Membership-based tenant authorization, tenant lookup, idempotent tenant creation - #6820

Merged

gz merged 25 commits into

mainfrom

tenant-get-and-idempotent-create

Aug 8, 2026

Commits on Aug 8, 2026

[pipeline-manager] Single-tenant lookup and idempotent tenant creation
gz
committed
eb1c7c2
[pipeline-manager] Treat empty tenant-claim entries as no claim
gz
committed
e2ca990
[pipeline-manager] Record membership provenance, add login DB operations
gz
committed
1b611d9
[pipeline-manager] Authorize logins from their memberships
gz
committed
aad0ff4
[python] Scenario matrix for membership-driven authorization
gz
committed
dd0a3ee
[web-console] Drive tenant selection from session memberships
gz
committed
c5c84e2
[fda] Manage tenants and members, select the acting tenant
gz
committed
7f224ac
[docs] Membership authorization guide, migration runbook, changelog
gz
committed
b309820
[pipeline-manager] Log RBAC audit lines at debug
gz
committed
bc4454b
[pipeline-manager] Read member profiles from the OIDC UserInfo endpoint
gz
committed
0fc4f45
[web-console] Name members and mark verified emails
gz
committed
d5606d8
[fda] Name members and mark verified emails in `member list`
gz
committed
524330b
[docs] How members are identified in the member list
gz
committed
0bf4a73
[scripts] Give the dev issuer profiles, `auth_time`, and a readable log
gz
committed
943de47
[pipeline-manager] Build the OIDC HTTP clients once, not per fetch
gz
committed
60a1d5a
[pipeline-manager] Require an encrypted destination for the UserInfo request
gz
committed
3027281
[fda] Display text the API returns rather than obey it
gz
committed
86e91ab
[web-console] Make newly added tenants immediately available in tenant selection

Karakatiza666
authored and
gz
committed
94763aa
[web-console] Simplify the gating on whether any tenant is selected by introducing the 'authorized' route group

Karakatiza666
authored and
gz
committed
85a2268
[python] Retry on a wall-clock deadline instead of an attempt cap
gz
committed
b9d4feb
[python] Retry dropped connections on idempotent non-GET endpoints
gz
committed
a0bd1e6
[python] Rerun tests that fail with infra-shaped errors
gz
committed
42150ee
[pipeline-manager] Send Retry-After on 503 error responses
gz
committed
71deec6
[python] Gate the retry deadline to CI; reserve 4 GiB for the buffer test
gz
committed
99470f9
[python] Reformat feldera_client.py for current ruff
gz
committed
031ece6

Navigation Menu

Uh oh!

Membership-based tenant authorization, tenant lookup, idempotent tenant creation - #6820

Membership-based tenant authorization, tenant lookup, idempotent tenant creation#6820
gz merged 25 commits into
mainfrom
tenant-get-and-idempotent-create

Commits on Aug 8, 2026

[pipeline-manager] Single-tenant lookup and idempotent tenant creation

[pipeline-manager] Treat empty tenant-claim entries as no claim

[pipeline-manager] Record membership provenance, add login DB operations

[pipeline-manager] Authorize logins from their memberships

[python] Scenario matrix for membership-driven authorization

[web-console] Drive tenant selection from session memberships

[fda] Manage tenants and members, select the acting tenant

[docs] Membership authorization guide, migration runbook, changelog

[pipeline-manager] Log RBAC audit lines at debug

[pipeline-manager] Read member profiles from the OIDC UserInfo endpoint

[web-console] Name members and mark verified emails

[fda] Name members and mark verified emails in `member list`

[docs] How members are identified in the member list

[scripts] Give the dev issuer profiles, `auth_time`, and a readable log

[pipeline-manager] Build the OIDC HTTP clients once, not per fetch

[pipeline-manager] Require an encrypted destination for the UserInfo request

[fda] Display text the API returns rather than obey it

[web-console] Make newly added tenants immediately available in tenant selection

[web-console] Simplify the gating on whether any tenant is selected by introducing the 'authorized' route group

[python] Retry on a wall-clock deadline instead of an attempt cap

[python] Retry dropped connections on idempotent non-GET endpoints

[python] Rerun tests that fail with infra-shaped errors

[pipeline-manager] Send Retry-After on 503 error responses

[python] Gate the retry deadline to CI; reserve 4 GiB for the buffer test

[python] Reformat feldera_client.py for current ruff