vendix-multi-tenant-context

Multi-tenant context propagation in NestJS uses a DomainResolverMiddleware to identify the tenant from hostname or headers, then a RequestContextInterceptor initializes AsyncLocalStorage to maintain store_id and organization_id throughout the request lifecycle without passing identifiers manually.

Preventing cross-tenant data leakage requires a safe RequestContextService that provides no static fallbacks when context is missing. By scoping database queries via AsyncLocalStorage initialized per request, the system securely isolates tenant data across stores and organizations.

AsyncLocalStorage for tenant isolation works when a RequestContextInterceptor merges authentication data with domain context resolved by middleware. The interceptor initializes the storage, allowing downstream services to safely access store_id and organization_id without explicit parameter passing.

Yes, a DomainResolverMiddleware resolves tenant information from the hostname or headers early in the request pipeline. This Context Bridge pattern attaches store_id and organization_id to the request, enabling downstream services to accurately scope database queries per tenant.

For multi-tenant NestJS applications, you should register the RequestContextInterceptor globally or per scope to ensure AsyncLocalStorage is initialized for all routes. This guarantees the tenant context is consistently available for all downstream operations and database scoping.

Multi-tenant context returns undefined when the RequestContextInterceptor is not registered correctly or AsyncLocalStorage was not initialized for that request lifecycle. Ensure the interceptor runs before downstream services execute and the DomainResolverMiddleware successfully attached the tenant context.