cc-multi-tenant-safety

Derive tenant identity from the authenticated token rather than request headers, and validate header-supplied tenant codes against the token's tenantId. Add a global filter via Hibernate @Filter or a MyBatis interceptor so every query automatically includes the tenant_id condition.

Primary-key lookups like findById, getReferenceById, and findAllById go through the persistence context or second-level cache and skip entity @Filter conditions. Define tenant-aware methods such as findByTenantIdAndId on each repository and call those from the service layer instead.

No, frontend UI gating is only a user experience optimization, not a security boundary. Any logged-in user can call the endpoint directly, so the backend must independently validate tenant code, role, or subscription status and return 403 with a readable message.

The response interceptor should detect 403 responses whose message indicates a tenant mismatch, clear the login state, redirect to the login page, and show a clear toast message. Silently rejecting the promise leaves users on a blank page.

Use a direct if check at the endpoint entry for one or two restricted endpoints since it is simplest and most readable. Introduce an annotation plus AOP, a Gin middleware factory, or a NestJS Guard only when three or more endpoints share the same restriction.