Janady13/missionmatch / internal/platform/tenant/tenant.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/platform/tenant/tenant.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	09015496d565a172bcaa15cfe9a8e4b072b13df0
Branch	workstream-b-screenmatch
Path or archive member	internal/platform/tenant/tenant.go
Original SHA-256	72a8ad994d2c31d44d327e64e55153d599075ee96339eabf358daec0d04b5723
Git blob SHA	666fa7c68976c911d43f77e47bc6d4182dc01426
Reading-copy SHA-256	72a8ad994d2c31d44d327e64e55153d599075ee96339eabf358daec0d04b5723

Original source ↗

Every recorded occurrence

These 53 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-b-screenmatch	09015496d565a172bcaa15cfe9a8e4b072b13df0	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-d-missionmatch	3be46ba89edb737182075a2b320509b42dc916f8	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-e-dataflow-deploy	433815a042f9741411e60fa553fe72143e9b10db	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	w3-ai-staffing-recommendations	43d56387270ef4da4cabd794d97ca6a49909bc7d	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws3-clearance	4b8e7ce594c068621867f9c9deed0ec64ae6c553	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-c-slatematch	5cd60c918301b46ecd6ed3e03e20c395da0062e2	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ai-intelligence-layer	5d5ddff70393a197c5f54a45280bb5dd42b24755	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws7-federal-signal	6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws6-retrieval	6c56e29231ec05735927fa265c97d517499dfeaf	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ai-brain-live	aac32fc49c878cc5bca099459307611562d0bac1	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws1-ontology-sync	b596f449a32a1016fbd403c36505cc00a1ac9ee6	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ruthless-debug-sweep	b7d742f8f032984be3817efffa3eb8b13b651c1f	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws8-teaching-loop	c823f0fb6bb2aba0f39001eb6de96f4000d9321f	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	phase2-eval-fairness	d361af254701975fe239927656ababb56374655e	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-a-shared-core	e0de03ac3a1ec826bd15d0e048e3b02baa23eeff	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws2-alias-relationship	e4dada4601c6eb101830f9d223a9655dfa120616	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws9-bench-ingestion	f585a9ef32fa554663ce1fba9a414a54b6e49cf0	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws6-retrieval	6c56e29231ec05735927fa265c97d517499dfeaf	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-a-shared-core	e0de03ac3a1ec826bd15d0e048e3b02baa23eeff	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-c-slatematch	5cd60c918301b46ecd6ed3e03e20c395da0062e2	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws1-ontology-sync	b596f449a32a1016fbd403c36505cc00a1ac9ee6	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws8-teaching-loop	c823f0fb6bb2aba0f39001eb6de96f4000d9321f	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	w3-ai-staffing-recommendations	43d56387270ef4da4cabd794d97ca6a49909bc7d	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws3-clearance	4b8e7ce594c068621867f9c9deed0ec64ae6c553	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	phase2-eval-fairness	d361af254701975fe239927656ababb56374655e	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-e-dataflow-deploy	433815a042f9741411e60fa553fe72143e9b10db	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ruthless-debug-sweep	b7d742f8f032984be3817efffa3eb8b13b651c1f	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ai-intelligence-layer	5d5ddff70393a197c5f54a45280bb5dd42b24755	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws9-bench-ingestion	f585a9ef32fa554663ce1fba9a414a54b6e49cf0	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws2-alias-relationship	e4dada4601c6eb101830f9d223a9655dfa120616	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-b-screenmatch	09015496d565a172bcaa15cfe9a8e4b072b13df0	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ws7-federal-signal	6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	ai-brain-live	aac32fc49c878cc5bca099459307611562d0bac1	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	workstream-d-missionmatch	3be46ba89edb737182075a2b320509b42dc916f8	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / internal/platform/tenant/tenant.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓138 lines · 5.2 KB

// Package tenant is the multi-tenancy correctness boundary.
//
// Tenant isolation is enforced by Postgres Row-Level Security, NOT by Go WHERE clauses. Every
// tenant-scoped request runs inside a transaction whose `app.current_org_id` GUC is set
// transaction-locally, so Postgres discards it at COMMIT/ROLLBACK and it can never leak to the next
// request that reuses a pooled connection (the pgx-pool gotcha, see docs/STACK_DECISIONS.md §2).
//
// Two safeguards stack here:
//   - Go side: no validated org in context => RunInTenantTx refuses to run (fail closed).
//   - DB side: an unset GUC makes current_setting(...,true) NULL, so the RLS policy matches zero
//     rows (default deny).
//
// The org id MUST originate from a verified session/JWT claim resolved by auth middleware, never
// from a client-supplied body, header, or query parameter.
package tenant

import (
	"context"
	"errors"
	"fmt"
	"net/http"

	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgxpool"
)

// ErrNoTenant is returned when tenant-scoped DB work is attempted without a validated organization.
var ErrNoTenant = errors.New("tenant: no organization_id in context (refusing to run unscoped query)")

// ctxKey is an unexported context key so a client cannot spoof the org via a context-key collision.
type ctxKey struct{}

var orgKey = ctxKey{}

// WithOrg stores the validated org id in ctx. Call this ONLY from auth middleware, with a value
// taken from verified claims.
func WithOrg(ctx context.Context, orgID string) context.Context {
	return context.WithValue(ctx, orgKey, orgID)
}

// OrgFromContext returns the validated org id and whether a non-empty one is present.
func OrgFromContext(ctx context.Context) (string, bool) {
	v, ok := ctx.Value(orgKey).(string)
	return v, ok && v != ""
}

// principalCtxKey is a SEPARATE key type from ctxKey. Reusing ctxKey for the user would collide with
// orgKey, because every empty struct value of the same type is equal, so the two context lookups
// would return each other's value. A distinct type keeps the org and the principal independent.
type principalCtxKey struct{}

var principalKey = principalCtxKey{}

// Principal is the authenticated actor resolved from a validated session: the user id and the role
// used for authorization. Like the org, it MUST originate from auth middleware reading verified
// session state, never a client supplied value.
type Principal struct {
	UserID string
	Role   string
}

// WithUser stores the validated principal in ctx. Call this ONLY from auth middleware.
func WithUser(ctx context.Context, p Principal) context.Context {
	return context.WithValue(ctx, principalKey, p)
}

// UserFromContext returns the validated principal and whether one with a non-empty user id is
// present.
func UserFromContext(ctx context.Context) (Principal, bool) {
	p, ok := ctx.Value(principalKey).(Principal)
	return p, ok && p.UserID != ""
}

// DB wraps a pgxpool.Pool whose DSN authenticates as the NOBYPASSRLS application role.
type DB struct{ Pool *pgxpool.Pool }

// New wraps a pool as a tenant-scoped DB.
func New(pool *pgxpool.Pool) *DB { return &DB{Pool: pool} }

// Close releases the underlying pool.
func (db *DB) Close() {
	if db.Pool != nil {
		db.Pool.Close()
	}
}

// RunInTenantTx is THE correctness boundary. It:
//  1. requires a validated org id (fail-closed: no org => no query, before the pool is touched),
//  2. opens a transaction on a single pooled connection,
//  3. sets app.current_org_id transaction-locally via set_config(..., is_local=true) so it
//     auto-resets at COMMIT/ROLLBACK and cannot leak across the pool,
//  4. runs fn against that same tx, then commits (rolling back on any error).
//
// All tenant-scoped repository work MUST go through this method.
func (db *DB) RunInTenantTx(ctx context.Context, fn func(ctx context.Context, tx pgx.Tx) error) (err error) {
	orgID, ok := OrgFromContext(ctx)
	if !ok {
		return ErrNoTenant
	}

	tx, err := db.Pool.Begin(ctx)
	if err != nil {
		return fmt.Errorf("begin tenant tx: %w", err)
	}
	// Rollback is a no-op once Commit succeeds; this guarantees the connection is released on every path.
	defer func() { _ = tx.Rollback(ctx) }()

	// Transaction-local GUC, parameterized (no SQL-injection surface). is_local=true is what makes
	// this safe on a pooled connection.
	if _, err = tx.Exec(ctx, "SELECT set_config('app.current_org_id', $1, true)", orgID); err != nil {
		return fmt.Errorf("set tenant guc: %w", err)
	}

	if err = fn(ctx, tx); err != nil {
		return err // defer rolls back
	}
	if err = tx.Commit(ctx); err != nil {
		return fmt.Errorf("commit tenant tx: %w", err)
	}
	return nil
}

// Middleware resolves the org id from an already-validated request and stores it in context.
// resolveOrg MUST read verified session/JWT claims, never a raw client value. A request whose org
// cannot be resolved is rejected with 403 before any downstream handler runs.
func Middleware(resolveOrg func(*http.Request) (string, bool)) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			orgID, ok := resolveOrg(r)
			if !ok {
				http.Error(w, "forbidden", http.StatusForbidden)
				return
			}
			next.ServeHTTP(w, r.WithContext(WithOrg(r.Context(), orgID)))
		})
	}
}