SaaS Substrate

5/**6 * Returns a SQL predicate scoping a query to the current tenant.7 *8 * Every `.where(...)` clause on a tenant-bearing table MUST include this9 * helper (or be wrapped in `withMasterScope` — see below). This is the10 * load-bearing tenant-isolation seam per ADR 0002.11 *12 * Visibility is the point: code review scans for `tenantScope(` at every13 * repository call site. If you don't see it, the query is cross-tenant.14 *15 * @example16 *   db.select().from(users).where(and(tenantScope(ctx, users.tenantId), ...))17 */18export function tenantScope(ctx: TenantContextService, tenantIdColumn: AnyPgColumn): SQL {19  return eq(tenantIdColumn, ctx.tenantId);20}2122/**23 * Audited escape hatch for master-tier reads/writes that legitimately span24 * tenants (operator analytics, support tools, tenant directory listing).25 *26 * The `reason` is captured for the future audit log. Today it's enforced27 * to be non-trivial (≥10 chars); when the audit module is rebuilt on28 * Drizzle, this hook will emit a structured audit event.29 *30 * Never call from tenant-tier code paths. A controller bug here would31 * leak rows — keep this helper out of any module reachable from a32 * tenant-tier route.33 */34export function withMasterScope<T>(reason: string, fn: () => T): T {35  if (typeof reason !== 'string' || reason.trim().length < 10) {36    throw new Error(37      `withMasterScope requires a non-trivial audit reason (>=10 chars). Got: ${JSON.stringify(reason)}.`,38    );39  }40  return fn();41}

saas-substrate41a32abapps/api/src/shared/persistence/application/tenant-scope.tsLines 5 to 4137 lines

/**
 * Returns a SQL predicate scoping a query to the current tenant.
 *
 * Every `.where(...)` clause on a tenant-bearing table MUST include this
 * helper (or be wrapped in `withMasterScope` — see below). This is the
 * load-bearing tenant-isolation seam per ADR 0002.
 *
 * Visibility is the point: code review scans for `tenantScope(` at every
 * repository call site. If you don't see it, the query is cross-tenant.
 *
 * @example
 *   db.select().from(users).where(and(tenantScope(ctx, users.tenantId), ...))
 */
export function tenantScope(ctx: TenantContextService, tenantIdColumn: AnyPgColumn): SQL {
  return eq(tenantIdColumn, ctx.tenantId);
}

/**
 * Audited escape hatch for master-tier reads/writes that legitimately span
 * tenants (operator analytics, support tools, tenant directory listing).
 *
 * The `reason` is captured for the future audit log. Today it's enforced
 * to be non-trivial (≥10 chars); when the audit module is rebuilt on
 * Drizzle, this hook will emit a structured audit event.
 *
 * Never call from tenant-tier code paths. A controller bug here would
 * leak rows — keep this helper out of any module reachable from a
 * tenant-tier route.
 */
export function withMasterScope<T>(reason: string, fn: () => T): T {
  if (typeof reason !== 'string' || reason.trim().length < 10) {
    throw new Error(
      `withMasterScope requires a non-trivial audit reason (>=10 chars). Got: ${JSON.stringify(reason)}.`,
    );
  }
  return fn();
}