multi-tenant-safety

Combine a global tenant filter (Hibernate @Filter or MyBatis interceptor) with tenant-aware repository methods like findByTenantIdAndId. Bare findById calls can bypass entity filters through the persistence context or second-level cache, so Service-layer queries should always include tenantId.

Request headers can be forged by any client, so an attacker can pair their own token with another tenant's header to read foreign data. The header should only route requests, and the tenantId from the authenticated token must be validated against it, returning 403 on mismatch.

Data isolation controls which rows a tenant can see, while feature-level authorization controls which functionality a tenant, role, or subscription tier can use. Hiding a button in the frontend is not a security boundary; the backend endpoint must independently validate eligibility and return 403.

Yes, the references directory includes complete implementations for Go Gin middleware factories, Express handlers, and NestJS Guards alongside the Java Spring Boot AOP examples. The same principles apply to Python FastAPI with SQLAlchemy.

Grep the Service layer for bare findById, getOne, getReferenceById, and findAllById calls, which bypass entity filters. Also check that every Repository defines findByTenantIdAndId and findByTenantIdAndIdIn methods, and optionally fail CI builds on violations.