tenant context from Authorization header
All downstream handlers receive tenant-scoped context
Unauthorized requests return 401
Cross-tenant access attempts return 403

Implementation Tasks

Implement JWT validation middleware
Add tenant context extraction from verified tokens
Inject tenant context into request handlers
Add authorization checks on all note endpoints
Return proper HTTP status codes (401 unauthenticated, 403 unauthorized)
Add middleware tests with valid/invalid/expired tokens

Security Considerations

Verify JWT signature on every request
Reject expired tokens
Ensure tenant context cannot be spoofed via headers
Log authentication failures for monitoring

Acceptance Criteria

All API endpoints require valid JWT
Tenant context is correctly extracted and enforced
Invalid/expired tokens return 401
Cross-tenant access returns 403
Middleware tests cover happy path and attack scenarios

## Summary Add middleware that extracts tenant context from JWT tokens and enforces tenant-scoped access across all API endpoints. ## Design - JWT middleware extracts user_id and tenant context from Authorization header - All downstream handlers receive tenant-scoped context - Unauthorized requests return 401 - Cross-tenant access attempts return 403 ## Implementation Tasks - [x] Implement JWT validation middleware - [x] Add tenant context extraction from verified tokens - [x] Inject tenant context into request handlers - [x] Add authorization checks on all note endpoints - [x] Return proper HTTP status codes (401 unauthenticated, 403 unauthorized) - [x] Add middleware tests with valid/invalid/expired tokens ## Security Considerations - Verify JWT signature on every request - Reject expired tokens - Ensure tenant context cannot be spoofed via headers - Log authentication failures for monitoring ## Acceptance Criteria - [x] All API endpoints require valid JWT - [x] Tenant context is correctly extracted and enforced - [x] Invalid/expired tokens return 401 - [x] Cross-tenant access returns 403 - [x] Middleware tests cover happy path and attack scenarios

libretech added the phase-1 label 2026-02-25 16:05:13 +01:00

libretech added the task label 2026-02-28 20:25:53 +01:00

libretech changed title from ~~Tenant-aware API routing~~ to Add tenant-aware API routing with auth middleware

2026-02-28 20:25:53 +01:00

libretech referenced this issue

2026-02-28 21:41:31 +01:00

Epic: Phase 1 — Multi-tenant Backend #7

libretech added the backend security labels 2026-02-28 22:00:43 +01:00

~~libretech referenced this issue 2026-03-01 20:32:14 +01:00~~

Implement per-user note directory isolation with filesystem sandboxing #10

libretech closed this issue

2026-04-28 22:29:05 +02:00