Skip to main content

LMS Tenant and Actor Context

Summary​

Source-backed Draft reference for LMS Tenant and Actor Context across the implemented Training Service and, where applicable, Gateway surface.

Audience​

API consumers, engineering, QA, support, architecture, security, product, and implementation reviewers.

Reference Content​

Tenant flow​

The HTTP tenant adapter resolves a numeric tenant, tenant key, actor email, user reference, and elevated-role indicator from request identity/context. Exact names and values are intentionally excluded from this public page.

EF applies global query filters to tenant entities. Normal reads therefore use current-tenant filtering. Writes commonly require a tenant and set tenant fields. Existing-entity lifecycle operations query through the filter and audit with the entity tenant. No endpoint uses filter bypass.

Actor behavior​

Actor email is recorded where audit/timeline helpers receive it. The implementation does not require an actor, validate the actor against the target employee, or distinguish system operations through an API policy. Gateway forwarding preserves request headers and correlation through its downstream request mechanism.

Gaps​

  • Tenant context is not authentication.
  • No resource ownership check binds an identifier-based enrollment, assessment, certificate, session, report, or ESS response to the authenticated caller.
  • No explicit endpoint policy controls elevated cross-tenant behavior.
  • Read behavior with missing tenant depends on the global filter's current-tenant fallback and should be reviewed.
  • Some create operations accept related identifiers without explicit same-tenant existence validation; global filters limit many lookups, but not every relationship is checked before persistence.

Source References​

  • microservices/src/training-service/Application/Common.cs
  • microservices/src/training-service/Infrastructure/TrainingDbContext.cs
  • microservices/src/training-service/Api/TrainingEndpoints.cs
  • microservices/src/gateway-api/EssEndpoints.cs

See Also​

Keywords​

  • LMS API
  • Training Service
  • Source-backed contract

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-17
  • Review cycle: Quarterly