Multi-Tenancy

/admin/v1/organizations/{org_slug}
/admin/v1/organizations/{org_slug}/teams/{team_slug}
/admin/v1/organizations/{org_slug}/projects/{project_slug}

POST /admin/v1/api-keys
{
  "name": "Shared Production Key",
  "owner": {
    "type": "organization",
    "organization_id": "550e8400-e29b-41d4-a716-446655440000"
  },
  "budget_limit_cents": 100000,
  "budget_period": "monthly"
}

POST /admin/v1/api-keys
{
  "name": "Dev Project Key",
  "owner": {
    "type": "project",
    "project_id": "660e8400-e29b-41d4-a716-446655440001"
  },
  "budget_limit_cents": 10000,
  "budget_period": "daily"
}

POST /admin/v1/api-keys
{
  "name": "My Personal Key",
  "owner": {
    "type": "user",
    "user_id": "770e8400-e29b-41d4-a716-446655440002"
  }
}

POST /admin/v1/api-keys
{
  "name": "CI/CD Pipeline Key",
  "owner": {
    "type": "service_account",
    "service_account_id": "880e8400-e29b-41d4-a716-446655440004"
  },
  "budget_limit_cents": 50000,
  "budget_period": "monthly"
}

POST /admin/v1/dynamic-providers
{
  "name": "Team OpenAI",
  "provider_type": "openai",
  "owner": {
    "type": "team",
    "team_id": "880e8400-e29b-41d4-a716-446655440003"
  },
  "base_url": "https://api.openai.com/v1",
  "api_key": "sk-..."
}

# Route through organization's provider
curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "model": ":org/acme-corp/openai/gpt-4o",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

# Route through project's provider
curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "model": ":org/acme-corp/:project/ml-research/anthropic/claude-sonnet-4-20250514",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

# Route through user's provider
curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "model": ":org/acme-corp/:user/alice/openai/gpt-4o",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

User pricing     →  Most specific
Project pricing  →  ↓
Team pricing     →  ↓
Org pricing      →  ↓
Global pricing   →  Fallback (from config or provider API)

POST /admin/v1/model-pricing
{
  "provider": "openai",
  "model": "gpt-4o",
  "input_cost_per_million": 2500,
  "output_cost_per_million": 10000,
  "owner": {
    "type": "project",
    "project_id": "660e8400-e29b-41d4-a716-446655440001"
  }
}

POST /admin/v1/organizations/{org_slug}/members
{
  "user_id": "770e8400-e29b-41d4-a716-446655440002",
  "role": "admin"
}

API Key → Owner (org/team/project/user) → No roles!

API Key → Service Account → Roles → RBAC works!

curl -X POST http://localhost:8080/admin/v1/organizations/acme-corp/service-accounts \
  -H "Authorization: Bearer $ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "slug": "ci-cd-bot",
    "name": "CI/CD Bot",
    "description": "Automated deployment service account",
    "roles": ["deployer", "viewer"]
  }'

[auth.rbac]
role_mapping = { "deployer" = "deploy_admin", "viewer" = "read_only" }

API Key only:
  - Service account owner → ServiceAccount principal (with SA roles)
  - User owner → User principal (user_id, no identity roles)
  - Org/Team/Project owner → Machine principal (scope only)

Identity only (OIDC/SAML/proxy):
  - Always User principal (with identity roles and claims)

Both (API key + Identity):
  - Service account owner → ServiceAccount principal (SA takes precedence)
  - Otherwise → User principal (identity provides fields)

use crate::auth::{AuthenticatedRequest, Principal};

fn handle_request(auth: &AuthenticatedRequest) {
    let principal = auth.principal();

    match principal {
        Principal::User { email, roles, .. } => {
            // Handle human user
        }
        Principal::ServiceAccount { id, roles, .. } => {
            // Handle service account
        }
        Principal::Machine { kind } => {
            // Handle shared credential
        }
    }
}

let subject = principal.to_subject();
// subject now has all fields needed for CEL policy evaluation

let actor_type = principal.actor_type();
// Returns: User, ServiceAccount, ApiKey, or System

{
  "name": "Team Budget Key",
  "owner": {
    "type": "team",
    "team_id": "880e8400-e29b-41d4-a716-446655440003"
  },
  "budget_limit_cents": 50000,
  "budget_period": "monthly"
}

1. Request arrives with API key
2. Check current spend for key's budget period
3. Reserve estimated cost (atomic operation)
4. Forward to LLM provider
5. Adjust reservation with actual cost
6. Track in usage_records table

[auth.rbac]

# Organization admins can manage all resources in their org
[[auth.rbac.policies]]
expression = "subject.org_id == resource.org_id && 'admin' in subject.roles"
permissions = ["*"]

# Users can only access their own resources
[[auth.rbac.policies]]
expression = "resource.owner_type == 'user' && resource.owner_id == subject.user_id"
permissions = ["read", "write", "delete"]

# Project members can read project resources
[[auth.rbac.policies]]
expression = "resource.owner_type == 'project' && resource.owner_id in subject.project_ids"
permissions = ["read"]

# Service accounts with 'deployer' role can call chat/completions
[[auth.rbac.policies]]
name = "service_account_deployer"
expression = "subject.service_account_id != '' && 'deployer' in subject.roles"
resources = ["chat_completions", "embeddings"]
permissions = ["write"]

[[auth.rbac.policies]]
expression = "subject.org_id == resource.org_id"
permissions = ["read"]

# Get audit logs for an organization
curl http://localhost:8080/admin/v1/organizations/{org_slug}/audit-logs \
  -H "Authorization: Bearer $ADMIN_KEY"

# Filter by action
curl "http://localhost:8080/admin/v1/organizations/{org_slug}/audit-logs?action=api_key.create" \
  -H "Authorization: Bearer $ADMIN_KEY"

[auth.admin.session]
cookie_name = "__gw_session"
duration_secs = 604800  # 7 days

[auth.admin.session.enhanced]
enabled = true                    # Enable session tracking
track_devices = true              # Store user agent and device info
max_concurrent_sessions = 3       # Limit sessions per user (0 = unlimited)
inactivity_timeout_secs = 28800   # Auto-logout after 8 hours idle

curl http://localhost:8080/admin/v1/users/{user_id}/sessions \
  -H "Authorization: Bearer $ADMIN_KEY"

{
  "data": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "device": {
        "device_description": "Chrome 120 on Windows 11",
        "ip_address": "192.168.1.100"
      },
      "created_at": "2024-01-15T10:30:00Z",
      "last_activity": "2024-01-15T14:22:00Z",
      "expires_at": "2024-01-22T10:30:00Z"
    }
  ],
  "enhanced_enabled": true
}

curl -X DELETE http://localhost:8080/admin/v1/users/{user_id}/sessions \
  -H "Authorization: Bearer $ADMIN_KEY"

{
  "sessions_revoked": 3
}

curl -X DELETE http://localhost:8080/admin/v1/users/{user_id}/sessions/{session_id} \
  -H "Authorization: Bearer $ADMIN_KEY"

GET /admin/v1/users/{user_id}/export

DELETE /admin/v1/users/{user_id}?hard=true