Resolve tenant identity from authenticated claims or a trusted server-side mapping and carry it through a scoped context. Never authorize a tenant merely because its ID appears in the URL or request body. Every tenant-owned table and unique/index relationship should include RestaurantId and OutletId. Every SELECT, INSERT, UPDATE, and DELETE must apply both values; use query filters only as defense-in-depth because IgnoreQueryFilters and raw SQL can bypass them. Validate related entity ownership and include tenant keys in cache keys, events, blobs, jobs, and audit records. Add negative integration tests that attempt cross-tenant reads and writes, and use database row-level security where appropriate as an additional barrier.
Backbencher Developer · · 0 likes