Decision record · Tenant scoping in every service
RepairCMS · accepted- The cost
- 1,100+ businesses share one platform. One query that forgets its filter shows a shop someone else's customers.1
- How shops work
- Every screen a shop uses touches its own customers, stock and money, many times a day.2
- Decision
- Every query filters by the shop, resolved from the user by one shared helper. Looking up tenant data by id alone is not allowed.3
- The price
- It is a rule, not a guarantee: a forgotten filter returns every shop's data, so it has to be held by tests and review.3
- Held by
- A written rule in the repo, tenant-scope regression tests and code review, with older modules being brought up to the same rule. No reported cross-tenant data incident since launch.4






