1.2 KiB
GovOPlaN Tenancy Module Boundary
govoplan-tenancy owns tenant registry, tenant settings, tenant lifecycle, and
tenant-context route contributions.
Owned Routes
/api/v1/admin/tenants*: tenant registry, delta feed, owner candidates, settings, deletion plans, retirement, and guarded empty-tenant destruction./api/v1/tenancy/switch-tenant: tenant-owned route surface for interactive tenant context switching.
/api/v1/auth/switch-tenant remains in govoplan-access for API
compatibility, but both routes delegate to the same
auth.tenantContextSwitcher capability.
Lifecycle Rules
Tenant retirement is non-destructive. It marks the tenant inactive and stores lifecycle metadata in tenant settings.
Destructive deletion is intentionally narrow: it is allowed only when the tenant is not the caller's active tenant and all registered tenant-owned counts are zero. Populated tenants must be retired first or cleaned explicitly by their owning modules before physical deletion.
Tenant lifecycle planning uses registered tenant summary providers and delete veto providers. Modules that own tenant-scoped data must contribute summaries so destructive deletion cannot silently miss their rows.