Implement MongoDB-based storage for Pack Run approval, artifact, log, and state management

- Added MongoPackRunApprovalStore for managing approval states with MongoDB.
- Introduced MongoPackRunArtifactUploader for uploading and storing artifacts.
- Created MongoPackRunLogStore to handle logging of pack run events.
- Developed MongoPackRunStateStore for persisting and retrieving pack run states.
- Implemented unit tests for MongoDB stores to ensure correct functionality.
- Added MongoTaskRunnerTestContext for setting up MongoDB test environment.
- Enhanced PackRunStateFactory to correctly initialize state with gate reasons.

src/Concelier/StellaOps.Concelier.WebService/Program.cs

@@ -235,6 +235,12 @@ var resolvedConcelierOptions = app.Services.GetRequiredService<IOptions<Concelie
 var resolvedAuthority = resolvedConcelierOptions.Authority ?? new ConcelierOptions.AuthorityOptions();
 authorityConfigured = resolvedAuthority.Enabled;
 var enforceAuthority = resolvedAuthority.Enabled && !resolvedAuthority.AllowAnonymousFallback;
+var requiredTenants = (resolvedAuthority.RequiredTenants ?? Array.Empty<string>())
+    .Select(static tenant => tenant?.Trim().ToLowerInvariant())
+    .Where(static tenant => !string.IsNullOrWhiteSpace(tenant))
+    .Distinct(StringComparer.Ordinal)
+    .ToImmutableHashSet(StringComparer.Ordinal);
+var enforceTenantAllowlist = !requiredTenants.IsEmpty;
 
 if (resolvedAuthority.Enabled && resolvedAuthority.AllowAnonymousFallback)
 {
@@ -358,11 +364,14 @@ var advisoryIngestEndpoint = app.MapPost("/ingest/advisory", async (
     AdvisoryIngestRequest request,
     [FromServices] IAdvisoryRawService rawService,
     [FromServices] TimeProvider timeProvider,
+    [FromServices] ILogger<Program> logger,
     CancellationToken cancellationToken) =>
 {
     ApplyNoCache(context.Response);
 
-    if (request is null || request.Source is null || request.Upstream is null || request.Content is null || request.Identifiers is null)
+    var ingestRequest = request;
+
+    if (ingestRequest is null || ingestRequest.Source is null || ingestRequest.Upstream is null || ingestRequest.Content is null || ingestRequest.Identifiers is null)
     {
         return Problem(context, "Invalid request", StatusCodes.Status400BadRequest, ProblemTypes.Validation, "source, upstream, content, and identifiers sections are required.");
     }
@@ -381,7 +390,14 @@ var advisoryIngestEndpoint = app.MapPost("/ingest/advisory", async (
     AdvisoryRawDocument document;
     try
     {
-        document = AdvisoryRawRequestMapper.Map(request, tenant, timeProvider);
+        logger.LogWarning(
+            "Binding advisory ingest request hash={Hash}",
+            ingestRequest.Upstream.ContentHash ?? "(null)");
+
+        document = AdvisoryRawRequestMapper.Map(ingestRequest, tenant, timeProvider);
+        logger.LogWarning(
+            "Mapped advisory_raw document hash={Hash}",
+            string.IsNullOrWhiteSpace(document.Upstream.ContentHash) ? "(empty)" : document.Upstream.ContentHash);
     }
     catch (Exception ex) when (ex is ArgumentException or InvalidOperationException)
     {
@@ -418,6 +434,15 @@ var advisoryIngestEndpoint = app.MapPost("/ingest/advisory", async (
     }
     catch (ConcelierAocGuardException guardException)
     {
+        logger.LogWarning(
+            guardException,
+            "AOC guard rejected advisory ingest tenant={Tenant} upstream={UpstreamId} requestHash={RequestHash} documentHash={DocumentHash} codes={Codes}",
+            tenant,
+            document.Upstream.UpstreamId,
+            request!.Upstream?.ContentHash ?? "(null)",
+            string.IsNullOrWhiteSpace(document.Upstream.ContentHash) ? "(empty)" : document.Upstream.ContentHash,
+            string.Join(',', guardException.Violations.Select(static violation => violation.ErrorCode)));
+
         IngestionMetrics.ViolationCounter.Add(1, new[]
         {
             new KeyValuePair<string, object?>("tenant", tenant),
@@ -945,6 +970,11 @@ IResult? EnsureTenantAuthorized(HttpContext context, string tenant)
         return null;
     }
 
+    if (enforceTenantAllowlist && !requiredTenants.Contains(tenant))
+    {
+        return Results.Forbid();
+    }
+
     var principal = context.User;
 
     if (enforceAuthority && (principal?.Identity?.IsAuthenticated != true))
@@ -965,6 +995,11 @@ IResult? EnsureTenantAuthorized(HttpContext context, string tenant)
         {
             return Results.Forbid();
         }
+
+        if (enforceTenantAllowlist && !requiredTenants.Contains(normalizedClaim))
+        {
+            return Results.Forbid();
+        }
     }
 
     return null;