Excititor Tenant Authority Client (AOC-19-013)

Audience: Excititor backend engineers wiring per-tenant Authority calls from the Worker and WebService. Purpose: Ensure every outbound Authority call is tenant-scoped so credentials and tokens cannot leak across tenants.

• Date: 2025-11-21
• Scope: EXCITITOR-CORE-AOC-19-013
• Implementation: src/Excititor/StellaOps.Excititor.Worker/Auth/TenantAuthorityClientFactory.cs

Contract

• Every outbound Authority call must carry X-Tenant header and use tenant-specific base URL.
• Base URLs and optional client credentials are configured under Excititor:Authority: with per-tenant keys.
• Factory throws when tenant is missing or not configured to prevent cross-tenant leakage.

Configuration shape

{
  "Excititor": {
    "Authority": {
      "BaseUrls": {
        "alpha": "https://authority.alpha.local/",
        "bravo": "https://authority.bravo.local/"
      },
      "ClientIds": {
        "alpha": "alpha-client-id"
      },
      "ClientSecrets": {
        "alpha": "alpha-secret"
      }
    }
  }
}

Implementation notes

• TenantAuthorityClientFactory (Worker) enforces tenant presence and a configured base URL; it adds Accept: application/json and X-Tenant headers.
• Registered in DI via Program.cs with options binding to Excititor:Authority.
• Reusable by both WebService and Worker components that call Authority.

Follow-ups

• Wire the factory into every service that calls Authority (WebService + Worker jobs), replacing any tenant-agnostic HttpClient usages.
• Add integration tests to confirm cross-tenant calls reject when configuration is missing or the header is mismatched.