feat: extend tenant storage with tenant.yaml file (#45)

* feat: extend tenant storage with tenant.yaml file

Add a top-level tenant.yaml to tenant storage, mirroring server.yaml in
server storage. On write, the tenant-level fields (name, url, jwks,
metadata, settings, styling) are serialized via the system Tenant model,
which strips the collections persisted as separate files (pools, schemas,
mfa_methods, themes, servers).

The file is optional on read: a missing tenant.yaml yields an empty base
map without error, preserving backwards compatibility with existing
on-disk configs.

Also bumps acp-client-go and aligns the otp_settings pool test with the
updated model.

* test: cover tenant settings message redaction in tenant.yaml round-trip

Extend the tenant-level configuration test case with settings.message_redaction
(address/content) to verify the redaction policy serializes to tenant.yaml and
round-trips back through read.

Author: piotrek-janus

go.mod

@@ -4,7 +4,7 @@ go 1.24.0
 
 require (
 	github.com/Masterminds/sprig/v3 v3.2.3
-	github.com/cloudentity/acp-client-go v0.0.0-20260410101459-b244b5048247
+	github.com/cloudentity/acp-client-go v0.0.0-20260527095100-008ff5049411
 	github.com/corvus-ch/zbase32 v1.0.0
 	github.com/go-json-experiment/json v0.0.0-20240524174822-2d9f40f7385b
 	github.com/go-openapi/strfmt v0.24.0

go.sum

@@ -7,8 +7,8 @@ github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/cloudentity/acp-client-go v0.0.0-20260410101459-b244b5048247 h1:TjlzXba4WIAE4INjq+bhKhl8yhS4iXGwB7leztdAKIA=
-github.com/cloudentity/acp-client-go v0.0.0-20260410101459-b244b5048247/go.mod h1:vfVPwSn1JfwCOheMlqGmF1NPGio88S8jdiXOzQYjCeY=
+github.com/cloudentity/acp-client-go v0.0.0-20260527095100-008ff5049411 h1:oty7npFWtmLAegF5gYXQAAsY2DOZ7WxcCZVVqBSeIwE=
+github.com/cloudentity/acp-client-go v0.0.0-20260527095100-008ff5049411/go.mod h1:Hr2WHHXmp+DC4B2oprhgP47yl/dsCAyj9HcG6P3z4m0=
 github.com/corvus-ch/zbase32 v1.0.0 h1:pDV0qZ1g+HYA8P0PbULsgUg/tZue1FIjsZ7r7h4nZeU=
 github.com/corvus-ch/zbase32 v1.0.0/go.mod h1:A7KLRecF1tysURyoqiJBvMJFmt/ccqkRdDTLjlQeVsU=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=

internal/cac/storage/tenant_storage.go

@@ -2,7 +2,9 @@ package storage
 
 import (
     "context"
+    "encoding/json"
     "github.com/cloudentity/acp-client-go/clients/hub/models"
+    smodels "github.com/cloudentity/acp-client-go/clients/system/models"
     "github.com/cloudentity/cac/internal/cac/api"
     "github.com/cloudentity/cac/internal/cac/utils"
     "path/filepath"
@@ -31,6 +33,10 @@ func (t *TenantStorage) Write(ctx context.Context, data models.Rfc7396PatchOpera
         return err
     }
 
+    if err = t.storeTenant(path, model); err != nil {
+        return err
+    }
+
     if err = writeFiles(model.Pools,
         filepath.Join(path, "pools"),
         func(id string, it models.TreePool) string { return it.Name }); err != nil {
@@ -194,6 +200,25 @@ func (t *TenantStorage) Read(ctx context.Context, opts ...api.SourceOpt) (models
 
 var _ Storage = &TenantStorage{}
 
+func (t *TenantStorage) storeTenant(path string, data *models.TreeTenant) error {
+    var (
+        tenant smodels.Tenant
+        bts    []byte
+        err    error
+    )
+
+    // serialize the tenant data into system/models to remove the dependencies which are stored in separate files
+    if bts, err = json.Marshal(data); err != nil {
+        return err
+    }
+
+    if err = json.Unmarshal(bts, &tenant); err != nil {
+        return err
+    }
+
+    return writeFile(tenant, filepath.Join(path, "tenant"))
+}
+
 func storeTemplates(templates models.TreeTemplates, path string) error {
     for id, template := range templates {
         var (

internal/cac/storage/tenant_storage_test.go

@@ -168,6 +168,7 @@ identifier_case_insensitive: false
 mfa_session_ttl: 0s
 name: Idp-datamigration-pool
 otp_settings:
+  require_user_confirmation_before_send: false
   verify_address:
     length: 6
     ttl: 5m0s
@@ -180,6 +181,45 @@ webauthn_settings:
     - https://www.sit2.example.com`, string(bts))
             },
         },
+        {
+            desc: "tenant level configuration",
+            data: &models.TreeTenant{
+                Name: "Default",
+                URL:  "https://example.com/default",
+                Metadata: models.TenantMetadata{
+                    "owner": "platform-team",
+                },
+                Settings: &models.TenantSettings{
+                    MessageRedaction: &models.RedactionPolicy{
+                        Address: "obfuscate",
+                        Content: "retain",
+                    },
+                },
+                MfaMethods: models.TreeMFAMethods{
+                    "sms": models.TreeMFAMethod{
+                        Enabled:   true,
+                        Mechanism: "sms",
+                    },
+                },
+            },
+            files: []string{
+                "tenant.yaml",
+                "mfa_methods/sms.yaml",
+            },
+            assert: func(t *testing.T, path string, bts []byte) {
+                switch path {
+                case "tenant.yaml":
+                    require.YAMLEq(t, `name: Default
+url: https://example.com/default
+metadata:
+  owner: platform-team
+settings:
+  message_redaction:
+    address: obfuscate
+    content: retain`, string(bts))
+                }
+            },
+        },
         {
             desc: "themes and templates",
             data: &models.TreeTenant{