feat: MasterTableTenancy implements IDynamicTenantSource<string> (#377)

[jeremydmiller]

Closes #377. Marks the NuGet packages as 5.8.0.

What

MasterTableTenancy already had the full dynamic-tenancy behavior (shipped in #165) but did not declare JasperFx.MultiTenancy.IDynamicTenantSource<string> — the abstraction store-agnostic admin tooling resolves through. Polecat-backed services therefore showed their tenants read-only in CritterWatch: no runtime add / disable / enable / remove.

Modeled directly on Marten's MasterTableTenancy: ITenancy, ITenancyWithMasterDatabase, IDynamicTenantSource<string> and MartenServiceCollectionExtensions.

MasterTableTenancy

• Now : ITenancy, IDynamicTenantSource<string>, reporting Cardinality == DatabaseCardinality.DynamicMultiple. Cardinality became a public member so it satisfies both ITenancy and ITenantedSource<string>.

• The interface members are explicit implementations adapting to the existing cancellable Polecat-native methods. Those carry an optional CancellationToken and therefore cannot implement the token-less interface signatures implicitly; explicit implementation also keeps the concrete API unambiguous for existing callers.

  IDynamicTenantSource<string>	Polecat-native method
  AddTenantAsync(tenantId, connectionValue)	AddDatabaseRecordAsync
  RemoveTenantAsync(tenantId)	DeleteDatabaseRecordAsync
  DisableTenantAsync(tenantId)	DisableTenantAsync(tenantId, token)
  EnableTenantAsync(tenantId)	EnableTenantAsync(tenantId, token)
  AllDisabledAsync()	AllDisabledAsync(token)

• FindAsync throws UnknownTenantIdException for an unknown or disabled tenant — same as opening a session for it.

• RefreshAsync clears the cache and re-reads the master table.

• AllActive() returns the tenant database identifiers, not raw connection strings, so credentials never reach an admin dashboard. This is the same choice Marten makes (it returns MartenDatabase.Identifier). AllActiveByTenant() returns Assignment<string>(tenantId, tenantId), matching Marten.

• The jasperfx#413 auto-assign overload Task<string> AddTenantAsync(string, CancellationToken) is deliberately left on its default interface implementation, which throws NotSupportedException. Database-per-tenant has no pool for Polecat to assign from, and CritterWatch skips sources that throw.

DI registration

AddPolecat registers the tenancy as IDynamicTenantSource<string> — but only when the configured tenancy is a dynamic source. Non-dynamic stores must keep GetServices empty; that emptiness is the signal consumers use to fall back to a read-only tenant list.

To make that probe possible while the container is still being assembled, AddPolecat(Action<StoreOptions>) now builds the StoreOptions eagerly and delegates to AddPolecat(StoreOptions) — exactly what Marten's AddMarten(Action<StoreOptions>) does. This is the one behavior change in the PR: the configure lambda now runs at registration time rather than on first IDocumentStore resolution. The lambda takes no IServiceProvider, so nothing it can legally reach has changed; the IConfigurePolecat chain and ReadJasperFxOptions still run later, at store construction, unchanged.

AddPolecat(Func<IServiceProvider, StoreOptions>) cannot probe (the options do not exist until the container is built) and is documented as such, with the one-liner for registering it manually.

Tests

• src/Polecat.Tests/MultiTenancy/dynamic_tenant_source_tests.cs — 7 tests driving the tenancy only through the IDynamicTenantSource<string> reference against real SQL Server databases: cardinality, add→find, unknown-tenant throw, disable/enable round-trip, remove, refresh/active-set, and the NotSupportedException on auto-assign.
• src/Polecat.Tests/DependencyInjection/dynamic_tenant_source_registration_tests.cs — 4 tests: registered (and same instance as Options.Tenancy) for master-table tenancy via both the lambda and pre-built-options overloads; empty for single-database and static MultiTenantedDatabases() stores.

Docs

New ### Store-Agnostic Runtime Tenant Management section in docs/configuration/multitenancy.md (badged 5.8), based on Marten's master-table docs: the full lifecycle through the abstraction, the DI registration, why the registration is conditional, and both caveats (auto-assign NotSupportedException; the SP-factory overload). Also notes that hard-deleting the physical database is out of scope — SQL Server needs ALTER DATABASE ... SET SINGLE_USER WITH ROLLBACK IMMEDIATE before DROP DATABASE, and that is the consumer's job (tracked on the CritterWatch side).

🤖 Generated with Claude Code