PrimusSaaS.MultiTenancy.AspNetCore 1.1.0

PrimusSaaS.MultiTenancy.AspNetCore

Release status: stable integration package for PrimusSaaS.MultiTenancy.

ASP.NET Core integration package for Primus multi-tenancy.

Validation

• Current workspace validation: covered by the PrimusSaaS.MultiTenancy.Tests suite, which passed 242/242 on net8.0, net9.0, and net10.0, plus smoke tests 5/5
• Scope boundary: middleware and endpoint extensions only; tenant registry and provisioning remain outside the generic core
• For a first-time onboarding path that combines Identity Validator, Multi-Tenancy, and RBAC in one host, use /docs/modules/combined-dotnet-integration

Usage

builder.Services
	.AddPrimusMultiTenancy()
	.AddPrimusMultiTenancyAspNetCore();

app.UseAuthentication();
app.UsePrimusTenantResolution();
app.UsePrimusTenantIsolation();
app.UsePrimusTenantRateLimiting();
app.UsePrimusTenantEntitlements();
app.UseAuthorization();

UsePrimusTenantIsolation() returns 401 for authenticated requests without resolved tenant context.

If TenantHeaderName is active in a production-style host, also register AddPrimusMultiTenancyMembershipValidatedSelection() with a real membership store path. Startup validation blocks unvalidated header-based tenant selection otherwise.

UsePrimusTenantEntitlements() enforces endpoint feature requirements against tenant tier metadata.

Feature-gated endpoints

builder.Services.Configure<MultiTenancyOptions>(o =>
{
	o.PerTierEntitlements["Free"] = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
	{
		"dashboard.view"
	};
	o.PerTierEntitlements["Pro"] = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
	{
		"dashboard.view",
		"reports.export"
	};
	o.DefaultTenantTier = "Free";
});

app.MapGet("/reports/export", ExportHandler)
 .RequirePrimusFeature("reports.export");

If the current tenant tier is not entitled, the middleware returns 403 and records TenantEntitlementDenied through ITenantAuditSink.

Advanced hooks

AddPrimusMultiTenancyAspNetCore() registers defaults for:

• ITenantRateLimiter → InMemoryTenantRateLimiter
• ITenantBypassPolicy → DefaultTenantBypassPolicy

For multi-instance deployments, replace ITenantRateLimiter with a distributed implementation.

builder.Services.AddSingleton<ITenantRateLimiter, RedisTenantRateLimiter>();

To control support/super-admin access, override bypass policy:

builder.Services.AddSingleton<ITenantBypassPolicy, ApprovalBackedBypassPolicy>();

When bypass policy denies access, middleware returns 403 with Super-admin bypass denied.

Authenticated bootstrap flows without tenant context

If you compose this package with flows that create a user's first tenant membership, register ITenantRequirementExemptionPolicy to allow only those specific requests through before a tenant context exists.

Typical example:

• POST /primus/invitations/{invitationId}/accept

Do not exempt broad path prefixes or all authenticated requests. Keep the policy narrow and auditable.