feat(backend): add PostgreSQL schema, RLS policies, and multi-tenant middleware

- Add EF Core migrations for initial schema (clubs, members, work_items, shifts, shift_signups) - Implement RLS policies with SET LOCAL for tenant isolation - Add Finbuckle multi-tenant middleware with ClaimStrategy + HeaderStrategy fallback - Create TenantValidationMiddleware to enforce JWT claims match X-Tenant-Id header - Add tenant-aware DB interceptors (SaveChangesTenantInterceptor, TenantDbConnectionInterceptor) - Configure AppDbContext with tenant scoping and RLS support - Add test infrastructure: CustomWebApplicationFactory, TestAuthHandler, DatabaseFixture - Write TDD integration tests for multi-tenant isolation and RLS enforcement - Add health check null safety for connection string Tasks: 7 (PostgreSQL schema + migrations + RLS), 8 (Finbuckle multi-tenancy + validation), 12 (test infrastructure)
2026-03-03 14:32:21 +01:00
parent b9edbb8a65
commit 28964c6767
35 changed files with 4006 additions and 5 deletions
--- a/.sisyphus/evidence/task-6-final-summary.txt
+++ b/.sisyphus/evidence/task-6-final-summary.txt
@@ -0,0 +1,68 @@
+TASK 6: KUBERNETES KUSTOMIZE BASE MANIFESTS — COMPLETE ✓
+==========================================================
+
+DELIVERABLES:
+✓ Created /infra/k8s/base/ directory structure
+✓ All 11 manifest files created:
+  - kustomization.yaml (root orchestrator)
+  - backend-deployment.yaml (1 replica, port 8080, health probes)
+  - backend-service.yaml (ClusterIP, port 80→8080)
+  - frontend-deployment.yaml (1 replica, port 3000, health probe)
+  - frontend-service.yaml (ClusterIP, port 80→3000)
+  - postgres-statefulset.yaml (1 replica, 10Gi PVC, pg_isready)
+  - postgres-service.yaml (headless + primary service)
+  - keycloak-deployment.yaml (1 replica, port 8080, production mode)
+  - keycloak-service.yaml (ClusterIP)
+  - configmap.yaml (app config + postgres init script)
+  - ingress.yaml (path-based routing: / → frontend, /api → backend)
+
+VERIFICATION RESULTS:
+✓ kustomize build infra/k8s/base: SUCCESS (456 lines valid YAML)
+✓ Resource kinds: ConfigMap, Deployment (3), Ingress, Service (5), StatefulSet
+✓ Resource naming: All use consistent workclub- prefix
+✓ Health probes: .NET (startup/live/ready), Frontend (/api/health), Postgres (pg_isready)
+✓ Environment variables: All services reference ConfigMap/Secrets correctly
+✓ Volumes: StatefulSet volumeClaimTemplate 10Gi, ConfigMap mounts for init scripts
+✓ Headless service: workclub-postgres-headless with publishNotReadyAddresses: true
+
+REQUIREMENT COVERAGE:
+✓ Backend: 1 replica, port 8080, all three .NET health probes
+✓ Frontend: 1 replica, port 3000, /api/health probe
+✓ PostgreSQL: StatefulSet, 1 replica, port 5432, 10Gi storage, pg_isready check
+✓ Keycloak: 1 replica, port 8080, KC_DB=postgres, production start command
+✓ ConfigMap: log-level, cors-origins, api-base-url, keycloak-url, database config
+✓ Ingress: Single domain routing with pathType: Prefix for /api
+✓ Resource limits: Placeholders (100m/256Mi requests, 500m/512Mi limits)
+✓ Image tags: :latest placeholder for all app images
+
+LEARNING OUTCOMES:
+✓ Documented in .sisyphus/notepads/club-work-manager/learnings.md
+✓ Kustomize base+overlay pattern vs Helm
+✓ K8s resource naming and labeling conventions
+✓ .NET health probe semantics and timing
+✓ StatefulSet + headless service pattern for Postgres
+✓ PostgreSQL initialization via ConfigMap
+✓ Keycloak 26.x production mode configuration
+✓ Ingress path-based routing design
+✓ ConfigMap strategy for non-sensitive data
+✓ Resource request/limit placeholders
+
+GIT COMMIT:
+✓ Commit: a103248
+✓ Message: "docs(k8s): add Task 6 Kustomize base manifests learnings"
+✓ Files modified: .sisyphus/notepads/club-work-manager/learnings.md (415 insertions)
+
+EVIDENCE FILES:
+✓ .sisyphus/evidence/task-6-kustomize-base.txt (verification results)
+✓ .sisyphus/evidence/task-6-resource-names.txt (resource inventory)
+✓ .sisyphus/evidence/task-6-final-summary.txt (this file)
+
+NOTES FOR NEXT TASKS:
+- Base manifests ready for Task 25 (dev overlay creation)
+- Image tags will be overridden per environment in overlays
+- Resource limits will be environment-specific in overlays
+- TLS/cert-manager deferred to production overlay
+- Health check endpoints require implementation in backend/frontend code
+- Secret values (passwords) must be created separately before deployment
+
+STATUS: READY FOR DEPLOYMENT PLANNING
--- a/.sisyphus/evidence/task-8-green-phase-attempt2.txt
+++ b/.sisyphus/evidence/task-8-green-phase-attempt2.txt
--- a/.sisyphus/evidence/task-8-green-phase-success.txt
+++ b/.sisyphus/evidence/task-8-green-phase-success.txt
--- a/.sisyphus/evidence/task-8-green-phase.txt
+++ b/.sisyphus/evidence/task-8-green-phase.txt
@@ -0,0 +1,119 @@
+Der Buildvorgang wurde am 03.03.2026 14:23:14 gestartet.
+     1>Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" auf Knoten "1", Restore Ziel(e).
+     1>_GetAllRestoreProjectPathItems:
+         Wiederherzustellende Projekte werden ermittelt...
+     1>Das Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (1) erstellt "/Users/mastermito/Dev/opencode/backend/WorkClub.Api/WorkClub.Api.csproj" (2:4) auf Knoten "1", _GenerateProjectRestoreGraph Ziel(e).
+     2>AddPrunePackageReferences:
+         Loading prune package data from PrunePackageData folder
+         Failed to load prune package data from PrunePackageData folder, loading from targeting packs instead
+     1>Das Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (1) erstellt "/Users/mastermito/Dev/opencode/backend/WorkClub.Application/WorkClub.Application.csproj" (4:6) auf Knoten "4", _GenerateProjectRestoreGraph Ziel(e).
+     4>AddPrunePackageReferences:
+         Loading prune package data from PrunePackageData folder
+         Failed to load prune package data from PrunePackageData folder, loading from targeting packs instead
+     2>AddPrunePackageReferences:
+         Looking for targeting packs in /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref
+         Pack directories found: /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0
+     1>Das Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (1) erstellt "/Users/mastermito/Dev/opencode/backend/WorkClub.Infrastructure/WorkClub.Infrastructure.csproj" (5:5) auf Knoten "3", _GenerateProjectRestoreGraph Ziel(e).
+     5>AddPrunePackageReferences:
+         Loading prune package data from PrunePackageData folder
+         Failed to load prune package data from PrunePackageData folder, loading from targeting packs instead
+     4>AddPrunePackageReferences:
+         Looking for targeting packs in /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref
+     1>Das Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (1) erstellt "/Users/mastermito/Dev/opencode/backend/WorkClub.Domain/WorkClub.Domain.csproj" (3:6) auf Knoten "2", _GenerateProjectRestoreGraph Ziel(e).
+     3>AddPrunePackageReferences:
+         Loading prune package data from PrunePackageData folder
+     4>AddPrunePackageReferences:
+         Pack directories found: /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0
+     3>AddPrunePackageReferences:
+         Failed to load prune package data from PrunePackageData folder, loading from targeting packs instead
+     5>AddPrunePackageReferences:
+         Looking for targeting packs in /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref
+         Pack directories found: /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0
+     2>AddPrunePackageReferences:
+         Found package overrides file /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0/data/PackageOverrides.txt
+     3>AddPrunePackageReferences:
+         Looking for targeting packs in /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref
+         Pack directories found: /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0
+     2>AddPrunePackageReferences:
+         Loading prune package data from PrunePackageData folder
+         Failed to load prune package data from PrunePackageData folder, loading from targeting packs instead
+         Looking for targeting packs in /usr/local/share/dotnet/packs/Microsoft.AspNetCore.App.Ref
+         Pack directories found: /usr/local/share/dotnet/packs/Microsoft.AspNetCore.App.Ref/10.0.0
+         Found package overrides file /usr/local/share/dotnet/packs/Microsoft.AspNetCore.App.Ref/10.0.0/data/PackageOverrides.txt
+     4>AddPrunePackageReferences:
+         Found package overrides file /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0/data/PackageOverrides.txt
+     5>AddPrunePackageReferences:
+         Found package overrides file /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0/data/PackageOverrides.txt
+     3>AddPrunePackageReferences:
+         Found package overrides file /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0/data/PackageOverrides.txt
+     4>Die Erstellung von Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Application/WorkClub.Application.csproj" ist abgeschlossen (_GenerateProjectRestoreGraph Ziel(e)).
+     5>Die Erstellung von Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Infrastructure/WorkClub.Infrastructure.csproj" ist abgeschlossen (_GenerateProjectRestoreGraph Ziel(e)).
+     3>Die Erstellung von Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Domain/WorkClub.Domain.csproj" ist abgeschlossen (_GenerateProjectRestoreGraph Ziel(e)).
+     2>Die Erstellung von Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Api/WorkClub.Api.csproj" ist abgeschlossen (_GenerateProjectRestoreGraph Ziel(e)).
+     1>Das Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (1) erstellt "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (1:6) auf Knoten "1", _GenerateProjectRestoreGraph Ziel(e).
+     1>AddPrunePackageReferences:
+         Loading prune package data from PrunePackageData folder
+         Failed to load prune package data from PrunePackageData folder, loading from targeting packs instead
+         Looking for targeting packs in /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref
+         Pack directories found: /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0
+         Found package overrides file /usr/local/share/dotnet/packs/Microsoft.NETCore.App.Ref/10.0.0/data/PackageOverrides.txt
+     1>Die Erstellung von Projekt "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" ist abgeschlossen (_GenerateProjectRestoreGraph Ziel(e)).
+     1>Restore:
+         Bei der Überprüfung der X.509-Zertifikatkette wird das Fallbackzertifikatpaket bei „/usr/local/share/dotnet/sdk/10.0.100/trustedroots/codesignctl.pem“ verwendet.
+         Bei der Überprüfung der X.509-Zertifikatkette wird das Fallbackzertifikatpaket bei „/usr/local/share/dotnet/sdk/10.0.100/trustedroots/timestampctl.pem“ verwendet.
+         Die Assetdatei wurde nicht geändert. Das Schreiben der Assetdatei wird übersprungen. Pfad: /Users/mastermito/Dev/opencode/backend/WorkClub.Infrastructure/obj/project.assets.json
+         Die Assetdatei wurde nicht geändert. Das Schreiben der Assetdatei wird übersprungen. Pfad: /Users/mastermito/Dev/opencode/backend/WorkClub.Domain/obj/project.assets.json
+         "/Users/mastermito/Dev/opencode/backend/WorkClub.Infrastructure/WorkClub.Infrastructure.csproj" wiederhergestellt (in 32 ms.).
+         "/Users/mastermito/Dev/opencode/backend/WorkClub.Domain/WorkClub.Domain.csproj" wiederhergestellt (in 32 ms.).
+     1>/Users/mastermito/Dev/opencode/backend/WorkClub.Application/WorkClub.Application.csproj : warning NU1603: WorkClub.Application hängt von Finbuckle.MultiTenant (>= 8.2.0) ab, aber Finbuckle.MultiTenant 8.2.0 wurde nicht gefunden. Finbuckle.MultiTenant 9.0.0 wurde stattdessen aufgelöst. [/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj]
+         Die Assetdatei wurde nicht geändert. Das Schreiben der Assetdatei wird übersprungen. Pfad: /Users/mastermito/Dev/opencode/backend/WorkClub.Application/obj/project.assets.json
+         "/Users/mastermito/Dev/opencode/backend/WorkClub.Application/WorkClub.Application.csproj" wiederhergestellt (in 46 ms.).
+         Pakete für "/Users/mastermito/Dev/opencode/backend/WorkClub.Api/WorkClub.Api.csproj" werden wiederhergestellt...
+         Pakete für "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" werden wiederhergestellt...
+           CACHE https://api.nuget.org/v3-flatcontainer/aspnetcore.healthchecks.npgsql/index.json
+           CACHE https://api.nuget.org/v3-flatcontainer/finbuckle.multitenant/index.json
+     1>/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : error NU1102: Das Paket "AspNetCore.HealthChecks.NpgSql" der Version (>= 10.0.0) wurde nicht gefunden.
+/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : error NU1102:   - 24 Version(en) gefunden in "nuget.org" [ Nächste Version: 9.0.0 ]
+     1>/Users/mastermito/Dev/opencode/backend/WorkClub.Api/WorkClub.Api.csproj : error NU1102: Das Paket "AspNetCore.HealthChecks.NpgSql" der Version (>= 10.0.0) wurde nicht gefunden. [/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj]
+/Users/mastermito/Dev/opencode/backend/WorkClub.Api/WorkClub.Api.csproj : error NU1102:   - 24 Version(en) gefunden in "nuget.org" [ Nächste Version: 9.0.0 ] [/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj]
+           CACHE https://api.nuget.org/v3/vulnerabilities/index.json
+           CACHE https://api.nuget.org/v3-vulnerabilities/2026.02.28.05.40.06/vulnerability.base.json
+           CACHE https://api.nuget.org/v3-vulnerabilities/2026.02.28.05.40.06/2026.03.02.23.40.14/vulnerability.update.json
+     1>/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : warning NU1902: Das Paket "BouncyCastle.Cryptography" 2.2.1 weist eine bekannte Moderat Schweregrad-Sicherheitsanfälligkeit auf, https://github.com/advisories/GHSA-8xfc-gm6g-vgpv.
+     1>/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : warning NU1902: Das Paket "BouncyCastle.Cryptography" 2.2.1 weist eine bekannte Moderat Schweregrad-Sicherheitsanfälligkeit auf, https://github.com/advisories/GHSA-m44j-cfrm-g8qc.
+     1>/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : warning NU1902: Das Paket "BouncyCastle.Cryptography" 2.2.1 weist eine bekannte Moderat Schweregrad-Sicherheitsanfälligkeit auf, https://github.com/advisories/GHSA-v435-xc8x-wvr9.
+         Die Assetdatei wurde nicht geändert. Das Schreiben der Assetdatei wird übersprungen. Pfad: /Users/mastermito/Dev/opencode/backend/WorkClub.Api/obj/project.assets.json
+         Die MSBuild-Datei "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/obj/WorkClub.Tests.Integration.csproj.nuget.g.props" wird generiert.
+         Die Assetdatei wird auf den Datenträger geschrieben. Pfad: /Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/obj/project.assets.json
+         Fehler beim Wiederherstellen von "/Users/mastermito/Dev/opencode/backend/WorkClub.Api/WorkClub.Api.csproj" (in 227 ms.).
+         Fehler beim Wiederherstellen von "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (in 233 ms.).
+         
+         Verwendete NuGet-Konfigurationsdateien:
+             /Users/mastermito/.nuget/NuGet/NuGet.Config
+         
+         Verwendete Feeds:
+             https://api.nuget.org/v3/index.json
+         3 von 5 Projekten sind für die Wiederherstellung auf dem neuesten Stand.
+     1>Die Erstellung des Projekts "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" ist abgeschlossen, Restore Ziel(e) -- FEHLER.
+
+Fehler beim Buildvorgang.
+
+       "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (Restore Ziel) (1) ->
+       (Restore Ziel) -> 
+         /Users/mastermito/Dev/opencode/backend/WorkClub.Application/WorkClub.Application.csproj : warning NU1603: WorkClub.Application hängt von Finbuckle.MultiTenant (>= 8.2.0) ab, aber Finbuckle.MultiTenant 8.2.0 wurde nicht gefunden. Finbuckle.MultiTenant 9.0.0 wurde stattdessen aufgelöst. [/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj]
+         /Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : warning NU1902: Das Paket "BouncyCastle.Cryptography" 2.2.1 weist eine bekannte Moderat Schweregrad-Sicherheitsanfälligkeit auf, https://github.com/advisories/GHSA-8xfc-gm6g-vgpv.
+         /Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : warning NU1902: Das Paket "BouncyCastle.Cryptography" 2.2.1 weist eine bekannte Moderat Schweregrad-Sicherheitsanfälligkeit auf, https://github.com/advisories/GHSA-m44j-cfrm-g8qc.
+         /Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : warning NU1902: Das Paket "BouncyCastle.Cryptography" 2.2.1 weist eine bekannte Moderat Schweregrad-Sicherheitsanfälligkeit auf, https://github.com/advisories/GHSA-v435-xc8x-wvr9.
+
+
+       "/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj" (Restore Ziel) (1) ->
+       (Restore Ziel) -> 
+         /Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : error NU1102: Das Paket "AspNetCore.HealthChecks.NpgSql" der Version (>= 10.0.0) wurde nicht gefunden.
+       /Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj : error NU1102:   - 24 Version(en) gefunden in "nuget.org" [ Nächste Version: 9.0.0 ]
+         /Users/mastermito/Dev/opencode/backend/WorkClub.Api/WorkClub.Api.csproj : error NU1102: Das Paket "AspNetCore.HealthChecks.NpgSql" der Version (>= 10.0.0) wurde nicht gefunden. [/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj]
+       /Users/mastermito/Dev/opencode/backend/WorkClub.Api/WorkClub.Api.csproj : error NU1102:   - 24 Version(en) gefunden in "nuget.org" [ Nächste Version: 9.0.0 ] [/Users/mastermito/Dev/opencode/backend/WorkClub.Tests.Integration/WorkClub.Tests.Integration.csproj]
+
+    4 Warnung(en)
+    2 Fehler
+
+Verstrichene Zeit 00:00:00.99
--- a/.sisyphus/evidence/task-8-red-phase.txt
+++ b/.sisyphus/evidence/task-8-red-phase.txt