@twin.org/dataspace-control-plane-service 0.0.3-next.42 → 0.0.3-next.44

package/dist/es/dataspaceControlPlaneService.js

@@ -1,4 +1,7 @@
-import { ContextIdKeys, ContextIdStore } from "@twin.org/context";
+// Copyright 2025 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+import { HttpUrlHelper } from "@twin.org/api-models";
+import { ContextIdKeys, ContextIdStore, ContextIdHelper } from "@twin.org/context";
 import { ArrayHelper, AlreadyExistsError, BaseError, ComponentFactory, Converter, GeneralError, Guards, Is, NotFoundError, ObjectHelper, RandomHelper, StringHelper, UnauthorizedError, Url, Urn, ValidationError } from "@twin.org/core";
 import { JsonLdHelper } from "@twin.org/data-json-ld";
 import { DataspaceAppFactory, DataspaceTransferFormat, TransferProcessRole, getJsonLdId, getJsonLdType } from "@twin.org/dataspace-models";
@@ -35,14 +38,6 @@ export class DataspaceControlPlaneService {
      * @internal
      */
     static _STALLED_NEGOTIATION_THRESHOLD_MS = 30 * 60 * 1000;
-    /**
-     * Matches the base64url encoding of a BLAKE2b-256 hash (32 bytes → 43 base64url
-     * chars, no padding). Used to discriminate the tenant-hash portion of a
-     * composite tenant identifier from a bare IOTA DID, whose `<id>` segment is
-     * always `0x<64-hex>` (66 chars) and cannot match.
-     * @internal
-     */
-    static _TENANT_HASH_PATTERN = /^[\w-]{43}$/;
     /**
      * The logging component.
      * @internal
@@ -77,7 +72,7 @@ export class DataspaceControlPlaneService {
      */
     _transferProcessStorage;
     /**
-     * Entity storage for tenant-supplied Dataspace App Dataset entities.
+     * Entity storage for Dataspace App Dataset entities.
      * @internal
      */
     _dataspaceAppDatasetStorage;
@@ -114,6 +109,11 @@ export class DataspaceControlPlaneService {
      * @internal
      */
     _taskScheduler;
+    /**
+     * Platform component.
+     * @internal
+     */
+    _platformComponent;
     /**
      * Registered negotiation callbacks from upstream callers, keyed by registration key.
      * @internal
@@ -135,17 +135,12 @@ export class DataspaceControlPlaneService {
      * @internal
      */
     _remoteControlPlaneComponentType;
-    /**
-     * The component type name for the hosting component.
-     * @internal
-     */
-    _urlTransformerComponent;
     /**
      * Create a new instance of DataspaceControlPlaneService.
      * @param options The options for the service.
      */
     constructor(options) {
-        this._loggingComponent = ComponentFactory.getIfExists(options?.loggingComponentType ?? "logging");
+        this._loggingComponent = ComponentFactory.getIfExists(options?.loggingComponentType);
         // Retrieve PAP component with default
         this._policyAdministrationPointComponent =
             ComponentFactory.get(options?.policyAdministrationPointComponentType ?? "policy-administration-point");
@@ -164,6 +159,7 @@ export class DataspaceControlPlaneService {
             ? StringHelper.trimTrailingSlashes(StringHelper.trimLeadingSlashes(options.config.dataPlanePath))
             : undefined;
         this._taskScheduler = ComponentFactory.getIfExists(options?.taskSchedulerComponentType ?? "task-scheduler");
+        this._platformComponent = ComponentFactory.getIfExists(options?.platformComponentType ?? "platform");
         // Data plane component is optional and resolved lazily. The control plane is initialised
         // BEFORE the data plane in engine startup order, so `getRegisteredInstanceTypeOptional`
         // returns undefined when the engine constructs us — the wiring override can't fire here.
@@ -172,14 +168,13 @@ export class DataspaceControlPlaneService {
         // lookup at push time finds it regardless of init order.
         this._dataPlaneComponentType =
             options?.dataPlaneComponentType ?? "dataspace-data-plane-service";
-        this._urlTransformerComponent = ComponentFactory.get(options?.urlTransformerComponentType ?? "url-transformer");
         this._negotiationCallbacks = new Map();
         this._transferCallbacks = new Map();
         this._internalTransferCallback = this.createInternalTransferCallback();
         this._remoteControlPlaneComponentType =
             options?.remoteControlPlaneComponentType ?? "dataspace-control-plane-rest-client";
         const internalCallback = this.createInternalCallback();
-        this._policyRequester = new DataspaceControlPlanePolicyRequester(options?.loggingComponentType ?? "logging", internalCallback);
+        this._policyRequester = new DataspaceControlPlanePolicyRequester(options?.loggingComponentType, internalCallback);
         PolicyRequesterFactory.register(DataspaceControlPlaneService._REQUESTER_TYPE, () => this._policyRequester);
     }
     /**
@@ -227,10 +222,6 @@ export class DataspaceControlPlaneService {
     }
     /**
      * The service needs to be started when the application is initialized.
-     * Populates the Federated Catalogue with datasets from registered apps
-     * and starts the stalled negotiation cleanup task. Also captures the node
-     * identity from ContextIdStore when tenant-token encryption is configured
-     * (required to derive the vault key name `${nodeId}/${signingKeyName}`).
      * @param nodeLoggingComponentType The node logging component type.
      */
     async start(nodeLoggingComponentType) {
@@ -254,49 +245,52 @@ export class DataspaceControlPlaneService {
         let registeredCount = 0;
         let errorCount = 0;
         let totalDatasets = 0;
-        // Walk stored dataspace app datasets one page at a time and publish each in its
-        // owning tenant's context. Memory stays bounded to one page.
-        let cursor;
-        do {
-            const page = await this._dataspaceAppDatasetStorage.query(undefined, undefined, undefined, cursor);
-            if (Is.arrayValue(page.entities)) {
-                for (const entity of page.entities) {
-                    const appDataset = entity;
-                    totalDatasets++;
-                    try {
-                        await this.publishAppDataset(appDataset);
-                        registeredCount++;
-                        await this._loggingComponent?.log({
-                            level: "debug",
-                            ts: Date.now(),
-                            source: DataspaceControlPlaneService.CLASS_NAME,
-                            message: "datasetRegistered",
-                            data: {
-                                datasetId: appDataset.id,
-                                appId: appDataset.appId,
-                                tenantId: appDataset.tenantId
-                            }
-                        });
-                    }
-                    catch (error) {
-                        errorCount++;
-                        await this._loggingComponent?.log({
-                            level: "error",
-                            ts: Date.now(),
-                            source: DataspaceControlPlaneService.CLASS_NAME,
-                            message: "datasetPublishFailed",
-                            error: BaseError.fromError(error),
-                            data: {
-                                datasetId: appDataset.id,
-                                appId: appDataset.appId,
-                                tenantId: appDataset.tenantId
-                            }
-                        });
+        // The platform component execute is used so that the dataset publication runs in the
+        // tenant context of the hosting component, also works in single tenant mode
+        await this._platformComponent?.execute(async () => {
+            // The tenant context id is set here for each system tenant
+            let cursor;
+            do {
+                const page = await this._dataspaceAppDatasetStorage.query(undefined, undefined, undefined, cursor);
+                if (Is.arrayValue(page.entities)) {
+                    for (const entity of page.entities) {
+                        const appDataset = entity;
+                        totalDatasets++;
+                        try {
+                            await this.publishAppDataset(appDataset);
+                            registeredCount++;
+                            await this._loggingComponent?.log({
+                                level: "debug",
+                                ts: Date.now(),
+                                source: DataspaceControlPlaneService.CLASS_NAME,
+                                message: "datasetRegistered",
+                                data: {
+                                    datasetId: appDataset.id,
+                                    appId: appDataset.appId,
+                                    tenantId: appDataset.tenantId
+                                }
+                            });
+                        }
+                        catch (error) {
+                            errorCount++;
+                            await this._loggingComponent?.log({
+                                level: "error",
+                                ts: Date.now(),
+                                source: DataspaceControlPlaneService.CLASS_NAME,
+                                message: "datasetPublishFailed",
+                                error: BaseError.fromError(error),
+                                data: {
+                                    datasetId: appDataset.id,
+                                    appId: appDataset.appId,
+                                    tenantId: appDataset.tenantId
+                                }
+                            });
+                        }
                     }
                 }
-            }
-            cursor = page.cursor;
-        } while (Is.stringValue(cursor));
+                cursor = page.cursor;
+            } while (Is.stringValue(cursor));
+        });
         await this._loggingComponent?.log({
             level: "info",
             ts: Date.now(),
@@ -380,12 +374,11 @@ export class DataspaceControlPlaneService {
             }
             const assigneeIdentity = OdrlPolicyHelper.extractAssigneeIdentity(agreement);
             const assigneeIds = ArrayHelper.fromObjectOrArray(assigneeIdentity);
-            // The agreement's assignee is stamped by the provider as the consumer's composite identity (`consumerNodeDid:hash(consumerTenantId)`).
-            const callerComposite = this.buildCallerComposite(trustInfo);
-            if (!assigneeIds.includes(callerComposite)) {
+            // The agreement's assignee is stamped by the provider as the consumer's organization identity.
+            if (!assigneeIds.includes(trustInfo.identity)) {
                 throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedForAgreement");
             }
-            consumerIdentity = callerComposite;
+            consumerIdentity = trustInfo.identity;
             const assignerIdentity = OdrlPolicyHelper.extractAssignerIdentity(agreement);
             const assignerIds = ArrayHelper.fromObjectOrArray(assignerIdentity);
             if (assignerIds.length > 1) {
@@ -400,8 +393,7 @@ export class DataspaceControlPlaneService {
             return transformToTransferError(error, { consumerPid: request.consumerPid, providerPid });
         }
         const now = new Date();
-        const requestContextIds = await ContextIdStore.getContextIds();
-        const requestTenantId = requestContextIds?.[ContextIdKeys.Tenant];
+        const organizationIdentity = await this.resolveContextOrganizationId();
         const storageEntity = {
             id: Converter.bytesToHex(RandomHelper.generate(32)),
             consumerPid: request.consumerPid,
@@ -417,7 +409,7 @@ export class DataspaceControlPlaneService {
             policies,
             callbackAddress: request.callbackAddress,
             format: request.format,
-            tenantId: Is.stringValue(requestTenantId) ? requestTenantId : undefined,
+            organizationIdentity,
             dataAddress: request.dataAddress,
             dateCreated: now.toISOString(),
             dateModified: now.toISOString()
@@ -484,8 +476,7 @@ export class DataspaceControlPlaneService {
         const agreement = await this.lookupAgreement(agreementId);
         const assigneeIdentity = OdrlPolicyHelper.extractAssigneeIdentity(agreement);
         const assigneeIds = ArrayHelper.fromObjectOrArray(assigneeIdentity);
-        const callerComposite = this.buildCallerComposite(trustInfo);
-        if (!assigneeIds.includes(callerComposite)) {
+        if (!assigneeIds.includes(trustInfo.identity)) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedForAgreement");
         }
         const assignerIdentity = OdrlPolicyHelper.extractAssignerIdentity(agreement);
@@ -498,11 +489,7 @@ export class DataspaceControlPlaneService {
         const consumerPid = `urn:uuid:${RandomHelper.generateUuidV7()}`;
         const callbackAddress = StringHelper.trimTrailingSlashes(publicOrigin);
         // Fetch context once and reuse across the PUSH dataAddress, trust token, and storage entity.
-        const contextIds = await ContextIdStore.getContextIds();
-        const nodeIdentity = contextIds?.[ContextIdKeys.Node];
-        Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "nodeIdentity", nodeIdentity);
-        const tenantId = contextIds?.[ContextIdKeys.Tenant];
-        const organizationIdentity = contextIds?.[ContextIdKeys.Organization];
+        const organizationIdentity = await this.resolveContextOrganizationId();
         const transferRequestMessage = {
             "@context": [DataspaceProtocolContexts.Context],
             "@type": DataspaceProtocolTransferProcessTypes.TransferRequestMessage,
@@ -519,8 +506,8 @@ export class DataspaceControlPlaneService {
                 throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "pushTransferDataPathNotConfigured", { consumerPid });
             }
             let inboxEndpoint = `${callbackAddress}/${this._dataPlanePath}/inbox`;
-            if (Is.stringValue(tenantId)) {
-                inboxEndpoint = await this._urlTransformerComponent.addEncryptedQueryParamToUrl(inboxEndpoint, "tenant", tenantId);
+            if (Is.stringValue(organizationIdentity)) {
+                inboxEndpoint = HttpUrlHelper.addQueryStringParam(inboxEndpoint, ContextIdKeys.Organization, organizationIdentity);
             }
             transferRequestMessage.dataAddress = {
                 "@type": DataspaceProtocolTransferProcessTypes.DataAddress,
@@ -529,7 +516,7 @@ export class DataspaceControlPlaneService {
             };
         }
         // Generate outbound trust token to authenticate this node to the provider.
-        const outboundToken = await this._trustComponent.generate(nodeIdentity, this._overrideTrustGeneratorType, { subject: { consumerPid, agreementId } }, Is.stringValue(tenantId) ? TrustHelper.hashTenantId(tenantId) : undefined, organizationIdentity);
+        const outboundToken = await this._trustComponent.generate(organizationIdentity, this._overrideTrustGeneratorType, { subject: { consumerPid, agreementId } });
         // Create a remote REST client pointed at the provider endpoint and call requestTransfer.
         const remoteControlPlane = ComponentFactory.create(this._remoteControlPlaneComponentType, { endpoint: providerEndpoint, pathPrefix: "" });
         const result = await remoteControlPlane.requestTransfer(transferRequestMessage, outboundToken);
@@ -553,14 +540,14 @@ export class DataspaceControlPlaneService {
             state: DataspaceProtocolTransferProcessStateType.REQUESTED,
             agreementId,
             datasetId,
-            consumerIdentity: callerComposite,
+            consumerIdentity: trustInfo.identity,
             providerIdentity,
             offerId: agreementId,
             policies: [agreement],
             callbackAddress,
             format,
             dataAddress: transferRequestMessage.dataAddress,
-            tenantId: Is.stringValue(tenantId) ? tenantId : undefined,
+            organizationIdentity,
             dateCreated: now.toISOString(),
             dateModified: now.toISOString()
         };
@@ -608,14 +595,13 @@ export class DataspaceControlPlaneService {
         }
         try {
             const { entity, role } = await this.lookupTransferByMessage(message);
-            this.validateCallerIsProvider(this.buildCallerComposite(trustInfo), entity);
-            // Only the tenant that owns this transfer can mutate it.
-            // Skipped on single-tenant nodes (entity.tenantId undefined).
-            const callingTenantId = await this.resolveCallingTenantId();
-            if (Is.stringValue(entity.tenantId) &&
-                Is.stringValue(callingTenantId) &&
-                entity.tenantId !== callingTenantId) {
-                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongTenant");
+            if (trustInfo.identity !== entity.providerIdentity) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedAsProvider");
+            }
+            // Only the organization that owns this transfer can mutate it.
+            const callingOrganizationIdentity = await this.resolveContextOrganizationId();
+            if (entity.organizationIdentity !== callingOrganizationIdentity) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongOrganization");
             }
             if (entity.state !== DataspaceProtocolTransferProcessStateType.REQUESTED &&
                 entity.state !== DataspaceProtocolTransferProcessStateType.SUSPENDED) {
@@ -665,27 +651,23 @@ export class DataspaceControlPlaneService {
                 if (!Is.stringValue(entity.providerIdentity)) {
                     throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "providerIdentityMissing");
                 }
-                // providerIdentity is a composite `nodeDid:hash(tenantId)`
-                const pushProviderId = this.parseTenantIdentifier(entity.providerIdentity);
-                const accessToken = await this._trustComponent.generate(pushProviderId.nodeDid, this._overrideTrustGeneratorType, {
+                const pushProviderId = entity.providerIdentity;
+                const accessToken = await this._trustComponent.generate(pushProviderId, this._overrideTrustGeneratorType, {
                     subject: {
                         consumerPid: entity.consumerPid,
                         providerPid: entity.providerPid,
                         agreementId: entity.agreementId,
                         datasetId: entity.datasetId
                     }
-                }, pushProviderId.tenantIdHash);
+                });
                 Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "accessToken", accessToken);
                 const tokenString = accessToken;
                 let fullEndpoint = `${publicOrigin}/${this._dataPlanePath}/inbox`;
-                // Bake the provider's tenant token into the /inbox URL so the consumer's
-                // inbound POST routes to the right tenant via TenantProcessor — mirrors the
+                // Bake the provider's organization identity into the /inbox URL so the consumer's
+                // inbound POST routes to the right organization via TenantProcessor — mirrors the
                 // pull-mode endpoint baking below.
-                const inboxContextIds1 = await ContextIdStore.getContextIds();
-                const inboxTenantId1 = inboxContextIds1?.[ContextIdKeys.Tenant];
-                if (Is.stringValue(inboxTenantId1)) {
-                    fullEndpoint = await this._urlTransformerComponent.addEncryptedQueryParamToUrl(fullEndpoint, "tenant", inboxTenantId1);
-                }
+                const organizationIdentity = await this.resolveContextOrganizationId();
+                fullEndpoint = HttpUrlHelper.addQueryStringParam(fullEndpoint, ContextIdKeys.Organization, organizationIdentity);
                 response.dataAddress = {
                     "@type": DataspaceProtocolTransferProcessTypes.DataAddress,
                     endpointType: DataspaceProtocolEndpointType.HttpsActivityStreamEndpoint,
@@ -725,29 +707,24 @@ export class DataspaceControlPlaneService {
                 }
                 // Provider signs the data access token with its own identity.
                 // The subject contains the transfer context claims that the data plane
-                // will verify when the consumer presents this token. Parse
-                // the composite providerIdentity to extract the signing nodeDid and
-                // the tenant-hash to embed as `tid`.
+                // will verify when the consumer presents this token
                 if (!Is.stringValue(entity.providerIdentity)) {
                     throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "providerIdentityMissing");
                 }
-                const pullProviderId = this.parseTenantIdentifier(entity.providerIdentity);
-                const accessToken = await this._trustComponent.generate(pullProviderId.nodeDid, this._overrideTrustGeneratorType, {
+                const pullProviderId = entity.providerIdentity;
+                const accessToken = await this._trustComponent.generate(pullProviderId, this._overrideTrustGeneratorType, {
                     subject: {
                         consumerPid: entity.consumerPid,
                         providerPid: entity.providerPid,
                         agreementId: entity.agreementId,
                         datasetId: entity.datasetId
                     }
-                }, pullProviderId.tenantIdHash);
+                });
                 Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "accessToken", accessToken);
                 const tokenString = accessToken;
                 let fullEndpoint = `${publicOrigin}/${this._dataPlanePath}`;
-                const contextIds = await ContextIdStore.getContextIds();
-                const tenantId = contextIds?.[ContextIdKeys.Tenant];
-                if (Is.stringValue(tenantId)) {
-                    fullEndpoint = await this._urlTransformerComponent.addEncryptedQueryParamToUrl(fullEndpoint, "tenant", tenantId);
-                }
+                const organizationIdentity = await this.resolveContextOrganizationId();
+                fullEndpoint = HttpUrlHelper.addQueryStringParam(fullEndpoint, ContextIdKeys.Organization, organizationIdentity);
                 response.dataAddress = {
                     "@type": DataspaceProtocolTransferProcessTypes.DataAddress,
                     endpointType: DataspaceProtocolEndpointType.HttpsQueryEndpoint,
@@ -792,14 +769,11 @@ export class DataspaceControlPlaneService {
                     return transformToTransferError(new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "pushTransferDataPathNotConfigured", { consumerPid: entity.consumerPid }), message);
                 }
                 let fullEndpoint = `${publicOrigin}/${this._dataPlanePath}/inbox`;
-                // Bake the provider's tenant token into the /inbox URL so the consumer's
-                // inbound POST routes to the right tenant via TenantProcessor — mirrors the
+                // Bake the provider's organization identity into the /inbox URL so the consumer's
+                // inbound POST routes to the right organization via TenantProcessor — mirrors the
                 // pull-mode endpoint baking.
-                const inboxContextIds2 = await ContextIdStore.getContextIds();
-                const inboxTenantId2 = inboxContextIds2?.[ContextIdKeys.Tenant];
-                if (Is.stringValue(inboxTenantId2)) {
-                    fullEndpoint = await this._urlTransformerComponent.addEncryptedQueryParamToUrl(fullEndpoint, "tenant", inboxTenantId2);
-                }
+                const organizationIdentity = await this.resolveContextOrganizationId();
+                fullEndpoint = HttpUrlHelper.addQueryStringParam(fullEndpoint, ContextIdKeys.Organization, organizationIdentity);
                 response.dataAddress = {
                     "@type": DataspaceProtocolTransferProcessTypes.DataAddress,
                     endpointType: DataspaceProtocolEndpointType.HttpsActivityStreamEndpoint,
@@ -887,14 +861,13 @@ export class DataspaceControlPlaneService {
         }
         try {
             const { entity, role } = await this.lookupTransferByMessage(message);
-            this.validateCallerIsConsumer(this.buildCallerComposite(trustInfo), entity);
-            // Only the tenant that owns this transfer can mutate it.
-            // Skipped on single-tenant nodes (entity.tenantId undefined).
-            const callingTenantId = await this.resolveCallingTenantId();
-            if (Is.stringValue(entity.tenantId) &&
-                Is.stringValue(callingTenantId) &&
-                entity.tenantId !== callingTenantId) {
-                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongTenant");
+            if (trustInfo.identity !== entity.consumerIdentity) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedAsConsumer");
+            }
+            // Only the organization that owns this transfer can mutate it.
+            const callingOrganizationId = await this.resolveContextOrganizationId();
+            if (entity.organizationIdentity !== callingOrganizationId) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongOrganization");
             }
             // DSP idempotency: re-receiving TransferCompletionMessage for a transfer already
             // in COMPLETED should return the same success response, not invalidStateForComplete.
@@ -981,14 +954,14 @@ export class DataspaceControlPlaneService {
         }
         try {
             const { entity, role } = await this.lookupTransferByMessage(message);
-            this.validateCallerIsTransferParty(this.buildCallerComposite(trustInfo), entity);
-            // S2 belt-and-braces: only the tenant that owns this transfer can mutate it.
-            // Skipped on single-tenant nodes (entity.tenantId undefined).
-            const callingTenantId = await this.resolveCallingTenantId();
-            if (Is.stringValue(entity.tenantId) &&
-                Is.stringValue(callingTenantId) &&
-                entity.tenantId !== callingTenantId) {
-                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongTenant");
+            if (trustInfo.identity !== entity.consumerIdentity &&
+                trustInfo.identity !== entity.providerIdentity) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedForTransfer");
+            }
+            // S2 belt-and-braces: only the organization that owns this transfer can mutate it.
+            const callingOrganizationId = await this.resolveContextOrganizationId();
+            if (entity.organizationIdentity !== callingOrganizationId) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongOrganization");
             }
             // DSP idempotency: re-receiving TransferSuspensionMessage for a transfer already
             // in SUSPENDED should return success. Data-plane suspend already ran.
@@ -1079,14 +1052,14 @@ export class DataspaceControlPlaneService {
         }
         try {
             const { entity, role } = await this.lookupTransferByMessage(message);
-            this.validateCallerIsTransferParty(this.buildCallerComposite(trustInfo), entity);
-            // Only the tenant that owns this transfer can mutate it.
-            // Skipped on single-tenant nodes (entity.tenantId undefined).
-            const callingTenantId = await this.resolveCallingTenantId();
-            if (Is.stringValue(entity.tenantId) &&
-                Is.stringValue(callingTenantId) &&
-                entity.tenantId !== callingTenantId) {
-                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongTenant");
+            if (trustInfo.identity !== entity.consumerIdentity &&
+                trustInfo.identity !== entity.providerIdentity) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedForTransfer");
+            }
+            // Only the organization that owns this transfer can mutate it.
+            const organizationIdentity = await this.resolveContextOrganizationId();
+            if (entity.organizationIdentity !== organizationIdentity) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongOrganization");
             }
             // DSP idempotency: re-receiving TransferTerminationMessage for a transfer already
             // in TERMINATED should return success. Data-plane teardown already ran.
@@ -1160,7 +1133,10 @@ export class DataspaceControlPlaneService {
         const trustInfo = await TrustHelper.verifyTrust(this._trustComponent, trustPayload, "getTransferProcess");
         try {
             const { entity, role } = await this.lookupTransferByPid(pid);
-            this.validateCallerIsTransferParty(this.buildCallerComposite(trustInfo), entity);
+            if (trustInfo.identity !== entity.consumerIdentity &&
+                trustInfo.identity !== entity.providerIdentity) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedForTransfer");
+            }
             await this._loggingComponent?.log({
                 level: "info",
                 source: DataspaceControlPlaneService.CLASS_NAME,
@@ -1218,7 +1194,8 @@ export class DataspaceControlPlaneService {
                 verifiedIdentity: trustInfo.identity
             }
         });
-        const localTrustPayload = await this.generateLocalTrustPayload();
+        const organizationId = await this.resolveContextOrganizationId();
+        const localTrustPayload = await this._trustComponent.generate(organizationId, this._overrideTrustGeneratorType, {});
         const catalogResult = await this._federatedCatalogueComponent.get(datasetId, localTrustPayload);
         if (isCatalogError(catalogResult)) {
             if (isCatalogErrorName(catalogResult, NotFoundError.CLASS_NAME)) {
@@ -1391,23 +1368,14 @@ export class DataspaceControlPlaneService {
             });
         }
         const agreement = await this.lookupAgreement(entity.agreementId);
-        const contextIds = await ContextIdStore.getContextIds();
-        const currentComposite = this.buildTenantIdentifier(contextIds?.[ContextIdKeys.Node], contextIds?.[ContextIdKeys.Tenant]);
-        // Identity is `nodeDid:hash(tenantId)` (or just `nodeDid` in
-        // single-tenant). Without a node DID in context we cannot derive any
-        // caller identity at all.
-        if (!Is.stringValue(currentComposite)) {
-            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "organizationContextMissing", {
-                consumerPid
-            });
-        }
+        const organizationIdentity = await this.resolveContextOrganizationId();
         const assignerIdentity = OdrlPolicyHelper.extractAssignerIdentity(agreement);
         const assignerIds = ArrayHelper.fromObjectOrArray(assignerIdentity);
-        if (!assignerIds.includes(currentComposite)) {
+        if (!assignerIds.includes(organizationIdentity)) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "agreementAssignerMismatch", {
                 consumerPid,
                 agreementId: OdrlPolicyHelper.getUid(agreement),
-                expectedComposite: currentComposite,
+                organizationIdentity,
                 actualAssigner: assignerIds.join(", ")
             });
         }
@@ -1422,7 +1390,7 @@ export class DataspaceControlPlaneService {
                 state: entity.state,
                 consumerIdentity: entity.consumerIdentity,
                 agreementId: OdrlPolicyHelper.getUid(agreement),
-                organizationId: contextIds?.[ContextIdKeys.Organization]
+                organizationId: organizationIdentity
             }
         });
         return {
@@ -1453,20 +1421,14 @@ export class DataspaceControlPlaneService {
             });
         }
         const agreement = await this.lookupAgreement(entity.agreementId);
-        const contextIds = await ContextIdStore.getContextIds();
-        const currentComposite = this.buildTenantIdentifier(contextIds?.[ContextIdKeys.Node], contextIds?.[ContextIdKeys.Tenant]);
-        if (!Is.stringValue(currentComposite)) {
-            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "organizationContextMissingProvider", {
-                providerPid
-            });
-        }
+        const organizationIdentity = await this.resolveContextOrganizationId();
         const assignerIdentity = OdrlPolicyHelper.extractAssignerIdentity(agreement);
         const assignerIds = ArrayHelper.fromObjectOrArray(assignerIdentity);
-        if (!assignerIds.includes(currentComposite)) {
+        if (!assignerIds.includes(organizationIdentity)) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "agreementAssignerMismatchProvider", {
                 providerPid,
                 agreementId: OdrlPolicyHelper.getUid(agreement),
-                expectedComposite: currentComposite,
+                organizationIdentity,
                 actualAssigner: assignerIds.join(", ")
             });
         }
@@ -1496,7 +1458,7 @@ export class DataspaceControlPlaneService {
                 consumerIdentity: entity.consumerIdentity,
                 providerIdentity: entity.providerIdentity,
                 agreementId: OdrlPolicyHelper.getUid(agreement),
-                organizationId: contextIds?.[ContextIdKeys.Organization]
+                organizationId: organizationIdentity
             }
         });
         return {
@@ -1512,7 +1474,7 @@ export class DataspaceControlPlaneService {
         };
     }
     /**
-     * Register a dataset for a dataspace app, owned by the calling tenant.
+     * Register a dataset for a dataspace app, owned by the calling organization.
      * @param id Optional explicit id. If omitted, derived from `dataset["@id"]`
      * or generated.
      * @param appId The dataspace app this dataset belongs to.
@@ -1537,8 +1499,7 @@ export class DataspaceControlPlaneService {
                 id: resolvedId
             });
         }
-        const tenantId = await this.resolveCallingTenantId();
-        const nodeIdentity = await this.resolveNodeIdentity();
+        const organizationIdentity = await this.resolveContextOrganizationId();
         const existing = await this._dataspaceAppDatasetStorage.get(resolvedId);
         if (!Is.empty(existing)) {
             throw new AlreadyExistsError(DataspaceControlPlaneService.CLASS_NAME, "datasetAlreadyExists", resolvedId);
@@ -1546,8 +1507,9 @@ export class DataspaceControlPlaneService {
         const now = new Date().toISOString();
         const entity = {
             id: resolvedId,
-            nodeIdentity,
-            tenantId,
+            organizationIdentity,
+            // Required for out of bound dataset operations that need to correlate back to the owning tenant
+            tenantId: await this.resolveContextTenantId(),
             appId,
             dataset: ObjectHelper.omit(dataset, ["@id"]),
             dateCreated: now,
@@ -1559,19 +1521,19 @@ export class DataspaceControlPlaneService {
         return resolvedId;
     }
     /**
-     * Get a dataset record owned by the calling tenant.
+     * Get a dataset record owned by the calling organization.
      * @param id The stored dataset id.
      * @returns The stored dataset record.
      */
     async getAppDataset(id) {
         Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "id", id);
-        const tenantId = await this.resolveCallingTenantId();
+        const organizationId = await this.resolveContextOrganizationId();
         const entity = await this._dataspaceAppDatasetStorage.get(id);
         if (Is.empty(entity)) {
             throw new NotFoundError(DataspaceControlPlaneService.CLASS_NAME, "datasetNotFound", id);
         }
-        if (entity.tenantId !== tenantId) {
-            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "datasetWrongTenant");
+        if (entity.organizationIdentity !== organizationId) {
+            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "datasetWrongOrganization");
         }
         return {
             id: entity.id,
@@ -1582,20 +1544,18 @@ export class DataspaceControlPlaneService {
         };
     }
     /**
-     * List the dataspace app datasets owned by the calling tenant.
+     * List the dataspace app datasets owned by the calling organization.
      * @param cursor Optional pagination cursor.
      * @param limit Optional maximum number of entries to return.
      * @returns The stored datasets and the next-page cursor if more exist.
      */
     async listAppDatasets(cursor, limit) {
-        const tenantId = await this.resolveCallingTenantId();
-        const page = await this._dataspaceAppDatasetStorage.query(Is.stringValue(tenantId)
-            ? {
-                property: "tenantId",
-                value: tenantId,
-                comparison: ComparisonOperator.Equals
-            }
-            : undefined, undefined, undefined, cursor, limit);
+        const organizationIdentity = await this.resolveContextOrganizationId();
+        const page = await this._dataspaceAppDatasetStorage.query({
+            property: "organizationIdentity",
+            value: organizationIdentity,
+            comparison: ComparisonOperator.Equals
+        }, undefined, undefined, cursor, limit);
         const entities = (page.entities ?? []).map(entity => ({
             id: entity.id,
             appId: entity.appId,
@@ -1609,7 +1569,7 @@ export class DataspaceControlPlaneService {
         };
     }
     /**
-     * Update a dataset record owned by the calling tenant.
+     * Update a dataset record owned by the calling organization.
      * @param id The stored dataset id.
      * @param appId The dataspace app this dataset belongs to.
      * @param dataset The dataset payload.
@@ -1618,13 +1578,13 @@ export class DataspaceControlPlaneService {
         Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "id", id);
         Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "appId", appId);
         Guards.object(DataspaceControlPlaneService.CLASS_NAME, "dataset", dataset);
-        const tenantId = await this.resolveCallingTenantId();
+        const organizationId = await this.resolveContextOrganizationId();
         const existing = await this._dataspaceAppDatasetStorage.get(id);
         if (Is.empty(existing)) {
             throw new NotFoundError(DataspaceControlPlaneService.CLASS_NAME, "datasetNotFound", id);
         }
-        if (existing.tenantId !== tenantId) {
-            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "datasetWrongTenant");
+        if (existing.organizationIdentity !== organizationId) {
+            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "datasetWrongOrganization");
         }
         const updated = {
             ...existing,
@@ -1637,20 +1597,20 @@ export class DataspaceControlPlaneService {
         await this._dataspaceAppDatasetStorage.set(updated);
     }
     /**
-     * Delete a dataspace app dataset owned by the calling tenant.
+     * Delete a dataspace app dataset owned by the calling organization.
      * @param id The stored app dataset id.
      */
     async deleteAppDataset(id) {
         Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "id", id);
-        const tenantId = await this.resolveCallingTenantId();
+        const organizationId = await this.resolveContextOrganizationId();
         const existing = await this._dataspaceAppDatasetStorage.get(id);
         if (Is.empty(existing)) {
             throw new NotFoundError(DataspaceControlPlaneService.CLASS_NAME, "datasetNotFound", id);
         }
-        if (existing.tenantId !== tenantId) {
-            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "datasetWrongTenant");
+        if (existing.organizationIdentity !== organizationId) {
+            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "datasetWrongOrganization");
         }
-        const localTrustPayload = await this.generateLocalTrustPayload(existing.tenantId);
+        const localTrustPayload = await this._trustComponent.generate(existing.organizationIdentity, this._overrideTrustGeneratorType, {});
         const removeResult = await this._federatedCatalogueComponent.remove(id, localTrustPayload);
         if (isCatalogError(removeResult)) {
             throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "datasetRemoveFailed", {
@@ -1730,7 +1690,7 @@ export class DataspaceControlPlaneService {
             providerIdentity: storageEntity.providerIdentity,
             format: storageEntity.format,
             callbackAddress: storageEntity.callbackAddress,
-            tenantId: storageEntity.tenantId,
+            organizationIdentity: storageEntity.organizationIdentity,
             dateCreated: new Date(storageEntity.dateCreated),
             dateModified: new Date(storageEntity.dateModified),
             policies: storageEntity.policies,
@@ -1756,7 +1716,7 @@ export class DataspaceControlPlaneService {
             providerIdentity: entity.providerIdentity,
             format: entity.format,
             callbackAddress: entity.callbackAddress,
-            tenantId: entity.tenantId,
+            organizationIdentity: entity.organizationIdentity,
             dateCreated: entity.dateCreated.toISOString(),
             dateModified: entity.dateModified.toISOString(),
             policies: entity.policies,
@@ -1783,57 +1743,6 @@ export class DataspaceControlPlaneService {
         }
         return agreement;
     }
-    /**
-     * Build the caller's composite identity (`nodeDid:tenantIdHash`) from a
-     * verified trust payload.
-     * @param trustInfo The verification info from `TrustHelper.verifyTrust`.
-     * @returns The composite identity.
-     * @internal
-     */
-    buildCallerComposite(trustInfo) {
-        Guards.object(DataspaceControlPlaneService.CLASS_NAME, "trustInfo", trustInfo);
-        Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "trustInfo.identity", trustInfo.identity);
-        return Is.stringValue(trustInfo.tenantId)
-            ? `${trustInfo.identity}:${trustInfo.tenantId}`
-            : trustInfo.identity;
-    }
-    /**
-     * Validate that the caller's verified identity matches the consumer of a transfer process.
-     * @param callerComposite The caller's composite identity (`nodeDid:tenantIdHash`).
-     * @param entity The transfer process entity.
-     * @throws UnauthorizedError if the caller is not the consumer.
-     * @internal
-     */
-    validateCallerIsConsumer(callerComposite, entity) {
-        if (callerComposite !== entity.consumerIdentity) {
-            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedAsConsumer");
-        }
-    }
-    /**
-     * Validate that the caller's verified identity matches the provider of a transfer process.
-     * @param callerComposite The caller's composite identity (`nodeDid:tenantIdHash`).
-     * @param entity The transfer process entity.
-     * @throws UnauthorizedError if the caller is not the provider.
-     * @internal
-     */
-    validateCallerIsProvider(callerComposite, entity) {
-        if (callerComposite !== entity.providerIdentity) {
-            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedAsProvider");
-        }
-    }
-    /**
-     * Validate that the caller's verified identity matches either the consumer or provider of a transfer process.
-     * @param callerComposite The caller's composite identity (`nodeDid:tenantIdHash`).
-     * @param entity The transfer process entity.
-     * @throws UnauthorizedError if the caller is not a party to the transfer.
-     * @internal
-     */
-    validateCallerIsTransferParty(callerComposite, entity) {
-        if (callerComposite !== entity.consumerIdentity &&
-            callerComposite !== entity.providerIdentity) {
-            throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedForTransfer");
-        }
-    }
     /**
      * Extract dataset ID from Agreement target.
      * @param format Agreement.
@@ -1882,8 +1791,8 @@ export class DataspaceControlPlaneService {
     async validateCatalogDataset(datasetId, agreement) {
         Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "datasetId", datasetId);
         Guards.object(DataspaceControlPlaneService.CLASS_NAME, "agreement", agreement);
-        // Lookup dataset in catalog
-        const localTrustPayload = await this.generateLocalTrustPayload();
+        const organizationId = await this.resolveContextOrganizationId();
+        const localTrustPayload = await this._trustComponent.generate(organizationId, this._overrideTrustGeneratorType, {});
         const catalogResult = await this._federatedCatalogueComponent.get(datasetId, localTrustPayload);
         if (isCatalogError(catalogResult)) {
             if (isCatalogErrorName(catalogResult, NotFoundError.CLASS_NAME)) {
@@ -2090,52 +1999,11 @@ export class DataspaceControlPlaneService {
             return dataset;
         }
         const contextIds = await ContextIdStore.getContextIds();
-        // The publisher attribution is always the composite identifier
-        const compositePublisher = this.buildTenantIdentifier(contextIds?.[ContextIdKeys.Node], contextIds?.[ContextIdKeys.Tenant]);
-        if (compositePublisher) {
-            return { ...dataset, "dcterms:publisher": compositePublisher };
+        if (contextIds?.[ContextIdKeys.Organization]) {
+            return { ...dataset, "dcterms:publisher": contextIds[ContextIdKeys.Organization] };
         }
         return dataset;
     }
-    /**
-     * Build the tenant-attributed identifier.
-     * @param nodeId The node identity (from `ContextIdKeys.Node`).
-     * @param tenantId The plaintext tenant id (from `ContextIdKeys.Tenant`), if any. Hashed before insertion into the composite.
-     * @returns Composite identifier, or undefined if nodeId is missing.
-     * @internal
-     */
-    buildTenantIdentifier(nodeId, tenantId) {
-        if (!Is.stringValue(nodeId)) {
-            return undefined;
-        }
-        return Is.stringValue(tenantId) ? `${nodeId}:${TrustHelper.hashTenantId(tenantId)}` : nodeId;
-    }
-    /**
-     * Parse a composite tenant identifier into its node and tenant-hash portions.
-     * @param composite The composite identifier (`nodeDid` or `nodeDid:hash`).
-     * @returns The parsed parts. `tenantIdHash` is undefined when the composite has no tenant portion (single-tenant node form).
-     * @throws GuardError if the input is not a non-empty string.
-     * @throws GeneralError if the input does not start with `did:` — the only valid composite identifier shapes carry a DID as the leading portion.
-     * @internal
-     */
-    parseTenantIdentifier(composite) {
-        Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "composite", composite);
-        if (!composite.startsWith("did:")) {
-            throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "invalidCompositeIdentifier", { composite });
-        }
-        const lastColon = composite.lastIndexOf(":");
-        if (lastColon === -1) {
-            return { nodeDid: composite };
-        }
-        const candidateHash = composite.slice(lastColon + 1);
-        if (DataspaceControlPlaneService._TENANT_HASH_PATTERN.test(candidateHash)) {
-            return {
-                nodeDid: composite.slice(0, lastColon),
-                tenantIdHash: candidateHash
-            };
-        }
-        return { nodeDid: composite };
-    }
     /**
      * Resolve the data plane component or throw if it isn't registered. Push-mode transfers
      * require the data plane; pull-only deployments may run without it.
@@ -2315,26 +2183,22 @@ export class DataspaceControlPlaneService {
     }
     // DATASPACE APP DATASET HANDLERS
     /**
-     * Publish a single dataspace app dataset to the federated catalogue in its owning tenant's context.
+     * Publish a single dataspace app dataset to the federated catalogue.
      * @param appDataset The stored dataspace app dataset entity.
      * @internal
      */
     async publishAppDataset(appDataset) {
-        // Override `Tenant` in the context wrap so federated catalogue captures the
-        // appDataset's owning tenant. On single-tenant nodes the appDataset has no tenantId,
-        // so the assignment writes `Tenant: undefined` — equivalent to no override.
-        const contextIds = (await ContextIdStore.getContextIds()) ?? {};
-        const localTrustPayload = await this.generateLocalTrustPayload(appDataset.tenantId);
-        const wrappedContextIds = {
-            ...contextIds,
-            [ContextIdKeys.Tenant]: appDataset.tenantId
-        };
-        await ContextIdStore.run(wrappedContextIds, async () => {
+        const localTrustPayload = await this._trustComponent.generate(appDataset.organizationIdentity, this._overrideTrustGeneratorType);
+        // Ensure that any dataspace app operations are run with the tenant id
+        // of the dataset owner, so that propagates to any operations it performs
+        const contextIds = await ContextIdStore.getContextIds();
+        const tenantContextIds = { ...contextIds, [ContextIdKeys.Tenant]: appDataset.tenantId };
+        await ContextIdStore.run(tenantContextIds, async () => {
             const app = DataspaceAppFactory.get(appDataset.appId);
             const datasetPayload = this.restampDatasetId(appDataset.dataset, appDataset.id);
             const overrideHandler = app.datasetsHandled?.bind(app);
             const rawDatasets = overrideHandler
-                ? await overrideHandler(datasetPayload, appDataset.tenantId ?? "")
+                ? await overrideHandler(datasetPayload)
                 : [datasetPayload];
             const datasets = await Promise.all(rawDatasets.map(async (d) => this.populateDefaults(d)));
             for (const dataset of datasets) {
@@ -2351,38 +2215,23 @@ export class DataspaceControlPlaneService {
         });
     }
     /**
-     * Resolve the calling tenant from the request context.
-     * @returns The owning tenant id, or undefined for single-tenant nodes.
+     * Resolve the calling organization from the request context.
+     * @returns The owning organization identity.
      * @internal
      */
-    async resolveCallingTenantId() {
+    async resolveContextOrganizationId() {
         const contextIds = await ContextIdStore.getContextIds();
-        const tenantId = contextIds?.[ContextIdKeys.Tenant];
-        return Is.stringValue(tenantId) ? tenantId : undefined;
+        ContextIdHelper.guard(contextIds, ContextIdKeys.Organization);
+        return contextIds[ContextIdKeys.Organization];
     }
     /**
-     * Resolve the node identity from the current context, throwing if absent.
-     * @returns The owning node identity.
+     * Resolve the tenant identity from the current context.
+     * @returns The owning tenant identity.
      * @internal
      */
-    async resolveNodeIdentity() {
+    async resolveContextTenantId() {
         const contextIds = await ContextIdStore.getContextIds();
-        const nodeId = contextIds?.[ContextIdKeys.Node];
-        if (!Is.stringValue(nodeId)) {
-            throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "datasetNodeContextRequired");
-        }
-        return nodeId;
-    }
-    /**
-     * Generate a trust payload representing this node for internal FederatedCatalogue calls.
-     * @param tenantId Optional tenant ID to embed in the token.
-     * @returns The generated trust payload.
-     * @internal
-     */
-    async generateLocalTrustPayload(tenantId) {
-        const nodeId = await this.resolveNodeIdentity();
-        const contextIds = (await ContextIdStore.getContextIds()) ?? {};
-        return this._trustComponent.generate(nodeId, this._overrideTrustGeneratorType, {}, Is.stringValue(tenantId) ? TrustHelper.hashTenantId(tenantId) : undefined, contextIds[ContextIdKeys.Organization]);
+        return contextIds?.[ContextIdKeys.Tenant];
     }
 }
 //# sourceMappingURL=dataspaceControlPlaneService.js.map