Skip to main content
Version: 2026.04.0

Composition Guide

Memberships is the tenant-user lifecycle source. The adjacent modules still keep their own responsibilities.

Memberships with Multi-Tenancy​

  • Use the bridge adapter when Multi-Tenancy should resolve or validate tenant access from membership state.
  • If your host also uses UsePrimusTenantIsolation(), invitation acceptance can need a narrow ITenantRequirementExemptionPolicy because the invited user may be authenticated before the first active tenant exists.
  • Keep the exemption narrow to the acceptance path instead of opening broad unaudited gaps.

Memberships with Identity Broker​

  • Use the IPrimusOrgMembershipStore bridge when Broker needs membership-backed organization data.
  • Add PrimusSaaS.Memberships.Broker when membership lifecycle changes should revoke Broker sessions or refresh tokens.
  • This bridge handles session revocation. It does not replace your own auth, notification, or compliance controls.

Memberships with RBAC​

  • Membership roles do not become RBAC assignments automatically by default.
  • Add PrimusSaaS.Memberships.Rbac when you want lifecycle-driven RBAC provisioning.
  • Configure explicit role mappings so the bridge knows which membership roles create which RBAC assignments.
builder.Services.AddPrimusMembershipsRbacBridge(options =>
{
    options.ApplicationId = "my-app";
    options.RoleMappings["tenant_admin"] = "role:tenant_admin";
    options.RoleMappings["participant"] = "role:participant";
});

Keep these boundaries clear​

  • Memberships owns invitation and membership lifecycle.
  • Multi-Tenancy owns tenant context resolution and request isolation.
  • Identity Broker owns login, sessions, and token flows.
  • RBAC owns authorization decisions and role assignment state.

Bridges connect those modules. They do not collapse them into one responsibility.

Current run evidence​

  • sdk/dotnet/tests/PrimusSaaS.Memberships.Tests/Regression/BridgeAdapterTests.cs Current run covers EF Core tenant and org bridge behavior.
  • sdk/dotnet/tests/PrimusSaaS.Memberships.Tests/Unit/InMemoryAdapterCoverageTests.cs Current run covers the in-memory Multi-Tenancy and Broker bridge adapters.