feat(backend): add PostgreSQL schema, RLS policies, and multi-tenant middleware
- Add EF Core migrations for initial schema (clubs, members, work_items, shifts, shift_signups)
- Implement RLS policies with SET LOCAL for tenant isolation
- Add Finbuckle multi-tenant middleware with ClaimStrategy + HeaderStrategy fallback
- Create TenantValidationMiddleware to enforce JWT claims match X-Tenant-Id header
- Add tenant-aware DB interceptors (SaveChangesTenantInterceptor, TenantDbConnectionInterceptor)
- Configure AppDbContext with tenant scoping and RLS support
- Add test infrastructure: CustomWebApplicationFactory, TestAuthHandler, DatabaseFixture
- Write TDD integration tests for multi-tenant isolation and RLS enforcement
- Add health check null safety for connection string
Tasks: 7 (PostgreSQL schema + migrations + RLS), 8 (Finbuckle multi-tenancy + validation), 12 (test infrastructure)
2026-03-03 14:32:21 +01:00
|
|
|
using System.Data.Common;
|
|
|
|
|
using Finbuckle.MultiTenant;
|
|
|
|
|
using Finbuckle.MultiTenant.Abstractions;
|
|
|
|
|
using Microsoft.EntityFrameworkCore.Diagnostics;
|
|
|
|
|
using Microsoft.Extensions.Logging;
|
|
|
|
|
using Npgsql;
|
|
|
|
|
|
|
|
|
|
namespace WorkClub.Infrastructure.Data.Interceptors;
|
|
|
|
|
|
|
|
|
|
public class TenantDbConnectionInterceptor : DbConnectionInterceptor
|
|
|
|
|
{
|
|
|
|
|
private readonly IMultiTenantContextAccessor _tenantAccessor;
|
|
|
|
|
private readonly ILogger<TenantDbConnectionInterceptor> _logger;
|
|
|
|
|
|
|
|
|
|
public TenantDbConnectionInterceptor(
|
|
|
|
|
IMultiTenantContextAccessor tenantAccessor,
|
|
|
|
|
ILogger<TenantDbConnectionInterceptor> logger)
|
|
|
|
|
{
|
|
|
|
|
_tenantAccessor = tenantAccessor;
|
|
|
|
|
_logger = logger;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public override async ValueTask<InterceptionResult> ConnectionOpeningAsync(
|
|
|
|
|
DbConnection connection,
|
|
|
|
|
ConnectionEventData eventData,
|
|
|
|
|
InterceptionResult result,
|
|
|
|
|
CancellationToken cancellationToken = default)
|
|
|
|
|
{
|
|
|
|
|
await base.ConnectionOpeningAsync(connection, eventData, result, cancellationToken);
|
|
|
|
|
|
|
|
|
|
var tenantId = _tenantAccessor.MultiTenantContext?.TenantInfo?.Identifier;
|
2026-03-05 11:07:19 +01:00
|
|
|
|
feat(backend): add PostgreSQL schema, RLS policies, and multi-tenant middleware
- Add EF Core migrations for initial schema (clubs, members, work_items, shifts, shift_signups)
- Implement RLS policies with SET LOCAL for tenant isolation
- Add Finbuckle multi-tenant middleware with ClaimStrategy + HeaderStrategy fallback
- Create TenantValidationMiddleware to enforce JWT claims match X-Tenant-Id header
- Add tenant-aware DB interceptors (SaveChangesTenantInterceptor, TenantDbConnectionInterceptor)
- Configure AppDbContext with tenant scoping and RLS support
- Add test infrastructure: CustomWebApplicationFactory, TestAuthHandler, DatabaseFixture
- Write TDD integration tests for multi-tenant isolation and RLS enforcement
- Add health check null safety for connection string
Tasks: 7 (PostgreSQL schema + migrations + RLS), 8 (Finbuckle multi-tenancy + validation), 12 (test infrastructure)
2026-03-03 14:32:21 +01:00
|
|
|
if (string.IsNullOrWhiteSpace(tenantId))
|
|
|
|
|
{
|
|
|
|
|
_logger.LogWarning("No tenant context available for database connection");
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (connection is NpgsqlConnection npgsqlConnection)
|
|
|
|
|
{
|
|
|
|
|
await using var command = npgsqlConnection.CreateCommand();
|
|
|
|
|
command.CommandText = $"SET LOCAL app.current_tenant_id = '{tenantId}'";
|
2026-03-05 11:07:19 +01:00
|
|
|
|
feat(backend): add PostgreSQL schema, RLS policies, and multi-tenant middleware
- Add EF Core migrations for initial schema (clubs, members, work_items, shifts, shift_signups)
- Implement RLS policies with SET LOCAL for tenant isolation
- Add Finbuckle multi-tenant middleware with ClaimStrategy + HeaderStrategy fallback
- Create TenantValidationMiddleware to enforce JWT claims match X-Tenant-Id header
- Add tenant-aware DB interceptors (SaveChangesTenantInterceptor, TenantDbConnectionInterceptor)
- Configure AppDbContext with tenant scoping and RLS support
- Add test infrastructure: CustomWebApplicationFactory, TestAuthHandler, DatabaseFixture
- Write TDD integration tests for multi-tenant isolation and RLS enforcement
- Add health check null safety for connection string
Tasks: 7 (PostgreSQL schema + migrations + RLS), 8 (Finbuckle multi-tenancy + validation), 12 (test infrastructure)
2026-03-03 14:32:21 +01:00
|
|
|
try
|
|
|
|
|
{
|
|
|
|
|
await command.ExecuteNonQueryAsync(cancellationToken);
|
|
|
|
|
_logger.LogDebug("Set tenant context for database connection: {TenantId}", tenantId);
|
|
|
|
|
}
|
|
|
|
|
catch (Exception ex)
|
|
|
|
|
{
|
|
|
|
|
_logger.LogError(ex, "Failed to set tenant context for connection");
|
|
|
|
|
throw;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public override void ConnectionOpened(DbConnection connection, ConnectionEndEventData eventData)
|
|
|
|
|
{
|
|
|
|
|
base.ConnectionOpened(connection, eventData);
|
|
|
|
|
|
|
|
|
|
var tenantId = _tenantAccessor.MultiTenantContext?.TenantInfo?.Identifier;
|
2026-03-05 11:07:19 +01:00
|
|
|
|
feat(backend): add PostgreSQL schema, RLS policies, and multi-tenant middleware
- Add EF Core migrations for initial schema (clubs, members, work_items, shifts, shift_signups)
- Implement RLS policies with SET LOCAL for tenant isolation
- Add Finbuckle multi-tenant middleware with ClaimStrategy + HeaderStrategy fallback
- Create TenantValidationMiddleware to enforce JWT claims match X-Tenant-Id header
- Add tenant-aware DB interceptors (SaveChangesTenantInterceptor, TenantDbConnectionInterceptor)
- Configure AppDbContext with tenant scoping and RLS support
- Add test infrastructure: CustomWebApplicationFactory, TestAuthHandler, DatabaseFixture
- Write TDD integration tests for multi-tenant isolation and RLS enforcement
- Add health check null safety for connection string
Tasks: 7 (PostgreSQL schema + migrations + RLS), 8 (Finbuckle multi-tenancy + validation), 12 (test infrastructure)
2026-03-03 14:32:21 +01:00
|
|
|
if (string.IsNullOrWhiteSpace(tenantId))
|
|
|
|
|
{
|
|
|
|
|
_logger.LogWarning("No tenant context available for database connection");
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (connection is NpgsqlConnection npgsqlConnection)
|
|
|
|
|
{
|
|
|
|
|
using var command = npgsqlConnection.CreateCommand();
|
|
|
|
|
command.CommandText = $"SET LOCAL app.current_tenant_id = '{tenantId}'";
|
2026-03-05 11:07:19 +01:00
|
|
|
|
feat(backend): add PostgreSQL schema, RLS policies, and multi-tenant middleware
- Add EF Core migrations for initial schema (clubs, members, work_items, shifts, shift_signups)
- Implement RLS policies with SET LOCAL for tenant isolation
- Add Finbuckle multi-tenant middleware with ClaimStrategy + HeaderStrategy fallback
- Create TenantValidationMiddleware to enforce JWT claims match X-Tenant-Id header
- Add tenant-aware DB interceptors (SaveChangesTenantInterceptor, TenantDbConnectionInterceptor)
- Configure AppDbContext with tenant scoping and RLS support
- Add test infrastructure: CustomWebApplicationFactory, TestAuthHandler, DatabaseFixture
- Write TDD integration tests for multi-tenant isolation and RLS enforcement
- Add health check null safety for connection string
Tasks: 7 (PostgreSQL schema + migrations + RLS), 8 (Finbuckle multi-tenancy + validation), 12 (test infrastructure)
2026-03-03 14:32:21 +01:00
|
|
|
try
|
|
|
|
|
{
|
|
|
|
|
command.ExecuteNonQuery();
|
|
|
|
|
_logger.LogDebug("Set tenant context for database connection: {TenantId}", tenantId);
|
|
|
|
|
}
|
|
|
|
|
catch (Exception ex)
|
|
|
|
|
{
|
|
|
|
|
_logger.LogError(ex, "Failed to set tenant context for connection");
|
|
|
|
|
throw;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|