Multi-Tenant Access Control

using Microsoft.EntityFrameworkCore;

namespace Shop.Api.Data;

public sealed class TenantContext
{
    public string? TenantId { get; set; }
}

public sealed class Order
{
    public int Id { get; set; }
    public required string TenantId { get; set; }
    public required string Number { get; set; }
    public decimal Total { get; set; }
    public bool IsDeleted { get; set; }
}

public sealed class ShopDb(DbContextOptions<ShopDb> options, TenantContext tenant) : DbContext(options)
{
    public DbSet<Order> Orders => Set<Order>();

    // Read through a member so EF Core evaluates it per query, not once when the model is built.
    private string? CurrentTenantId => tenant.TenantId;

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<Order>(order =>
        {
            order.HasIndex(o => new { o.TenantId, o.Number }).IsUnique();
            order.HasQueryFilter(TenantFilters.Tenant, o => o.TenantId == CurrentTenantId);
            order.HasQueryFilter(TenantFilters.SoftDelete, o => !o.IsDeleted);
        });
    }
}

public static class TenantFilters
{
    public const string Tenant = "Tenant";
    public const string SoftDelete = "SoftDelete";

    // Restoring a deleted order: drop the soft-delete filter only; the tenant filter still applies.
    public static Task<Order?> FindIncludingDeletedAsync(ShopDb db, int id, CancellationToken cancellationToken) =>
        db.Orders.IgnoreQueryFilters([SoftDelete]).FirstOrDefaultAsync(o => o.Id == id, cancellationToken);
}

using Microsoft.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore.Diagnostics;

namespace Shop.Api.Data;

public interface ITenantOwned
{
    string TenantId { get; set; }
}

public sealed class TenantContext
{
    public string? TenantId { get; set; }
}

public sealed class TenantWriteGuard(TenantContext tenant) : SaveChangesInterceptor
{
    // SaveChanges and SaveChangesAsync go through different hooks; guard both.
    public override InterceptionResult<int> SavingChanges(DbContextEventData eventData, InterceptionResult<int> result)
    {
        Guard(eventData.Context);
        return result;
    }

    public override ValueTask<InterceptionResult<int>> SavingChangesAsync(
        DbContextEventData eventData, InterceptionResult<int> result, CancellationToken cancellationToken = default)
    {
        Guard(eventData.Context);
        return ValueTask.FromResult(result);
    }

    private void Guard(DbContext? context)
    {
        if (context is null) return;

        foreach (var entry in context.ChangeTracker.Entries<ITenantOwned>())
        {
            if (entry.State is not (EntityState.Added or EntityState.Modified or EntityState.Deleted)) continue;

            var current = tenant.TenantId
                ?? throw new InvalidOperationException("Cannot save tenant data without a tenant.");

            if (entry.State == EntityState.Added && string.IsNullOrEmpty(entry.Entity.TenantId))
                entry.Entity.TenantId = current;
            else if (entry.Entity.TenantId != current
                || entry.Property(e => e.TenantId).OriginalValue != current)
                throw new InvalidOperationException($"Write to tenant data outside tenant '{current}'.");
        }
    }
}

public static class TenantDataRegistration
{
    public static IServiceCollection AddTenantData<TContext>(this IServiceCollection services, string connectionString)
        where TContext : DbContext
    {
        services.AddScoped<TenantContext>();
        services.AddScoped<TenantWriteGuard>();
        services.AddDbContext<TContext>((sp, options) => options
            .UseSqlite(connectionString)
            .AddInterceptors(sp.GetRequiredService<TenantWriteGuard>()));
        return services;
    }
}

-- Run once in a migration. The API connects as shop_app, which does not own the table.
ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
ALTER TABLE orders FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation ON orders
    USING (tenant_id = current_setting('app.tenant_id', true))
    WITH CHECK (tenant_id = current_setting('app.tenant_id', true));

GRANT SELECT, INSERT, UPDATE, DELETE ON orders TO shop_app;

-- Per request, inside the transaction that runs the queries.
BEGIN;
SELECT set_config('app.tenant_id', 'acme', true);
SELECT id, number, total FROM orders WHERE status = 'Placed';
COMMIT;