neuro-cms-architecture

Add a storeId column to every tenant-scoped model, then use a Prisma client extension that automatically injects storeId into all queries, creates, and updates. For defense-in-depth, enable PostgreSQL row-level security policies keyed on a session variable.

Row-level isolation suits most SaaS CMS projects supporting thousands of tenants at lowest cost. Schema-level fits enterprise tenants needing stronger isolation, while database-level is reserved for regulated industries like healthcare where compliance mandates full separation.

Three patterns are covered: config transformation where plugins receive and return modified config, hook-based lifecycle events like beforeCreate and afterUpdate, and middleware chains for the request pipeline. Hook-based systems offer the most flexibility for content operations.

Define access functions per collection that return true, false, or a query constraint such as { authorId: user.id }. Merge returned constraints into the database where clause so editors only see their own drafts while admins retain full access.

The architectural patterns—tenant isolation, content type registries, hooks, and RBAC—are ORM-agnostic. The Skill instructs analyzing the project first to detect whether Prisma, Drizzle, Mongoose, or another ORM is in use, then follows those existing conventions.

Store content as typed blocks (heading, image, code, table) in a JSON array when content must render across multiple platforms or be queried structurally. Rich text blobs are acceptable only for simple, single-channel publishing.