🏗️ Architecture: How to implement multi-tenant auth foundation for B2B2C AI p...

Date: 2026-02-05
Time: 22:35:37 UTC
Session: editor2-92.17
Agent: backend
Confidence: 90%
Status: ✅ Documented

📋 Decision Context

Question:

How to implement multi-tenant auth foundation for B2B2C AI platform?

Task: Session 93: Multi-tenant auth foundation for B2B2C AI platform

🎯 Decision Made

Chosen:

Phase 1 implementation: InfrastructureAuthGuard (localhost bypass + JWT + API key), JWT enrichment with userType/mcpTier/spaceId claims, Platform User JWT generation, spaceId on tenant schemas, SpaceAIDatabaseService for per-space DB routing, BuilderProfile schema for T2 cross-space prefs, SpaceAIPreferences schema for T2 controls

Options Considered:

1. Modify core PlatformUserService for JWT generation
2. Generate JWT in backend-api wrapper service
3. Add full RBAC middleware
4. Simple guard + enriched JWT claims

💭 Reasoning

Auth foundation must come first - every feature built on unscoped data needs retrofitting later. Added claims are additive (existing tokens still valid). Localhost bypass preserves dev workflow. Per-space DB routing mirrors proven McpProjectService pattern. Builder profiles stored in global ai-agents DB (not per-space) because they follow the builder across spaces. SpaceAIPreferences stored per-space because they're space-specific T2 controls.

📁 Files Involved

• apis/backend-ai-api/src/app/infrastructure/guards/infrastructure-auth.guard.ts
• apis/backend-ai-api/src/app/agents/services/space-ai-database.service.ts
• apis/backend-ai-api/src/app/agents/schemas/builder-profile.schema.ts
• apis/backend-ai-api/src/app/agents/schemas/space-ai-preferences.schema.ts
• apis/backend-api/src/app/backend-auth/backend-auth.service.ts
• apis/backend-api/src/app/platform-users/platform-users.service.ts

🔗 Related

• Decision ID: dev_1770330937550_rs8voau
• Session: 92
• Workspace: editor2

Auto-generated by MCP Smart Consolidation