Added Authentication to Tenant create, update and delete based on Super-Admin Role

[sonal-aot]

JIRA Ticket

M8F-85
M8F-99

Description

Refactor: Multi-Tenant Management and Security Hardening

This refactor centralizes tenant lifecycle management and ensures that creation, updates, and deletions are synchronized between the local PostgreSQL database and Keycloak, while enforcing strict Super Admin oversight.

🚀 Key Changes

Enhanced Security & Authorization

• Unified Super-Admin Access: All three administrative operations (Create, Update, Delete) are now strictly restricted to users with the super-admin role.
• Permission Enforcement: Updated m8flow.yml with the manage-tenant-realms permission covering /m8flow/tenant-realms* and enforced via AuthorizationService.
• Exclusion List Removal: Removed create_realm from the authentication exclusion list. This ensures the standard SpiffWorkflow JWT authentication flow applies, populating g.user for manual role verification.
• Internal Authentication: Transitioned all administrative controllers to use the internal Master Admin token via get_master_admin_token(). This eliminates the need for external systems to provide Keycloak admin credentials in request headers.

🛠️ How to Test

Postman Collection: [m8flow_tenant_management.postman_collection.json](
m8flow_tenant_management.postman_collection.json

1. Obtain Super Admin Token: Ensure the master realm is configured in your .env. Log in as a master realm super-admin to obtain a token.
2. Creation: Use POST /v1.0/m8flow/tenant-realms. Verify the new realm in Keycloak and the new row in m8f_tenant.
3. Update: Use PUT /v1.0/m8flow/tenants/{uuid}/name with body {"name": "New Name"}. Verify synchronization between the DB and Keycloak.
4. Deletion: Use DELETE /v1.0/m8flow/tenant-realms/{slug}. Verify the realm is removed and the database record is purged.
5. Authorization Test: Use a standard user token and verify it returns 403 Forbidden with the custom error message.

Type

• Feature
• Bug fix
• Documentation
• Other

Changes

• Backend
• Frontend
• Documentation

Testing

Manual API testing and security verification were performed to confirm that all tenant management operations are secure, correctly synchronized, and restricted to the super-admin role as per organizational requirements.

[andrepestana-aot]

Looks good. Thanks for the changes.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud