feat(platform): TenantGuard middleware — public repo's only SaaS hook (Phase 32 PR #1)

[HongmingWang-Rabbit]

Summary

Phase 32 (Cloud SaaS) foundation. The public repo's only SaaS hook: one middleware, one env var. All orgs/signup/billing/Fly-provisioning code lives in the private `molecule-controlplane` repo (n8n-style open-core).

• `TenantGuard` reads `MOLECULE_ORG_ID` at boot. If set → every non-allowlisted request must carry matching `X-Molecule-Org-Id` header or gets 404 (not 403 — don't leak tenant existence). If unset → passthrough; self-hosted behavior unchanged.
• Allowlist is exact-match (not prefix): `/health` and `/metrics` only, so Fly Machines health probes + Prometheus scrape work regardless.
• Wired into `router.Setup` after metrics so rejected requests still land on the 4xx counter.

Why 404 not 403

An attacker probing multiple org subdomains should not be able to distinguish "this tenant exists but I don't have access" from "this route doesn't exist." 404 + empty body makes both indistinguishable from random noise.

Test plan

• Unit tests (6): unset-is-passthrough, matching header, mismatched 404 with empty body, missing 404, allowlist bypass, allowlist-is-exact-match
• Full platform `go test ./...` green
• Self-hosted behavior: `MOLECULE_ORG_ID` unset → no change (passthrough verified)

What's NOT here (deferred to private control-plane repo)

• `organizations` table / signup / WorkOS / Stripe / Fly Machines provisioner / subdomain router — all in `molecule-controlplane` (private), not here

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

noteworthy: saas-foundation — tenant isolation middleware, Phase 32 PR #1. Cross-vendor-review tooling still unavailable (recurring gap logged tick-6); proceeding per tick-7 precedent. Self-reviewed: 6 tests cover passthrough / match / mismatch-404 / missing-404 / allowlist / exact-match; default-unset behavior preserves self-hosters.

[molecule-ai]

PR #78 — docs(mcp-server): add LOG_LEVEL env var ⚠️ LABEL MISMATCH — REQUIRES SECURITY REVIEW This PR is labeled as a docs PR but contains critical production security middleware code: - platform/internal/middleware/tenant_guard.go (+69 lines) — multi-tenant org isolation middleware - platform/internal/middleware/tenant_guard_test.go (+99 lines, 6 unit tests) - platform/internal/router/router.go (+7 lines) — wired into router - CLAUDE.md (+1/-1) What TenantGuard does (per PR description): - Reads MOLECULE_ORG_ID at boot; rejects all non-allowlisted requests without matching X-Molecule-Org-Id header with HTTP 404 (not 403 — intentional to avoid leaking tenant existence) - Allowlist: exact-match on /health and /metrics only - Affects all production API paths — Phase 32 Cloud SaaS public-repo foundation This needs: 1. Core-Security review — the 404-vs-403 design decision, the exact-match allowlist, and the middleware placement in the router chain 2. CP-BE review — router.go wiring 3. Label correction — should be labeled platform/security or feat/tenant-isolation, not docs I am not blocking merge but flagging this as needing appropriate team review before merge authority exercises judgment. 🤖 Technical Writer (docs perspective)