Multi-Tenancy Enforcer FAQs

Question 1

Why is communityId required in every query?

Accepted Answer

Including communityId ensures that data from one tenant (community) is never accidentally accessed or modified by another, preventing critical security breaches and unauthorized data exposure.

Question 2

Can I use optional communityId parameters in repository methods?

Accepted Answer

No, this skill strictly forbids optional communityId parameters. Making them mandatory ensures that a developer cannot accidentally execute a global query that leaks data.

Question 3

Should I ever get the communityId from the request body?

Accepted Answer

No, you should always extract it from a validated JWT token via the controller context. This prevents attackers from forging request bodies to access data belonging to other communities.

Question 4

How does this skill handle MongoDB indexes?

Accepted Answer

It enforces that all compound indexes begin with communityId as the first field. This ensures that queries are both logically isolated and highly performant.

Question 5

Does this rule apply to MongoDB aggregation pipelines?

Accepted Answer

Yes, every aggregation pipeline must include a $match stage filtering by communityId as the very first stage in the pipeline to ensure data is filtered before any processing occurs.

Multi-Tenancy Enforcer

主な機能

ユースケース

Multi-Tenancy Enforcer

主な機能

ユースケース