{"type":"excalidraw","version":2,"source":"https://AwesomeSystemDesign.dev","elements":[{"angle":0,"strokeColor":"#6577aa","backgroundColor":"#eef1fc","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-1"}],"updated":0,"link":null,"locked":false,"id":"shape-0","type":"rectangle","seed":41,"x":16,"y":16,"width":288,"height":922.6,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-1","type":"text","seed":114,"x":36,"y":34,"width":248,"height":886.6,"fontSize":22,"fontFamily":1,"text":"TENANT CONTEXT\nPROPAGATION\n\n• Every Layer is\nTenant-Aware\nRequest → Middleware\nresolves tenant_id →\nAttaches to request\ncontext → Service\nlayer reads from\ncontext → Database\nqueries ALWAYS\ninclude WHERE\ntenant_id = ? →\nCache keys prefixed:\n{tenant_id}:resource:\nid → Background jobs\ncarry tenant_id in\npayload → Events\ncarry tenant_id in\nmetadata → Logs\ninclude tenant_id\nfield\nDefense in depth:\nEven if application\ncode forgets\ntenant_id in a query,\nPostgreSQL\nRow-Level Security\n(RLS) blocks\ncross-tenant reads","originalText":"TENANT CONTEXT\nPROPAGATION\n\n• Every Layer is\nTenant-Aware\nRequest → Middleware\nresolves tenant_id →\nAttaches to request\ncontext → Service\nlayer reads from\ncontext → Database\nqueries ALWAYS\ninclude WHERE\ntenant_id = ? →\nCache keys prefixed:\n{tenant_id}:resource:\nid → Background jobs\ncarry tenant_id in\npayload → Events\ncarry tenant_id in\nmetadata → Logs\ninclude tenant_id\nfield\nDefense in depth:\nEven if application\ncode forgets\ntenant_id in a query,\nPostgreSQL\nRow-Level Security\n(RLS) blocks\ncross-tenant reads","textAlign":"left","verticalAlign":"middle","containerId":"shape-0","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#6577aa","backgroundColor":"#eef1fc","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-3"}],"updated":0,"link":null,"locked":false,"id":"shape-2","type":"rectangle","seed":187,"x":16,"y":982.6,"width":288,"height":1208.6000000000001,"customData":{"revealStep":2}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-3","type":"text","seed":260,"x":36,"y":1000.6,"width":248,"height":1172.6000000000001,"fontSize":22,"fontFamily":1,"text":"TENANT\nRESOLUTION LAYER\n\n• How Is Tenant\nIdentified?\nMethod 1: Subdomain\nacme.myproduct.com →\ntenant_id = \"acme\"\nbigcorp.myproduct.com\n→ tenant_id =\n\"bigcorp\"\nMethod 2: Custom\nDomain (Enterprise)\napp.acme.com →\nCNAME →\nacme.myproduct.com →\ntenant=\"acme\"\nRequires: per-tenant\nTLS certificate\n(Let's Encrypt auto)\nMethod 3: JWT\nToken Claim\nAuthorization: Bearer\n<JWT> JWT payload:\n{ \"tenant_id\": \"acme\",\n\"user_id\": \"alice\" }\nMethod 4: API\nHeader X-Tenant-ID:\nacme Used for:\nAPI-first / headless\nSaaS\nResolution order:\ncustom domain →\nsubdomain → JWT →\nheader Resolved\ntenant_id attached\nto request context\n(middleware) ALL\ndownstream queries\nscoped to this\ntenant_id","originalText":"TENANT\nRESOLUTION LAYER\n\n• How Is Tenant\nIdentified?\nMethod 1: Subdomain\nacme.myproduct.com →\ntenant_id = \"acme\"\nbigcorp.myproduct.com\n→ tenant_id =\n\"bigcorp\"\nMethod 2: Custom\nDomain (Enterprise)\napp.acme.com →\nCNAME →\nacme.myproduct.com →\ntenant=\"acme\"\nRequires: per-tenant\nTLS certificate\n(Let's Encrypt auto)\nMethod 3: JWT\nToken Claim\nAuthorization: Bearer\n<JWT> JWT payload:\n{ \"tenant_id\": \"acme\",\n\"user_id\": \"alice\" }\nMethod 4: API\nHeader X-Tenant-ID:\nacme Used for:\nAPI-first / headless\nSaaS\nResolution order:\ncustom domain →\nsubdomain → JWT →\nheader Resolved\ntenant_id attached\nto request context\n(middleware) ALL\ndownstream queries\nscoped to this\ntenant_id","textAlign":"left","verticalAlign":"middle","containerId":"shape-2","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":2}}],"appState":{"viewBackgroundColor":"#fbfbf8","gridSize":null},"files":{}}