Examples

Multi-tenant SaaS

Row-level isolation, a per-request tenant scope, and a unique constraint that makes cross-tenant writes impossible rather than merely discouraged.

Isolation at the schema

Tenant identity belongs in the row, not in a session variable. Every table carries tenantId, and every query filters on it. The composite primary key is what makes a mistake a constraint violation instead of a data leak.

yatta/func/db.tsts

1import { col, createDatabase } from "yatta/db";2 3export const schema = {4  tenants: {5    id: col.uuid(),6    slug: col.text().unique(),7    name: col.text(),8    plan: col.text().default("free"),9    createdAt: col.createdAt(),10  },11 12  members: {13    id: col.uuid(),14    tenantId: col.text().references("tenants.id", { onDelete: "CASCADE" }),15    userId: col.text().references("users.id", { onDelete: "CASCADE" }),16    role: col.text().default("member"),17    createdAt: col.createdAt(),18  },19 20  projects: {21    // Scoped id: two tenants can both own project "p1" without colliding.22    id: col.text(),23    tenantId: col.text().references("tenants.id", { onDelete: "CASCADE" }),24    name: col.text(),25    createdAt: col.createdAt(),26  },27};28 29export const db = createDatabase({30  url: process.env.DATABASE_URL,31  schema,32});

The request scope

Resolve the tenant once, from the host or a subdomain, and carry it on ctx.state. Handlers read it from there rather than re-parsing the host on every query.

yatta/func/tenant.tsts

1import type { PublicUser } from "yatta/auth";2import { and } from "yatta/db";3import { db } from "./db";4import { auth } from "./auth";5 6export interface TenantContext {7  tenant: { id: string; slug: string; plan: string } | null;8  user: PublicUser | null;9  role: string | null;10}11 12/**13 * Resolve host -> tenant -> membership.14 *15 * Order matters: the membership check is scoped to the tenant resolved from16 * the host, never to a tenant id supplied by the caller.17 */18export async function resolveTenant(host: string, req: Request): Promise<TenantContext> {19  const slug = host.split(":")[0] ?? "";20  if (!slug || slug === "localhost" || slug === "127.0.0.1") {21    return { tenant: null, user: null, role: null };22  }23 24  const tenant = await db.tenants.where((f) => f.slug.isEqualTo(slug)).first();25  if (!tenant) throw new HttpError(404, "Unknown workspace");26 27  const found = await auth.getSession(req);28  if (!found) return { tenant, user: null, role: null };29 30  const membership = await db.members31    .where((f) => and(32      f.tenantId.isEqualTo(tenant.id),33      f.userId.isEqualTo(found.user.id),34    ))35    .first();36 37  return {38    tenant,39    user: found.user,40    role: membership?.role ?? null,41  };42}

A scoped table

A thin wrapper removes the chance of forgetting the filter. It is the single highest-leverage line in a multi-tenant codebase.

yatta/func/scoped.tsts

1import { and } from "yatta/db";2import { db } from "./db";3 4/**5 * Bind every query to one tenant.6 *7 * Returns null when there is no tenant, so a missing scope fails loudly8 * instead of silently querying the whole table.9 */10export function scoped(tenantId: string | null) {11  if (!tenantId) throw new HttpError(400, "No tenant in scope");12 13  return {14    projects: {15      list: () =>16        db.projects.where((f) => f.tenantId.isEqualTo(tenantId)).all(),17 18      find: (id: string) =>19        db.projects20          .where((f) => and(21            f.id.isEqualTo(id),22            f.tenantId.isEqualTo(tenantId),23          ))24          .first(),25 26      create: (data: Record<string, unknown>) =>27        db.projects.insert({ ...data, tenantId }),28 29      remove: (id: string) =>30        db.projects31          .where((f) => and(32            f.id.isEqualTo(id),33            f.tenantId.isEqualTo(tenantId),34          ))35          .delete(),36    },37  };38}

Wiring it up

yatta/backend/projects.tsts

1import { createAPI, HttpError } from "yatta/api";2import { withSession } from "../func/middleware";3import { resolveTenant } from "../func/tenant";4import { scoped } from "../func/scoped";5import { observer } from "../func/observe";6 7const projects = createAPI("/projects");8 9projects.use(withSession);10 11// Runs first, for every route in this file.12projects.use(async (ctx, next) => {13  ctx.state.tenant = await resolveTenant(ctx.url.host, ctx.req);14 15  // The tenant is a resource attribute, so every span and issue is filterable16  // by workspace without extra plumbing.17  observer.tracer.active?.setAttribute("tenant.id", ctx.state.tenant?.tenant?.id ?? "none");18 19  return next();20});21 22projects.get("/", async (ctx) => {23  return Response.json(scoped(ctx.state.tenant.tenant?.id).projects.list());24});25 26projects.post("/", async (ctx) => {27  const tenantId = ctx.state.tenant.tenant?.id;28  if (!tenantId) throw new HttpError(400, "No tenant in scope");29 30  if (ctx.state.tenant.role !== "owner" && ctx.state.tenant.role !== "admin") {31    throw new HttpError(403, "Only admins can create projects");32  }33 34  const body = await ctx.json();35  const project = await scoped(tenantId).projects.create(body);36 37  return Response.json(project, { status: 201 });38});39 40export default projects;

Warning

Never accept a tenantId from the request body. Take it from the resolved scope or not at all — the moment a handler reads it from user input, the isolation guarantee is gone.