Overview

Use Memberships when your application needs a canonical tenant-user lifecycle instead of ad hoc invitation and membership code. PrimusSaaS Memberships handles invitations, bootstrap-first-admin flow, membership activation and suspension, active-tenant selection, and bridge adapters into adjacent modules.

Maturity: Release Candidate For The Validated Package Family

The implementation is validated strongly in the current workspace, but the public package family still uses early-version packages and the broader docs set is not yet complete. Treat this as release-candidate quality backed by current-run evidence, not as a blanket repo-wide stable claim.

Use this module when

• You need invitation create, accept, resend, and revoke flows.
• You need a supported bootstrap path for the first tenant admin.
• You need active-tenant selection backed by membership validation.
• You need one canonical membership source that can feed Multi-Tenancy or Identity Broker.
• You need optional bridge hooks into Broker or RBAC without hard-coding those integrations into your app.

Do not start here if

• You need a ready-made admin UI. This package family is headless.
• You do not yet have authentication in place. Start with Identity Validator or Identity Broker.
• You only need static roles with no invitation or membership lifecycle. Start with RBAC.
• You expect Membership roles to become RBAC assignments automatically without a bridge. That only happens if you add the RBAC bridge package and mapping.

Start here

Goal	Start with	What it proves
Fastest first success	Verified .NET Quickstart	A minimal in-memory ASP.NET Core host can create an invite, accept it, and return tenant memberships.
Full host setup	Integration Guide	Core registration, ASP.NET Core endpoints, storage choice, and policy layering.
Understand the API surface	Endpoint Reference	The implemented routes, default auth behavior, and expected result shapes.
Choose options and persistence	Options And Storage	Invitation, bootstrap, endpoint, and storage choices with current package boundaries.
Compose with adjacent modules	Composition Guide	How Memberships feeds Multi-Tenancy, Identity Broker, and RBAC.
Fix common rollout errors	Troubleshooting	The current validated failure modes instead of trial-and-error debugging.

What this module does

• invitation create, list, resend, accept, and revoke
• membership activation, suspension, reactivation, and revoke
• bootstrap-first-admin flow for initial tenant ownership
• active-tenant selection with membership validation
• structured audit sink abstraction
• startup validation for required store registrations
• bridge adapters for Multi-Tenancy, Identity Broker, and RBAC composition

Core concepts

• Membership: the tenant-user relationship, including status and assigned roles.
• Invitation: the protected token and metadata used to onboard a user into a tenant.
• Active tenant selection: the current tenant chosen by a user with access to multiple tenants.
• Bootstrap admin: the first active admin created for a tenant without a prior invite.
• Bridge adapter: an optional package that projects membership state into Multi-Tenancy, Identity Broker, or RBAC.

Packages

Package	Purpose
PrimusSaaS.Memberships	Core membership domain, services, and contracts
PrimusSaaS.Memberships.AspNetCore	ASP.NET Core endpoints and host integration
PrimusSaaS.Memberships.EFCore	Durable EF Core persistence plus bridge adapters
PrimusSaaS.Memberships.InMemory	In-memory adapter for development and tests
PrimusSaaS.Memberships.Broker	Identity Broker projection helpers
PrimusSaaS.Memberships.Rbac	RBAC composition helpers

Current evidence

• dotnet test sdk/dotnet/tests/PrimusSaaS.Memberships.Tests/PrimusSaaS.Memberships.Tests.csproj --no-restore --nologo Current run: 65/65 passed on net8.0, net9.0, and net10.0.
• Current run coverage: 96.92% line / 86.19% branch / 97.82% method.
• sdk/dotnet/tests/PrimusSaaS.Memberships.Tests/Integration/MembershipEndpointsTests.cs Current implementation covers invite create/accept, membership suspend/reactivate, bootstrap admin, invitation resend/revoke, active-tenant selection, and auth-by-default behavior.
• Docusaurus production build succeeded in the current run with the same two pre-existing broken links outside Memberships.

Boundary

• Canonical source of truth for tenant-user membership lifecycle
• Not a Primus-hosted user-management portal
• Not a substitute for your application's own audit-retention, notification delivery, or compliance controls
• In-memory adapters are development/test only and are not production persistence

Related modules

• Multi-Tenancy for tenant context resolution and request isolation
• RBAC for scoped authorization
• Identity Broker for authentication and session flows

For package-level detail beyond this Docusaurus overview, use sdk/dotnet/src/PrimusSaaS.Memberships/README.md in the repository root.