Hello Apache OFBiz Developers, I would appreciate feedback from maintainers and contributors familiar with OFBiz multi-tenancy and the REST API implementation. I have submitted a draft pull request proposing request-scoped tenant-context resolution: https://github.com/apache/ofbiz-framework/pull/2606 The implementation introduces tenant-specific Delegator, LocalDispatcher, and Security resolution for REST API requests, together with tenant-bound JWT validation. The implementation has passed the standard Gradle checks under JDK 25 and includes 13 regression tests, including concurrent-request isolation tests. Following initial feedback from the security team, I would appreciate the community's guidance on these design questions:
1. Is request-scoped tenant resolution appropriate for the current framework REST API architecture? 2. Should the REST API support tenant selection through registered domain mappings, as proposed? 3. Could the planned OFBIZ-13812 improvement overlap with or supersede this approach? 4. Would it be preferable to adapt PR #2606 after that improvement is available? The PR is currently in draft status, and I am happy to revise the design based on the community's recommendations. My goal is to contribute the tenant-aware REST API functionality in a way that aligns with the long-term Apache OFBiz architecture. Thank you for your guidance. Kind regards, Sutherland Nele Technical Software Solutions Architect Cloudcode PNG Limited
