Struct TenantRegistry 

pub struct TenantRegistry { /* private fields */ }

Tenant registry with dynamic provisioning.

Hot path: resolve() is one ArcSwap pointer load + an immutable map read — exactly the zero-lock profile of the old frozen map. Control plane: Self::upsert/Self::suspend/Self::resume copy-on-write a new snapshot and swap it atomically, so onboarding a customer (or cutting off a delinquent one) takes effect on the next request — no redeploy, no restart.

Not #[Injectable] — provide via ctx.provide(TenantRegistry::new(...)).

Implementations

impl TenantRegistry

pub fn new( strategy: TenantStrategy, tenants: Vec<TenantConfig>, fallback: Option<TenantId>, ) -> Self

pub fn upsert(&self, cfg: TenantConfig)

Add or replace a tenant — visible to the very next request.

pub fn suspend(&self, id: &TenantId)

Suspend a tenant: resolve() returns None → guards reject with 401. Deliberately does NOT fall through to the fallback tenant — a suspended customer must not silently ride the shared pool.

pub fn resume(&self, id: &TenantId)

pub fn resolve(&self, headers: &HeaderMap) -> Option<Arc<TenantConfig>>

Resolve the request’s tenant. Called once per request by the boundary.

One atomic snapshot load + immutable map reads — zero locks. Unknown IDs resolve to the fallback (a typo’d header cannot select an unconfigured tenant); suspended IDs resolve to None outright.

pub fn get(&self, id: &TenantId) -> Option<Arc<TenantConfig>>

pub fn resolve_by_id(&self, id: &str) -> Option<Arc<TenantConfig>>

Resolve a tenant by its raw id — the non-HTTP twin of resolve, used by the consumer mesh where the id rides a message envelope instead of a header. Same semantics: suspended → None outright (a suspended tenant’s queued events must stop processing, exactly like its HTTP traffic). Unknown ids get no fallback: an envelope names its tenant explicitly, and falling back would process data under the wrong tenant.