multi-tenant-support

KO | EN

gitlite — search

#python #hacktoberfest #ai #typescript #golang #android #machine-learning #rust #linux #nodejs #cli #mcp #ios #openai

multi-tenant-support

(★ 48)

Build a highly secure, no data leak, multi-tenant rails app

multi-tenant-support 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# MultiTenantSupport

[![Test](https://github.com/hoppergee/multi-tenant-support/actions/workflows/main.yaml/badge.svg?branch=main)](https://github.com/hoppergee/multi-tenant-support/actions/workflows/main.yaml) [![Gem Version](https://badge.fury.io/rb/multi-tenant-support.svg)](https://badge.fury.io/rb/multi-tenant-support)

![](https://raw.githubusercontent.com/hoppergee/multi-tenant-support/main/hero.png)

Build a highly secure, multi-tenant rails app without data leak.

Keep your data secure with multi-tenant-support. Prevent most ActiveRecord CRUD methods to action across tenant, ensuring no one can accidentally or intentionally access other tenants' data. This can be crucial for applications handling sensitive information like financial information, intellectual property, and so forth.

- Prevent most ActiveRecord CRUD methods from acting across tenants.
- Support Row-level Multitenancy
- Build on ActiveSupport::CurrentAttributes offered by rails
- Auto set current tenant through subdomain and domain in controller (overrideable)
- Support ActiveJob and Sidekiq

This gem was inspired much from [acts_as_tenant](https://github.com/ErwinM/acts_as_tenant), [multitenant](https://github.com/wireframe/multitenant), [multitenancy](https://github.com/Flipkart/multitenancy/blob/master/lib/multitenancy/model_extensions.rb), [rails-multitenant](https://github.com/salsify/rails-multitenant), [activerecord-firewall](https://github.com/Shopify/activerecord-firewall), [milia](https://github.com/jekuno/milia).

But it does more than them, and highly focuses on ActiveRecord data leak protection.

## What make it differnce on details

It protects data in every scenario in great detail. Currently, you can't find any multi-tenant gems doing a full data leak protect on ActiveRecord. But this gem does it.

Our protection code mainly focus on 5 scenarios:

- Action by tenant
  - `CurrentTenantSupport.current_tenant` exists
  - `CurrentTenantSupport.allow_read_across_tenant` is false (default)
- Action by wrong tenant
  - `CurrentTenantSupport.current_tenant` does not match `target_record.account`
  - `CurrentTenantSupport.allow_read_across_tenant` is false (default)
- Action when missing tenant
  - `CurrentTenantSupport.current_tenant` is nil
  - `CurrentTenantSupport.allow_read_across_tenant` is false (default)
- Action by super admin but readonly
  - `CurrentTenantSupport.current_tenant` is nil
  - `CurrentTenantSupport.allow_read_across_tenant` is true
- Action by super admin but want modify on a specific tenant
  - `CurrentTenantSupport.current_tenant` is nil
  - `CurrentTenantSupport.allow_read_across_tenant` is true
  - Run code in the block of `CurrentTenantSupport.under_tenant`

Below are the behaviour of all ActiveRecord CRUD methods under abvove scenarios:

### Protect on read

| Read By  | tenant | missing tenant | super admin | super admin(modify on a specific tenant) |
| -------- | ------ | -------------- | ----------- | ---------------------------------------- |
| count    | 🍕      | 🚫              | 🌎           | 🍕                                        |
| first    | 🍕      | 🚫              | 🌎           | 🍕                                        |
| last     | 🍕      | 🚫              | 🌎           | 🍕                                        |
| where    | 🍕      | 🚫              | 🌎           | 🍕                                        |
| find_by  | 🍕      | 🚫              | 🌎           | 🍕                                        |
| unscoped | 🍕      | 🚫              | 🌎           | 🍕                                        |