WebSvc.CrudAdmin 1.7.0

WebSvc.CrudAdmin (v1.6.0)

Unified Admin UI + IAM for multi-tenant Dynamic CRUD API platforms — database registration, API-key/Basic/JWT authentication, role-based permissions, row-level policies, tenant self-service, and machine-to-machine provisioning, all in one package.

⚠ CRITICAL — Program.cs Setup

builder.Services.AddCrudAdmin(o => { o.RequireAuth = true; });

var app = builder.Build();

app.UseRouting();
app.UseSetupWizardGate();      // ✅ blocks everything but /setup until first-run setup is done
app.UseCrudAdminPipeline();    // ✅ CORS → admin auth → audit → CrudAuth → tenant resolver → permissions
app.MapCrudAdmin();            // ✅ REQUIRED — maps /admin/* pages and /api/admin/* endpoints
app.Run();

UseCrudAdminPipeline() is the all-in-one for UseCrudCors/UseCrudAdmin/UseCrudAudit/ UseCrudAuth/UseProvisioning/UseTenantPortal/UseCrudTenantResolver/UseCrudPermissions in the correct order — call the individual Use* extensions yourself only if you need custom ordering. If you comment out app.MapCrudAdmin(), you will get 404 on /admin/login.

First run — no default credential

There is no seeded admin/admin@123 account — a fresh install redirects everything except /setup to a first-run wizard that creates the real first admin account. Existing installs upgraded from before this existed are grandfathered in automatically (setup.completed=true) without being forced through it again.

Storage: SQLite (default) or MySQL

The admin registry (tenants, databases, credentials, roles, audit log, settings — everything under /admin) runs on either engine behind one IAdminDbConnectionFactory/SqlDialect abstraction. SQLite is the zero-config default; set CRUDADMIN_DB_ENGINE=mysql + CRUDADMIN_MYSQL_CONNECTION_STRING=... (env vars, read at startup before the store is created) to run on MySQL from first boot instead. An existing SQLite install can move to MySQL later without a fresh setup, via the Migrate to MySQL wizard at /admin/migrate-mysql (Services/MySqlMigrationService.cs) — copies every table across, then the env vars above switch the running instance over.

Stored database credentials (db_password_encrypted, connection_string) are encrypted at rest via CredentialProtector, using ASP.NET Core's Data Protection API — keys persist under {DataDirectory}/keys, so back up that folder alongside the database file itself.

Tenant self-service portal

A tenant's own API-key holder can sign in at /tenant/login (using an unscoped, non-global drk_-prefixed "login key") to reach /tenant/workspace: manage their own databases and API keys, view their own audit trail, and edit tenant-level settings — always forced to their own tenant_id, no route accepts a caller-supplied one. A Global Admin can force-revoke any tenant's active portal session from /admin/tenantsessions.

Provisioning Keys — machine-to-machine onboarding

For an external system (e.g. a customer dashboard) to create tenants and databases in real time with no human admin session: a Provisioning Key (pvk_-prefixed, managed at /admin/provisioningkeys) authenticates via the X-Provisioning-Key header against /api/provision/tenants, /api/provision/databases, /api/provision/bootstrap, and /api/provision/status (Endpoints/ProvisioningEndpoints.cs). Each key is scoped by an optional tenant_id_prefix and a hard max_databases quota, with mandatory expiry, idempotent tenant creation, and full audit logging — a key can only ever create/see what it created.

Cross-app auto-login handoff

CrudAdmin can hand an already-authenticated session off to an independent add-on package (WebSvc.RateLimitAdmin, WebSvc.SqliteAdmin) without the browser ever seeing a password, via CrossAppHandoffService (Services/CrossAppHandoffService.cs): a short-lived, single-use, purpose-scoped token signed with the same Data Protection key ring CredentialProtector already persists to disk (ITimeLimitedDataProtector, ~60s lifetime). CrudAdmin's Databases page and the Tenant Portal's own Databases tab both surface this as one-click buttons (Endpoints/CrossAppHandoffEndpoints.cs, Endpoints/TenantPortalEndpoints.cs). Consumers verify independently — no compiled dependency on this package required, just the documented purpose string ("CrudAdmin.CrossAppHandoff.v1") and JSON claim shape. Also stamps a plain-string ctx.Items identity bridge (CrudAdmin.Identity.AuthType/SubjectId/TenantId/DatabaseKey, Middleware/CrudAuthMiddleware.cs) after every successful /api/v* authentication, so an add-on package's own middleware can read the caller's identity the same way, with zero coupling.

🎭 Built-in roles

Why Editor exists

The wildcard *.* (held by Owner) literally means "every permission, including future ones." When new destructive permissions are added (e.g. database.bootstrap, database.config), Owner inherits them automatically. Editor explicitly lists the four CRUD actions, so it cannot accidentally accumulate destructive scope as the package evolves.

For most users, Editor is the right choice — assign Owner only when you genuinely want a role to grow with every new permission ever added.

Versions

• 1.6.0 — CrossAppHandoffService + plain-string identity bridge (enables WebSvc.RateLimitAdmin's and WebSvc.SqliteAdmin's auto-login handoff), cross-app handoff endpoints on Databases/Tenant Portal.
• 1.5.0 — Tenant Sessions admin page (force-revoke a tenant's active portal session).
• 1.4.0 — Tenant self-service Settings tab + cross-app SSO exchange (/api/tenant/sso/exchange, /tenant/sso).
• 1.3.0 — first-run /setup wizard; the default admin/admin@123 seed was removed.
• 1.1.0–1.2.0 — MySQL support for the admin registry (IAdminDbConnectionFactory/SqlDialect), /admin/migrate-mysql migration wizard.

Further reading

• docs/TENANT-SELF-SERVICE-REQUIREMENTS.md — the original self-service planning doc; see its status banner for what shipped as-specified vs. what shipped a different way (the Tenant Portal above) vs. what's still genuinely open (a REST role-export endpoint).
• docs/BUG-DUPLICATE-GLOBAL-SETTINGS.md — resolved; kept as the record of why UpsertSetting does an explicit check-then-write instead of relying on ON CONFLICT.

© Narender Kumar