Membership-based tenant authorization, tenant lookup, idempotent tenant creation - #6820

An IdP claim template that evaluates empty emits `tenants: ""`, which
became a one-element list naming the empty string, so the login
get-or-created a tenant literally named "" that every misconfigured
user shared. Empty and whitespace-only entries, in the array form, the
comma-separated string form, and the deprecated singular `tenant`
claim, now fall through to tenant derivation like an absent claim, and
entries are trimmed.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

Membership rows gain `created_at` and `origin` (`claim`, `derived`, or
`api`; NULL for rows predating the migration), recorded on creation and
kept across role changes, so an operator can audit how access came to
be. `TenantMember` reports the origin.

New operations for membership-driven logins: `list_user_memberships`
lists the tenants a user may act in by `(provider, subject)`;
`enroll_in_existing_tenants` enrolls a user into listed tenants without
creating tenants or touching existing roles; `find_tenant_id_by_name`
looks a tenant up by name alone, so a name that parses as a UUID is not
reinterpreted as an id. `resolve_login`'s auto-enrollment inserts only
if absent, so a concurrent admin grant wins. New error variants answer
membership-based logins: `NotATenantMember` (one neutral 403 for an
unknown tenant and a tenant the user is no member of),
`AmbiguousTenantMembership`, and `NoTenantMemberships`.

The pre-provision endpoint doc no longer calls grants dormant: a
membership authorizes on its own once the identity authenticates.

The same migration adds the `app_user` profile columns that a later
commit fills from the identity provider: `email_verified`, `display_name`,
and the bookkeeping for how often to ask (`profile_refreshed_at`,
`profile_auth_time`). One migration per branch, so the schema for both
arrives together.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

The membership table now decides which tenants a human login may act
in; the tenancy strategies (`tenants` claim, issuer tenant, per-sub
tenant) only provision rows at login, gated by the new
`provision_on_login` flag (default `true`,
`FELDERA_AUTH_PROVISION_ON_LOGIN`). With the flag on, the deliberately
selected claim entry is fully provisioned and other listed entries
enroll into existing tenants only, so a mangled claim entry cannot mint
a tenant. With the flag off, a login creates nothing and enrolls no
one: access comes solely from rows granted through the RBAC endpoints,
and startup refuses the flag without a configured owner, because no
principal could otherwise ever grant access.

Acting-tenant selection mirrors the federated path: a `Feldera-Tenant`
header resolves by UUID or name and must match a membership, with one
neutral 403 for an unknown tenant and a non-membership, so the login
path is no tenant-existence oracle; a sole membership lands without a
header; several memberships without one are refused.
`GET /v0/config/session` is the one route that answers such a login: it
reports a `memberships` array and, when no acting tenant resolved,
`null` acting-tenant fields, which drives the web console's tenant
picker. Owners keep platform-wide access; with the flag off an owner
home tenant is looked up by name and never created.

Narrowing a claim no longer revokes access, and with the flag on a
removed member is re-enrolled by their next login while the claim still
names the tenant. Regenerates openapi.json and the console's generated
client.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

The switcher and the new must-pick tenant picker read the session's
`memberships` instead of decoding the token's `tenants` claim, and
select by tenant id, which stays valid across renames and disambiguates
names that parse as UUIDs (a Cognito sub-derived personal tenant). The
picker preserves deep links by reloading in place; the profile-menu
switcher restarts at the home page. A login with no membership sees a
no-access notice instead of a broken UI.

The saved selection is keyed per user and survives logout; an invalid
selection (membership removed, or an owner's acted-as tenant deleted)
clears itself and retries once headerless. Losing the last membership
is different: no fetch is pending to carry that news and a reload lands
in the same place, so the global error interceptor records it and the
gate engages on that, which also parks the pollers rather than letting
them spray failing requests until the user happens to refresh. Pollers
pause while no acting tenant is resolved. The remove-member dialog
states when removal takes effect and that API keys and OIDC trusts
survive it.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

`--tenant` / `FELDERA_TENANT` sends the `Feldera-Tenant` header on
every request, which a platform owner or a user with several
memberships needs; the selector is not a credential and travels on any
scheme.

`fda member list|add|set-role|remove` covers the tenant's membership
endpoints, so an owner who creates a tenant from the CLI can also grant
access from it rather than dropping to curl for half the workflow.
`add` takes an identity rather than a user id, because the point is to
grant access before that user's first login.

A bodyless 401, what the auth middleware answers when no credentials
arrived, now reads "authentication failed" with a hint that fda sends
credentials only over https, instead of the misleading version-mismatch
notice.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

The authentication guide describes memberships as the authorization
authority and the tenancy strategies as login provisioning, marks
managed tenancy deprecated, and adds the runbook for migrating to
Feldera-managed memberships. The roles page gains a "Revoking access"
section with the two-lever semantics under provisioning. Changelog
entries cover the model, the revocation breaking change, and rename
decoupling.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

One line per request drowned the log at info, and every request is
privileged on deployments such as auth-off development mode. A
dedicated audit sink will carry these separately.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

A membership is keyed to an OIDC subject, which is rarely a string
anyone recognizes, and an access token is a poor place to look up a
person's name and email: the claims a provider puts there vary, and an
AWS Cognito access token carries neither however many scopes it was
granted. Read them from the provider's UserInfo endpoint (OpenID Connect
Core 1.0 section 5.3) instead, and report them in `TenantMember` as
`display_name`, `email`, and `email_verified`.

Feldera holds no session, so there is no login moment to hang the fetch
on. The token's `auth_time` supplies one: it records when the user
authenticated and survives token refresh, so a newer value marks a fresh
login, which is when a changed email appears. Providers publishing no
`auth_time` fall back to a daily refresh. Two gates keep one login to
one request: an in-memory claim settles the common case without touching
the database, and a single atomic upsert then settles it across
api-server replicas and across restarts. The fetch runs detached, so a
provider that is slow or down costs the request nothing and never turns
a valid token away.

An address the provider vouched for now outranks both an access-token
claim and the email an administrator types into `preprovision_member`,
neither of which carries verification: overwriting would strip a
verified address of its mark or leave the mark beside a different one.
`email_verified` is false unless a provider says otherwise, so a
provider saying nothing never reads as an endorsement.

`email_verified` is a boolean in the specification but AWS Cognito
answers with the strings "true" and "false"; both spellings are now
accepted. A token using the string form previously failed to decode at
all, so such a provider could not authenticate.

The UserInfo endpoint comes out of the issuer's discovery document,
which the issuer controls, so a tenant-registered issuer is held to the
same destination policy as its `jwks_uri`. The answer's `sub` is checked
against the token's before anything is stored (section 5.3.2). Owner
matching deliberately still reads the token alone, so who is an owner
never depends on whether a background fetch has landed.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

The member list led with an OIDC subject, which identifies a person to
the identity provider and to nobody else. Lead with the name the
provider spells instead, falling back to the email and then to the
subject, and show the email beside it.

A check mark follows an email the provider vouches for. Nothing follows
one it will not: an address typed into the pre-provisioning form is a
claim about an address, and so is one from a provider that answers
nothing either way, and neither earns a mark.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

`member list` gains `name` and `verified` columns, so an administrator
reads a member's identity without decoding an OIDC subject and can tell
an address the provider vouches for from one an administrator typed.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

Document where a member's name, email, and verification verdict come
from, and record in the owners note that owner matching reads the access
token alone: many providers put neither `email` nor `email_verified`
there, so an email entry cannot match on such a provider.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

The dev issuer answered `/userinfo` by echoing the token's own claims,
which cannot exercise a profile lookup: the point of the endpoint is
that a provider knows more than the token carries. Its demo identities
now have names and their own verification verdicts, answered from the
profile rather than the token, covering the three shapes a real provider
sends: the boolean of the specification, the string AWS Cognito answers
with, and a provider that will not vouch for the address.

Tokens carry `auth_time`, set when a role is picked and preserved across
refresh, as a real provider issues it. `--omit-token-email` keeps
`email` and `email_verified` out of access tokens, as an AWS Cognito
access token does, leaving UserInfo as the only source.

The access log was block-buffered and sat empty for minutes at a time
under `rbac_up.sh`, which redirects it to a file; it is the only record
of what a browser asked the issuer for, so line-buffer it.

`rbac_demo.py` keys members by subject rather than email: the subject is
the identity itself, whereas the email is display data a provider may
not put in an access token at all.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

`oidc_http_client` takes about 90 ms per call, because `use_rustls_tls()`
loads and parses the platform's root certificate store every time. Every
OIDC fetch built a fresh one, so resolving an issuer's keys spent
roughly 180 ms constructing clients before a single byte moved:
discovery built one, the JWKS fetch built another. That sat on the
authentication path, once per JWKS cache miss per issuer.

Only two clients differ, by whether the destination policy restricts DNS
to public addresses, so hold both in `ServerState` and hand out a
reference. Reuse also keeps the connection pool, so a repeat fetch to
the same issuer skips the TLS handshake as well.

The measurement, on this branch:

    oidc_http_client (use_rustls_tls): 89.761995ms per build
    Client::builder().build() default: 85.657µs per build

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

…request

The profile refresh presents the caller's own live access token, and the
endpoint it presents it to comes out of the issuer's discovery document.
Only a tenant-registered issuer had that URL checked, so a login provider
whose discovery named an `http://` UserInfo endpoint would have had the
token sent in the clear, replayable by anyone on that route for the rest
of its lifetime.

The earlier code held the endpoint to the same policy as `jwks_uri`,
which was the wrong model to copy: a JWKS is signed and costs nothing to
disclose, whereas this request carries a credential. `validate_credential
_destination` states the stricter rule and runs in every mode before the
`Authorization` header is attached.

Loopback is the exception, because nothing off the host can observe it
and an identity provider on `localhost` is the ordinary shape of a
development deployment. A name that merely resembles loopback does not
qualify, and a private address is still refused over cleartext: it is
observable on that network.

The regression test asserts through a mock that expects zero requests,
so it proves the request is never made rather than merely that it fails.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

A table cell goes straight to stdout, and much of what fills one is
written by somebody else: a member's name and email come from the
identity provider, a pipeline's name from another member of the tenant,
a tenant's name and a trust's description from whoever created them. An
escape sequence in that text was acted on by the terminal instead of
shown, letting one user redraw what an administrator sees, or reach
whatever else that terminal binds to a control sequence.

`util::terminal_safe` replaces every control character, and the
bidirectional overrides that reorder a line without leaving a visible
trace. Ordinary text, accents and scripts of every direction included,
is untouched. It now covers the member, tenant, trust, API-key and
pipeline listings, the server error text that quotes names the caller
did not choose, and the echo of a just-created object.

Three things stay verbatim on purpose, and the helper's documentation
says so: the `logs` byte stream and ad-hoc query results are the
program's own output, which is the point of asking for them; and
`--format json` reports exactly what the server said, escaped by the
JSON encoder, because machine consumers need the original bytes. The
monitor tables needed nothing either, rendering through `Debug` and
`serde_json`, both of which already escape.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

…t selection

Avoid showing empty selection of tenants on admin page

Refactor how possible tenants are selected in profile menu

Signed-off-by: Karakatiza666 <bulakh.96@gmail.com>

…y introducing the 'authorized' route group

This change lets all not directly related UI components not have to know that a tenant may not be selected

Other minor fixes and style changes

Signed-off-by: Karakatiza666 <bulakh.96@gmail.com>

The default retry budget (3 retries, exponential backoff) gives up after
about 14 seconds. Infrastructure churn on shared CI instances, such as a
node replacement or a pipeline pod rescheduling, outlasts that budget and
fails tests with 503 PipelineUnavailable even though the instance recovers.

Add RetryConfig.deadline_seconds: when set, retries continue with the usual
waits until the wall-clock budget is spent, and max_retries no longer
applies. An outage lasts for a duration, not a number of requests.

The shared test client retries for up to 300 seconds, sized to ride out a
node replacement.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

A connection dropped by an API-server restart failed any in-flight POST
immediately: only GET was assumed safe to retry. Pipeline actions (start,
pause, stop, activate, dismiss_error, connector pause/start) are
desired-state setters, and PUT/DELETE of a pipeline are idempotent by API
contract, so a repeat cannot change the outcome. Callers now mark such
requests idempotent=True and dropped connections retry.

A DELETE marked idempotent that sees 404 on a retry attempt reports
success: the resource vanished between attempts, so an earlier attempt was
applied and the postcondition (resource absent) holds.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

The shared CI instances see node replacement and pipeline pod rescheduling
that no request-level retry can fully absorb: a stream cut mid-body or a
pipeline that stays unavailable past the retry budget still kills the test.

Add pytest-rerunfailures with an allowlist of transport failures and
pipeline unavailability. Assertion failures never match the allowlist, so
real bugs still fail deterministically.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

A 503 signals a transient condition (pipeline pod rescheduling, runner
restart, compiler busy, database lock contention) that resolves within
seconds, but clients had to guess how long to back off. All error types now
build their response through one helper that attaches Retry-After: 5 to
503s, sized to the runner's fastest pipeline-status probe interval and its
pipeline-descriptor cache TTL.

The Python SDK already honors Retry-After, so its 503 retries switch from
an exponential ramp toward 64 seconds to the server-chosen interval.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

…test

The 300-second retry budget belongs to shared CI instances only:
enterprise_only gates call get_config at import time, so with no local
instance running the deadline turned test collection into a 5-minute hang.

The output-buffer size-limit test pipeline peaks near 2 GiB while buffering
10M+ records for the Delta sink, but requested the default 1 GiB; the
kubelet evicted it when a packed CI node ran out of memory, failing the
test with PipelineUnavailable. Reserve 4 GiB.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>