🔐 RecSys.AI - Authentication & Authorization Guide

Version: 1.0.0
Last Updated: January 3, 2026
Status: Implementation Guide

---

Table of Contents

1. Overview
2. Multi-Tenancy Architecture
3. Authentication System
4. Authorization & Access Control
5. Subscription Management
6. API Key Management
7. Implementation Guide
8. Security Best Practices

---

Overview

RecSys.AI implements a multi-tenant SaaS architecture with API key-based authentication for service-to-service communication and JWT-based authentication for the admin dashboard.

Key Features

• ✅ Multi-Tenancy - Complete data isolation per tenant
• ✅ Subscription Plans - 5 tiers (Free, Starter, Growth, Business, Enterprise)
• ✅ API Key Authentication - Secure, revocable keys with expiration
• ✅ Quota Management - Per-tenant rate limiting and usage tracking
• ✅ Domain Whitelisting - Restrict API usage to approved domains
• ✅ Usage Analytics - Real-time tracking of requests, items, and users

---

Multi-Tenancy Architecture

Data Model

┌──────────────────────────────────────────────────┐
│                   Tenant                          │
│  (Aggregate Root)                                │
│                                                   │
│  - TenantId (PK)                                 │
│  - Name, ContactEmail, CompanyName               │
│  - SubscriptionPlan (Free/Starter/Growth/...)    │
│  - SubscriptionStatus (Trial/Active/Suspended)   │
│  - Usage Metrics (Requests, Items, Users)        │
│  - Allowed Domains []                            │
│  - Created/Updated/Expiry Dates                  │
└───────────────┬──────────────────────────────────┘
                │ 1:N
                ├──────────────────────────┐
                │                          │
                ▼                          ▼
┌───────────────────────┐   ┌─────────────────────┐
│      ApiKey           │   │   User/Item/etc     │
│  - Id (PK)            │   │   - tenant_id (FK)  │
│  - TenantId (FK)      │   │   - ... (data)      │
│  - Name               │   └─────────────────────┘
│  - KeyHash (SHA256)   │
│  - IsRevoked          │
│  - ExpiresAt          │
│  - TotalRequests      │
└───────────────────────┘

Tenant Entity

File: RecSysAI.Domain/Entities/Tenant.cs

public sealed class Tenant : Entity<TenantId>, IAggregateRoot
{
    // Identity
    public string Name { get; }
    public string ContactEmail { get; }
    public string? CompanyName { get; }
    
    // Subscription
    public SubscriptionPlan SubscriptionPlan { get; }
    public SubscriptionStatus Status { get; }
    
    // Usage Tracking
    public long TotalRequestsThisMonth { get; }
    public long TotalItemsCount { get; }
    public long TotalUsersCount { get; }
    
    // Limits (from subscription plan)
    public long MonthlyRequestLimit => SubscriptionPlan.MonthlyRequestLimit;
    public long MaxItemsLimit => SubscriptionPlan.MaxItemsLimit;
    public long MaxUsersLimit => SubscriptionPlan.MaxUsersLimit;
    
    // Collections
    public IReadOnlyCollection<string> AllowedDomains { get; }
    public IReadOnlyCollection<ApiKey> ApiKeys { get; }
    
    // Business Methods
    public bool CanMakeRequest();
    public void IncrementRequestCount();
    public ApiKey CreateApiKey(string name, DateTime? expiresAt = null);
    public void UpgradePlan(SubscriptionPlan newPlan);
    public void SuspendSubscription();
    // ... more methods
}

Subscription Plans

File: RecSysAI.Domain/ValueObjects/SubscriptionPlan.cs

Plan	Price/mo	Requests/mo	Max Items	Max Users	Support
Free	$0	50,000	10,000	1,000	Community
Starter	$49	200,000	50,000	10,000	Email (48h)
Growth	$199	1,000,000	200,000	50,000	Priority (24h)
Business	$499	5,000,000	1,000,000	200,000	Dedicated (4h)
Enterprise	Custom	Unlimited	Unlimited	Unlimited	24/7

Implementation:

public sealed class SubscriptionPlan : ValueObject
{
    public static readonly SubscriptionPlan Free = new(
        name: "Free",
        level: 0,
        monthlyPrice: 0,
        monthlyRequestLimit: 50_000,
        maxItemsLimit: 10_000,
        maxUsersLimit: 1_000
    );
    
    public static readonly SubscriptionPlan Starter = new(
        name: "Starter",
        level: 1,
        monthlyPrice: 49,
        monthlyRequestLimit: 200_000,
        maxItemsLimit: 50_000,
        maxUsersLimit: 10_000
    );
    
    // ... other plans
}

---

Authentication System

API Key Authentication Flow

┌─────────────┐
│   Client    │
└──────┬──────┘
       │ 1. HTTP Request
       │    Header: X-Api-Key: rsk_live_abc123...
       ▼
┌──────────────────────────────────────────────┐
│     Authentication Middleware                 │
│                                               │
│  1. Extract API key from X-Api-Key header    │
│  2. Hash the key (SHA256)                    │
│  3. Query ApiKey by hash                     │
│  4. Validate:                                │
│     - Key exists?                            │
│     - Not revoked?                           │
│     - Not expired?                           │
│  5. Load Tenant                              │
│  6. Validate:                                │
│     - Tenant IsActive?                       │
│     - Subscription Active?                   │
│     - Within quota limits?                   │
│  7. Set HttpContext.Items["TenantId"]        │
│  8. Set HttpContext.Items["Tenant"]          │
│  9. Record API key usage                     │
└──────┬───────────────────────────────────────┘
       │ 2. Authenticated request
       │    with TenantId in context
       ▼
┌──────────────────────────────────────────────┐
│         Recommendation Controller             │
│                                               │
│  - Access Tenant from HttpContext            │
│  - Filter queries by TenantId                │
│  - Enforce data isolation                    │
│  - Increment request counter                 │
└──────┬───────────────────────────────────────┘
       │ 3. Query with tenant_id filter
       ▼
┌──────────────────────────────────────────────┐
│              Database                         │
│  SELECT * FROM users                          │
│  WHERE tenant_id = ?                         │
└───────────────────────────────────────────────┘

API Key Format

Format: rsk_live_<24 random characters>

Example: rsk_live_xJ8Kp2mNq5RtYz3WvBc9

Breakdown:

• rsk - RecSys Key prefix
• live - Environment (live/test)
• _ - Separator
• <random> - 24 cryptographically secure random characters

Generation:

private static string GenerateApiKey()
{
    const string prefix = "rsk_live_";
    const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
    var random = new byte[24];
    
    using (var rng = RandomNumberGenerator.Create())
    {
        rng.GetBytes(random);
    }

    var sb = new StringBuilder(prefix);
    foreach (var b in random)
    {
        sb.Append(chars[b % chars.Length]);
    }

    return sb.ToString();
}

Storage: Keys are hashed with SHA256 before storing in database. Plain keys are shown ONCE to the user during creation.

private static string HashApiKey(string apiKey)
{
    using var sha256 = SHA256.Create();
    var bytes = Encoding.UTF8.GetBytes(apiKey);
    var hash = sha256.ComputeHash(bytes);
    return Convert.ToBase64String(hash);
}

---

Authorization & Access Control

Access Control Model

RecSys.AI uses a Role-Based Access Control (RBAC) model within each tenant:

Tenant
├── Owner (Full access)
│   └── Can manage billing, invite users, delete tenant
├── Admin (Manage access)
│   └── Can manage API keys, view analytics, configure settings
├── Developer (API access)
│   └── Can view API keys, make API requests, view documentation
└── Viewer (Read-only)
    └── Can view dashboards and reports

Data Isolation Strategy

Row-Level Security (RLS):

Every entity that belongs to a tenant has a tenant_id foreign key:

-- Users table
CREATE TABLE recsys.users (
    id VARCHAR(100) PRIMARY KEY,
    tenant_id VARCHAR(100) NOT NULL REFERENCES recsys.tenants(id) ON DELETE CASCADE,
    metadata JSONB,
    features JSONB,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Create index for tenant-scoped queries
CREATE INDEX idx_users_tenant_id ON recsys.users(tenant_id);

-- PostgreSQL Row-Level Security (optional additional layer)
ALTER TABLE recsys.users ENABLE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON recsys.users
    USING (tenant_id = current_setting('app.current_tenant_id')::VARCHAR);

Application-Level Filtering:

All repository queries automatically filter by TenantId:

public async Task<IReadOnlyList<User>> GetAllAsync(
    TenantId tenantId, 
    CancellationToken cancellationToken = default)
{
    return await _context.Users
        .Where(u => u.TenantId == tenantId) // Automatic filtering
        .ToListAsync(cancellationToken);
}

Query Filters (Global Filter)

EF Core Global Query Filters ensure tenant isolation:

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    // Automatically filter all User queries by TenantId
    modelBuilder.Entity<User>().HasQueryFilter(u => 
        u.TenantId == _currentTenantId);
    
    modelBuilder.Entity<Item>().HasQueryFilter(i => 
        i.TenantId == _currentTenantId);
    
    modelBuilder.Entity<Interaction>().HasQueryFilter(i => 
        i.TenantId == _currentTenantId);
}

---

Subscription Management

Lifecycle Management

1. Sign-Up (Trial Period)

// Create new tenant with 30-day trial
var tenant = Tenant.Create(
    tenantId: "acme_corp",
    name: "Acme Corporation",
    contactEmail: "admin@acme.com",
    plan: SubscriptionPlan.Free
);

// Auto-generated properties:
// - Status = SubscriptionStatus.Trial
// - TrialEndsAt = DateTime.UtcNow.AddDays(30)
// - IsActive = true

2. Trial Conversion

// Upgrade to paid plan
tenant.UpgradePlan(SubscriptionPlan.Starter);

// Result:
// - Status = SubscriptionStatus.Active
// - SubscriptionStartedAt = DateTime.UtcNow
// - SubscriptionEndsAt = DateTime.UtcNow.AddMonths(1)
// - TrialEndsAt = null (trial ended)

3. Monthly Renewal

// Renew subscription (typically triggered by successful payment)
tenant.RenewSubscription();

// Result:
// - SubscriptionEndsAt += 1 month
// - TotalRequestsThisMonth = 0 (reset counter)

4. Suspension (Payment Failed)

// Suspend due to payment failure
tenant.SuspendSubscription();

// Result:
// - Status = SubscriptionStatus.Suspended
// - IsActive = false
// - API requests blocked

5. Reactivation

// Reactivate after payment resolved
tenant.ReactivateSubscription();

// Result:
// - Status = SubscriptionStatus.Active
// - IsActive = true

6. Cancellation

// Cancel subscription
tenant.CancelSubscription();

// Result:
// - Status = SubscriptionStatus.Cancelled
// - IsActive = false
// - SubscriptionEndsAt = DateTime.UtcNow

Quota Enforcement

Request Quota

// Before processing API request
if (!tenant.CanMakeRequest())
{
    // Returns 429 Too Many Requests
    return Results.Problem(
        statusCode: 429,
        title: "Quota Exceeded",
        detail: $"Monthly limit of {tenant.MonthlyRequestLimit:N0} requests exceeded. " +
                $"Upgrade your plan at https://recsys.ai/pricing"
    );
}

// Process request
tenant.IncrementRequestCount(); // Thread-safe increment
await _unitOfWork.SaveChangesAsync();

Items Quota

// Before adding new item
if (tenant.TotalItemsCount >= tenant.MaxItemsLimit)
{
    return Results.Problem(
        statusCode: 403,
        title: "Item Limit Reached",
        detail: $"Your plan allows up to {tenant.MaxItemsLimit:N0} items. " +
                $"Current count: {tenant.TotalItemsCount:N0}. " +
                $"Upgrade to add more items."
    );
}

// Add item
var item = Item.Create(...);
tenant.UpdateUsageMetrics(tenant.TotalItemsCount + 1, tenant.TotalUsersCount);

Background Jobs

Daily Quota Reset

// Run daily at midnight UTC
public async Task ResetMonthlyQuotasAsync()
{
    var tenantsToReset = await _tenantRepository.GetTenantsForQuotaResetAsync();
    
    foreach (var tenant in tenantsToReset)
    {
        if (tenant.SubscriptionEndsAt <= DateTime.UtcNow.AddDays(1))
        {
            // Subscription ending soon, renew or suspend
            if (await _billingService.AttemptRenewalAsync(tenant.Id))
            {
                tenant.RenewSubscription();
            }
            else
            {
                tenant.SuspendSubscription();
            }
        }
    }
    
    await _unitOfWork.SaveChangesAsync();
}

Trial Expiration Warnings

// Run daily
public async Task SendTrialExpirationWarningsAsync()
{
    var expiringTrials = await _tenantRepository.GetExpiringTrialsAsync(daysUntilExpiry: 7);
    
    foreach (var tenant in expiringTrials)
    {
        await _emailService.SendAsync(new TrialExpirationEmail
        {
            To = tenant.ContactEmail,
            TenantName = tenant.Name,
            DaysRemaining = (tenant.TrialEndsAt!.Value - DateTime.UtcNow).Days
        });
    }
}

---

API Key Management

Creating API Keys

// In controller or service
var apiKey = tenant.CreateApiKey(
    name: "Production API Key",
    expiresAt: DateTime.UtcNow.AddYears(1) // Optional
);

// Store the plain key temporarily (only shown once!)
var plainKey = apiKey.PlainKeyOneTime; // "rsk_live_abc123..."

// Return to user (NEVER store plain key in database)
return Results.Ok(new
{
    id = apiKey.Id,
    key = plainKey, // ⚠️ SHOWN ONLY ONCE
    name = apiKey.Name,
    expiresAt = apiKey.ExpiresAt
});

// The database stores only the hash
// apiKey.KeyHash = "7X9K2mP5..." (SHA256 hash)

Validating API Keys

// In authentication middleware
public async Task<Tenant?> AuthenticateAsync(string plainApiKey)
{
    // 1. Hash the incoming key
    var keyHash = ApiKey.HashApiKey(plainApiKey);
    
    // 2. Find the API key by hash
    var apiKey = await _apiKeyRepository.GetByKeyHashAsync(keyHash);
    if (apiKey == null)
        return null;
    
    // 3. Validate the key
    if (!apiKey.IsValid()) // Checks IsRevoked and ExpiresAt
        return null;
    
    // 4. Load the tenant
    var tenant = await _tenantRepository.GetByIdAsync(apiKey.TenantId);
    if (tenant == null || !tenant.IsActive)
        return null;
    
    // 5. Record usage
    apiKey.RecordUsage();
    await _unitOfWork.SaveChangesAsync();
    
    return tenant;
}

Revoking API Keys

// Revoke a specific key
tenant.RevokeApiKey(apiKeyId);
await _unitOfWork.SaveChangesAsync();

// Result:
// - apiKey.IsRevoked = true
// - Future authentication attempts will fail

Rotating API Keys

// Best practice: Rotate keys every 90 days
public async Task RotateApiKeyAsync(Guid oldKeyId)
{
    var tenant = await _tenantRepository.GetByApiKeyIdAsync(oldKeyId);
    
    // 1. Create new key
    var newApiKey = tenant.CreateApiKey(
        name: "Rotated Production Key",
        expiresAt: DateTime.UtcNow.AddYears(1)
    );
    
    // 2. Grace period (both keys work for 7 days)
    await Task.Delay(TimeSpan.FromDays(7));
    
    // 3. Revoke old key
    tenant.RevokeApiKey(oldKeyId);
    
    await _unitOfWork.SaveChangesAsync();
    
    return newApiKey;
}

---

Implementation Guide

Step 1: Database Migrations

# Add migrations for new entities
cd recommendai-api/RecSysAI.Infrastructure
dotnet ef migrations add AddMultiTenancy --startup-project ../RecommendAI.Api

# Review generated migration, then apply
dotnet ef database update --startup-project ../RecommendAI.Api

Expected Tables:

• recsys.tenants
• recsys.api_keys
• Updated: recsys.users, recsys.items, recsys.interactions (add tenant_id FK)

Step 2: EF Core Configurations

TenantConfiguration.cs:

public class TenantConfiguration : IEntityTypeConfiguration<Tenant>
{
    public void Configure(EntityTypeBuilder<Tenant> builder)
    {
        builder.ToTable("tenants", "recsys");
        
        builder.HasKey(t => t.Id);
        builder.Property(t => t.Id)
            .HasConversion(
                id => id.Value,
                value => TenantId.Create(value))
            .HasMaxLength(100);
        
        builder.Property(t => t.Name).IsRequired().HasMaxLength(200);
        builder.Property(t => t.ContactEmail).IsRequired().HasMaxLength(255);
        
        builder.OwnsOne(t => t.SubscriptionPlan, plan =>
        {
            plan.Property(p => p.Name).HasColumnName("plan_name").HasMaxLength(50);
            plan.Property(p => p.Level).HasColumnName("plan_level");
            plan.Property(p => p.MonthlyPrice).HasColumnName("monthly_price").HasColumnType("decimal(10,2)");
        });
        
        builder.Property(t => t.Status)
            .HasConversion<string>()
            .HasMaxLength(20);
        
        builder.Property(t => t.AllowedDomains)
            .HasConversion(
                v => JsonSerializer.Serialize(v, (JsonSerializerOptions)null!),
                v => JsonSerializer.Deserialize<List<string>>(v, (JsonSerializerOptions)null!) ?? new List<string>())
            .HasColumnType("jsonb");
        
        builder.HasMany(t => t.ApiKeys)
            .WithOne(k => k.Tenant)
            .HasForeignKey(k => k.TenantId);
        
        builder.HasIndex(t => t.ContactEmail);
        builder.HasIndex(t => t.IsActive);
        builder.HasIndex(t => t.Status);
    }
}

ApiKeyConfiguration.cs:

public class ApiKeyConfiguration : IEntityTypeConfiguration<ApiKey>
{
    public void Configure(EntityTypeBuilder<ApiKey> builder)
    {
        builder.ToTable("api_keys", "recsys");
        
        builder.HasKey(k => k.Id);
        
        builder.Property(k => k.TenantId)
            .HasConversion(
                id => id.Value,
                value => TenantId.Create(value))
            .IsRequired();
        
        builder.Property(k => k.Name).IsRequired().HasMaxLength(200);
        builder.Property(k => k.KeyHash).IsRequired().HasMaxLength(64);
        builder.Property(k => k.IsRevoked).IsRequired();
        
        builder.HasIndex(k => k.KeyHash).IsUnique();
        builder.HasIndex(k => k.TenantId);
        builder.HasIndex(k => k.ExpiresAt);
    }
}

Step 3: Repository Implementations

TenantRepository.cs:

internal sealed class TenantRepository : ITenantRepository
{
    private readonly RecSysAIDbContext _context;
    
    public TenantRepository(RecSysAIDbContext context)
    {
        _context = context;
    }
    
    public async Task<Tenant?> GetByIdAsync(TenantId id, CancellationToken cancellationToken = default)
    {
        return await _context.Tenants
            .Include(t => t.ApiKeys)
            .FirstOrDefaultAsync(t => t.Id == id, cancellationToken);
    }
    
    public async Task<Tenant?> GetByApiKeyAsync(string apiKeyHash, CancellationToken cancellationToken = default)
    {
        return await _context.Tenants
            .Include(t => t.ApiKeys)
            .FirstOrDefaultAsync(t => t.ApiKeys.Any(k => k.KeyHash == apiKeyHash), cancellationToken);
    }
    
    public async Task<IReadOnlyList<Tenant>> GetActiveTenantsAsync(CancellationToken cancellationToken = default)
    {
        return await _context.Tenants
            .Where(t => t.IsActive && t.Status == SubscriptionStatus.Active)
            .ToListAsync(cancellationToken);
    }
    
    // ... more methods
}

Step 4: Authentication Middleware

ApiKeyAuthenticationMiddleware.cs:

public class ApiKeyAuthenticationMiddleware
{
    private readonly RequestDelegate _next;
    private readonly ILogger<ApiKeyAuthenticationMiddleware> _logger;
    
    public ApiKeyAuthenticationMiddleware(
        RequestDelegate next,
        ILogger<ApiKeyAuthenticationMiddleware> logger)
    {
        _next = next;
        _logger = logger;
    }
    
    public async Task InvokeAsync(HttpContext context, ITenantRepository tenantRepository)
    {
        // 1. Extract API key from header
        if (!context.Request.Headers.TryGetValue("X-Api-Key", out var apiKeyValue))
        {
            context.Response.StatusCode = 401;
            await context.Response.WriteAsJsonAsync(new 
            { 
                error = "Missing API key", 
                message = "Provide X-Api-Key header" 
            });
            return;
        }
        
        var plainKey = apiKeyValue.ToString();
        
        // 2. Hash and validate
        var keyHash = ApiKey.HashApiKey(plainKey);
        var apiKey = await apiKeyRepository.GetByKeyHashAsync(keyHash);
        
        if (apiKey == null || !apiKey.IsValid())
        {
            _logger.LogWarning("Invalid API key attempt");
            context.Response.StatusCode = 401;
            await context.Response.WriteAsJsonAsync(new 
            { 
                error = "Invalid API key", 
                message = "Key not found, revoked, or expired" 
            });
            return;
        }
        
        // 3. Load tenant
        var tenant = await tenantRepository.GetByIdAsync(apiKey.TenantId);
        
        if (tenant == null || !tenant.CanMakeRequest())
        {
            _logger.LogWarning("Tenant {TenantId} cannot make request", apiKey.TenantId);
            context.Response.StatusCode = 429;
            await context.Response.WriteAsJsonAsync(new 
            { 
                error = "Quota exceeded", 
                message = $"Monthly limit of {tenant?.MonthlyRequestLimit:N0} reached" 
            });
            return;
        }
        
        // 4. Set tenant context
        context.Items["TenantId"] = tenant.Id;
        context.Items["Tenant"] = tenant;
        
        // 5. Record usage
        apiKey.RecordUsage();
        tenant.IncrementRequestCount();
        
        // 6. Continue pipeline
        await _next(context);
        
        // 7. Save metrics (async, don't block response)
        _ = Task.Run(async () =>
        {
            using var scope = context.RequestServices.CreateScope();
            var unitOfWork = scope.ServiceProvider.GetRequiredService<IUnitOfWork>();
            await unitOfWork.SaveChangesAsync();
        });
    }
}

Register in Program.cs:

app.UseMiddleware<ApiKeyAuthenticationMiddleware>();

Step 5: Update Existing Entities

User entity - add TenantId:

public sealed class User : Entity<UserId>, IAggregateRoot
{
    public TenantId TenantId { get; private init; } // ADD THIS
    
    // ... existing properties
    
    public static User Create(TenantId tenantId, string userId, string? metadata = null)
    {
        var id = UserId.Create(userId);
        return new User(tenantId, id, metadata);
    }
}

Similar updates for Item, Interaction entities.

---

Security Best Practices

1. API Key Security

✅ Do:

• Hash keys with SHA256 before storing
• Show plain keys only once during creation
• Implement key rotation (90-day policy)
• Support key expiration
• Allow immediate revocation
• Use cryptographically secure random generation

❌ Don't:

• Store plain keys in database
• Log API keys in plain text
• Transmit keys in URLs (use headers)
• Use weak hashing algorithms (MD5, SHA1)
• Allow unlimited key lifetime

2. Tenant Isolation

✅ Do:

• Always filter queries by tenant_id
• Use EF Core global query filters
• Implement PostgreSQL RLS as defense-in-depth
• Validate tenant ownership in business logic
• Test cross-tenant access attempts

❌ Don't:

• Rely solely on application-level filtering
• Use user-provided tenant IDs directly
• Skip tenant validation in async operations
• Allow tenant ID changes after creation

3. Rate Limiting

✅ Do:

• Enforce per-tenant quotas
• Track usage in real-time
• Provide clear error messages
• Offer quota upgrade paths
• Reset counters on billing cycle

❌ Don't:

• Use global rate limits only
• Ignore burst traffic patterns
• Block legitimate traffic aggressively
• Forget to handle clock skew

4. Secrets Management

✅ Do:

• Use HashiCorp Vault or AWS Secrets Manager
• Rotate secrets regularly
• Encrypt secrets at rest
• Use environment variables for config
• Audit secret access

❌ Don't:

• Hardcode secrets in code
• Commit secrets to Git
• Share secrets via email/Slack
• Use weak encryption

---

Summary

We've Implemented:

• ✅ Multi-tenant domain model (Tenant, ApiKey entities)
• ✅ Subscription management system (5 plans)
• ✅ API key generation and hashing
• ✅ Quota tracking and enforcement logic
• ✅ Repository interfaces

Still Need to Implement:

• ⚠️ Authentication middleware
• ⚠️ Database migrations
• ⚠️ Repository implementations
• ⚠️ Tenant context injection
• ⚠️ Query filters for existing entities

Estimated Time to Complete: 1-2 weeks for full implementation and testing.

---

Documentation Version: 1.0.0
Last Updated: January 3, 2026
Next Review: After middleware implementation