skills.rest
davila7
davila7COMMUNITY
Explore all skills by this author →
Website𝕏@dani_avila7GitHub

saas-multi-tenant

Implements multi-tenant SaaS architectures with PostgreSQL row-level security and tenant-scoped queries.

30.5k|3.5k|Updated Jul 4, 2025
Search Tags:#prisma#Multi-Tenancy#typeScript#row-level-security#tenant-isolation#postgreSQL#saaS
One-click install
npx skills add https://github.com/davila7/claude-code-templates --skill saas-multi-tenant
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: saas-multi-tenant
Source: https://github.com/davila7/claude-code-templates/tree/main/cli-tool/components/skills/development/saas-multi-tenant
Command: npx skills add https://github.com/davila7/claude-code-templates --skill saas-multi-tenant

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Building a SaaS application where multiple customers share one database risks cross-tenant data leaks if any query forgets its tenant filter. This Skill guides the design of tenant isolation using PostgreSQL row-level security, tenant-aware middleware, and ORM-level scoping so every query is constrained to the correct tenant.

Core Features & Use Cases

  • Tenancy Model Selection: Compares shared-schema, schema-per-tenant, and database-per-tenant approaches based on scale and isolation requirements.
  • Defense-in-Depth Isolation: Combines PostgreSQL RLS policies with Express middleware that sets app.current_tenant_id per request and Prisma middleware that injects tenantId into every query.
  • Safe Admin and Operations Patterns: Covers cross-tenant admin routes, tenant provisioning, migrations with RLS, background jobs, and GDPR data exports.
  • Use Case: When adding multi-tenancy to an existing single-tenant TypeScript app, use this Skill to add tenant_id columns, write RLS policies, and build middleware that scopes every request automatically.

Quick Start

Ask the AI to design a multi-tenant PostgreSQL schema with row-level security and tenant-scoped Express middleware for your SaaS application.

Frequently Asked Questions about saas-multi-tenant

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement row-level security for multi-tenant PostgreSQL?▼

Enable RLS on each tenant-scoped table and create a policy filtering rows by current_setting('app.current_tenant_id'). Set that session variable per request inside a transaction using set_config, so every query inherits the tenant scope automatically.

Shared schema vs schema-per-tenant vs database-per-tenant: which should I choose?▼

Shared-schema with a tenant_id column is the correct default for most SaaS apps under 1000 tenants. Schema-per-tenant multiplies migration overhead, and database-per-tenant is only justified by regulatory data residency requirements.

How do I scope Prisma queries by tenant automatically?▼

Use Prisma middleware ($use) that injects tenantId into the where clause of findMany, findFirst, update, and delete calls, and into data on creates. Maintain a list of global tables like plans and feature flags that skip the filter.

Can I use integer IDs for tenant-scoped resources?▼

No. Sequential integer IDs let attackers enumerate other tenants' resources by incrementing the ID. Use UUIDs for all tenant-scoped primary keys and reserve integer IDs for internal-only tables.

Why do background jobs fail with row-level security enabled?▼

Background jobs have no HTTP request to extract tenant_id from, so the session variable is never set and RLS blocks or bypasses queries. Include tenant_id in the job payload and set the database session variable before processing.

How do I run migrations when RLS is enabled?▼

Never run migrations on a connection with RLS active, since ALTER TABLE commands may silently fail or apply only to the current tenant's view. Use a dedicated superuser or a role with the bypassrls attribute for migrations.

Related Skills

Explore More Software Engineering Skills→
shafibabarshafibabar
1

zero-trust-design

Design Zero Trust Architecture with mTLS, JWT propagation, and deny-by-default policies.

Community
Advanced
BagelHoleBagelHole
46

multi-tenant-llm-hosting

Design multi-tenant LLM hosting platforms with tenant isolation and usage tracking.

Community
Advanced
marquesfelipmarquesfelip

tenant-aware-query-design

Ensure tenant-scoped queries include a tenant_id filter across SQL and ORM layers.

Community
Advanced
e-t-y-be-t-y-b
9

saas-architect

Architect multi-tenant SaaS architectures with isolation, billing, and governance patterns.

Official
Advanced