go-duck-cli 1.1.40 → 1.1.43

package/generators/kratos.js

@@ -273,6 +273,8 @@ import (
     my_middleware "{{projectName}}/middleware"
 	"gorm.io/gorm"
 	"go.mongodb.org/mongo-driver/mongo"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"strings"
 	"fmt"
 	"sort"
@@ -297,13 +299,14 @@ func TenantServerInterceptor(conf *config.Config, db *gorm.DB) middleware.Middle
             rolesInterface, ok := ra["roles"].([]interface{})
             if !ok { return handler(ctx, req) }
 
+            superAdminRole := strings.ToLower(conf.GoDuck.Security.SuperAdminRole)
             // Normalize roles (lowercase)
             var lowerRoles []string
             isAdmin := false
             for _, r := range rolesInterface {
                 roleStr := strings.ToLower(fmt.Sprintf("%v", r))
                 lowerRoles = append(lowerRoles, roleStr)
-                if roleStr == "admin" || roleStr == "role_admin" { isAdmin = true }
+                if roleStr == "admin" || roleStr == "role_admin" || (superAdminRole != "" && roleStr == superAdminRole) { isAdmin = true }
             }
 
             var requestedTenant string
@@ -312,18 +315,12 @@ func TenantServerInterceptor(conf *config.Config, db *gorm.DB) middleware.Middle
             }
 
             var mappings []models.TenantRole
-            if requestedTenant != "" {
-                if isAdmin {
-                    db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE tenant_id = ?", requestedTenant).Scan(&mappings)
-                } else {
-                    db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ? AND tenant_id = ?", lowerRoles, requestedTenant).Scan(&mappings)
-                }
+            if isAdmin {
+                mappings = []models.TenantRole{}
+            } else if requestedTenant != "" {
+                db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ? AND tenant_id = ?", lowerRoles, requestedTenant).Scan(&mappings)
             } else {
-                if isAdmin {
-                    db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles").Scan(&mappings)
-                } else {
-                    db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ?", lowerRoles).Scan(&mappings)
-                }
+                db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ?", lowerRoles).Scan(&mappings)
             }
 
             siloConnections := make(map[string]*gorm.DB)
@@ -340,6 +337,9 @@ func TenantServerInterceptor(conf *config.Config, db *gorm.DB) middleware.Middle
             mappings = authorizedMappings
 
             if len(mappings) == 0 {
+                if !isAdmin {
+                    return nil, status.Error(codes.PermissionDenied, "Access denied. No tenant database provisioned for your roles.")
+                }
                 conn, _ := mgr.GetDB(fallbackDB)
                 siloConnections["fallback"] = conn
                 ctx = context.WithValue(ctx, "tenantDBConn", conn)

package/generators/multitenancy.js

@@ -147,12 +147,13 @@ func TenantMiddleware(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
+		superAdminRole := strings.ToLower(cfg.GoDuck.Security.SuperAdminRole)
 		var lowerRoles []string
 		isAdmin := false
 		for _, r := range roles {
 			roleStr := strings.ToLower(fmt.Sprintf("%v", r))
 			lowerRoles = append(lowerRoles, roleStr)
-			if roleStr == "admin" || roleStr == "role_admin" {
+			if roleStr == "admin" || roleStr == "role_admin" || (superAdminRole != "" && roleStr == superAdminRole) {
 				isAdmin = true
 			}
 		}
@@ -173,18 +174,12 @@ func TenantMiddleware(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
 			}
 		}
 
-		if len(requestedTenants) > 0 {
-			if isAdmin {
-				db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE tenant_id IN ?", requestedTenants).Scan(&mappings)
-			} else {
-				db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ? AND tenant_id IN ?", lowerRoles, requestedTenants).Scan(&mappings)
-			}
+		if isAdmin {
+			mappings = []models.TenantRole{}
+		} else if len(requestedTenants) > 0 {
+			db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ? AND tenant_id IN ?", lowerRoles, requestedTenants).Scan(&mappings)
 		} else {
-			if isAdmin {
-				db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles").Scan(&mappings)
-			} else {
-				db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ?", lowerRoles).Scan(&mappings)
-			}
+			db.Raw("SELECT role_name, db_name, is_primary FROM tenant_roles WHERE LOWER(role_name) IN ?", lowerRoles).Scan(&mappings)
 		}
 
 		// Filter out unauthorized mappings (e.g. admin_db for non-admins)
@@ -198,11 +193,16 @@ func TenantMiddleware(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
 		mappings = authorizedMappings
 
         if len(mappings) == 0 {
+             if !isAdmin {
+                  c.JSON(http.StatusForbidden, gin.H{"error": "Access denied. No tenant database provisioned for your roles."})
+                  c.Abort()
+                  return
+             }
              conn, err := mgr.GetDB(fallbackDB)
              if err != nil || conn == nil {
-                 c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to resolve tenant fallback database connection"})
-                 c.Abort()
-                 return
+                  c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to resolve tenant fallback database connection"})
+                  c.Abort()
+                  return
              }
              siloConnections["fallback"] = conn
              c.Set("tenantDBConn", conn)
@@ -355,6 +355,7 @@ import (
 )
 
 type DatabaseRequest struct {
+	TenantID  string \`json:"tenantId" form:"tenantId"\`
 	RoleName  string \`json:"roleName" form:"roleName" binding:"required"\`
 	DBName    string \`json:"dbName" form:"dbName" binding:"required"\`
     IsPrimary bool   \`json:"isPrimary" form:"isPrimary"\`
@@ -390,15 +391,25 @@ func CreateDatabaseAndMigrate(masterDB *gorm.DB) gin.HandlerFunc {
         if count == 0 {
             isPrimary = true
         }
+
+        tenantID := req.TenantID
+        if tenantID == "" {
+            tenantID = uuid.New().String()
+        }
+
         if err := masterDB.Where("LOWER(role_name) = LOWER(?) AND db_name = ?", req.RoleName, req.DBName).First(&existing).Error; err == nil {
             if count <= 1 {
                 isPrimary = true
             }
             existing.IsPrimary = isPrimary
+            if req.TenantID != "" {
+                existing.TenantID = req.TenantID
+            }
             masterDB.Save(&existing)
+            tenantID = existing.TenantID
         } else {
             masterDB.Create(&models.TenantRole{
-                TenantID:  uuid.New().String(),
+                TenantID:  tenantID,
                 RoleName:  req.RoleName,
                 DBName:    req.DBName,
                 IsPrimary: isPrimary,
@@ -414,7 +425,7 @@ func CreateDatabaseAndMigrate(masterDB *gorm.DB) gin.HandlerFunc {
             migrations.RunGoNativeMigrationsForTenant(tenantDB)
         }
 
-		c.JSON(http.StatusOK, gin.H{"message": "Role silo assigned successfully", "role": req.RoleName, "primary": isPrimary})
+		c.JSON(http.StatusOK, gin.H{"message": "Role silo assigned successfully", "role": req.RoleName, "tenantId": tenantID, "primary": isPrimary})
 	}
 }
 

package/generators/postman.js

@@ -140,11 +140,11 @@ export const generatePostmanCollection = async (config, entities, outputDir, ope
                         { key: "X-Tenant-ID", value: "{{tenant}}" }
                     ],
                     url: {
-                        raw: "http://{{host}}:{{port}}/api/audit",
+                        raw: "http://{{host}}:{{port}}/api/admin/audit",
                         protocol: "http",
                         host: ["{{host}}"],
                         port: "{{port}}",
-                        path: ["api", "audit"]
+                        path: ["api", "admin", "audit"]
                     }
                 }
             },
@@ -305,6 +305,17 @@ export const generatePostmanCollection = async (config, entities, outputDir, ope
             }
         ];
 
+        if (entity.isSearchable && config.elasticsearch?.enabled) {
+            privateItems.push({
+                name: `Elasticsearch Search (${capitalized})`,
+                request: {
+                    method: "GET",
+                    header: [ { key: "Authorization", value: "Bearer {{token}}" }, { key: "X-Tenant-ID", value: "{{tenant}}" } ],
+                    url: { raw: `http://{{host}}:{{port}}/api/search/${name}?q=Sample`, protocol: "http", host: ["{{host}}"], port: "{{port}}", path: ["api", "search", name], query: [ { key: "q", value: "Sample" } ] }
+                }
+            });
+        }
+
         folder.item.push({ name: "Private (Auth Required) CRUD", item: privateItems });
         restFolder.item.push(folder);
     }

package/generators/swagger.js

@@ -208,7 +208,7 @@ export const generateSwaggerDocs = async (config, entities, outputDir, openEntit
     }
 
     // 2. Add System Paths
-    swagger.paths['/rpc/{table}'] = {
+    swagger.paths['/api/rpc/{table}'] = {
         get: {
             tags: ['Search Engine'],
             summary: 'Generic PostgREST RPC Engine',
@@ -240,7 +240,7 @@ export const generateSwaggerDocs = async (config, entities, outputDir, openEntit
         }
     };
 
-    swagger.paths['/audit'] = {
+    swagger.paths['/api/admin/audit'] = {
         get: {
             tags: ['Observability'],
             summary: 'Fetch Audit Trail',
@@ -249,6 +249,68 @@ export const generateSwaggerDocs = async (config, entities, outputDir, openEntit
         }
     };
 
+    swagger.paths['/management/tenant/assign'] = {
+        post: {
+            tags: ['Management'],
+            summary: 'Provision and Assign Tenant Database',
+            description: 'Creates a dedicated database for the specified tenant and runs all migrations.',
+            requestBody: {
+                required: true,
+                content: {
+                    'application/json': {
+                        schema: {
+                            type: 'object',
+                            properties: {
+                                roleName: { type: 'string', example: 'tenant_1_admin', description: 'The realm role name mapped to this database context' },
+                                dbName: { type: 'string', example: 'tenant_1', description: 'The physical name of the database to create and provision' }
+                            },
+                            required: ['roleName', 'dbName']
+                        }
+                    }
+                }
+            },
+            parameters: [
+                { name: 'X-Tenant-ID', in: 'header', required: true, schema: { type: 'string', default: 'master_internal' }, description: 'SuperAdmin internal master bypass token' }
+            ],
+            responses: {
+                200: { description: 'Success' },
+                401: { description: 'Unauthorized' },
+                403: { description: 'Forbidden (Requires SuperAdmin role)' }
+            }
+        }
+    };
+
+    if (config.elasticsearch?.enabled) {
+        swagger.paths['/api/search/{entity}'] = {
+            get: {
+                tags: ['Search Engine'],
+                summary: 'Elasticsearch Global Search',
+                description: 'High-performance full-text search with fuzzy matching across federated silos using Elasticsearch.',
+                parameters: [
+                    ...commonHeaders,
+                    { name: 'entity', in: 'path', required: true, schema: { type: 'string' }, description: 'The entity name to search (e.g., institute)' },
+                    { name: 'q', in: 'query', schema: { type: 'string' }, description: 'The search query (Spring-style fuzzy match)' }
+                ],
+                responses: {
+                    200: {
+                        description: 'OK',
+                        content: {
+                            'application/json': {
+                                schema: {
+                                    type: 'object',
+                                    properties: {
+                                        total: { type: 'integer', description: 'Total search hits matching query' },
+                                        hits: { type: 'array', items: { type: 'object' }, description: 'Search hits (matching source documents)' }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        };
+    }
+
     await fs.writeJson(path.join(docsDir, 'swagger.json'), swagger, { spaces: 2 });
     console.log(chalk.gray('  Generated Swagger Documentation: swagger.json'));
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "go-duck-cli",
-  "version": "1.1.40",
+  "version": "1.1.43",
   "description": "The Ultimate Evolutionary Go Microservice Scaffolder.",
   "main": "index.js",
   "type": "module",

package/templates/go/router.go.hbs

@@ -230,6 +230,13 @@ func SetupRouter(appConfig *config.Config) *gin.Engine {
     api := r.Group("/api")
     api.Use(middleware.JWTMiddleware())
     api.Use(middleware.TenantMiddleware(masterDB, appConfig))
+    // Log request DB resolution for debugging
+    api.Use(func(c *gin.Context) {
+        if dbName, ok := c.Get("resolvedDB"); ok {
+            fmt.Printf("[LOG] %s %s using DB: %s\n", c.Request.Method, c.Request.URL.Path, dbName.(string))
+        }
+        c.Next()
+    })
     api.Use(middleware.AuditMiddleware(masterDB))
     api.Use(middleware.MeteringMiddleware(masterDB))
     {