Multi-Tenancy-Isolation

app.get('/api/projects', requireAuth, async (req, res) => {
  const projects = await db.projects.find({
    tenantId: req.user.tenantId,  // manuell überall
  });
  res.json(projects);
});

app.get('/api/projects/:id', requireAuth, async (req, res) => {
  const project = await db.projects.findOne({
    id: req.params.id,
    tenantId: req.user.tenantId,  // wieder manuell
  });
  // ...
});

// Repository-Wrapper, der tenantId automatisch hinzufügt
class TenantScopedRepo {
  constructor(model, tenantId) {
    this.model = model;
    this.tenantId = tenantId;
  }

  find(query = {}) {
    return this.model.find({ ...query, tenantId: this.tenantId });
  }

  findOne(query = {}) {
    return this.model.findOne({ ...query, tenantId: this.tenantId });
  }

  create(data) {
    return this.model.create({ ...data, tenantId: this.tenantId });
  }

  update(query, data) {
    return this.model.update(
      { ...query, tenantId: this.tenantId },
      data
    );
  }

  delete(query) {
    return this.model.delete({ ...query, tenantId: this.tenantId });
  }
}

// Middleware: setzt req.db auf tenant-scoped
app.use((req, res, next) => {
  if (!req.user) return next();
  req.db = {
    projects: new TenantScopedRepo(db.projects, req.user.tenantId),
    tasks: new TenantScopedRepo(db.tasks, req.user.tenantId),
    // ...
  };
  next();
});

// Endpoint kann nicht „vergessen", den Filter zu setzen
app.get('/api/projects/:id', async (req, res) => {
  const project = await req.db.projects.findOne({ id: req.params.id });
  if (!project) return res.status(404).end();
  res.json(project);
});

-- Tabelle mit tenant_id
CREATE TABLE projects (
  id UUID PRIMARY KEY,
  tenant_id UUID NOT NULL,
  name TEXT,
  -- ...
);

-- RLS aktivieren
ALTER TABLE projects ENABLE ROW LEVEL SECURITY;

-- Policy: Zeile nur sichtbar, wenn tenant_id zum Session-Setting passt
CREATE POLICY tenant_isolation ON projects
  USING (tenant_id = current_setting('app.current_tenant')::uuid);

-- Force RLS auch für Tabellen-Owner (sonst umgeht der Admin-User RLS)
ALTER TABLE projects FORCE ROW LEVEL SECURITY;

async function withTenant(tenantId, callback) {
  const client = await pool.connect();
  try {
    await client.query(`SET app.current_tenant = '${tenantId}'`);
    return await callback(client);
  } finally {
    await client.query('RESET app.current_tenant');
    client.release();
  }
}

// Endpoint
app.get('/api/projects', requireAuth, async (req, res) => {
  const projects = await withTenant(req.user.tenantId, client =>
    client.query('SELECT * FROM projects')
  );
  // Postgres filtert automatisch — kein WHERE nötig
  res.json(projects.rows);
});

-- Pro Neuer Tenant
CREATE SCHEMA tenant_acme;
CREATE TABLE tenant_acme.projects (...);
CREATE TABLE tenant_acme.tasks (...);

async function withTenantSchema(tenantSlug, callback) {
  const client = await pool.connect();
  try {
    await client.query(`SET search_path = tenant_${tenantSlug}, public`);
    return await callback(client);
  } finally {
    await client.query('RESET search_path');
    client.release();
  }
}

// Subdomain → Tenant
function getTenantFromHostname(hostname) {
  const match = hostname.match(/^([a-z0-9-]+)\.app\.example\.com$/);
  return match ? match[1] : null;
}

// Middleware
app.use(async (req, res, next) => {
  const urlTenant = getTenantFromHostname(req.hostname);
  const sessionTenant = req.user?.tenantSlug;

  // Beide müssen übereinstimmen
  if (urlTenant && sessionTenant && urlTenant !== sessionTenant) {
    return res.status(403).send('Tenant mismatch');
  }

  req.tenantId = sessionTenant;
  next();
});

// Schadhaft
async function getProject(id) {
  const cached = await redis.get(`project:${id}`);
  if (cached) return JSON.parse(cached);

  const project = await db.projects.findOne({ id });
  await redis.set(`project:${id}`, JSON.stringify(project), { EX: 60 });
  return project;
}

async function getProject(tenantId, id) {
  const key = `tenant:${tenantId}:project:${id}`;
  const cached = await redis.get(key);
  if (cached) return JSON.parse(cached);

  const project = await db.projects.findOne({ tenantId, id });
  await redis.set(key, JSON.stringify(project), { EX: 60 });
  return project;
}

describe('Cross-Tenant Isolation', () => {
  let tenantA, tenantB, userA, userB, projectA;

  beforeEach(async () => {
    tenantA = await createTenant('acme');
    tenantB = await createTenant('globex');
    userA = await createUser(tenantA);
    userB = await createUser(tenantB);
    projectA = await createProject(tenantA, { name: 'A Project' });
  });

  test('User in Tenant B cannot read Project in Tenant A', async () => {
    const session = await login(userB);
    const response = await api.get(`/api/projects/${projectA.id}`, session);
    expect(response.status).toBe(404);
  });

  test('User in Tenant B cannot modify Project in Tenant A', async () => {
    const session = await login(userB);
    const response = await api.patch(
      `/api/projects/${projectA.id}`,
      { name: 'Hijacked' },
      session
    );
    expect(response.status).toBe(404);

    // Verify nothing changed
    const project = await db.projects.findOne({ id: projectA.id });
    expect(project.name).toBe('A Project');
  });

  test('Bulk-list does not include other tenants projects', async () => {
    const session = await login(userB);
    const response = await api.get('/api/projects', session);
    expect(response.body.find(p => p.id === projectA.id)).toBeUndefined();
  });
});

// Express-Middleware: Request-Context mit Tenant
const { AsyncLocalStorage } = require('async_hooks');
const requestContext = new AsyncLocalStorage();

app.use((req, res, next) => {
  requestContext.run({ tenantId: req.user?.tenantId, userId: req.user?.id }, next);
});

// Logger mit automatischem Context
function log(level, message, extra = {}) {
  const ctx = requestContext.getStore() || {};
  console.log(JSON.stringify({ level, message, ...ctx, ...extra, ts: Date.now() }));
}