cameleer/cameleer-saas

Fork 0

Files

hsiegeln 1ef8c9dceb

CI / build (push) Successful in 38s

Details

CI / docker (push) Successful in 37s

Details

refactor: merge tenant isolation into single HandlerInterceptor

Replace TenantResolutionFilter + TenantOwnershipValidator (15 manual
calls across 5 controllers) with a single TenantIsolationInterceptor
that uses Spring HandlerMapping path variables for fail-closed tenant
isolation. New endpoints with {tenantId}, {environmentId}, or {appId}
path variables are automatically isolated without manual code.

Simplify OrgResolver from dual-token fetch to single token — Logto
merges all scopes into either token type.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-05 15:48:04 +02:00

2.6 KiB

Raw Blame History

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Project

Cameleer SaaS — multi-tenant SaaS platform wrapping the Cameleer observability stack (Java agent + server) for Apache Camel applications. Customers get managed observability for their Camel integrations without running infrastructure.

Ecosystem

This repo is the SaaS layer on top of two proven components:

cameleer3 (sibling repo) — Java agent using ByteBuddy for zero-code instrumentation of Camel apps. Captures route executions, processor traces, payloads, metrics, and route graph topology. Deploys as -javaagent JAR.
cameleer3-server (sibling repo) — Spring Boot observability backend. Receives agent data via HTTP, pushes config/commands via SSE. PostgreSQL + OpenSearch storage. React SPA dashboard. JWT auth with Ed25519 config signing.
cameleer-website — Marketing site (Astro 5)
design-system — Shared React component library (@cameleer/design-system on Gitea npm registry)

Agent-server protocol is defined in cameleer3/cameleer3-common/PROTOCOL.md. The agent and server are mature, proven components — this repo wraps them with multi-tenancy, billing, and self-service onboarding.

Architecture Context

The existing cameleer3-server already has single-tenant auth (JWT, RBAC, bootstrap tokens, OIDC). The SaaS layer must:

Add multi-tenancy (tenant isolation of agent data, diagrams, configs)
Provide self-service signup, billing, and team management
Generate per-tenant bootstrap tokens for agent registration
Proxy or federate access to tenant-specific cameleer3-server instances
Enforce usage quotas and metered billing

Auth enforcement (current state):

All API endpoints enforce OAuth2 scopes via @PreAuthorize("hasAuthority('SCOPE_xxx')") annotations
Tenant isolation enforced by TenantIsolationInterceptor (a single HandlerInterceptor on /api/** that resolves JWT org_id to TenantContext and validates {tenantId}, {environmentId}, {appId} path variables; fail-closed, platform admins bypass)
10 OAuth2 scopes defined on the Logto API resource (https://api.cameleer.local), served to the frontend from GET /api/config

Gitea-hosted: gitea.siegeln.net/cameleer/
CI: .gitea/workflows/ — Gitea Actions
K8s target: k3s cluster at 192.168.50.86
Docker builds: multi-stage, buildx with registry cache, --provenance=false for Gitea compatibility
Design system: import from @cameleer/design-system (Gitea npm registry)

Disabled Skills

Do NOT use any gsd:* skills in this project. This includes all /gsd: prefixed commands.

2.6 KiB Raw Blame History