{"type":"excalidraw","version":2,"source":"https://AwesomeSystemDesign.dev","elements":[{"angle":0,"strokeColor":"#6577aa","backgroundColor":"#eef1fc","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-1"}],"updated":0,"link":null,"locked":false,"id":"shape-0","type":"rectangle","seed":41,"x":466,"y":32,"width":390,"height":433.8,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-1","type":"text","seed":114,"x":486,"y":50,"width":350,"height":397.8,"fontSize":18,"fontFamily":1,"text":"TENANT CONTEXT PROPAGATION\n\n• Every Layer is Tenant-Aware\nRequest → Middleware resolves\ntenant_id → Attaches to request\ncontext → Service layer reads from\ncontext → Database queries ALWAYS\ninclude WHERE tenant_id = ? →\nCache keys prefixed:\n{tenant_id}:resource:id → Background\njobs carry tenant_id in payload →\nEvents carry tenant_id in metadata\n→ Logs include tenant_id field\nDefense in depth: Even if application\ncode forgets tenant_id in a query,\nPostgreSQL Row-Level Security\n(RLS) blocks cross-tenant reads","originalText":"TENANT CONTEXT PROPAGATION\n\n• Every Layer is Tenant-Aware\nRequest → Middleware resolves\ntenant_id → Attaches to request\ncontext → Service layer reads from\ncontext → Database queries ALWAYS\ninclude WHERE tenant_id = ? →\nCache keys prefixed:\n{tenant_id}:resource:id → Background\njobs carry tenant_id in payload →\nEvents carry tenant_id in metadata\n→ Logs include tenant_id field\nDefense in depth: Even if application\ncode forgets tenant_id in a query,\nPostgreSQL Row-Level Security\n(RLS) blocks cross-tenant reads","textAlign":"center","verticalAlign":"middle","containerId":"shape-0","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#628572","backgroundColor":"#edf5ee","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-3"}],"updated":0,"link":null,"locked":false,"id":"shape-2","type":"rectangle","seed":187,"x":36,"y":32,"width":390,"height":621,"customData":{"revealStep":2}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-3","type":"text","seed":260,"x":56,"y":50,"width":350,"height":585,"fontSize":18,"fontFamily":1,"text":"TENANT RESOLUTION LAYER\n\n• How Is Tenant Identified?\nMethod 1: Subdomain\nacme.myproduct.com → tenant_id =\n\"acme\" bigcorp.myproduct.com →\ntenant_id = \"bigcorp\"\nMethod 2: Custom Domain\n(Enterprise) app.acme.com → CNAME →\nacme.myproduct.com → tenant=\"acme\"\nRequires: per-tenant TLS certificate\n(Let's Encrypt auto)\nMethod 3: JWT Token Claim\nAuthorization: Bearer <JWT> JWT\npayload: { \"tenant_id\": \"acme\",\n\"user_id\": \"alice\" }\nMethod 4: API Header X-Tenant-ID:\nacme Used for: API-first / headless\nSaaS\nResolution order: custom domain →\nsubdomain → JWT → header Resolved\ntenant_id attached to request\ncontext (middleware) ALL\ndownstream queries scoped to this\ntenant_id","originalText":"TENANT RESOLUTION LAYER\n\n• How Is Tenant Identified?\nMethod 1: Subdomain\nacme.myproduct.com → tenant_id =\n\"acme\" bigcorp.myproduct.com →\ntenant_id = \"bigcorp\"\nMethod 2: Custom Domain\n(Enterprise) app.acme.com → CNAME →\nacme.myproduct.com → tenant=\"acme\"\nRequires: per-tenant TLS certificate\n(Let's Encrypt auto)\nMethod 3: JWT Token Claim\nAuthorization: Bearer <JWT> JWT\npayload: { \"tenant_id\": \"acme\",\n\"user_id\": \"alice\" }\nMethod 4: API Header X-Tenant-ID:\nacme Used for: API-first / headless\nSaaS\nResolution order: custom domain →\nsubdomain → JWT → header Resolved\ntenant_id attached to request\ncontext (middleware) ALL\ndownstream queries scoped to this\ntenant_id","textAlign":"center","verticalAlign":"middle","containerId":"shape-2","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":2}}],"appState":{"viewBackgroundColor":"#fbfbf8","gridSize":null},"files":{}}