gitea-admin/gh-christianlouis-dmarq
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add workspace tenant foundations

Browse Source
This commit is contained in:
Christian Krakau-Louis
2026-05-23 19:05:55 +02:00
parent 60193c990b
commit b503d9c9fe
19 changed files with 576 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/database.md
+38
View File
@@ -12,6 +12,22 @@ DMARQ uses a relational database to store all its data. The schema is designed t
## Core Tables
### Workspaces
The `workspaces` table stores tenant boundaries for multi-organization and MSP
deployments. Existing single-tenant installs are attached to the default
workspace during migration.
| Column | Type | Description |
|--------|------|-------------|
| id | INTEGER | Primary key |
| slug | VARCHAR | Unique stable workspace slug |
| name | VARCHAR | Display name |
| description | TEXT | Optional operator-facing description |
| active | BOOLEAN | Whether the workspace can be used |
| created_at | TIMESTAMP | When the workspace was created |
| updated_at | TIMESTAMP | When the workspace was last updated |
### Domains
The `domains` table stores information about the domains being monitored.
@@ -19,6 +35,7 @@ The `domains` table stores information about the domains being monitored.
| Column | Type | Description |
|--------|------|-------------|
| id | INTEGER | Primary key |
| workspace_id | INTEGER | Foreign key to workspaces.id |
| name | VARCHAR(255) | Domain name (e.g., example.com) |
| created_at | TIMESTAMP | When the domain was added |
| active | BOOLEAN | Whether the domain is actively monitored |
@@ -105,6 +122,7 @@ The `users` table stores user account information.
| Column | Type | Description |
|--------|------|-------------|
| id | INTEGER | Primary key |
| workspace_id | INTEGER | Foreign key to workspaces.id |
| username | VARCHAR(50) | Username |
| email | VARCHAR(255) | Email address |
| password_hash | VARCHAR(255) | Hashed password |
@@ -177,6 +195,26 @@ The `webhook_deliveries` table records delivery attempts and retry state.
## DNS and Configuration Tables
### Mail_Sources
The `mail_sources` table stores configured inboxes used to retrieve DMARC,
forensic, and SMTP TLS reports.
| Column | Type | Description |
|--------|------|-------------|
| id | INTEGER | Primary key |
| workspace_id | INTEGER | Foreign key to workspaces.id |
| name | VARCHAR | Human-readable source name |
| method | VARCHAR | Source type such as IMAP, Gmail API, or Microsoft Graph |
| server | VARCHAR | IMAP/POP server hostname |
| port | INTEGER | IMAP/POP server port |
| username | VARCHAR | Mailbox username |
| password | TEXT | Encrypted mailbox password |
| enabled | BOOLEAN | Whether scheduled imports should poll this source |
| last_checked | TIMESTAMP | Last polling attempt time |
| created_at | TIMESTAMP | When the source was created |
| updated_at | TIMESTAMP | When the source was last updated |
### DNS_Records
The `dns_records` table stores DNS record information for domains.
docs/reference/workspaces.md
+42
View File
@@ -0,0 +1,42 @@
# Workspace Foundations
DMARQ uses a workspace as the tenant boundary for multi-organization and MSP
deployments. Milestone 15 starts with a default single-tenant workspace so
existing deployments have a clear migration path before workspace RBAC and MSP
views are added.
## Default Workspace
Existing installs are migrated into:
```text
slug: default
name: Default Workspace
```
The migration attaches legacy domains, users, and mail sources to this default
workspace. New domain rows created by the API also default to this workspace.
## Ownership Boundaries
The initial workspace model relates these core records to a workspace:
- monitored domains
- mail sources
- users
Domain, mail-source, and user query helpers scope reads to a workspace by
default. This prevents cross-tenant reads in new M15 surfaces and gives later
RBAC work a single ownership field to enforce.
## Migration Story
The migration creates the `workspaces` table, inserts the default workspace, and
adds nullable `workspace_id` ownership columns to existing domain, user, and
mail-source tables. Nullable columns keep upgrades safe for older databases and
for import paths that may be backfilled in stages; runtime helpers attach
legacy rows to the default workspace when needed.
The current implementation keeps domain names globally unique. That matches the
existing single-domain ownership model and avoids ambiguous ownership while MSP
RBAC and onboarding controls are built out.