Documentation
README
Multi-Tenancy
Treat tenant identity as an authorization boundary, not a query convenience.
Choose an isolation model
- Database per tenant: strongest isolation and highest operational cost.
- Schema per tenant: strong logical isolation with shared infrastructure.
- Shared schema with
tenant_id: simplest operations, but every access path must enforce scope. - Document the selected model and prohibit repositories from bypassing it.
Resolve tenant identity
- Derive the tenant from a verified token claim, trusted host mapping, or authenticated API key.
- Reject missing, unknown, disabled, or conflicting tenant identifiers.
- Never trust a public
X-Tenant-Idheader by itself. - Clear servlet thread-local context in
finally; use ReactorContextfor reactive flows.
This is the opening of the README. Read the full README on GitHub.