glapi-rls-guide

What problem does it solve?

GLAPI's multi-tenant databases need reliable Row Level Security and contextual session variables so that organization-specific queries cannot leak data between tenants, especially when repositories or services might inadvertently use global connections.

Core Features & Use Cases

• Session Variable Enforcement: Every contextual database connection sets app.current_organization_id before executing queries, ensuring policies compare organization_id values accurately even across inserts, selects, updates, and deletes.
• Context Module & Middleware: The context helpers and authenticated tRPC middleware create RLS-aware connections, validate organization UUIDs, and release clients safely at the end of each request.
• Repository Patterns & Troubleshooting: Services and repositories accept a contextual db, follow the ctx.db path, and include debug patterns for diagnosing new row violates row-level security policy errors, illustrating how to add RLS for new tables while keeping migrations aligned.

Quick Start

Use the GLAPI RLS guide to outline the steps for enabling PostgreSQL session variables, RLS policies, and contextual database connections when adding a new multi-tenant table.