[Proposal] Sails.js Multi Tenancy on Document Level

[Goostavo]

I'm willing to implement a way of doing multi tenancy on sails, using the document level approach. As it will works on all adapters easily.

Implementation and approach

I'm willing to add a tenant_id column on every multi tenant table/collection. And also on users table/collection. O login a policy will add the tenant_id to the request and every model call will ensure that is being used.

What i need to do:

1. Implement a policy that adds a tenant from user after authentication (Sails fully support, nothing to do here).
2. Intercept all model calls to ensure tenant is used (See Model intercept for details)

Why intercept model and not controllers? Controller might use multiple model calls, so it's impossible to guarantee the usage. Also blueprints will not work.

Model intercept

I want to make a default implementation that enables the tenant_id verification or return error automatically on every model call.

"beforeFind"/"beforeDelete": guaranteed that where contains tenant_id, else returns error "beforeCreate"/"beforeCreateEach": Automatically overrides the tenant_id of each document with tenant_id

Any toughts on implementation (where should i edit to intercept model calls, is it possibile to make a hook for it?), or possible problems that i might find?

---

Node version: v14 Sails version (sails): 1.x ORM hook version (sails-hook-orm): 3.x

---

[sailsbot]

@Goostavo Thanks for posting! We'll take a look as soon as possible.

In the mean time, there are a few ways you can help speed things along:

• look for a workaround. (Even if it's just temporary, sharing your solution can save someone else a lot of time and effort.)
• tell us why this issue is important to you and your team. What are you trying to accomplish? (Submissions with a little bit of human context tend to be easier to understand and faster to resolve.)
• make sure you've provided clear instructions on how to reproduce the bug from a clean install.
• double-check that you've provided all of the requested version and dependency information. (Some of this info might seem irrelevant at first, like which database adapter you're using, but we ask that you include it anyway. Oftentimes an issue is caused by a confluence of unexpected factors, and it can save everybody a ton of time to know all the details up front.)
• read the code of conduct.
• if appropriate, ask your business to sponsor your issue. (Open source is our passion, and our core maintainers volunteer many of their nights and weekends working on Sails. But you only get so many nights and weekends in life, and stuff gets done a lot faster when you can work on it during normal daylight hours.)
• let us know if you are using a 3rd party plugin; whether that's a database adapter, a non-standard view engine, or any other dependency maintained by someone other than our core team. (Besides the name of the 3rd party package, it helps to include the exact version you're using. If you're unsure, check out this list of all the core packages we maintain.)

  ---

Please remember: never post in a public forum if you believe you've found a genuine security vulnerability. Instead, disclose it responsibly.

For help with questions about Sails, click here.

[eashaw]

Hi @Goostavo, Thanks for using Sails. If you're interested in adding multi tenancy, we recommend adding an organization model and building the app around multi tenancy, instead of going the intercept route.