Kind: Constant
Source: atloria-monorepo/libs/database/src/lib/tenant-backstop.ts
Tenant backstop — a Prisma client extension that guards against the cross-tenant bug class where a
service reads or mutates a row by id under a request context but forgets to scope it to the
caller's organization (the _user-ignored bug found in the SG red-team).
IMPORTANT: this is DEFENSE-IN-DEPTH. The primary control is ResourceOrgGuard at the controller edge. This runs at the data layer as a second line.
It ships in LOG-ONLY (detect) mode: it never alters a query, it only records the distinct
(model, operation) shapes that ran unscoped under an org context — mapping the remaining surface
in real traffic with zero risk of breaking a query. Enforcement is opt-in per deployment (a flag)
and, even then, is applied ONLY to filter operations where injecting AND organizationId is
always valid Prisma — never to a unique-key op (findUnique/update/delete by id), where injecting a
non-unique field would be rejected, and never blindly over an intentional cross-org query (e.g.
OR: [{ isPublic }, { organizationId }]), which is why enforcement stays conservative and off by
default.
Definition
tsReadonlySet<string>
Was this page helpful?