2.0.0 (2025-12-25)

Features

• implement multi-tenant filtering with organisation support (ba29f22)
• optimize database connection pool (min: 5, max: 20) to reduce cold-start errors (108e5cd)

BREAKING CHANGES

• URL patterns changed from tenant_slug to tenant (tenant_id)
  Clients will need to update their API calls to use tenant IDs instead of slugs

Key security improvements:

• Platform admins can access tenant_global for platform-wide view
• Organisation-based filtering for resellers/CPOs via tenant-api
• as_tenant query parameter for platform admin impersonation
• Changed URL paths from /tenants/{tenant_slug} to /tenants/{tenant}
• All endpoints enforce tenant allowlist filtering

Changes:

• Add tenant-api client with internal endpoint support
• Add filtering helpers for tenant resolution and org expansion
• Update all route handlers with compliant filtering logic
• Change URL pattern from tenant_slug to tenant throughout
• Add TENANT_API_BASE_URL and INTERNAL_AUTH_TOKEN config
• Remove old ensure_tenant logic from AuthContext
• Add comprehensive unit tests for filtering scenarios

All endpoints now enforce proper tenant isolation with audit logging.