Class TenantIsolationServiceCollectionExtensions

Namespace: Microsoft.Extensions.DependencyInjection

Assembly: Stratara.Mediator.dll

DI extensions that register the Stratara tenant-isolation pipeline behavior.

public static class TenantIsolationServiceCollectionExtensions

Inheritance: object

TenantIsolationServiceCollectionExtensions

Inherited Members: object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

AddStrataraTenantIsolation(IServiceCollection, Action<TenantIsolationOptions>?)

Register the tenant-isolation pipeline behaviors for both request shapes (IRequest and IRequest<TResult>). The behavior acts only on requests that implement ITenantScopedRequest; all others pass through.

public static IServiceCollection AddStrataraTenantIsolation(this IServiceCollection services, Action<TenantIsolationOptions>? configure = null)

Parameters

services IServiceCollection: The service collection to mutate.
configure Action<TenantIsolationOptions>: Optional callback to configure the enforcement mode.

Returns

IServiceCollection: The same service collection, to enable chaining.

Examples

Strict isolation with a platform-admin cross-tenant authorizer:

builder.Services
    .AddStrataraValidation()
    .AddStrataraTenantIsolation(o => o.Mode = TenantIsolationMode.Strict);

builder.Services.AddScoped<ICrossTenantAuthorizer, PlatformAdminCrossTenantAuthorizer>();

Remarks

Call this after AddStrataraValidation() (so validation stays the outermost behavior) and before registering the handler-adjacent behaviors. A tenant-scoped request is rejected with TenantAccessDeniedException when its TenantId does not match the session's data-owner tenant.

The default Default permits privileged cross-tenant operations (the calling endpoint promotes the session's data-owner tenant to the target before dispatch). Opt into Strict to additionally route every cross-tenant operation through an ICrossTenantAuthorizer. Stratara registers a deny-all authorizer via TryAdd, so register your own ICrossTenantAuthorizer to grant the cross-tenant case (e.g. for a platform administrator).

TenantIsolationOptions follows the options pattern, so it can equally be bound from configuration with Configure<TenantIsolationOptions>(section). Calling this method more than once installs the behaviors once and applies every configuration callback in order, rather than leaving a second, conflicting options instance behind.

Table of Contents