LakeWright.Databricks 2.1.0

LakeWright.NET

The build kit for multi-tenant .NET SaaS on Databricks.

An opinionated reference architecture and a small set of reusable components for teams that sell analytics to customers who are not themselves Databricks customers.

Project site: https://github.com/ivanvyd/LakeWright.NET — the argument in one page, with the same three identities you can run locally.

Status: early, but you can run it. Implemented and tested: the tenant model, the tenant-scoped Databricks query layer, the asynchronous operation worker with crash reconciliation and resumed polling, the ASP.NET Core tier (tenant middleware, role policies, the operations API with client idempotency), the audit trail, the Declarative Automation Bundle, telemetry instruments, and the Signalboard sample — two organizations, three people, a Blazor dashboard and the same API from a terminal. Opt-in OpenTelemetry export wiring and an Azure reference deployment template are included. Currency billing integration is implemented locally; its live system-table read and the first reference deployment remain unverified. Currency budgets remain open. The milestones are in ROADMAP.md, and docs/compatibility.md records exactly what has been verified against a live workspace and what has not.

Run it

Docker, and nothing else. No .NET SDK, no Databricks account, nothing to configure.

git clone https://github.com/ivanvyd/LakeWright.NET
cd LakeWright.NET/samples/Signalboard
docker compose up

Open http://localhost:8080. The landing page seeds two organizations and three people and hands you the curl commands. Sign in as someone from the other organization and the same address answers 404 rather than 403, because a 403 would confirm the work exists.

That is the isolation model in about a minute, and it runs without a workspace because tenancy and authorization never talk to Databricks. Getting started goes on to the tests, the DI wiring, and a live workspace.

What problem this solves

Unity Catalog row filters resolve the caller with session_user(). When an ASP.NET Core backend connects with one service principal for every tenant, that function returns the same value on every request, so the filter predicate is identical for all of them. The result is a system that either shows every tenant nothing or shows every tenant everything.

Databricks documents the trade-off directly, for Databricks Apps:

All actions initiated by the app use the service principal's permissions... it doesn't support user-level access control. All users who interact with the app share the same permissions defined for the service principal, which prevents the app from enforcing fine-grained policies based on individual user identity.

App identity means you filter. User identity means Unity Catalog filters. There is no third option, and there is no general on-behalf-of flow for a service hosted outside Databricks.

You find this in an audit rather than in testing, because every tenant's request returns a plausible-looking result. LakeWright.NET handles it in the query layer, along with the pieces such a product needs anyway: durable asynchronous operations, a per-tenant ceiling on Databricks compute, an audit trail, and the Databricks side deployed as code.

What this is not

• Not a Databricks SDK. Microsoft.Azure.Databricks.Client already covers Unity Catalog, Statement Execution and Jobs under MIT. This project depends on it.
• Not a dashboard embedding library. Databricks AI/BI external embedding ships today, with row-level security and no per-viewer fee. Use it. LakeWright.Embedding brokers the token that flow needs and stops there — the tenant is signed into it rather than chosen by the caller. Rendering remains @databricks/aibi-client's job.
• Not a generic ASP.NET Core SaaS starter. If you are not on Databricks, nothing here is for you.
• Not an admin portal, a workspace provisioner, or a notebook tutorial.

Why the application runs outside Databricks

Databricks Apps documentation states: "You can't make Databricks apps public. Anonymous access and bypassing single sign-on (SSO) are not supported." Every end user must exist as an identity in your Databricks account, there are no custom domains, and the runtime ships Python and Node with no .NET.

Databricks Apps is the right host for internal tooling. It cannot host a customer-facing product. ADR 0001 records the evidence and settles it.

Planned repository layout

Projects appear when there is code to put in them, so this grows over the milestones in ROADMAP.md. What exists today:

src/
  LakeWright.Core/            tenancy and job contracts
  LakeWright.Databricks/      tenant-scoped Databricks SQL and job access
  LakeWright.Multitenancy/    tenant model, resolution, operations, audit, EF Core
  LakeWright.AspNetCore/      tenant middleware, role policies, operations API
  LakeWright.AI/              Databricks model serving as an IChatClient, optional
  LakeWright.Embedding/       scoped tokens for AI/BI dashboards, optional
  LakeWright.Conversations/   tenant-scoped Genie, optional
  LakeWright.Caching.Redis/   Redis-backed Genie conversation ownership, optional
samples/
  Signalboard/                two-tenant sample product, Blazor dashboard plus the API
tests/
  LakeWright.TenantIsolation.Tests/   the suite the rest of it rests on
databricks/                   Declarative Automation Bundle, dev and prod targets
docs/                         see docs/README.md

LakeWright.Multitenancy does not reference LakeWright.Databricks, so adopting the tenancy tier alone does not drag in the Databricks client. A test enforces that rather than a convention.

The sample includes opt-in OpenTelemetry export wiring. Currency attribution has a billing-reader implementation, and Azure deployment has Bicep templates and a workflow. Their live verification boundaries are recorded in the compatibility matrix.

Current stable release: v2.0.0. The source tree may contain changes for a later candidate; published packages retain the behavior documented in their release evidence.

Documentation

docs/README.md is the index. The ones most people want:

Support boundary

This is a community project maintained in personal time. It is provided for your exploration only, it carries no service-level agreement, and it is provided as-is without warranties or guarantees of any kind. Do not open Databricks support tickets about it.

docs/compatibility.md records which Databricks features have been verified against a live workspace and which have not. Anything not listed as verified should be treated as unverified.

Trademarks

Databricks is a trademark of Databricks, Inc. This project is not affiliated with, endorsed by, or sponsored by Databricks, Inc.

.NET is a trademark of Microsoft Corporation. This project is not affiliated with, endorsed by, or sponsored by Microsoft Corporation.

License

Apache-2.0.