30 lines
1.2 KiB
Markdown
30 lines
1.2 KiB
Markdown
# GovOPlaN Tenancy Module Boundary
|
|
|
|
`govoplan-tenancy` owns tenant registry, tenant settings, tenant lifecycle, and
|
|
tenant-context route contributions.
|
|
|
|
## Owned Routes
|
|
|
|
- `/api/v1/admin/tenants*`: tenant registry, delta feed, owner candidates,
|
|
settings, deletion plans, retirement, and guarded empty-tenant destruction.
|
|
- `/api/v1/tenancy/switch-tenant`: tenant-owned route surface for interactive
|
|
tenant context switching.
|
|
|
|
`/api/v1/auth/switch-tenant` remains in `govoplan-access` for API
|
|
compatibility, but both routes delegate to the same
|
|
`auth.tenantContextSwitcher` capability.
|
|
|
|
## Lifecycle Rules
|
|
|
|
Tenant retirement is non-destructive. It marks the tenant inactive and stores
|
|
lifecycle metadata in tenant settings.
|
|
|
|
Destructive deletion is intentionally narrow: it is allowed only when the
|
|
tenant is not the caller's active tenant and all registered tenant-owned counts
|
|
are zero. Populated tenants must be retired first or cleaned explicitly by
|
|
their owning modules before physical deletion.
|
|
|
|
Tenant lifecycle planning uses registered tenant summary providers and delete
|
|
veto providers. Modules that own tenant-scoped data must contribute summaries
|
|
so destructive deletion cannot silently miss their rows.
|