OKAPI-1081: Reject invalid tenant ids

[julianladisch]

https://folio-org.atlassian.net/browse/OKAPI-1081

Implement
https://folio-org.atlassian.net/wiki/display/TC/ADR-000002+-+Tenant+Id+and+Module+Name+Restrictions
so that creating a new tenant via POST /_/proxy/tenants API is rejected unless the tenant id matches
^[a-z][a-z0-9]{0,30}$

Legacy tenant ids still work when used in any other API.

[jakub-id]

@julianladisch while this avoids problems with existing tenant data. it is still a breaking change of the API. If we need to bump Okapi version to 6.0.0, I'd like us to release 5.3.0 first. Platform module release deadline for Quesnelia is March 1.

[hjiebsco]

https://folio-org.atlassian.net/wiki/spaces/DD/pages/1779867/Tenant+Id+and+Module+Name+Restrictions mentions Okapi and the modules should provide APIs and/or scripts to do the migration. Is that ready? Can we provide a configuration to allow user to continue use the old ^[a-z0-9_-]+$ validation to avoid this breaking change?

[julianladisch]

Legacy tenant IDs can still be used. The restriction only affects new tenant IDs created via the API. There's no need to migrate legacy tenant IDs.
Therefore this breaking change doesn't affect existing tenant IDs. The breaking change only affects tenant IDs that people will create after the upgrade.

[hjiebsco]

Legacy tenant IDs can still be used. The restriction only affects new tenant IDs created via the API. There's no need to migrate legacy tenant IDs. Therefore this breaking change doesn't affect existing tenant IDs. The breaking change only affects tenant IDs that people will create after the upgrade.

From users' perspective, for whatever reason, they might need or prefer to name new tenant id consistently with old tenants, or they might need to recreate old tenants with the same ids. It would be better to provide configuration to allow these.

[hjiebsco]

Legacy tenant IDs can still be used. The restriction only affects new tenant IDs created via the API. There's no need to migrate legacy tenant IDs. Therefore this breaking change doesn't affect existing tenant IDs. The breaking change only affects tenant IDs that people will create after the upgrade.

From users' perspective, for whatever reason, they might need or prefer to name new tenant id consistently with old tenants, or they might need to recreate old tenants with the same ids. It would be better to provide configuration to allow these.

FYI that was just a suggestion. No objection if you want to merge as is.

[julianladisch]

The FOLIO security team discussed whether there should be an option to allow creation of legacy tenant ids. However, the security team prefers not to have such an option for security reasons. There are workarounds for people who want to do create legacy tenant ids: They can directly write into the Okapi database, or they can install an old Okapi version.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud