zeekay c32ffbab9d feat: per-org + per-user S3 storage isolation with SSE-C encryption ...

TenantStorage manages isolated S3 prefixes on Hanzo S3 (s3.hanzo.space):

  tenants/{orgSlug}/org/                   ← org-level shared storage
  tenants/{orgSlug}/users/{userId}/        ← per-user isolated storage

Each level gets a unique SSE-C encryption key:
  org key  = HMAC-SHA256(master, "s3:org:" + orgSlug)
  user key = HMAC-SHA256(master, "s3:user:" + orgSlug + ":" + userId)

IAM bucket policies enforce path isolation:
  - Org admins: access tenants/{orgSlug}/*
  - Users: access only tenants/{orgSlug}/users/{userId}/*
  - Zero cross-org or cross-user access

PlatformConfig additions:
  TenantStorageEndpoint — S3 endpoint (s3.hanzo.space)
  TenantStorageBucket — root bucket name

2026-03-02 13:03:58 -07:00

..

cloudsql

fix(cloudsql): avoid route conflict with static catch-all handler

2026-03-01 18:57:51 -08:00

functions

feat(base): add OpenFaaS functions plugin

2026-03-01 18:38:16 -08:00

ghupdate

Merge remote-tracking branch 'upstream/master'

2026-02-22 01:17:16 -08:00

jsvm

chore: strip all PocketBase cruft from codebase

2026-03-01 20:44:11 -07:00

migratecmd

Rebrand PocketBase imports to Hanzo Base across all Go files

2026-02-27 09:43:39 -08:00

platform

feat: per-org + per-user S3 storage isolation with SSE-C encryption

2026-03-02 13:03:58 -07:00

scheduler

Add realtime DX platform: CRDT engine, WebSocket, SDKs, typegen, scheduler, multi-tenant

2026-02-27 10:00:24 -08:00

tasks

security: fix critical and high findings from red team review

2026-03-02 01:02:45 -07:00

zap

fix: add luxfi/zap dependency, fix Send() signature for Docker build

2026-03-02 15:06:24 -07:00