feat: add workspace tenant foundations

backend/app/models/domain.py

@@ -12,6 +12,7 @@ class Domain(Base):
     __tablename__ = "domains"
 
     id = Column(Integer, primary_key=True, index=True)
+    workspace_id = Column(Integer, ForeignKey("workspaces.id"), nullable=True, index=True)
     name = Column(String, unique=True, index=True, nullable=False)
     description = Column(Text, nullable=True)
     active = Column(Boolean, default=True, index=True)
@@ -30,6 +31,7 @@ class Domain(Base):
     updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
 
     # Relationships
+    workspace = relationship("Workspace", back_populates="domains")
     reports = relationship("DMARCReport", back_populates="domain", cascade="all, delete-orphan")
     forensic_reports = relationship(
         "ForensicReport", back_populates="domain", cascade="all, delete-orphan"
@@ -41,6 +43,8 @@ class Domain(Base):
     __table_args__ = (
         # Index for finding active and verified domains
         Index("ix_domains_active_verified", "active", "verified"),
+        # Workspace-scoped domain lookups for MSP mode.
+        Index("ix_domains_workspace_name", "workspace_id", "name"),
         # Index for finding domains by policy
         Index("ix_domains_policy", "dmarc_policy"),
         # Index for finding recently updated domains

backend/app/models/mail_source.py

@@ -1,6 +1,6 @@
 from datetime import datetime
 
-from sqlalchemy import Boolean, Column, DateTime, Integer, String, Text
+from sqlalchemy import Boolean, Column, DateTime, ForeignKey, Index, Integer, String, Text
 from sqlalchemy.orm import relationship
 
 from app.core.credential_encryption import decrypt_secret, encrypt_secret, is_encrypted_secret
@@ -24,6 +24,7 @@ class MailSource(Base):
     __tablename__ = "mail_sources"
 
     id = Column(Integer, primary_key=True, index=True)
+    workspace_id = Column(Integer, ForeignKey("workspaces.id"), nullable=True, index=True)
 
     # Human-readable label for the source
     name = Column(String, nullable=False)
@@ -80,6 +81,9 @@ class MailSource(Base):
         back_populates="mail_source",
         cascade="all, delete-orphan",
     )
+    workspace = relationship("Workspace", back_populates="mail_sources")
+
+    __table_args__ = (Index("ix_mail_sources_workspace_enabled", "workspace_id", "enabled"),)
 
     def __repr__(self):
         return f"<MailSource id={self.id} name={self.name!r} method={self.method!r}>"

backend/app/models/user.py

@@ -1,6 +1,6 @@
 from datetime import datetime
 
-from sqlalchemy import Boolean, Column, DateTime, Integer, String
+from sqlalchemy import Boolean, Column, DateTime, ForeignKey, Integer, String
 from sqlalchemy.orm import relationship
 
 from app.core.database import Base
@@ -12,6 +12,7 @@ class User(Base):
     __tablename__ = "users"
 
     id = Column(Integer, primary_key=True, index=True)
+    workspace_id = Column(Integer, ForeignKey("workspaces.id"), nullable=True, index=True)
     email = Column(String, unique=True, index=True, nullable=False)
     # Logto subject claim (the user's stable ID inside Logto).
     # Null for users that pre-date Logto integration or for
@@ -41,4 +42,5 @@ class User(Base):
     )
 
     # Relationships
+    workspace = relationship("Workspace", back_populates="users")
     user_domains = relationship("UserDomain", back_populates="user", cascade="all, delete-orphan")

backend/app/models/workspace.py

@@ -0,0 +1,29 @@
+from datetime import datetime
+
+from sqlalchemy import Boolean, Column, DateTime, Index, Integer, String, Text
+from sqlalchemy.orm import relationship
+
+from app.core.database import Base
+
+
+class Workspace(Base):
+    """Tenant/workspace boundary for monitored DMARC assets."""
+
+    __tablename__ = "workspaces"
+
+    id = Column(Integer, primary_key=True, index=True)
+    slug = Column(String, unique=True, nullable=False, index=True)
+    name = Column(String, nullable=False)
+    description = Column(Text, nullable=True)
+    active = Column(Boolean, default=True, nullable=False, index=True)
+    created_at = Column(DateTime, default=datetime.utcnow, index=True)
+    updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
+
+    domains = relationship("Domain", back_populates="workspace")
+    mail_sources = relationship("MailSource", back_populates="workspace")
+    users = relationship("User", back_populates="workspace")
+
+    __table_args__ = (Index("ix_workspaces_active_slug", "active", "slug"),)
+
+    def __repr__(self):
+        return f"<Workspace {self.slug}>"