SignalDB Multi-Tenancy & Authentication

Tenant Model

Tenant (e.g., "acme", slug: "acme")
  +-- API Keys (SHA-256 hashed, revocation support)
  +-- Datasets
  |   +-- "production" (slug: "prod", default)
  |   +-- "staging" (slug: "staging")
  +-- Schema Config (optional per-tenant overrides)

Authentication Flow

1. •Client sends Authorization: Bearer <api-key> + optional X-Tenant-ID / X-Dataset-ID
2. •Authenticator hashes key (SHA-256) and checks:
   • •Config-based keys first (from signaldb.toml)
   • •Database-backed keys second (from service catalog)
3. •Validates tenant_id matches key's tenant (403 on mismatch)
4. •Resolves dataset: explicit header -> tenant default_dataset -> first is_default -> 400 error
5. •Returns TenantContext { tenant_id, dataset_id, tenant_slug, dataset_slug }

Error Codes

• •400: Missing/malformed auth headers
• •401: Invalid API key
• •403: Key valid but wrong tenant/dataset

Isolation Layers

Slug-Based Naming

All storage paths and Iceberg identifiers use slugs (URL-friendly), not raw IDs.

• •CatalogManager::get_tenant_slug(tenant_id) -> slug from config, or tenant_id if not found
• •CatalogManager::get_dataset_slug(tenant_id, dataset_id) -> slug from config, or dataset_id if not found

Security: Slugs validated against alphanumeric + hyphen pattern. Path traversal (../) is checked.

Configuration

[auth]
enabled = true
admin_api_key = "sk-admin-key"

[[auth.tenants]]
id = "acme"
slug = "acme"
name = "Acme Corporation"
default_dataset = "production"

[[auth.tenants.datasets]]
id = "production"
slug = "prod"
is_default = true

[[auth.tenants.datasets]]
id = "archive"
slug = "archive"
[auth.tenants.datasets.storage]
dsn = "s3://acme-archive/signals"    # Per-dataset override

[[auth.tenants.api_keys]]
key = "sk-acme-prod-key-123"
name = "Production Key"

Admin API (Router)

Requires admin_api_key:

CLI Tool

signaldb-cli tenant list
signaldb-cli tenant create --name "Acme Corp" --slug acme
signaldb-cli api-key create --tenant acme --name "Production Key"
signaldb-cli dataset create --tenant acme --name production --slug prod

Key Implementation Files