feat: multi-tenant source namespacing -- isolate log sources per deployment context #50

New issue

Closed

opened 2026-05-26 23:05:27 -07:00 by pyr0ball · 0 comments

pyr0ball commented

2026-05-26 23:05:27 -07:00

Owner

Design:

Add optional tenant_id field to source definitions in sources.yaml
Store tenant_id in the log_entries table (new column, nullable -- NULL = default tenant)
All search, diagnose, and incident API endpoints accept an optional ?tenant=<id> filter
When ?tenant= is specified: only entries from that tenant's sources are returned
list_sources MCP tool and /api/sources endpoint filter by tenant if specified

Migration:

Existing entries get tenant_id = NULL (default behavior unchanged)
Column added via ALTER TABLE in ensure_schema() with IF NOT EXISTS

Acceptance criteria:

Two tenants with overlapping source IDs cannot see each other's entries
Existing single-tenant deployments work unchanged
Unit test: verify cross-tenant query isolation

When Turnstone is deployed in a shared or enterprise context, log sources from different customers, environments, or teams must be queryable in isolation. Today all sources share a single flat namespace. **Design:** - Add optional `tenant_id` field to source definitions in `sources.yaml` - Store `tenant_id` in the `log_entries` table (new column, nullable -- NULL = default tenant) - All search, diagnose, and incident API endpoints accept an optional `?tenant=<id>` filter - When `?tenant=` is specified: only entries from that tenant's sources are returned - `list_sources` MCP tool and `/api/sources` endpoint filter by tenant if specified **Migration:** - Existing entries get `tenant_id = NULL` (default behavior unchanged) - Column added via `ALTER TABLE` in `ensure_schema()` with `IF NOT EXISTS` **Acceptance criteria:** - Two tenants with overlapping source IDs cannot see each other's entries - Existing single-tenant deployments work unchanged - Unit test: verify cross-tenant query isolation