- Add JWT-based authentication to all API endpoints
- Implement tenant isolation and access control validation
- Add Galactic Admin role validation for cross-tenant endpoints
- Enhance certificate validation with full X.509 chain checking
- Add certificate validation cache (5-min TTL) and self-signed cert protection
- Implement NDJSON payload size limit protection (configurable per tenant)
- Replace placeholder audit user identifiers with actual JWT user principals
- Add TenantHelper utility for consistent tenant/user extraction from tokens
- Disable PII logging in production (ShowPII = false)
Agent:
- Add automatic tenant ID detection from Windows Registry (AAD Join enrollment)
- Implement tenant ID precedence: CLI argument > Registry > Fallback
SignalR:
- Add authentication checks to all SignalR functions
- Implement tenant-based group access control
- Add user identifier logging for SignalR operations
Frontend:
- Change MSAL cache from localStorage to sessionStorage (XSS protection)
- Add warning status support to health check page
- Add Admin Configuration link in navbar (Galactic Admin only)
- Move maintenance trigger from Settings to Admin Configuration page
- Update tenant context logging for clarity
Configuration:
- Add MaxNdjsonPayloadSizeMB setting to TenantConfiguration model
- Update configuration service to persist new retention/timeout settings
Oliver Kieselbach