REQ-401 Multi-Tenancy and Strict Organization Isolation

[UweSchwaeke]

🆔 Requirement Details

• ID: REQ-401
• Priority: Must Have
• Google Doc Link: link

📝 Description

The platform must support true multi-tenancy by allowing the creation of multiple, independent organizations (or tenants). The system must enforce strict logical data isolation at the API, CLI, and UI levels. Users belonging to one organization must not be able to view, search, or access repositories, artifacts (RPMs or OCI images), or administrative metadata belonging to another organization.

🧪 Evaluation / Acceptance Criteria

• Successfully create two distinct test organizations: Org-A and Org-B.
• Create User-A (assigned only to Org-A) and User-B (assigned only to Org-B).
• Upload a private test artifact (RPM or Container) to Org-A.
• Log in as User-B and verify that the artifact from Org-A is completely invisible and inaccessible via the CLI/API.
• Log in as User-B and verify that Org-A's repositories cannot be used as a source for dnf pull or podman pull.